PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
MEMORANDUM
To: Arjun Mehta, CEO & Co-Founder; David Lindstrom, CFO; Priya Ramanathan, General Counsel — Skybridge Fintech Ltd.
From: Leonard Ashford, Of Counsel; Nina Reyes, Senior Associate — Calderwood & Harkness LLP
Date: December 23, 2023
Re: Insurance Coverage Review — Skybridge Fintech Ltd. ($60,000,000 Convertible Note Bridge Financing)
Matter No.: 1009-00001
Right-click to update Table of Contents
I. Executive Summary
Calderwood & Harkness LLP has been engaged by Skybridge Fintech Ltd. (the "Company" or "Skybridge") to conduct a review of the Company's existing insurance program in connection with the proposed $60,000,000 convertible note bridge financing (the "Bridge Financing") led by Ridgeline Ventures Fund IV, L.P. ("Ridgeline"). This memorandum sets forth our findings and recommendations based on that review.
The scope of our analysis encompasses the Company's four primary insurance coverages: (i) Directors & Officers ("D&O") liability insurance; (ii) Errors & Omissions ("E&O") / Technology Professional Liability insurance; (iii) Cyber Liability / Privacy & Network Security insurance; and (iv) General Commercial Liability ("CGL") insurance. We have also reviewed ancillary coverages, including Employment Practices Liability Insurance ("EPLI"), Workers' Compensation, Crime/Fidelity insurance, Property insurance, and Umbrella/Excess Liability coverage, to the extent such policies were made available to us.
This review has been undertaken in the context of the Bridge Financing currently under negotiation with the investor syndicate consisting of Ridgeline Ventures Fund IV, L.P.; Beacon Hill Capital Partners, LLC; Northstar Innovation Fund II, L.P.; and Halcyon Growth Equity, L.P. (collectively, the "Investors"). The Note Purchase Agreement (the "NPA") being negotiated with the Investors contains representations and warranties regarding the Company's insurance coverage, and the Company Disclosure Schedule to be delivered in connection with the execution of the NPA will require disclosure of insurance-related matters that could be material to the Investors' decision to consummate the Bridge Financing.
Overall Finding. Based on our review, Skybridge maintains a commercially reasonable insurance program for a fintech and software-as-a-service ("SaaS") company of its size, which currently comprises approximately 310 full-time equivalent employees ("FTEs"), generates approximately $78 million in annual recurring revenue ("ARR"), and processes approximately $4.2 billion in annualized gross payment volume ("GPV") through its cloud-based payments orchestration and embedded lending platform. The Company's insurance program is generally consistent with industry norms for companies at Skybridge's stage and scale of operations, and no insurance-related matters have been identified that would prevent closing of the Bridge Financing.
However, we have identified certain areas where the Company's existing coverage could be enhanced, particularly in light of the increased board-level and enterprise-level exposure that will result from the Bridge Financing, the anticipated expansion of the board of directors (including the potential addition of investor-designated directors or board observers), and the planned Series D equity financing round anticipated for Q3–Q4 2024 (the "Series D"). Our specific recommendations are summarized in Section X of this memorandum and are discussed in detail in the relevant sections below.
Cross-Reference. This memorandum supplements the Due Diligence Summary & Risk Assessment Memorandum currently under preparation by Calderwood & Harkness LLP, which is expected to be finalized in early January 2024. This memorandum should be read in conjunction with the following companion work products:
• Material Contracts Diligence Summary (dated December 18, 2023), which addresses key commercial agreements, customer and vendor contracts, and related insurance and indemnification provisions;
• Regulatory & Compliance Diligence Memorandum (dated December 22, 2023), which addresses state money transmission licensing, regulatory compliance, and associated risks relevant to the Company's payments orchestration and embedded lending operations; and
• IP Ownership & Assignment Analysis (dated December 22, 2023) and the IP Diligence Memorandum (dated December 20, 2023), which address intellectual property matters relevant to the E&O coverage analysis set forth herein.
II. Scope of Review and Methodology
A. Documents Reviewed
In conducting this review, we examined the following documents and materials, which were provided to us by the Company (principally through Priya Ramanathan, General Counsel) in response to our due diligence requests:
1. All documents provided in response to Item 14 of the Due Diligence Request List (dated November 13, 2023) and Item 7 of the Supplemental Due Diligence Request List (dated December 6, 2023), which collectively requested copies of all material insurance policies, binders, certificates, and related correspondence.
2. Current policy declarations pages for each of the Company's material insurance policies, including all endorsements, riders, and amendments thereto.
3. Binders of insurance for each policy currently in effect.
4. A summary of the Company's claims history for the past three policy years (policy years 2021–2022, 2022–2023, and the current 2023–2024 policy year through the date of the summary), as prepared by the Company's insurance broker.
5. Selected correspondence between the Company and its insurance broker, Halcyon Benefit Group ("Cascade Risk Advisors"), relating to policy placement, renewal terms, and claims submissions during the review period.
6. The Loan and Security Agreement dated August 15, 2022 (the "Kelvantis LSA"), by and between Kelvantis Lending Corp. ("Kelvantis") and Skybridge Fintech Ltd., establishing the Company's $15,000,000 venture debt facility (maturing August 15, 2025), including the insurance covenants set forth therein (specifically, the provisions requiring the Company to maintain minimum insurance coverage of specified types and amounts as a condition to the continuing availability of the facility).
7. The Company's organizational chart and current headcount data, as relevant to the assessment of EPLI and Workers' Compensation coverage adequacy.
We note that the Company represented to us that the foregoing documents constitute the complete set of material insurance policies and related documents currently in effect. We have relied on that representation in preparing this memorandum.
B. Methodology. Our review was conducted in accordance with the following methodology:
1. Policy Terms Review. We reviewed the terms, conditions, limits of liability, retentions and deductibles, exclusions, and key endorsements of each material insurance policy to identify the scope of coverage afforded to the Company, its directors and officers, and other insureds.
2. Industry Benchmarking. We assessed the adequacy of the Company's insurance program against industry benchmarks for fintech and SaaS companies at a comparable stage of development and revenue level. In conducting this assessment, we drew upon publicly available market data, third-party insurance benchmarking reports (including the Glenrock Management Consulting 2023 Tech & Life Sciences Looking Ahead Guide and the Westvale Management Consulting Cyber Risk Analytics Report, Q3 2023), and our firm's experience representing similarly situated technology companies in financing transactions.
3. Contractual Compliance. We assessed compliance with the insurance covenants contained in the Kelvantis LSA, including minimum coverage types and amounts, lender's loss payee endorsements, and additional insured requirements.
4. Investor Expectations. We evaluated the Company's insurance program against anticipated investor expectations in the context of the Bridge Financing and the planned Series D. Institutional investors at the growth stage, including the members of the Investor syndicate, typically expect portfolio companies to maintain robust D&O, cyber, and E&O coverage consistent with the company's risk profile and valuation.
5. Regulatory Considerations. We considered insurance-related implications of the Company's regulatory posture, including its payments orchestration and embedded lending operations, state money transmission licensing obligations, and PCI-DSS compliance requirements. This analysis was conducted in coordination with the Regulatory & Compliance Diligence Memorandum dated December 22, 2023.
Important Caveat. We note that Calderwood & Harkness LLP is not an insurance broker, insurance coverage counsel, or risk management consultant. This memorandum is provided solely for due diligence purposes in connection with the Bridge Financing and should not be considered a formal coverage opinion, an actuarial analysis, or a substitute for consultation with the Company's insurance broker regarding specific coverage questions or claims. The Company should continue to rely on Cascade Risk Advisors and its own internal risk management function for ongoing insurance program management.
III. Directors & Officers (D&O) Liability Insurance
A. Current Policy Summary
The Company currently maintains a Directors & Officers Liability Insurance policy issued by Meridian National Indemnity Company ("Meridian"), a surplus lines insurer rated A (Excellent) by AM Best. The key terms of the current policy are summarized below:
Named Insureds. The policy covers Skybridge Fintech Ltd. as the named entity, and all past, present, and future directors and officers of the Company in their capacities as such. As of the date of this memorandum, the insured individuals include, among others: Arjun Mehta (CEO & Co-Founder), Elena Vasquez (CTO & Co-Founder), David Lindstrom (CFO), Priya Ramanathan (General Counsel), Marcus Tillman (VP of Engineering), and the current members of the Company's board of directors, including investor-designated directors appointed by Crestpoint Seed Partners (Series A lead), Halcyon Growth Equity, L.P. (Series B lead), and Ridgeline Ventures Fund III, L.P. (Series C lead).
Structure. The policy is structured as a blended ABC policy, providing three distinct insuring agreements within a single shared aggregate limit:
• Side A provides coverage for non-indemnifiable loss — i.e., loss arising from claims against individual directors and officers where the Company is unable or unwilling to indemnify such individuals (for example, due to insolvency, legal prohibition, or a refusal to indemnify). Side A coverage carries no retention, consistent with market practice, and is intended to serve as a backstop for individual director and officer liability.
• Side B provides coverage for corporate reimbursement — i.e., reimbursement to the Company for amounts it pays to indemnify its directors and officers against covered claims. Side B coverage is subject to the $100,000 per-claim retention.
• Side C provides entity coverage for securities claims — i.e., coverage for the Company itself when it is named as a co-defendant alongside its directors and officers in a securities claim. Side C coverage is also subject to the $100,000 per-claim retention.
B. Key Coverage Terms and Exclusions
The Meridian policy provides coverage for "Wrongful Acts," defined to include any actual or alleged act, error, omission, misstatement, misleading statement, neglect, or breach of duty by an insured person in his or her capacity as a director or officer of the Company. The policy is written on a claims-made-and-reported basis, meaning that coverage is triggered when a claim is first made against an insured during the policy period and reported to the carrier within the time period specified in the policy (60 days after the end of the policy period, per the Extended Reporting Period endorsement).
Securities Claim Coverage. The policy defines "Securities Claim" to include any claim made against an insured alleging a violation of any federal, state, or foreign regulation or statute governing the purchase, sale, or offer of securities. This definition is relevant given the Company's recent and anticipated securities transactions, including the issuance of convertible notes under Rule 506(b) of Regulation D of the Securities Act of 1933, as amended, and the planned Series D equity round. We discuss the adequacy of this definition in Section III.D below.
Key Exclusions. The policy contains the following material exclusions, which are generally consistent with market practice for D&O policies at this coverage level:
1. Fraud/Dishonesty Exclusion. The policy excludes claims arising from or attributable to any fraudulent, dishonest, or criminal act by an insured person, provided that this exclusion applies only after a final adjudication in the underlying proceeding (the "final adjudication carve-out"). This carve-out is important because it preserves defense coverage pending the resolution of fraud allegations and prevents the carrier from denying coverage based solely on unproven allegations.
2. Prior/Pending Litigation Exclusion. The policy excludes claims arising from, based upon, or attributable to any litigation or proceeding that was pending on or before the inception date of the policy, or arising from the same or substantially similar facts as any such prior proceeding. The Company has represented that there is no prior or pending litigation that would trigger this exclusion with respect to the current policy period.
3. Insured-vs.-Insured Exclusion. The policy excludes claims brought by one insured against another insured. This exclusion is a standard feature of D&O policies and is designed to prevent collusive claims. However, this exclusion raises a potential issue in the Company's context, given the multi-investor cap table and the presence of investor-designated directors on the Company's board. We discuss this issue further in Section III.D below.
4. Bodily Injury/Property Damage Exclusion. Claims for bodily injury or property damage are excluded from D&O coverage, as such risks are addressed under the Company's CGL and other liability policies.
5. Professional Services Exclusion. Claims arising from the rendering or failure to render professional services are excluded from D&O coverage, as such risks are addressed under the Company's E&O/Technology Professional Liability policy. This exclusion helps avoid overlapping coverage and potential disputes between the D&O and E&O carriers.
Defense Costs. Under the current policy, defense costs are included within the policy limits — i.e., the payment of defense costs erodes the aggregate limit available for indemnity payments. This is a common structure for primary D&O policies at this coverage level, although we note that defense-costs-outside-limits structures are available in the market and may be preferable as the Company's valuation and risk profile increase. The erosion of limits by defense costs is a meaningful consideration for a company facing securities-related claims, where defense costs can be substantial and can significantly reduce the indemnity limits available to the Company and its directors and officers.
Run-Off / Tail Provisions. The policy includes a provision allowing the Company to purchase an extended reporting period ("tail coverage") for a period of up to six (6) years following the expiration or non-renewal of the policy, at a premium of 200% of the then-current annual premium. Tail coverage is an important consideration in the context of a future change-of-control transaction, as it would allow the Company's current directors and officers to report claims arising from pre-transaction wrongful acts during the extended reporting period. We note that the availability and cost of tail coverage should be evaluated in the context of any future M&A transaction or IPO.
C. Adequacy Assessment
Based on our review and industry benchmarking analysis, we have identified the following adequacy considerations with respect to the Company's current D&O coverage:
Aggregate Limits. The current $10,000,000 aggregate D&O limit is at the lower end of the range for a company with Skybridge's valuation profile. At the Company's Series C round, the post-money valuation was approximately $620,000,000. The Bridge Financing contemplates a pre-money valuation cap of $750,000,000, and the anticipated Series D could result in a post-money valuation exceeding $1 billion. Industry benchmarking data indicates that companies at this stage and valuation typically carry D&O limits in the range of $15,000,000 to $25,000,000 in aggregate coverage, with many growth-stage fintech companies maintaining $20,000,000 or more.
The $10,000,000 limit is further strained by the fact that defense costs erode the aggregate limit. In a contested securities claim or derivative action, defense costs alone could consume a significant portion of the available coverage, leaving limited indemnity coverage for settlements or judgments.
Board Expansion. The Bridge Financing may result in the addition of one or more investor-designated board observers or directors. Ridgeline Ventures Fund IV, L.P., as lead investor, may negotiate for a board seat or observer right, consistent with market practice for a $60,000,000 convertible note investment. Similarly, the Series D is likely to result in the addition of at least one new investor-designated board seat. Each additional board member increases the Company's D&O exposure, as additional individuals are covered under the policy and additional governance and fiduciary duty risks are introduced.
Kelvantis Facility Compliance. Section 6.8 of the Kelvantis LSA requires the Company to "maintain insurance with responsible and reputable insurance companies or associations in such amounts and covering such risks as is customarily carried by companies engaged in the same or similar businesses operating in the same or similar locations," including specifically D&O liability insurance. Based on our review, the current $10,000,000 D&O limit satisfies the minimum requirements under the Kelvantis facility. However, we note that the Kelvantis lender consent to be obtained in connection with the Bridge Financing may impose additional insurance requirements, and we recommend confirming this with Ted Marsh at Kelvantis during the consent process.
Claims History. The Company has reported no D&O claims during the past three policy years. While this is a favorable indicator, the absence of past claims does not diminish the importance of maintaining adequate limits prospectively, particularly given the Company's increasing valuation, the complexity of its multi-investor cap table, and the inherent risks associated with securities-related transactions.
D. Recommendations. Based on the foregoing analysis, we recommend the following enhancements to the Company's D&O insurance program:
1. Increase Aggregate Limits. We recommend increasing the aggregate D&O limit from $10,000,000 to at least $15,000,000, and preferably $20,000,000, prior to or concurrent with the planned Series D. Given the anticipated Series D valuation and the Company's growth trajectory, a $20,000,000 aggregate limit would be more consistent with industry norms and would provide a more adequate cushion against the risk of defense cost erosion. The Company should begin discussions with Cascade Risk Advisors regarding the cost and availability of increased limits at the next renewal (July 1, 2024) or earlier, if pricing is favorable.
2. Excess Side A / DIC Layer. We recommend that the Company consider adding an excess Side A / Difference in Conditions ("DIC") layer to provide dedicated protection for independent directors. A Side A DIC policy would provide coverage that "drops down" in the event that the primary D&O policy fails to respond — for example, due to an insured-vs.-insured exclusion, a bankruptcy-related limitation, or a dispute with the primary carrier. This additional layer would enhance the Company's ability to attract and retain qualified independent board members, who increasingly view robust Side A protection as a prerequisite for board service at growth-stage technology companies.
3. Insured-vs.-Insured Exclusion Carve-Back. We recommend that the Company confirm with Meridian and Cascade Risk Advisors that the insured-vs.-insured exclusion contains an explicit carve-back for derivative suits brought on behalf of the Company. This carve-back is important because derivative claims are, by their nature, brought by one insured (a shareholder, who may also be a director) against other insureds (directors and officers). Without a derivative suit carve-back, the insured-vs.-insured exclusion could potentially bar coverage for the most common form of D&O claim at growth-stage companies. This consideration is particularly important given the Company's multi-investor cap table, which includes Crestpoint Seed Partners (Series A), Halcyon Growth Equity, L.P. (Series B), Ridgeline Ventures Fund III, L.P. (Series C), and Beacon Hill Capital Partners, LLC (Series C), each of which holds board designation rights and whose interests may not always be aligned.
4. Securities Claim Definition. We recommend that the Company confirm with Meridian and Cascade Risk Advisors that the policy's definition of "Securities Claim" is broad enough to encompass claims arising from the issuance of convertible notes in the Bridge Financing, including claims alleging misrepresentation or omission of material information in connection with the offering, as well as claims arising from the future conversion of such notes into equity securities. While the current definition appears to be broad enough to cover such claims on its face, we recommend obtaining written confirmation from the carrier to avoid any ambiguity.
IV. Errors & Omissions (E&O) / Technology Professional Liability Insurance
A. Current Policy Summary
The Company maintains an Errors & Omissions / Technology Professional Liability Insurance policy issued by Cascadia Specialty Insurance Group ("Cascadia"), rated A+ (Superior) by AM Best. The key terms of the current policy are summarized below:
Scope of Coverage. The Cascadia policy provides coverage for claims arising from the provision of "Technology Professional Services," which is defined to include the design, development, deployment, hosting, maintenance, and support of the Company's cloud-based payments orchestration and embedded lending platform (the "Skybridge Platform"). The policy covers claims alleging negligent acts, errors, or omissions in the delivery of such services to the Company's customers, which consist primarily of mid-market e-commerce merchants and marketplace platforms.
B. Key Coverage Terms and Exclusions
The Cascadia policy provides the following key coverages, which are generally consistent with market standards for technology professional liability policies:
1. Professional Negligence. Coverage for claims alleging negligent acts, errors, or omissions in the performance of Technology Professional Services, including claims arising from defects in the Skybridge Platform, incorrect processing of payment transactions, and failures in the embedded lending functionality.
2. Failure to Perform / Service Outages. Coverage for claims alleging failure to perform contracted services, including claims arising from platform downtime, service outages, and interruptions in payment processing functionality. This coverage is particularly relevant given that Skybridge's customers rely on the platform for real-time payment processing and any significant outage could result in claims from affected merchants.
3. intellectual Property Infringement Defense. The policy provides coverage for defense costs and indemnity arising from claims alleging intellectual property infringement, including copyright infringement and trade secret misappropriation, in connection with the delivery of Technology Professional Services. We note that this coverage should be considered in conjunction with the IP Diligence Memorandum dated December 20, 2023, and the IP Ownership & Assignment Analysis dated December 22, 2023, which identified certain open-source software licensing issues and third-party API integration considerations that could give rise to IP-related claims.
4. Media Liability. The policy includes a media liability insuring agreement providing coverage for claims alleging defamation, invasion of privacy, or infringement of copyright in connection with the Company's content and marketing activities.
Key Exclusions. The Cascadia policy contains the following material exclusions:
1. Intentional/Criminal Acts Exclusion. Claims arising from intentional, dishonest, fraudulent, malicious, or criminal acts by an insured.
2. Prior Known Claims Exclusion. Claims based upon, arising from, or attributable to any fact, circumstance, act, error, or omission of which any insured had knowledge prior to the inception of the policy and which a reasonable person would have expected to give rise to a claim.
3. Contractual Liability Exclusion. Claims arising from liability assumed under any contract or agreement, provided that this exclusion contains a carve-back for liability that the Company would have in the absence of such contract or agreement ("Technology Services Carve-Back"). This carve-back is important because it preserves coverage for claims arising from the Company's performance of technology services, even where such services are provided pursuant to a contractual arrangement with a customer.
4. Bodily Injury/Property Damage Exclusion. Claims for bodily injury or property damage.
5. Employer's Liability Exclusion. Claims brought by or on behalf of any employee of the Company.
Retroactive Date. The policy's retroactive date is March 12, 2017, which is the date of the Company's incorporation in the State of Delaware. This means that the policy covers claims arising from wrongful acts that occurred on or after that date, provided that such claims are first made during the current policy period. The retroactive date predates the commencement of the Company's commercial operations (which began in approximately Q2 2018), and accordingly, there should be no gap in coverage for pre-commercial activities.
C. Adequacy Assessment
Limits Adequacy. The current per-claim limit of $5,000,000 and aggregate limit of $10,000,000 appear reasonable for the Company's current ARR of approximately $78 million and GPV of approximately $4.2 billion annualized. However, we note that as the Company's GPV and customer count continue to grow, the potential aggregate exposure from a single platform error or service outage affecting multiple merchants could exceed the current per-claim limit. For example, an error in payment processing affecting a significant cohort of the Company's approximately 2,400 active merchant customers could give rise to a large number of individual claims, each of which could erode the aggregate limit.
Embedded Lending Operations. We note that the policy's definition of "Technology Professional Services" should be reviewed carefully to confirm that it encompasses the Company's embedded lending platform operations — i.e., the provision of credit underwriting, loan origination, and servicing technology to the Company's merchant customers. Embedded lending involves distinct risks from payment processing (including consumer credit-related regulatory exposure), and it is important that the policy's coverage scope explicitly extends to these operations. We have not been able to confirm this from the policy documents provided, and we recommend that the Company seek written confirmation from Cascadia.
Regulatory Defense Costs. Given the Company's operations in the payments and lending space, regulatory investigations and enforcement actions by state regulators (including state banking departments, financial regulators, and attorneys general) are a meaningful risk. We recommend reviewing whether the Cascadia policy covers defense costs arising from regulatory proceedings related to money transmission licensing or state lending law compliance. This consideration is discussed in greater detail in the Regulatory & Compliance Diligence Memorandum dated December 22, 2023.
Subcontractor/Vendor Coverage. The Company's platform relies on numerous third-party API integrations — including payment processor APIs, banking-as-a-service ("BaaS") provider integrations, and credit bureau connections — to deliver its services. An error or failure originating from a third-party API could give rise to claims against the Company by its merchant customers. We recommend confirming that the Cascadia policy does not contain subcontractor or vendor exclusions that would create coverage gaps where third-party API integrations are involved in the delivery of the Company's services.
D. Recommendations. Based on the foregoing analysis, we recommend the following enhancements to the Company's E&O / Technology Professional Liability insurance program:
1. Increase Per-Claim Limit. We recommend that the Company consider increasing the per-claim limit from $5,000,000 to $10,000,000 in connection with the next policy renewal (July 1, 2024) or the Series D, whichever occurs first. A $10,000,000 per-claim limit would be more consistent with the Company's growing GPV and customer base, and would provide more adequate protection against large-scale platform errors or outages.
2. Confirm Embedded Lending Coverage. We recommend that the Company confirm with Cascadia and Cascade Risk Advisors that the definition of "Professional Services" or "Technology Services" specifically encompasses the Company's embedded lending platform operations, including credit underwriting technology, loan origination, and loan servicing functionality — not solely payment processing services.
3. Verify Third-Party API Coverage. We recommend that the Company verify that the policy does not contain subcontractor or vendor carve-outs that would create coverage gaps where third-party API integrations are involved in the delivery of the Skybridge Platform's services. If such exclusions exist, the Company should negotiate appropriate carve-backs or endorsements.
V. Cyber Liability / Privacy & Network Security Insurance
A. Current Policy Summary
The Company maintains a Cyber Liability / Privacy & Network Security Insurance policy issued by Trident Cyber Insurance Co. ("Trident"), rated A (Excellent) by AM Best and a recognized specialist in technology and financial services cyber risk. The key terms of the current policy are summarized below:
First-Party Coverages. The Trident policy provides the following first-party coverages, which respond to direct losses incurred by the Company as a result of a covered cyber event:
• Breach Notification and Response Costs. Coverage for costs associated with notifying affected individuals, providing credit monitoring services, and engaging third-party breach response vendors (including legal counsel, forensic investigators, and call center services) in the event of a data breach affecting personal information.
• Forensic Investigation. Coverage for the cost of engaging qualified forensic investigators to determine the cause, scope, and extent of a cyber incident, including identification of compromised systems and data.
• Business Interruption and Extra Expense. Coverage for lost net income and extra expenses incurred as a result of a material interruption of the Company's computer systems caused by a covered cyber event, subject to a 12-hour waiting period deductible.
• Data Restoration. Coverage for the cost of restoring, recreating, or recollecting data and software that is corrupted, destroyed, or otherwise rendered inaccessible as a result of a covered cyber event.
• Cyber Extortion / Ransomware. Coverage for extortion payments (including cryptocurrency payments) and related expenses incurred in response to a credible ransomware or cyber extortion threat, subject to applicable law and OFAC compliance requirements.
• Regulatory Fines and Penalties. Coverage for insurable fines and penalties assessed against the Company by regulatory authorities in connection with a data breach or privacy violation, to the extent such fines and penalties are insurable under applicable law.
• Crisis Management / Public Relations. Coverage for the cost of engaging public relations and crisis communications firms to manage reputational harm arising from a covered cyber event.
Third-Party Coverages. The Trident policy provides the following third-party coverages, which respond to claims made against the Company by third parties as a result of a covered cyber event:
• Privacy Liability. Coverage for claims brought by individuals whose personal information has been compromised as a result of a data breach or privacy violation attributable to the Company.
• Network Security Liability. Coverage for claims brought by third parties arising from a failure of the Company's computer network security, including claims arising from unauthorized access, denial-of-service attacks, and the unintentional transmission of malicious code.
• Media Liability. Coverage for claims alleging defamation, invasion of privacy, or infringement of intellectual property rights in connection with the Company's electronic content and communications.
• Regulatory Defense and Proceedings. Coverage for defense costs incurred in connection with regulatory investigations and proceedings arising from a data breach or privacy violation, including actions by state attorneys general, the Federal Trade Commission, and foreign data protection authorities.
• PCI-DSS Assessment Coverage. Coverage for PCI-DSS compliance assessments, fines, and penalties imposed by payment card brands (Visa, Hollowell Partners LLC, Pinnacle Partners LLC, Discover) as a result of a data breach involving payment card data.
B. Key Coverage Terms and Exclusions
Coverage Triggers. The Trident policy is triggered by a broad range of cyber events, including:
• Unauthorized access to or use of the Company's computer systems or data;
• A data breach involving the unauthorized acquisition, disclosure, or exfiltration of personal information, protected health information, financial data, or payment card data;
• A denial-of-service ("DDoS") attack that materially disrupts the availability of the Company's systems or services;
• The introduction of malware, ransomware, or other malicious code into the Company's computer systems;
• Acts by rogue or malicious employees involving unauthorized access to or misuse of the Company's systems or data; and
• The unintentional transmission of malicious code from the Company's systems to a third party.
Key Exclusions. The policy contains the following material exclusions:
1. War/Terrorism Exclusion. The policy excludes losses arising from war, invasion, acts of foreign enemies, hostilities, civil war, rebellion, revolution, insurrection, military or usurped power, or terrorism. Notably, the policy includes a cyber-war carve-out that excludes losses attributable to a cyber operation conducted by or on behalf of a nation-state as part of a military or intelligence operation, even if such operation does not constitute a traditional "act of war." We note that the cyber-war exclusion has been the subject of significant market tightening in recent years, and the scope of this exclusion should be monitored at each renewal. The Company should discuss with Cascade Risk Advisors whether the current carve-out language is consistent with the latest market formulations (including the Lloyd's Market Association model clauses adopted in 2023).
2. Infrastructure Failure Exclusion. The policy excludes losses arising from the failure of public utilities, telecommunications infrastructure, or internet backbone providers that is unrelated to a security event affecting the Company's own systems. This exclusion is standard but could be relevant in the event of a widespread internet outage affecting the Company's cloud infrastructure.
3. Prior Known Incidents Exclusion. The policy excludes claims or losses arising from incidents that were known to the Company prior to the inception of the policy.
4. Contractual Penalties Beyond Insurable Fines. The policy excludes contractual penalties or liquidated damages imposed under commercial contracts, to the extent such penalties exceed the scope of insurable fines and penalties under applicable law.
5. Trade Secret Misappropriation by Insureds. The policy excludes claims arising from the misappropriation of trade secrets by the Company or its employees.
6. Bodily Injury/Property Damage Exclusion. Claims for bodily injury or tangible property damage are excluded.
Territorial Scope. The Trident policy provides worldwide coverage, which is appropriate given that the Company's platform processes transactions involving international e-commerce customers and merchants. However, we note that certain jurisdictions (particularly within the European Union and the European Economic Area) impose specific data protection requirements that may affect the scope of available coverage. The Company should confirm with Cascade Risk Advisors that the policy's territorial scope is adequate for the Company's current and anticipated geographic footprint.
Retroactive Date. The policy provides full prior acts coverage — i.e., there is no retroactive date limitation, and the policy covers claims arising from wrongful acts or cyber events that occurred at any time prior to the inception of the policy, provided that such events were not known to the Company at the time of the policy inception. This is a favorable feature of the current policy.
C. Adequacy Assessment
Aggregate Limits. The current $10,000,000 aggregate cyber limit is within the general industry range for fintech companies, but may be insufficient for a company processing approximately $4.2 billion in annualized GPV and holding sensitive payment and financial data for approximately 2,400 active mid-market e-commerce merchants. A significant data breach affecting the Company's payment processing platform could result in breach notification costs, forensic investigation expenses, regulatory fines, PCI-DSS assessments, business interruption losses, and third-party liability claims that, in the aggregate, could exceed the current $10,000,000 limit.
Industry benchmarking data indicates that fintech companies processing comparable GPV typically carry between $15,000,000 and $25,000,000 in cyber limits, with many companies in the payments space maintaining $20,000,000 or more. The Stonefield Group's 2023 Cost of a Data Breach Report estimates the average cost of a data breach in the financial services sector at approximately $5.9 million, and a breach affecting a payments platform of Skybridge's scale could significantly exceed this average.
Business Interruption Sublimit. We recommend that the Company assess the adequacy of the business interruption sublimit under the Trident policy. A major platform outage caused by a cyber event — for example, a ransomware attack that renders the Skybridge Platform unavailable for an extended period — could result in significant lost revenue for the Company and give rise to substantial claims from merchants who are unable to process payments during the outage period. The 12-hour waiting period deductible is standard, but the Company should confirm that the business interruption sublimit (if subject to a sublimit lower than the aggregate policy limit) is adequate to cover a multi-day outage scenario.
PCI-DSS Assessment Coverage. Given the Company's role as a payments orchestration platform that processes, transmits, and/or stores payment card data, PCI-DSS compliance is a critical requirement. A data breach involving payment card data could result in PCI-DSS assessment fines imposed by the payment card brands, which can be substantial — in some cases exceeding $5,000,000 for a single breach event affecting a large number of cardholders. We recommend confirming that the PCI-DSS assessment coverage sublimit under the Trident policy is adequate in light of the Company's transaction volumes.
Insider Threat Exposure. With approximately 310 FTEs having access to proprietary systems and customer data, the Company faces meaningful insider threat exposure. Rogue employee actions — including unauthorized access to customer data, theft of payment credentials, or sabotage of platform infrastructure — represent a significant cyber risk. The policy should adequately cover losses arising from such insider threats, and the Company should consider whether its internal access controls, monitoring, and security training programs are sufficient to mitigate this risk. This assessment is outside the scope of this memorandum but may be addressed in the Due Diligence Summary & Risk Assessment Memorandum.
Social Engineering Fraud. We note that social engineering fraud (including business email compromise, phishing-based wire transfer fraud, and impersonation schemes) has become one of the most prevalent and costly forms of cyber-enabled fraud affecting financial technology companies. We recommend that the Company confirm whether the Trident policy includes a social engineering fraud coverage sublimit and, if so, whether that sublimit is adequate given the Company's transaction volumes and the increasing sophistication of social engineering attacks targeting payments companies.
D. Recommendations. Based on the foregoing analysis, we recommend the following enhancements to the Company's Cyber Liability / Privacy & Network Security insurance program:
1. Increase Aggregate Limits. We recommend increasing the aggregate cyber limit from $10,000,000 to at least $15,000,000, and preferably $20,000,000, consistent with the Company's growth trajectory, transaction volumes, and the expected increase in scrutiny from the Series D investor base. This increase should be pursued at the next policy renewal (July 1, 2024) or earlier if market conditions are favorable.
2. Cloud Infrastructure Coverage. We recommend confirming that the policy's definition of "Computer System" (or equivalent defined term) includes cloud infrastructure and third-party hosted environments, including the Company's Ridgeway Industries ("Meridian Technologies") production environment and any other cloud service provider environments used by the Company. Many cyber policies contain limitations or exclusions for losses arising from failures of third-party cloud infrastructure, and it is important that the Company's coverage extend to such environments given the Company's reliance on cloud-hosted infrastructure for its core platform operations.
3. Regulatory Proceedings Coverage. We recommend evaluating whether the policy provides adequate coverage for regulatory proceedings related to state money transmission licensing and compliance, which is an area of heightened regulatory focus for fintech companies operating in the payments space. This consideration should be coordinated with the analysis set forth in the Regulatory & Compliance Diligence Memorandum dated December 22, 2023.
4. Social Engineering Fraud Sublimit. If the Trident policy currently includes a social engineering fraud coverage sublimit, we recommend evaluating whether that sublimit is adequate given the Company's exposure profile. If the policy does not currently include social engineering fraud coverage, we recommend adding this coverage at the next renewal or via a mid-term endorsement, if available.
VI. General Commercial Liability (CGL) Insurance
A. Current Policy Summary
The Company maintains a General Commercial Liability Insurance policy issued by Keystone General Insurance Company ("Keystone"), rated A (Excellent) by AM Best. The key terms of the current policy are summarized below:
Scope of Coverage. The Keystone policy is written on a standard ISO Commercial General Liability form (CG 00 01) or equivalent, and provides coverage for the following:
• Bodily Injury and Property Damage Liability. Coverage for sums the Company becomes legally obligated to pay as damages because of bodily injury or property damage caused by an occurrence.
• Personal and Advertising Injury Liability. Coverage for sums the Company becomes legally obligated to pay as damages because of personal injury (including defamation, false arrest, and invasion of privacy) or advertising injury (including misappropriation of advertising ideas and infringement of copyright, trade dress, or slogan in advertising).
• Products-Completed Operations Liability. Coverage for bodily injury or property damage arising from the Company's products or completed operations.
B. Key Coverage Terms and Exclusions
The Keystone CGL policy contains the following material provisions and exclusions:
Additional Insured Endorsements. The policy includes an additional insured endorsement in favor of Larkspur Group, as landlord of the Company's headquarters located at 1400 Market Street, Suite 2200, Wilmington, DE 19801. This endorsement is required under the terms of the Company's commercial lease for its headquarters space and provides the landlord with coverage for claims arising from the Company's operations at the leased premises.
Key Exclusions. The following exclusions are applicable under the CGL policy:
1. Professional Liability Exclusion. Claims arising from the rendering or failure to render professional services are excluded, as such risks are covered under the Company's E&O / Technology Professional Liability policy.
2. Employment Practices Exclusion. Claims arising from employment-related practices (including discrimination, harassment, wrongful termination, and retaliation) are excluded, as such risks are covered under the Company's EPLI policy.
3. Pollution Exclusion. Standard total pollution exclusion.
4. Cyber/Data Breach Exclusion. Claims arising from data breaches, cyber events, or privacy violations are excluded, as such risks are covered under the Company's Cyber Liability / Privacy & Network Security policy.
5. Auto Liability Exclusion. Claims arising from the ownership, maintenance, or use of automobiles are excluded. The Company has represented that it does not own or lease any vehicles.
Workers' Compensation / Employers' Liability. Workers' compensation and employers' liability coverage is maintained separately from the CGL policy and is discussed in Section VII.B below.
C. Adequacy Assessment
The CGL limits of $2,000,000 per occurrence / $4,000,000 general aggregate appear standard and adequate for a technology/SaaS company with approximately 310 employees and primarily office-based operations. Technology companies at Skybridge's stage typically face limited CGL exposure, as their primary liability risks (professional negligence, cyber incidents, D&O claims) are addressed by other, more specialized policies.
No unusual CGL exposures were identified in our due diligence review. The Company does not manufacture physical products, does not operate retail locations open to the public, and does not engage in activities that would give rise to significant bodily injury or property damage risk.
We have confirmed that the current CGL policy, including its limits, deductible, and endorsements, satisfies the minimum insurance requirements under the Kelvantis LSA.
D. Recommendations. No material changes are recommended to the Company's CGL program at this time. The current limits, deductible, and endorsements are appropriate for the Company's risk profile and operational footprint.
We recommend that the Company ensure that all certificates of insurance are current and reflect the accurate named insured information ("Skybridge Fintech Ltd.") and the Company's current principal office address (1400 Market Street, Suite 2200, Wilmington, DE 19801). Updated certificates should be obtained from Cascade Risk Advisors in advance of the Bridge Financing closing to ensure they are available as part of the closing deliverable package, if requested by investor counsel.
VII. Other Insurance Coverages
A. Employment Practices Liability Insurance (EPLI)
The Company maintains an EPLI policy issued by Cascadia Specialty Insurance Group (the same carrier that underwrites the Company's E&O policy), providing coverage for claims arising from wrongful employment practices, including discrimination, harassment, wrongful termination, retaliation, failure to promote, and wage and hour disputes. The key terms of the current EPLI policy are as follows:
Adequacy Assessment. The current $3,000,000 aggregate EPLI limit is generally adequate for a company with approximately 310 FTEs, based on industry benchmarking data for technology companies at a comparable headcount. However, we note that the Company expects to increase its headcount significantly following the Bridge Financing, as a portion of the proceeds is expected to be deployed toward product development and go-to-market expansion. If the Company's headcount grows to 400 or more FTEs in connection with the planned Series D, the current EPLI limits should be reassessed.
Additionally, we note that employment practices claims can be costly to defend even where the Company ultimately prevails, and defense costs under the EPLI policy erode the available limits. The Company should discuss with Cascade Risk Advisors whether an increase to $5,000,000 in aggregate EPLI limits is warranted in connection with the planned headcount growth.
B. Workers' Compensation
The Company maintains Workers' Compensation insurance providing statutory limits in all states where Skybridge currently has employees, including Delaware, New York, California, and Texas. The policy is issued by Keystone General Insurance Company (the same carrier that underwrites the CGL policy) and includes Employers' Liability coverage with limits of $1,000,000 per accident / $1,000,000 per disease (each employee) / $1,000,000 per disease (policy limit).
We have confirmed that the Company's Workers' Compensation coverage is maintained in compliance with applicable state law and satisfies the minimum requirements under the Kelvantis LSA. As the Company expands its workforce into additional states, it should ensure that Workers' Compensation coverage is extended accordingly.
C. Crime / Omnivrel Insurance
The Company maintains a Commercial Crime / Omnivrel Insurance policy issued by Meridian National Indemnity Company (the same carrier that underwrites the D&O policy), providing coverage for losses arising from employee dishonesty, theft, forgery, alteration, computer fraud, and funds transfer fraud. The key terms of the current policy are as follows:
Adequacy Assessment. Crime/Fidelity coverage is particularly important for a company that handles payment flows of the magnitude processed by Skybridge (approximately $4.2 billion in annualized GPV). While the Company does not typically hold customer funds for extended periods (as payment transactions are generally processed and settled within standard clearing cycles), the volume and velocity of transactions create meaningful exposure to employee fraud, computer fraud, and funds transfer fraud.
The current $5,000,000 aggregate limit appears adequate for the Company's present operations, but should be reassessed as GPV grows. We recommend confirming that the Kelvantis LSA's requirement for a minimum fidelity bond (referenced in the insurance covenants) is satisfied by the current policy, and that any lender-specific endorsements required by Kelvantis have been obtained.
D. Property Insurance
The Company maintains a Commercial Property Insurance policy issued by Keystone General Insurance Company, providing coverage for loss or damage to the Company's office contents, business personal property, and improvements and betterments at its headquarters located at 1400 Market Street, Suite 2200, Wilmington, DE 19801. The policy provides coverage on a replacement cost basis with an aggregate limit of $1,500,000.
This coverage is standard for a technology company without significant physical assets. The Company's most valuable assets are its intellectual property, software code, and data — risks that are more appropriately addressed by the Company's cyber, E&O, and IP insurance coverages. No material changes to the Company's property insurance program are recommended at this time.
E. Umbrella / Excess Liability
Based on our review of the policy documents provided, the Company does not currently maintain an umbrella or excess liability policy that would provide additional limits above the CGL, auto liability (if applicable), and employers' liability policies.
While the absence of umbrella/excess coverage is not unusual for an early-stage technology company, we note that as the Company matures and its revenue, headcount, and operational complexity increase, an umbrella or excess liability policy would provide valuable additional protection against catastrophic loss scenarios that could exhaust the primary policy limits. We recommend that the Company consider adding an umbrella or excess liability layer in connection with the planned Series D, when the Company's overall insurance program is expected to be reviewed and enhanced.
VIII. Compliance with Kelvantis Loan and Security Agreement
As noted above, the Company is party to the Loan and Security Agreement dated August 15, 2022, by and between Kelvantis Lending Corp. and Skybridge Fintech Ltd. (the "Kelvantis LSA"), which established a $15,000,000 venture debt facility maturing on August 15, 2025. The Kelvantis LSA contains affirmative covenants requiring the Company to maintain insurance coverage of specified types and minimum amounts throughout the term of the facility.
Specifically, Section 6.8 of the Kelvantis LSA (Maintenance of Insurance) requires the Company to:
(a) maintain commercial general liability insurance with limits of not less than $1,000,000 per occurrence and $2,000,000 in the aggregate;
(b) maintain workers' compensation insurance at statutory limits in all applicable states;
(c) maintain directors and officers liability insurance with limits reasonably acceptable to Kelvantis (no specific minimum dollar amount is stated, but the requirement is measured against a "commercially reasonable" standard);
(d) maintain crime/fidelity insurance with limits of not less than $2,000,000; and
(e) name Kelvantis Lending Corp. as lender's loss payee on the Company's property insurance policy and as additional insured on the Company's CGL policy, as applicable.
Based on our review of the Company's current insurance program, we believe that all of the foregoing insurance covenants under the Kelvantis LSA are satisfied. The current CGL limits ($2,000,000 per occurrence / $4,000,000 aggregate) exceed the $1,000,000 / $2,000,000 minimums; workers' compensation is maintained at statutory limits in all applicable states; the D&O limit of $10,000,000 is commercially reasonable; and the crime/fidelity limit of $5,000,000 exceeds the $2,000,000 minimum.
We recommend confirming with the Company's insurance broker that the lender's loss payee and additional insured endorsements in favor of Kelvantis Lending Corp. have been obtained and are reflected on the current certificates of insurance. Our review of the property and CGL policy endorsements indicates that these endorsements are in place, but we have not independently verified this with Keystone or Cascade Risk Advisors.
We also note, as discussed in the Memorandum: Analysis of Existing Kelvantis Venture Debt Covenants and Consent Requirements (dated November 28, 2023), that the Kelvantis lender consent and waiver to be obtained in connection with the Bridge Financing may impose additional insurance requirements or conditions. The Company should coordinate with Ted Marsh at Kelvantis (or his designee) as part of the consent process to confirm whether any incremental insurance obligations will be imposed and to ensure timely compliance.
IX. Note Purchase Agreement Insurance Representations
The NPA being prepared for the Bridge Financing will contain representations and warranties by the Company regarding the adequacy and status of its insurance program. Based on our review of the most recent draft of the NPA (draft dated December 19, 2023, circulated by investor counsel Whitfield, Pratt & Soo LLP), the anticipated insurance-related representations include the following:
(i) The Company maintains insurance policies with reputable insurers in such amounts and covering such risks as are customary for companies engaged in similar businesses and at similar stages of development.
(ii) All such insurance policies are in full force and effect, all premiums due and payable thereon have been timely paid, and no written notice of cancellation, non-renewal, or material premium increase has been received by the Company from any insurer.
(iii) The Company has not received any notice from any insurer that coverage has been or will be denied with respect to any pending claim, and no pending claim under any such policy would, if determined adversely, materially impair the coverage available to the Company under such policy.
(iv) The Company's Disclosure Schedule sets forth a true and complete list of all material insurance policies maintained by the Company, including the insurer, policy number, type of coverage, aggregate limits, per-claim or per-occurrence limits, deductibles or retentions, and expiration date.
Assessment. Based on our review of the Company's insurance program as described in this memorandum, we believe that the Company can make the foregoing representations in substantially the form described above, subject to the following qualifications:
• The recommendations set forth in Section X of this memorandum identify certain areas where the Company's coverage could be enhanced. While these recommendations reflect best practices and prudent risk management, we do not believe that the current coverage levels are so deficient as to render the "customary for companies engaged in similar businesses" representation inaccurate. The Company's current insurance program is within the range of what would be considered commercially reasonable for a fintech/SaaS company at Skybridge's stage and scale, even though certain limits are at the lower end of the applicable industry benchmarks.
• Any pending claims or known circumstances that could give rise to claims should be disclosed in the applicable schedule of the Company Disclosure Schedule. The Company has represented to us that there are no pending claims under any of its insurance policies as of the date of this memorandum, but we recommend that the Company confirm this representation as of the date of signing of the NPA.