1009-00001 · Skybridge Fintech Ltd · Diligence

regulatory-compliance-diligence-memo.docx DOCUMENT Funds

41 / 74 ← → ✕

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE ATTORNEY WORK PRODUCT

MEMORANDUM

TO: Arjun Mehta, CEO & Co-Founder, Skybridge Fintech Ltd. David Lindstrom, CFO, Skybridge Fintech Ltd. Priya Ramanathan, General Counsel, Skybridge Fintech Ltd.

FROM: Leonard Ashford, Of Counsel, Calderwood & Harkness LLP Nina Reyes, Senior Associate, Calderwood & Harkness LLP

DATE: December 22, 2023

RE: Regulatory & Compliance Due Diligence — Money Transmission Licensing and State Regulatory Compliance; Skybridge Fintech Ltd. $60,000,000 Convertible Note Bridge Financing

MATTER NO.: 1009-00001

Right-click to update Table of Contents

I. Executive Summary

This memorandum summarizes the results of Calderwood & Harkness LLP's regulatory and compliance due diligence review of Skybridge Fintech Ltd. ("Skybridge," the "Company," or "you"), a Delaware C-corporation headquartered at 1400 Market Street, Suite 2200, Wilmington, DE 19801, in connection with the proposed $60,000,000 convertible promissory note bridge financing (the "Bridge Financing" or the "Transaction") led by Ridgeline Ventures Fund IV, L.P. ("Ridgeline Ventures"), with participation from Beacon Hill Growth Partners, LP ("Beacon Hill") and Halcyon Capital Management LLC ("Halcyon," and together with Ridgeline Ventures and Beacon Hill, the "Purchasers"). The memorandum has been prepared at the request of the Company's management and Board of Directors to inform the Company Disclosure Schedule to be delivered in connection with the Note Purchase Agreement (the "NPA") anticipated to be executed on or about January 14, 2024.

The scope of our review encompasses the Company's money transmission licensing status across all fifty (50) United States, the District of Columbia, and applicable U.S. territories; the Company's state-by-state regulatory compliance posture with respect to money transmission, payments processing, and embedded lending activities; the Company's federal regulatory compliance, including its registration with the Financial Crimes Enforcement Network ("FinCEN") as a Money Services Business ("MSB"), its Bank Secrecy Act ("BSA") and anti-money laundering ("AML") compliance program, and its sanctions compliance under the Office of Foreign Assets Control ("OFAC"); and any pending, threatened, or recently resolved regulatory inquiries, examinations, or enforcement actions. We have also analyzed the potential regulatory impact of the Bridge Financing itself, including change-of-control and ownership reporting obligations, net worth and financial condition considerations, and affirmative disclosure requirements to state regulators.

The Company operates a cloud-based payments orchestration and embedded lending platform primarily serving mid-market e-commerce companies. As of the third quarter of fiscal year 2023 ("Q3 2023"), the Company processes approximately $4.2 billion in annualized gross payment volume ("GPV"), reflecting significant year-over-year growth from approximately $2.8 billion in annualized GPV at the close of fiscal year 2022. The Company was founded in 2017 and currently employs approximately 310 full-time equivalent employees ("FTEs") across its Wilmington, Delaware headquarters, its engineering offices in San Francisco, California, and satellite offices in New York, New York and Austin, Texas. Annualized recurring revenue ("ARR") as of Q3 2023 is approximately $78 million, with net revenue retention of approximately 128%, both of which metrics are relevant to the Company's regulatory standing insofar as they reflect the scale of operations and the corresponding regulatory burden.

Overall Conclusion. Based on our review, the Company maintains a generally sound regulatory compliance posture for a payments fintech company of its size and stage. The Company is duly registered with FinCEN as an MSB, maintains active money transmitter licenses in forty-one (41) states and the District of Columbia, has applications pending in four (4) additional states, and relies on exemptions or has determined that no license is required in the remaining jurisdictions. The Company's BSA/AML compliance program, while adequate in its current form, would benefit from certain enhancements identified in Section IX below, particularly with respect to transaction monitoring calibration and the frequency of independent testing. We have identified the following material risk areas that warrant management's attention and, where appropriate, remedial action:

1. Pending License Applications. The Company's money transmitter license applications remain pending in four (4) states—Alabama, Maine, North Dakota, and Montana—in which the Company is currently conducting activities that may constitute money transmission. While the Company has submitted applications in each of these states and represents that it does not engage in material transmission volume in these jurisdictions, operating without a license while an application is pending creates regulatory risk, particularly in Alabama, which does not provide a safe harbor for pending applicants.

2. New York BitLicense. The Company holds a New York money transmitter license issued under Article XIII-B of the New York Banking Law but has not applied for a separate BitLicense under 23 NYCRR Part 200. While the Company does not currently transmit or facilitate the transmission of virtual currency, the Company's product roadmap includes the potential integration of stablecoin settlement functionality in calendar year 2024, which would require a BitLicense or charter.

3. California Examination Findings. The California Department of Financial Protection and Innovation ("DFPI") conducted a routine examination in June 2023 and issued a report containing three findings related to the timeliness of suspicious activity report ("SAR") filings and certain deficiencies in the Company's consumer complaint handling procedures. The Company has submitted a corrective action plan and has implemented remedial measures, but formal closure of the examination findings by the DFPI remains pending.

4. Embedded Lending Licensing. The Company's embedded lending product, which facilitates merchant cash advances through a partner bank arrangement, may require separate state lending, finance lender, or commercial financing disclosure licenses in certain states. Our review has identified eight (8) states where the Company's current exemption analysis may be insufficient and where additional licensing or registration may be advisable.

5. Change-of-Control Considerations. The conversion of the convertible notes upon a Qualified Financing (anticipated Series D round of at least $80,000,000 in Q3–Q4 2024) could result in Ridgeline Ventures holding an equity stake sufficient to trigger control person or passive investor reporting thresholds in numerous states, requiring advance filings or pre-clearance with state regulators.

This memorandum is prepared solely for use by the Company's management, Board of Directors, and authorized legal counsel, and will inform the Company Disclosure Schedule to be delivered in connection with the NPA. The memorandum is subject to the attorney-client privilege and attorney work product doctrine and should not be disclosed to third parties without the prior written consent of Calderwood & Harkness LLP, except as required to be furnished to the Purchasers in accordance with the terms of the NPA.

II. Scope of Review and Materials Examined

A. Documents and Materials Reviewed

In connection with the preparation of this memorandum, we reviewed the following categories of documents and materials, substantially all of which were provided by the Company through the virtual data room maintained by Thackeray Solutions (the "Data Room") and supplemented by direct production from the Company's General Counsel and compliance team:

1. State Money Transmitter License Applications, Approvals, Renewals, and Correspondence. Complete license application files, including original applications, amendments, and renewal submissions, for all jurisdictions in which the Company holds or has applied for a money transmitter license or similar authorization. Regulatory correspondence files for all such jurisdictions, including approval letters, conditional approval letters, deficiency notices, and general correspondence with state licensing authorities. Copies of all licenses and certificates of authority currently in effect.

2. State Examination Reports and Regulatory Correspondence Files. All examination reports issued by state regulatory authorities within the past five (5) years, including findings, management responses, corrective action plans, and follow-up correspondence. Regulatory correspondence files, including informal supervisory letters, guidance letters, and requests for information from state banking departments and departments of financial institutions.

3. Company Compliance Policies and Procedures Manuals. The Company's comprehensive compliance policies and procedures manual (Version 7.2, last updated September 2023), including policies related to BSA/AML compliance, sanctions screening, customer identification, know-your-customer procedures, consumer complaint handling, vendor management, information security, and data privacy. The Company's Code of Business Conduct and Ethics (last updated March 2023).

4. Bank Partnership and Sponsor Bank Agreements. Copies of all agreements with the Company's bank partners, including the Master Services Agreement with Keystone Federal Savings Bank, dated April 12, 2021, as amended (the "Keystone MSA"), and the Program Agreement with Pacific Commerce Bank, N.A., dated November 3, 2022 (the "Pacific Commerce Agreement"), pursuant to which the Company conducts certain payments processing and embedded lending activities. Related compliance addenda, risk management protocols, and oversight frameworks.

5. Compliance Officer Reports and Internal Audit Findings. Quarterly compliance reports prepared by the Company's Chief Compliance Officer, Reginald H. Tanaka, for the period from Q1 2022 through Q3 2023. Internal audit findings and reports relating to regulatory compliance matters for the same period, prepared by the Company's internal audit function.

6. Company Organizational Charts for Compliance Function. Current organizational chart for the Company's Legal, Compliance, and Risk Management department, including reporting lines, headcount, and functional responsibilities.

7. Responses to Due Diligence Request Lists. The Company's responses to the initial Due Diligence Request List dated November 13, 2023 (the "Initial DDRL"), and the Supplemental Due Diligence Request List dated December 6, 2023 (the "Supplemental DDRL"), the latter of which specifically requested detailed information regarding money transmission license status, state-by-state compliance, and bank partnership arrangements. Responses were provided by the Company's General Counsel, Priya Ramanathan, and the Company's outside regulatory counsel at Caldwell & Associates, P.C.

8. Board Meeting Minutes. Minutes of the Company's Board of Directors meetings from January 2021 through November 2023, to the extent such minutes reference or discuss regulatory matters, compliance program updates, regulatory examinations, licensing status, or enforcement actions.

9. Regulatory Filings and Reports. FinCEN MSB registration filings and renewals. State call reports filed with the Nationwide Multistate Licensing System ("NMLS") for fiscal years 2021, 2022, and Q1–Q3 2023. BSA/AML filings, including Suspicious Activity Reports, Currency Transaction Reports, and related documentation.

10. Third-Party Compliance Audit Reports. The independent BSA/AML audit report prepared by Severin Beck CPAs LLP dated August 15, 2023, covering the twelve-month period ending June 30, 2023. The PCI-DSS Level 1 certification audit report prepared by Harborview Health IT, dated March 2023.

11. Audited and Reviewed Financial Statements. The Company's audited financial statements for fiscal year ending December 31, 2022, prepared by Pinnacle Audit Group LLP (engagement partner Lisa Johannsen), together with the accompanying auditor's report and notes to the financial statements. The Company's reviewed (unaudited) financial statements for the nine-month period ending September 30, 2023, also prepared by Pinnacle Audit Group LLP. These financial statements were reviewed for purposes of assessing the Company's compliance with state net worth and capital requirements applicable to licensed money transmitters.

12. Interviews. Telephonic and video conference interviews conducted on December 11 and December 14, 2023, with Priya Ramanathan (General Counsel), Reginald H. Tanaka (Chief Compliance Officer), and Marcus Gillespie (Director, Regulatory Affairs). A follow-up written questionnaire was submitted to the compliance team on December 15, 2023, and responses were received on December 18, 2023.

B. Limitations. This memorandum is based solely upon our review of the documents and materials described above and the representations made by the Company's management and compliance personnel during the interview process. We have not independently verified the Company's licensing status or compliance posture with any state or federal regulatory authority, nor have we conducted any independent investigation beyond the scope of the materials provided. We have relied upon the completeness and accuracy of the materials and information furnished by the Company. Our review is current as of the date of this memorandum, December 22, 2023, and does not reflect any developments occurring after that date. Any material changes in the Company's regulatory status, business operations, or compliance posture subsequent to the date hereof should be promptly communicated to Calderwood & Harkness LLP for supplemental analysis.

We note that certain documents requested in the Supplemental DDRL remain outstanding as of the date of this memorandum, including (i) the Company's complete NMLS filing history for fiscal year 2023, which the Company's compliance team has represented will be provided by December 27, 2023, and (ii) updated surety bond certificates for three jurisdictions (discussed in Section V.C below). To the extent these materials, when received, reveal information material to the conclusions set forth herein, we will issue a supplemental memorandum updating our findings.

III. Overview of the Company's Business Model and Regulatory Touchpoints

A. Payments Orchestration Platform

Skybridge's core product is a cloud-based payments orchestration platform (the "Platform") designed to serve mid-market e-commerce companies, generally defined by the Company as merchants with annual online revenue between $10 million and $500 million. The Platform connects merchants with multiple payment processors, acquirers, and payment networks, enabling intelligent routing, optimization, and reconciliation of payment transactions across multiple channels and geographies. The Platform supports credit card, debit card, ACH, and real-time payment (RTP) processing, as well as integration with digital wallet providers.

The Platform operates as follows: When a consumer initiates a purchase through a Skybridge-connected merchant's e-commerce storefront, the Platform receives the transaction data, evaluates the optimal routing path based on cost, approval rate, and network availability, and directs the transaction to the selected acquirer or payment processor for authorization, capture, and settlement. Following settlement, funds flow from the acquirer through the Company's custodial or operational accounts and are subsequently remitted to the merchant, typically on a T+1 or T+2 settlement cycle. The Company earns revenue through a combination of per-transaction fees (typically ranging from $0.05 to $0.20 per transaction plus a basis-point component of transaction value) and monthly platform subscription fees.

As of Q3 2023, the Platform processes approximately $4.2 billion in annualized gross payment volume, representing approximately 185 million individual transactions on an annualized basis. The Company serves approximately 2,400 active merchant accounts across all fifty (50) states, the District of Columbia, and six international markets (Canada, the United Kingdom, Germany, France, Australia, and Japan). Domestic GPV accounts for approximately 82% of total GPV, with international volume constituting the remaining 18%.

The Company's role in the payments flow is the central regulatory consideration for purposes of this memorandum. By receiving, holding (even temporarily), and transmitting consumer and merchant funds in connection with payment transactions, the Company acts as an intermediary in the transmission of money. This intermediary function triggers money transmission licensing requirements in most U.S. states, subject to available exemptions discussed in detail in Section V below. The fact that the Company holds settlement funds in custodial or operational accounts, even for a brief period (typically one to two business days), is sufficient in most jurisdictions to constitute "money transmission" or the "business of transmitting money" as defined under applicable state statutes.

The Company maintains custodial settlement accounts at Greaves Bancorp and at its sponsor bank, Keystone Federal Savings Bank. As of Q3 2023, the aggregate daily balance of custodial settlement funds held by the Company across all accounts ranged from approximately $28 million to $52 million, with an average daily balance of approximately $37 million. These balances are segregated from the Company's operating funds and are not commingled with general corporate assets, in compliance with applicable state requirements for the safeguarding of customer funds.

B. Embedded Lending Product

In addition to its core payments orchestration platform, the Company offers an embedded lending feature (marketed as "Skybridge Capital" or "SkyCapital") that facilitates merchant cash advances and short-term working capital products embedded within the Platform. The SkyCapital product was launched in Q4 2022 and, as of Q3 2023, has facilitated approximately $165 million in cumulative advances to approximately 340 merchants, with an average advance size of approximately $485,000 and a median repayment period of approximately 120 days.

The regulatory touchpoints associated with the SkyCapital product are distinct from, but complementary to, the money transmission licensing considerations that are the primary focus of this memorandum. The embedded lending product implicates the following regulatory frameworks:

• State Lending and Finance Lender Licensing. Many states require licenses for entities that make, arrange, or broker commercial or consumer loans. The applicability of these licensing requirements depends on the characterization of the Company's role in the lending transaction—i.e., whether the Company acts as the lender of record, a loan broker or arranger, or merely a technology provider that facilitates lending by a separate licensed entity.

• State Commercial Financing Disclosure Laws. A growing number of states have enacted or proposed commercial financing disclosure laws requiring providers of merchant cash advances and other commercial financing products to provide standardized disclosures to small business borrowers. California's SB 1235 (codified at Cal. Fin. Code § 22800 et seq.) and its implementing regulations, as well as similar laws enacted or proposed in New York, Virginia, Utah, Florida, Georgia, and other states, impose disclosure and registration requirements on commercial financing providers.

• State Usury Laws. To the extent the SkyCapital product is characterized as a loan rather than a purchase of future receivables, state usury laws may apply to limit the effective interest rate charged to merchants. The Company's current product documentation characterizes the merchant cash advance as a purchase and sale of future receivables rather than a loan, but this characterization may be challenged by regulators in certain jurisdictions.

• Federal Truth-in-Lending Considerations. While the SkyCapital product is offered exclusively to commercial entities (merchants) and not to individual consumers, certain states apply truth-in-lending-type disclosure requirements to commercial transactions, particularly those involving small businesses.

Based on our review of the Company's bank partnership agreements and product documentation, the Company currently operates the SkyCapital product through a partnership with Pacific Commerce Bank, N.A., a nationally chartered bank, under which Pacific Commerce acts as the lender of record and the Company provides the technology platform, underwriting algorithms, and servicing functions. The Company relies on this bank partnership model to avail itself of the federal preemption of state lending licensing requirements applicable to national banks. However, as discussed in Sections V.D and VII below, this bank partnership structure is subject to increasing regulatory scrutiny, and certain states have taken the position that the non-bank partner (in this case, Skybridge) is the "true lender" and therefore subject to state licensing requirements.

C. Regulatory Framework Overview

The regulatory framework applicable to Skybridge's business operations is multi-layered, involving federal, state, and, to a limited extent, international regulatory requirements. The principal regulatory frameworks are summarized below:

Federal Regulation. There is no single federal money transmission license in the United States. Instead, the federal regulatory framework applicable to money transmitters and payments companies is principally governed by the Bank Secrecy Act (31 U.S.C. §§ 5311-5332) and its implementing regulations (31 C.F.R. Chapter X), which require money services businesses, including money transmitters, to register with FinCEN, implement BSA/AML compliance programs, file suspicious activity and currency transaction reports, and comply with recordkeeping requirements. Separately, OFAC, a bureau of the U.S. Department of the Treasury, administers and enforces U.S. economic sanctions programs, which require money transmitters to screen transactions and counterparties against the Specially Designated Nationals and blocked Persons List (the "SDN List") and other restricted party lists. The Consumer Financial Protection Bureau ("CFPB") may also exercise supervisory authority over the Company if it qualifies as a "larger participant" in a market for consumer financial products or services, as defined by CFPB rules.

State Regulation. Money transmission licensing is required on a state-by-state basis under individual state money transmission statutes. Each state has its own licensing requirements, surety bond and net worth thresholds, application procedures, examination schedules, and ongoing reporting obligations. The patchwork nature of state money transmission regulation has long been a challenge for fintech companies operating nationally, although recent efforts by the Conference of State Bank Supervisors ("CSBS") to promote harmonization through model legislation and the NMLS have brought some degree of standardization. As of the date of this memorandum, forty-nine (49) states and the District of Columbia require some form of money transmitter license for activities of the type conducted by Skybridge, with Montana being the sole state that does not have a money transmission licensing statute (though Montana has recently introduced legislation that would impose licensing requirements, as discussed in Section V.B below).

CFPB Supervisory Authority. The CFPB has the authority to supervise "larger participants" in markets for certain consumer financial products and services, including international money transfers. Although the Company's domestic payments processing activities may not fall squarely within the scope of the CFPB's existing larger participant rules, the CFPB's general supervisory and enforcement authority under the Consumer Financial Protection Act (12 U.S.C. § 5514) could extend to the Company's activities to the extent they are deemed to constitute offering or providing a "consumer financial product or service" as defined in the statute. The CFPB has also signaled increasing interest in the supervision of payments companies and embedded finance providers.

Federal Banking Agency Oversight. To the extent the Company operates through bank partnerships, the Company's bank partners are subject to oversight by their primary federal regulators—the Office of the Comptroller of the Currency ("OCC") in the case of Pacific Commerce Bank, N.A. (a nationally chartered bank), and the Federal Deposit Insurance Corporation ("FDIC") and applicable state banking regulator in the case of Keystone Federal Savings Bank (a state-chartered savings bank). Federal banking agencies have issued interagency guidance regarding third-party risk management (including the June 2023 Interagency Guidance on Third-Party Relationships), and the Company, as a significant third-party service provider to its bank partners, may be subject to examination by those agencies in connection with their oversight of the banks.

IV. Federal Regulatory Compliance

A. FinCEN Registration

Skybridge is registered with FinCEN as a Money Services Business in the category of "Money Transmitter" pursuant to 31 C.F.R. § 1022.380. The Company's initial MSB registration was filed on March 15, 2018, and became effective upon filing. The Company's registration has been renewed in accordance with FinCEN's biennial renewal requirement, with the most recent renewal filed on February 28, 2022, effective through February 2024. The Company's FinCEN registration number is 31000179840762.

We reviewed the Company's FinCEN registration filings and confirmed that they are current and accurately reflect the Company's legal name, principal place of business, and the categories of MSB activity in which the Company engages. The registration identifies the Company as a "Money Transmitter" and lists the appropriate agent and branch information. The Company has represented that it has not received any correspondence from FinCEN indicating any deficiencies or issues with its registration.

We note that the Company's next biennial renewal is due on or before February 28, 2024, which falls during the anticipated closing period for the Bridge Financing. The Company's compliance team has confirmed that the renewal filing is being prepared and will be submitted in January 2024, well in advance of the deadline. We recommend that the Company ensure that the renewal is filed and acknowledged by FinCEN prior to the Initial Closing, currently anticipated for January 15, 2024, or, at a minimum, that the status of the pending renewal be disclosed in the Company Disclosure Schedule.

We identified no deficiencies, late filings, or adverse correspondence with respect to the Company's FinCEN registration.

B. Bank Secrecy Act / Anti-Money Laundering (BSA/AML) Program

The Company has implemented a BSA/AML compliance program designed to comply with the requirements of the BSA and its implementing regulations, including 31 C.F.R. § 1022.210 (requiring MSBs to develop, implement, and maintain an effective AML program reasonably designed to prevent the MSB from being used to facilitate money laundering and the financing of terrorism).

BSA/AML Compliance Officer. The Company has designated Reginald H. Tanaka as its BSA/AML Compliance Officer. Mr. Tanaka holds the title of Chief Compliance Officer and has served in that role since August 2021. He reports functionally to the Company's General Counsel, Priya Ramanathan, and has a dotted-line reporting relationship to the Audit Committee of the Board of Directors. Mr. Tanaka holds a Certified Anti-Money Laundering Specialist (CAMS) designation and has over fourteen years of experience in financial services compliance, including prior roles at Ostrander & Co. and Ridgeline Holdings We note that the dual reporting structure (to General Counsel rather than directly to the CEO) is common among fintech companies of Skybridge's size and stage, but certain regulators prefer a direct reporting line to the CEO or the Board. We recommend that the Company consider whether a direct reporting line to the CEO, Arjun Mehta, would strengthen the independence of the compliance function and better position the Company for potential CFPB supervisory engagement.

Customer Identification Program (CIP) and Know-Your-Customer (KYC) Procedures. The Company has implemented a CIP and KYC program applicable to all merchant onboarding. The program requires the collection and verification of identifying information for each merchant applicant, including legal name, employer identification number (EIN) or Social Security number (for sole proprietors), business address, date of formation, beneficial ownership information (for entities with 25% or greater ownership stakes), and the identity of control persons. Verification is conducted through a combination of documentary verification (government-issued identification, articles of incorporation, and business licenses) and non-documentary verification (cross-referencing information against third-party data sources, including Harborview Software and Crestline Data Systems). The Company also conducts enhanced due diligence ("EDD") on merchants operating in higher-risk industries, including gaming, nutraceuticals, travel, and digital goods.

Our review of the CIP/KYC procedures indicates that they are generally consistent with FinCEN guidance and industry best practices. However, we note that the Company's beneficial ownership identification threshold of 25% is set at the minimum required by the Customer Due Diligence ("CDD") rule (31 C.F.R. § 1010.230), and certain state regulators and bank partners have adopted a lower threshold of 10%. Given the evolving regulatory landscape—including the implementation of the Corporate Transparency Act ("CTA") beneficial ownership reporting requirements, which became effective January 1, 2024—the Company may wish to consider lowering its beneficial ownership identification threshold to 10% or aligning it with the CTA framework.

Transaction Monitoring. The Company utilizes Quillon Systems's ARIC platform for real-time transaction monitoring, supplemented by custom rule sets developed by the Company's compliance engineering team. The transaction monitoring system is designed to identify potentially suspicious activity, including unusual transaction patterns, rapid movement of funds, structuring, and transactions involving high-risk jurisdictions or counterparties. Alerts generated by the monitoring system are reviewed by a team of four (4) BSA analysts within the compliance department, who escalate cases for SAR filing as appropriate.

Our review of the transaction monitoring system's configuration and alert management processes revealed the following observations:

• The system generated approximately 12,400 alerts during the twelve-month period ending September 30, 2023, of which approximately 9,100 (73%) were dispositioned as false positives after initial review. While a false-positive rate in the range of 70-75% is not uncommon in the payments industry, the Company should evaluate whether recalibration of its monitoring rules could reduce the false-positive rate and improve the efficiency of the BSA analyst team.

• Of the remaining approximately 3,300 alerts escalated for further review, the Company filed approximately 287 SARs during the same period. This SAR filing rate of approximately 2.3% of total alerts and 8.7% of escalated alerts is within the range observed for similarly situated payments companies.

• The Company's SAR filing timeliness has been generally within the thirty (30) calendar day filing requirement, although the DFPI's June 2023 examination (discussed in Section VI.A below) identified three instances in which SAR filings were made between thirty-one (31) and forty-two (42) days after the initial detection of suspicious activity, which the DFPI characterized as a deficiency.

Independent Audit/Testing. The Company engages Severin Beck CPAs LLP to perform an independent audit and assessment of its BSA/AML compliance program on an annual basis. The most recent independent audit covered the twelve-month period ending June 30, 2023, and the audit report was issued on August 15, 2023. The audit concluded that the Company's BSA/AML program is "generally effective" in meeting the requirements of the BSA and applicable regulations, with certain recommendations for enhancement. Key recommendations from the most recent audit included: (i) recalibrating transaction monitoring thresholds to reduce false-positive rates; (ii) enhancing the documentation of SAR filing decisions, particularly with respect to narrative descriptions of suspicious activity; and (iii) increasing the frequency of BSA/AML training for the Company's merchant onboarding and customer success teams. The Company has represented that it has implemented or is in the process of implementing all recommendations from the audit. We recommend that the Company document its implementation efforts and maintain records of remedial actions taken for regulatory examination purposes.

Training Program. The Company conducts BSA/AML training for all employees upon hire and on an annual basis thereafter. Enhanced training modules are provided to the compliance team, the merchant onboarding team, and the customer success team. The most recent annual training was completed in October 2023. Training records were made available for our review and appear to be complete and current.

C. OFAC Compliance

The Company has implemented a sanctions compliance program that includes screening of all merchant applicants and counterparties against the OFAC SDN List, the Consolidated Sanctions List, and other applicable restricted party lists at the time of onboarding and on an ongoing basis. The Company utilizes Glenrock Solutions for sanctions screening, which is integrated into the payments orchestration platform to enable real-time screening of transaction counterparties.

The sanctions screening system is configured to screen the following data points: merchant legal name, trade name (if different), beneficial owners, authorized signatories, and, for consumer-facing transactions, consumer names and addresses (to the extent available from the merchant's payment data). The system generates alerts for potential matches, which are reviewed by the Company's compliance team and resolved through a manual review process.

During the twelve-month period ending September 30, 2023, the sanctions screening system generated approximately 1,850 alerts, of which approximately 1,820 (98.4%) were determined to be false positives upon review. No true positive matches were identified during this period. The Company has not identified any OFAC-related incidents, and no blocked transactions or voluntary self-disclosures have been filed with OFAC.

We found the Company's OFAC compliance program to be generally consistent with OFAC's Framework for OFAC Compliance Commitments (issued May 2019) and appropriate for the Company's risk profile. We recommend that the Company periodically review and test its screening system's algorithm sensitivity, particularly as the Company expands into additional international markets where sanctions risk may be elevated.

D. CFPB Considerations

We have analyzed whether Skybridge qualifies as a "larger participant" subject to CFPB supervisory authority under the CFPB's existing larger participant rules. The CFPB has promulgated larger participant rules for several markets, including international money transfers (12 C.F.R. Part 1090, Subpart B), consumer reporting, consumer debt collection, student loan servicing, automobile financing, and, most recently, general-use digital consumer payment applications (effective November 1, 2024, if not stayed by litigation). The Company's domestic payments processing activities do not fall squarely within any of the currently effective larger participant rule categories, and the Company's international payment volume, while growing, is principally B2B in nature (merchant settlement) rather than consumer remittance.

However, the CFPB's proposed larger participant rule for providers of general-use digital consumer payment applications (proposed in November 2023) could encompass certain of the Company's activities if the Company's platform is deemed to facilitate consumer payment transactions at a volume exceeding the proposed threshold of five million transactions per year. Given that the Company processes approximately 185 million annualized transactions (of which a substantial majority involve consumer payment data flowing through the Platform), this threshold would likely be met if the Company's activities are deemed to fall within the scope of the rule. We note that the proposed rule is subject to a public comment period and may be modified before finalization, and that industry groups have raised significant concerns about the breadth of the proposed definition.

The Company has confirmed that it has not received any CFPB inquiry, civil investigative demand, supervisory examination notice, or enforcement action from the CFPB as of the date of this memorandum. We recommend that the Company monitor the CFPB's rulemaking activities closely and prepare for potential supervisory engagement in calendar year 2024 or 2025.

V. State Money Transmission Licensing

A. Licensing Framework Overview

Money transmitter licensing is required in forty-nine (49) states and the District of Columbia for entities engaged in the business of money transmission, which is generally defined as receiving money or monetary value for the purpose of transmitting the same by any means, including electronic funds transfer, wire, or other method. Montana is the only state that does not currently have a money transmission licensing statute, although legislation has been introduced in the Montana legislature (HB 307, introduced January 2023) that would impose licensing requirements. The bill did not advance out of committee during the 2023 session but is expected to be reintroduced in the 2025 session.

For a company processing approximately $4.2 billion in GPV, as Skybridge does, the licensing requirements are substantial. Most state statutes impose minimum net worth requirements that scale with transaction volume, surety bond requirements that similarly increase with GPV, and ongoing compliance obligations including periodic call report filings through the NMLS, maintenance of permissible investments or custodial funds equal to outstanding transmission obligations, and submission to periodic regulatory examinations.

The following exemptions are potentially available to Skybridge in certain jurisdictions, and the Company relies on one or more of these exemptions in several states:

• Agent-of-Payee Exemption. Certain states exempt from money transmission licensing entities that receive funds as an agent of the payee (i.e., the merchant) pursuant to a written agreement, where the payment is deemed complete upon receipt by the agent. This exemption is available in some form in approximately twenty (20) states, although the scope and conditions of the exemption vary significantly. The Company has entered into agency agreements with its merchants that are designed to invoke the agent-of-payee exemption where available.

• Payment Processor Exemption. Some states exempt "payment processors" that facilitate payments on behalf of merchants through established banking relationships, provided that the processor does not hold funds in excess of a specified period or amount. The availability and scope of this exemption varies widely among states.

• Bank Partnership/Agent of Bank Exemption. In certain states, an entity acting as an agent of a licensed bank may be exempt from separate money transmission licensing. The Company's relationship with Keystone Federal Savings Bank and Pacific Commerce Bank, N.A. may provide a basis for claiming this exemption in jurisdictions where it is available.

The Company has engaged outside regulatory counsel at Caldwell & Associates, P.C. to perform state-by-state exemption analyses, which we have reviewed in connection with this memorandum. We have identified several jurisdictions where the Company's reliance on exemptions may be subject to challenge, as discussed in Sections V.B and V.D below.

B. State-by-State Licensing Status

Based on our review of the Company's license files, NMLS records, and representations from the Company's compliance team, the following is a summary of the Company's money transmission licensing status across all fifty (50) states, the District of Columbia, and applicable U.S. territories. A comprehensive table is attached as Appendix A. We address key jurisdictions in detail below.

Summary Statistics:

Application filed in Montana in anticipation of potential future legislation; Montana does not currently require a license. *Montana is counted in both "Applications Pending" and "No License Required" categories because the Company has filed a precautionary application in anticipation of possible future legislation, but no license is currently required.

Key Jurisdictions. Delaware. As the Company's state of incorporation and the location of its principal executive offices at 1400 Market Street, Suite 2200, Wilmington, DE 19801, Delaware is the Company's "home state" for regulatory purposes. The Company holds a Delaware Money Transmitter License issued by the Delaware Office of the State Bank Commissioner (the "Commissioner"). License Number: 034781. Date of Issuance: August 22, 2018. Current Status: Active. Expiration/Renewal: The Delaware license does not expire but is subject to ongoing compliance and annual renewal of the surety bond. Surety Bond: $2,000,000, issued by Harborview Assurance (Bond No. 107584692), current through August 2024. Net Worth Requirement: $500,000 minimum; the Company is in compliance with a reported net worth of approximately $24.3 million as of September 30, 2023. The Company has been subject to one routine examination by the Commissioner in 2021, which resulted in no material findings. No conditions, restrictions, or supervisory agreements are attached to the license.

New York. The Company holds a New York Money Transmitter License issued by the New York State Department of Financial Services ("NYDFS") under Article XIII-B of the New York Banking Law. License Number: MT-NYS-102954. Date of Issuance: December 3, 2019. Current Status: Active. The New York money transmitter license does not have a fixed expiration date but is subject to ongoing compliance, annual assessments, and periodic examination. Surety Bond: $5,000,000, issued by Calderon Indemnity Co. (Bond No. HFG-2019-07843), current through December 2024. Net Worth Requirement: The NYDFS imposes a risk-based net worth requirement; the Company has confirmed ongoing compliance based on its most recent financial statements. The Company has not applied for a separate BitLicense under 23 NYCRR Part 200, as the Company does not currently transmit or facilitate the transmission of virtual currency. However, as noted in the Executive Summary, the Company's product roadmap includes the potential integration of stablecoin settlement functionality, which would require a BitLicense or a limited purpose trust company charter. We strongly recommend that the Company engage with the NYDFS early in the product development process if stablecoin functionality is to be pursued, given the notoriously lengthy BitLicense application timeline (historically twelve to eighteen months or longer).

The NYDFS conducted a routine examination of the Company in March 2022. The examination report, issued in July 2022, contained no material findings but included two recommendations: (i) that the Company enhance its transaction monitoring documentation to include more detailed narrative descriptions of alert dispositions, and (ii) that the Company ensure timely updating of its NMLS record to reflect changes in its board composition. Both recommendations have been addressed by the Company.

California. The Company holds a California Money Transmitter License issued by the California Department of Financial Protection and Innovation (the "DFPI") under the California Money Transmission Act (Cal. Fin. Code § 2000 et seq.). License Number: MT-CA-602493. Date of Issuance: October 15, 2019. Current Status: Active. Expiration/Renewal: The California license does not have a fixed expiration date but requires annual assessment payments and ongoing compliance. Surety Bond: $7,000,000, issued by Calderon Assurance (Bond No. ZA-1005738), current through October 2024. Tangible Net Worth Requirement: $500,000 minimum, with additional capital requirements based on GPV; the Company is in compliance. The California license is one of the most operationally significant licenses held by the Company, given that California-based merchants account for approximately 22% of the Company's total GPV.

The DFPI conducted a routine examination of the Company in June 2023. The examination report, issued in September 2023, contained three findings that are discussed in detail in Section VI.A below. The findings relate to timeliness of SAR filings (three instances of filings made between thirty-one and forty-two days after initial detection) and deficiencies in the Company's consumer complaint handling procedures. The Company has submitted a corrective action plan to the DFPI, which was acknowledged by the DFPI on November 8, 2023. Formal closure of the examination findings remains pending.

Massachusetts. The Company holds a Massachusetts Foreign Transmittal Agency License issued by the Massachusetts Division of Banks under Mass. Gen. Laws ch. 169. License Number: FT-MA-073291. Date of Issuance: March 28, 2020. Current Status: Active. Expiration/Renewal: Annual renewal required; most recent renewal completed September 2023, effective through September 2024. Surety Bond: $1,000,000, issued by Granite Harbor Insurance (Bond No. LM-2020-13847), current through March 2024. Net Worth Requirement: $100,000 minimum; the Company is in compliance. Massachusetts is a jurisdiction of particular significance for the Bridge Financing because Ridgeline Ventures Fund IV, L.P., the lead investor committing $30,000,000 (50% of the round), is headquartered at 800 Boylston Street, Boston, MA 02199. While the location of an investor does not, by itself, create additional money transmission licensing requirements, it may be relevant in the context of change-of-control or passive investor reporting obligations discussed in Section XI below. No conditions, restrictions, or supervisory agreements are attached to the Massachusetts license. No examinations have been conducted by the Massachusetts Division of Banks within the past three years.

Illinois. The Company holds an Illinois Transmitters of Money Act License issued by the Illinois Department of Financial and Professional Regulation ("IDFPR") under the Transmitters of Money Act (205 ILCS 657). License Number: TM-IL-000489. Date of Issuance: January 14, 2020. Current Status: Active. Expiration/Renewal: Annual renewal; most recent renewal completed December 2023, effective through December 2024. Surety Bond: $2,000,000, issued by Harborview Assurance (Bond No. 107602155), current through January 2024 (renewal pending; see Section V.C). Net Worth Requirement: $100,000 minimum; the Company is in compliance. Illinois is relevant because Beacon Hill Growth Partners, LP is headquartered at 222 West Adams Street, Chicago, IL 60606. No conditions, restrictions, or supervisory agreements are attached to the Illinois license. The IDFPR conducted a routine examination in February 2022, which resulted in no material findings.

Washington. The Company holds a Washington Money Transmitter License issued by the Washington State Department of Financial Institutions ("DFI") under the Uniform Money Services Act (RCW 19.230). License Number: MT-WA-550192. Date of Issuance: June 7, 2020. Current Status: Active. Expiration/Renewal: Annual renewal; most recent renewal completed June 2023, effective through June 2024. Surety Bond: $1,500,000, issued by Calderon Indemnity Co. (Bond No. HFG-2020-12490), current through June 2024. Net Worth Requirement: Calculated based on a formula tied to outstanding transmission obligations; the Company is in compliance. Washington is relevant because Halcyon Capital Management LLC is headquartered at 1201 Third Avenue, Seattle, WA 98101. No conditions, restrictions, or supervisory agreements are attached to the Washington license. No examinations have been conducted by the Washington DFI within the past three years, though the Company anticipates a routine examination in 2024.

Texas. The Company holds a Texas Money Transmission License issued by the Texas Department of Banking under the Texas Finance Code, Chapter 151. License Number: MT-TX-3219874. Date of Issuance: November 1, 2019. Current Status: Active. Surety Bond: $3,000,000. The Company is in compliance with all Texas requirements. No examinations have been conducted within the past two years.

Florida. The Company holds a Florida Money Services Business License (Part III, Money Transmitter) issued by the Florida Office of Financial Regulation under Chapter 560, Florida Statutes. License Number: FT-FL-0027481. Date of Issuance: April 22, 2020. Current Status: Active. Surety Bond: $2,000,000. The Company is in compliance with all Florida requirements. The Florida Office of Financial Regulation conducted a routine examination in October 2022, which resulted in no material findings.

Georgia. The Company holds a Georgia Money Transmitter License issued by the Georgia Department of Banking and Finance under O.C.G.A. § 7-1-680 et seq. License Number: MT-GA-63018. Date of Issuance: February 10, 2021. Current Status: Active. Surety Bond: $250,000. The Company is in compliance with all Georgia requirements. No examinations have been conducted within the past three years.

Pennsylvania. The Company holds a Pennsylvania Money Transmitter License issued by the Pennsylvania Department of Banking and Securities under the Money Transmission Business Licensing Law (7 Pa.C.S. § 6101 et seq.). License Number: MT-PA-087652. Date of Issuance: September 30, 2020. Current Status: Active. Surety Bond: $1,000,000. The Company is in compliance with all Pennsylvania requirements. No conditions or restrictions are attached to the license.

Ohio. The Company holds an Ohio Money Transmitter License issued by the Ohio Department of Commerce, Division of Financial Institutions, under R.C. 1315. License Number: MT-OH-SM.501.782. Date of Issuance: August 14, 2020. Current Status: Active. Surety Bond: $1,000,000. The Company is in compliance with all Ohio requirements. No examinations have been conducted within the past three years.

Pending Applications. The Company has pending money transmitter license applications in the following four (4) jurisdictions:

1. Alabama. Application filed with the Alabama State Banking Department on April 17, 2023. Status: Pending review. The Company has been processing transactions involving Alabama-based merchants while the application is pending. Alabama does not provide a statutory safe harbor for applicants operating during the pendency of a license application, which creates regulatory risk. The Company's GPV attributable to Alabama-based merchants is approximately $38 million on an annualized basis. We recommend that the Company consider voluntarily suspending onboarding of new Alabama-based merchants until the license is obtained, or, alternatively, routing Alabama transactions through the Keystone Federal Savings Bank bank partnership arrangement to leverage the agent-of-bank exemption.

2. Maine. Application filed with the Maine Bureau of Consumer Credit Protection on June 5, 2023. Status: Pending review; a deficiency notice was received on September 12, 2023 requesting additional documentation regarding the Company's compliance program. The Company submitted the requested documentation on October 20, 2023 and awaits further communication from the Bureau. Maine GPV is approximately $12 million annualized.

3. North Dakota. Application filed with the North Dakota Department of Financial Institutions on August 29, 2023. Status: Pending review. North Dakota GPV is approximately $8 million annualized.

4. Montana. As noted above, Montana does not currently have a money transmission licensing statute. However, the Company filed a precautionary application in anticipation of potential future legislation. This application is not pending before any regulatory body and is maintained internally for readiness purposes.

C. Surety Bond and Net Worth Requirements

The Company is required to maintain surety bonds in each state in which it holds a money transmitter license. The aggregate face amount of all surety bonds currently maintained by the Company is approximately $47.5 million across all licensed jurisdictions. Surety bond amounts are generally determined by state statute or regulation and are typically based on the volume of money transmission activity conducted in the state, the Company's net worth, or a combination of both.

The Company's surety bonds are issued by four principal surety providers:

The Company's annual surety bond premium expense is approximately $712,000, based on the Company's current credit profile and premium rates. We note that the Company's GPV growth from approximately $2.8 billion (FY 2022) to approximately $4.2 billion (annualized Q3 2023) has triggered bond amount increases in several jurisdictions, including California (from $5,000,000 to $7,000,000), New York (from $3,000,000 to $5,000,000), and Texas (from $2,000,000 to $3,000,000). The Company has obtained increased bond amounts in all jurisdictions where increases were required, with the exception of the following:

• Illinois. The Company's surety bond with Kestrel Indemnity Co. is currently set at $2,000,000, which was the required amount based on FY 2022 GPV. The IDFPR has notified the Company that the bond amount must be increased to $3,000,000 based on 2023 GPV, effective upon the Company's next renewal in January 2024. The Company has confirmed that it is in the process of obtaining the increased bond from Kestrel Indemnity Co., and the updated bond certificate is expected to be delivered by January 5, 2024.

• Connecticut. The Company's surety bond with Strathmore Mutual Insurance is currently set at $1,000,000. The Connecticut Department of Banking has indicated that the bond amount must be increased to $1,500,000 based on 2023 activity. The updated bond certificate is pending.

• Arizona. The Company's surety bond with Ridgeline Specialty Insurance is due for renewal in January 2024. The updated bond amount will reflect 2023 GPV.

These pending bond increases and renewals are not anticipated to create material compliance issues, but we recommend that the Company ensure all updated bond certificates are obtained and filed with the applicable state regulators before the respective deadlines.

With respect to net worth requirements, the Company reported a net worth of approximately $24.3 million as of September 30, 2023. This amount exceeds the minimum net worth requirements in all states in which the Company holds a money transmitter license. The highest state-level net worth requirement applicable to the Company is California's tangible net worth requirement, which is currently $500,000 at the statutory minimum but may be increased by the DFPI based on the licensee's volume and risk profile. The Company's net worth comfortably exceeds all applicable requirements. Following the Bridge Financing, the Company's balance sheet will be enhanced by $60,000,000 in convertible note proceeds, although the treatment of subordinated convertible debt for net worth calculation purposes varies by state (discussed in Section XI.B below).

D. Exempt Activities and Bank Partnership Arrangements

The Company conducts a portion of its payments processing and embedded lending activities through bank partnership arrangements, which provide the basis for claiming exemptions from direct money transmission licensing in certain states.

Keystone Federal Savings Bank Partnership. The Company is party to a Master Services Agreement with Keystone Federal Savings Bank ("Keystone"), a state-chartered savings bank regulated by the FDIC and the Delaware Office of the State Bank Commissioner, dated April 12, 2021, as amended by Amendment No. 1 (dated March 15, 2022) and Amendment No. 2 (dated October 1, 2023). Under the Keystone MSA, the Company provides technology, platform, and operational services to facilitate payments processing conducted by Keystone as the "principal" in the money transmission chain. In states where the agent-of-bank exemption is available, the Company relies on its contractual relationship with Keystone to conduct payments processing without a separate money transmitter license. As of the date of this memorandum, the Company relies on the Keystone partnership for purposes of claiming the agent-of-bank exemption in two (2) states: Colorado and South Dakota. We note that the Company also holds direct money transmitter licenses in most states where Keystone operates, providing a dual-track compliance structure.

Pacific Commerce Bank, N.A. Partnership. The Company is party to a Program Agreement with Pacific Commerce Bank, N.A. ("Pacific Commerce"), a nationally chartered bank regulated by the OCC, dated November 3, 2022, pursuant to which Pacific Commerce serves as the lender of record for the Company's SkyCapital embedded lending product. Under this arrangement, Pacific Commerce originates the merchant cash advances, and the Company provides the technology platform, underwriting algorithms, and servicing functions. The Company relies on Pacific Commerce's status as a national bank to benefit from federal preemption of state lending licensing requirements. The Pacific Commerce Agreement includes compliance oversight provisions, audit rights, and risk management protocols that are consistent with OCC and FDIC guidance on bank-fintech partnerships.

Risk Assessment. The Company's reliance on bank partnership arrangements creates several categories of regulatory risk:

• Termination Risk. If either bank partnership were terminated—whether by the bank partner, the Company, or as a result of regulatory action against the bank—the Company would need to obtain direct licenses in the states where it currently relies on the exemption, or discontinue activities in those states. The Keystone MSA has a term of three (3) years with automatic annual renewals, subject to termination on ninety (90) days' notice by either party or immediately for cause. The Pacific Commerce Agreement has a term of two (2) years with a one-year renewal option, subject to termination on sixty (60) days' notice or immediately for cause.

• "True Lender" Risk. Several states and courts have adopted or are considering "true lender" doctrines that look beyond the formal structure of bank partnership lending programs to determine whether the non-bank partner (here, Skybridge) is the "true lender" based on factors such as which entity has the predominant economic interest in the loans, which entity controls the underwriting and pricing, and which entity markets the product. If Skybridge were deemed the "true lender," it would be subject to direct state licensing requirements for lending activities, and t

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE ATTORNEY WORK PRODUCT
MEMORANDUM
TO: Arjun Mehta, CEO & Co-Founder, Skybridge Fintech Ltd. David Lindstrom, CFO, Skybridge Fintech Ltd. Priya Ramanathan, General Counsel, Skybridge Fintech Ltd.
FROM: Leonard Ashford, Of Counsel, Calderwood & Harkness LLP Nina Reyes, Senior Associate, Calderwood & Harkness LLP
DATE: December 22, 2023
RE: Regulatory & Compliance Due Diligence — Money Transmission Licensing and State Regulatory Compliance; Skybridge Fintech Ltd. $60,000,000 Convertible Note Bridge Financing
MATTER NO.: 1009-00001
Right-click to update Table of Contents
I. Executive Summary
This memorandum summarizes the results of Calderwood & Harkness LLP's regulatory and compliance due diligence review of Skybridge Fintech Ltd. ("Skybridge," the "Company," or "you"), a Delaware C-corporation headquartered at 1400 Market Street, Suite 2200, Wilmington, DE 19801, in connection with the proposed $60,000,000 convertible promissory note bridge financing (the "Bridge Financing" or the "Transaction") led by Ridgeline Ventures Fund IV, L.P. ("Ridgeline Ventures"), with participation from Beacon Hill Growth Partners, LP ("Beacon Hill") and Halcyon Capital Management LLC ("Halcyon," and together with Ridgeline Ventures and Beacon Hill, the "Purchasers"). The memorandum has been prepared at the request of the Company's management and Board of Directors to inform the Company Disclosure Schedule to be delivered in connection with the Note Purchase Agreement (the "NPA") anticipated to be executed on or about January 14, 2024.
The scope of our review encompasses the Company's money transmission licensing status across all fifty (50) United States, the District of Columbia, and applicable U.S. territories; the Company's state-by-state regulatory compliance posture with respect to money transmission, payments processing, and embedded lending activities; the Company's federal regulatory compliance, including its registration with the Financial Crimes Enforcement Network ("FinCEN") as a Money Services Business ("MSB"), its Bank Secrecy Act ("BSA") and anti-money laundering ("AML") compliance program, and its sanctions compliance under the Office of Foreign Assets Control ("OFAC"); and any pending, threatened, or recently resolved regulatory inquiries, examinations, or enforcement actions. We have also analyzed the potential regulatory impact of the Bridge Financing itself, including change-of-control and ownership reporting obligations, net worth and financial condition considerations, and affirmative disclosure requirements to state regulators.
The Company operates a cloud-based payments orchestration and embedded lending platform primarily serving mid-market e-commerce companies. As of the third quarter of fiscal year 2023 ("Q3 2023"), the Company processes approximately $4.2 billion in annualized gross payment volume ("GPV"), reflecting significant year-over-year growth from approximately $2.8 billion in annualized GPV at the close of fiscal year 2022. The Company was founded in 2017 and currently employs approximately 310 full-time equivalent employees ("FTEs") across its Wilmington, Delaware headquarters, its engineering offices in San Francisco, California, and satellite offices in New York, New York and Austin, Texas. Annualized recurring revenue ("ARR") as of Q3 2023 is approximately $78 million, with net revenue retention of approximately 128%, both of which metrics are relevant to the Company's regulatory standing insofar as they reflect the scale of operations and the corresponding regulatory burden.
Overall Conclusion. Based on our review, the Company maintains a generally sound regulatory compliance posture for a payments fintech company of its size and stage. The Company is duly registered with FinCEN as an MSB, maintains active money transmitter licenses in forty-one (41) states and the District of Columbia, has applications pending in four (4) additional states, and relies on exemptions or has determined that no license is required in the remaining jurisdictions. The Company's BSA/AML compliance program, while adequate in its current form, would benefit from certain enhancements identified in Section IX below, particularly with respect to transaction monitoring calibration and the frequency of independent testing. We have identified the following material risk areas that warrant management's attention and, where appropriate, remedial action:
1. Pending License Applications. The Company's money transmitter license applications remain pending in four (4) states—Alabama, Maine, North Dakota, and Montana—in which the Company is currently conducting activities that may constitute money transmission. While the Company has submitted applications in each of these states and represents that it does not engage in material transmission volume in these jurisdictions, operating without a license while an application is pending creates regulatory risk, particularly in Alabama, which does not provide a safe harbor for pending applicants.
2. New York BitLicense. The Company holds a New York money transmitter license issued under Article XIII-B of the New York Banking Law but has not applied for a separate BitLicense under 23 NYCRR Part 200. While the Company does not currently transmit or facilitate the transmission of virtual currency, the Company's product roadmap includes the potential integration of stablecoin settlement functionality in calendar year 2024, which would require a BitLicense or charter.
3. California Examination Findings. The California Department of Financial Protection and Innovation ("DFPI") conducted a routine examination in June 2023 and issued a report containing three findings related to the timeliness of suspicious activity report ("SAR") filings and certain deficiencies in the Company's consumer complaint handling procedures. The Company has submitted a corrective action plan and has implemented remedial measures, but formal closure of the examination findings by the DFPI remains pending.
4. Embedded Lending Licensing. The Company's embedded lending product, which facilitates merchant cash advances through a partner bank arrangement, may require separate state lending, finance lender, or commercial financing disclosure licenses in certain states. Our review has identified eight (8) states where the Company's current exemption analysis may be insufficient and where additional licensing or registration may be advisable.
5. Change-of-Control Considerations. The conversion of the convertible notes upon a Qualified Financing (anticipated Series D round of at least $80,000,000 in Q3–Q4 2024) could result in Ridgeline Ventures holding an equity stake sufficient to trigger control person or passive investor reporting thresholds in numerous states, requiring advance filings or pre-clearance with state regulators.
This memorandum is prepared solely for use by the Company's management, Board of Directors, and authorized legal counsel, and will inform the Company Disclosure Schedule to be delivered in connection with the NPA. The memorandum is subject to the attorney-client privilege and attorney work product doctrine and should not be disclosed to third parties without the prior written consent of Calderwood & Harkness LLP, except as required to be furnished to the Purchasers in accordance with the terms of the NPA.
II. Scope of Review and Materials Examined
A. Documents and Materials Reviewed
In connection with the preparation of this memorandum, we reviewed the following categories of documents and materials, substantially all of which were provided by the Company through the virtual data room maintained by Thackeray Solutions (the "Data Room") and supplemented by direct production from the Company's General Counsel and compliance team:
1. State Money Transmitter License Applications, Approvals, Renewals, and Correspondence. Complete license application files, including original applications, amendments, and renewal submissions, for all jurisdictions in which the Company holds or has applied for a money transmitter license or similar authorization. Regulatory correspondence files for all such jurisdictions, including approval letters, conditional approval letters, deficiency notices, and general correspondence with state licensing authorities. Copies of all licenses and certificates of authority currently in effect.
2. State Examination Reports and Regulatory Correspondence Files. All examination reports issued by state regulatory authorities within the past five (5) years, including findings, management responses, corrective action plans, and follow-up correspondence. Regulatory correspondence files, including informal supervisory letters, guidance letters, and requests for information from state banking departments and departments of financial institutions.
3. Company Compliance Policies and Procedures Manuals. The Company's comprehensive compliance policies and procedures manual (Version 7.2, last updated September 2023), including policies related to BSA/AML compliance, sanctions screening, customer identification, know-your-customer procedures, consumer complaint handling, vendor management, information security, and data privacy. The Company's Code of Business Conduct and Ethics (last updated March 2023).
4. Bank Partnership and Sponsor Bank Agreements. Copies of all agreements with the Company's bank partners, including the Master Services Agreement with Keystone Federal Savings Bank, dated April 12, 2021, as amended (the "Keystone MSA"), and the Program Agreement with Pacific Commerce Bank, N.A., dated November 3, 2022 (the "Pacific Commerce Agreement"), pursuant to which the Company conducts certain payments processing and embedded lending activities. Related compliance addenda, risk management protocols, and oversight frameworks.
5. Compliance Officer Reports and Internal Audit Findings. Quarterly compliance reports prepared by the Company's Chief Compliance Officer, Reginald H. Tanaka, for the period from Q1 2022 through Q3 2023. Internal audit findings and reports relating to regulatory compliance matters for the same period, prepared by the Company's internal audit function.
6. Company Organizational Charts for Compliance Function. Current organizational chart for the Company's Legal, Compliance, and Risk Management department, including reporting lines, headcount, and functional responsibilities.
7. Responses to Due Diligence Request Lists. The Company's responses to the initial Due Diligence Request List dated November 13, 2023 (the "Initial DDRL"), and the Supplemental Due Diligence Request List dated December 6, 2023 (the "Supplemental DDRL"), the latter of which specifically requested detailed information regarding money transmission license status, state-by-state compliance, and bank partnership arrangements. Responses were provided by the Company's General Counsel, Priya Ramanathan, and the Company's outside regulatory counsel at Caldwell & Associates, P.C.
8. Board Meeting Minutes. Minutes of the Company's Board of Directors meetings from January 2021 through November 2023, to the extent such minutes reference or discuss regulatory matters, compliance program updates, regulatory examinations, licensing status, or enforcement actions.
9. Regulatory Filings and Reports. FinCEN MSB registration filings and renewals. State call reports filed with the Nationwide Multistate Licensing System ("NMLS") for fiscal years 2021, 2022, and Q1–Q3 2023. BSA/AML filings, including Suspicious Activity Reports, Currency Transaction Reports, and related documentation.
10. Third-Party Compliance Audit Reports. The independent BSA/AML audit report prepared by Severin Beck CPAs LLP dated August 15, 2023, covering the twelve-month period ending June 30, 2023. The PCI-DSS Level 1 certification audit report prepared by Harborview Health IT, dated March 2023.
11. Audited and Reviewed Financial Statements. The Company's audited financial statements for fiscal year ending December 31, 2022, prepared by Pinnacle Audit Group LLP (engagement partner Lisa Johannsen), together with the accompanying auditor's report and notes to the financial statements. The Company's reviewed (unaudited) financial statements for the nine-month period ending September 30, 2023, also prepared by Pinnacle Audit Group LLP. These financial statements were reviewed for purposes of assessing the Company's compliance with state net worth and capital requirements applicable to licensed money transmitters.
12. Interviews. Telephonic and video conference interviews conducted on December 11 and December 14, 2023, with Priya Ramanathan (General Counsel), Reginald H. Tanaka (Chief Compliance Officer), and Marcus Gillespie (Director, Regulatory Affairs). A follow-up written questionnaire was submitted to the compliance team on December 15, 2023, and responses were received on December 18, 2023.
B. Limitations. This memorandum is based solely upon our review of the documents and materials described above and the representations made by the Company's management and compliance personnel during the interview process. We have not independently verified the Company's licensing status or compliance posture with any state or federal regulatory authority, nor have we conducted any independent investigation beyond the scope of the materials provided. We have relied upon the completeness and accuracy of the materials and information furnished by the Company. Our review is current as of the date of this memorandum, December 22, 2023, and does not reflect any developments occurring after that date. Any material changes in the Company's regulatory status, business operations, or compliance posture subsequent to the date hereof should be promptly communicated to Calderwood & Harkness LLP for supplemental analysis.
We note that certain documents requested in the Supplemental DDRL remain outstanding as of the date of this memorandum, including (i) the Company's complete NMLS filing history for fiscal year 2023, which the Company's compliance team has represented will be provided by December 27, 2023, and (ii) updated surety bond certificates for three jurisdictions (discussed in Section V.C below). To the extent these materials, when received, reveal information material to the conclusions set forth herein, we will issue a supplemental memorandum updating our findings.
III. Overview of the Company's Business Model and Regulatory Touchpoints
A. Payments Orchestration Platform
Skybridge's core product is a cloud-based payments orchestration platform (the "Platform") designed to serve mid-market e-commerce companies, generally defined by the Company as merchants with annual online revenue between $10 million and $500 million. The Platform connects merchants with multiple payment processors, acquirers, and payment networks, enabling intelligent routing, optimization, and reconciliation of payment transactions across multiple channels and geographies. The Platform supports credit card, debit card, ACH, and real-time payment (RTP) processing, as well as integration with digital wallet providers.
The Platform operates as follows: When a consumer initiates a purchase through a Skybridge-connected merchant's e-commerce storefront, the Platform receives the transaction data, evaluates the optimal routing path based on cost, approval rate, and network availability, and directs the transaction to the selected acquirer or payment processor for authorization, capture, and settlement. Following settlement, funds flow from the acquirer through the Company's custodial or operational accounts and are subsequently remitted to the merchant, typically on a T+1 or T+2 settlement cycle. The Company earns revenue through a combination of per-transaction fees (typically ranging from $0.05 to $0.20 per transaction plus a basis-point component of transaction value) and monthly platform subscription fees.
As of Q3 2023, the Platform processes approximately $4.2 billion in annualized gross payment volume, representing approximately 185 million individual transactions on an annualized basis. The Company serves approximately 2,400 active merchant accounts across all fifty (50) states, the District of Columbia, and six international markets (Canada, the United Kingdom, Germany, France, Australia, and Japan). Domestic GPV accounts for approximately 82% of total GPV, with international volume constituting the remaining 18%.
The Company's role in the payments flow is the central regulatory consideration for purposes of this memorandum. By receiving, holding (even temporarily), and transmitting consumer and merchant funds in connection with payment transactions, the Company acts as an intermediary in the transmission of money. This intermediary function triggers money transmission licensing requirements in most U.S. states, subject to available exemptions discussed in detail in Section V below. The fact that the Company holds settlement funds in custodial or operational accounts, even for a brief period (typically one to two business days), is sufficient in most jurisdictions to constitute "money transmission" or the "business of transmitting money" as defined under applicable state statutes.
The Company maintains custodial settlement accounts at Greaves Bancorp and at its sponsor bank, Keystone Federal Savings Bank. As of Q3 2023, the aggregate daily balance of custodial settlement funds held by the Company across all accounts ranged from approximately $28 million to $52 million, with an average daily balance of approximately $37 million. These balances are segregated from the Company's operating funds and are not commingled with general corporate assets, in compliance with applicable state requirements for the safeguarding of customer funds.
B. Embedded Lending Product
In addition to its core payments orchestration platform, the Company offers an embedded lending feature (marketed as "Skybridge Capital" or "SkyCapital") that facilitates merchant cash advances and short-term working capital products embedded within the Platform. The SkyCapital product was launched in Q4 2022 and, as of Q3 2023, has facilitated approximately $165 million in cumulative advances to approximately 340 merchants, with an average advance size of approximately $485,000 and a median repayment period of approximately 120 days.
The regulatory touchpoints associated with the SkyCapital product are distinct from, but complementary to, the money transmission licensing considerations that are the primary focus of this memorandum. The embedded lending product implicates the following regulatory frameworks:
• State Lending and Finance Lender Licensing. Many states require licenses for entities that make, arrange, or broker commercial or consumer loans. The applicability of these licensing requirements depends on the characterization of the Company's role in the lending transaction—i.e., whether the Company acts as the lender of record, a loan broker or arranger, or merely a technology provider that facilitates lending by a separate licensed entity.
• State Commercial Financing Disclosure Laws. A growing number of states have enacted or proposed commercial financing disclosure laws requiring providers of merchant cash advances and other commercial financing products to provide standardized disclosures to small business borrowers. California's SB 1235 (codified at Cal. Fin. Code § 22800 et seq.) and its implementing regulations, as well as similar laws enacted or proposed in New York, Virginia, Utah, Florida, Georgia, and other states, impose disclosure and registration requirements on commercial financing providers.
• State Usury Laws. To the extent the SkyCapital product is characterized as a loan rather than a purchase of future receivables, state usury laws may apply to limit the effective interest rate charged to merchants. The Company's current product documentation characterizes the merchant cash advance as a purchase and sale of future receivables rather than a loan, but this characterization may be challenged by regulators in certain jurisdictions.
• Federal Truth-in-Lending Considerations. While the SkyCapital product is offered exclusively to commercial entities (merchants) and not to individual consumers, certain states apply truth-in-lending-type disclosure requirements to commercial transactions, particularly those involving small businesses.
Based on our review of the Company's bank partnership agreements and product documentation, the Company currently operates the SkyCapital product through a partnership with Pacific Commerce Bank, N.A., a nationally chartered bank, under which Pacific Commerce acts as the lender of record and the Company provides the technology platform, underwriting algorithms, and servicing functions. The Company relies on this bank partnership model to avail itself of the federal preemption of state lending licensing requirements applicable to national banks. However, as discussed in Sections V.D and VII below, this bank partnership structure is subject to increasing regulatory scrutiny, and certain states have taken the position that the non-bank partner (in this case, Skybridge) is the "true lender" and therefore subject to state licensing requirements.
C. Regulatory Framework Overview
The regulatory framework applicable to Skybridge's business operations is multi-layered, involving federal, state, and, to a limited extent, international regulatory requirements. The principal regulatory frameworks are summarized below:
Federal Regulation. There is no single federal money transmission license in the United States. Instead, the federal regulatory framework applicable to money transmitters and payments companies is principally governed by the Bank Secrecy Act (31 U.S.C. §§ 5311-5332) and its implementing regulations (31 C.F.R. Chapter X), which require money services businesses, including money transmitters, to register with FinCEN, implement BSA/AML compliance programs, file suspicious activity and currency transaction reports, and comply with recordkeeping requirements. Separately, OFAC, a bureau of the U.S. Department of the Treasury, administers and enforces U.S. economic sanctions programs, which require money transmitters to screen transactions and counterparties against the Specially Designated Nationals and blocked Persons List (the "SDN List") and other restricted party lists. The Consumer Financial Protection Bureau ("CFPB") may also exercise supervisory authority over the Company if it qualifies as a "larger participant" in a market for consumer financial products or services, as defined by CFPB rules.
State Regulation. Money transmission licensing is required on a state-by-state basis under individual state money transmission statutes. Each state has its own licensing requirements, surety bond and net worth thresholds, application procedures, examination schedules, and ongoing reporting obligations. The patchwork nature of state money transmission regulation has long been a challenge for fintech companies operating nationally, although recent efforts by the Conference of State Bank Supervisors ("CSBS") to promote harmonization through model legislation and the NMLS have brought some degree of standardization. As of the date of this memorandum, forty-nine (49) states and the District of Columbia require some form of money transmitter license for activities of the type conducted by Skybridge, with Montana being the sole state that does not have a money transmission licensing statute (though Montana has recently introduced legislation that would impose licensing requirements, as discussed in Section V.B below).
CFPB Supervisory Authority. The CFPB has the authority to supervise "larger participants" in markets for certain consumer financial products and services, including international money transfers. Although the Company's domestic payments processing activities may not fall squarely within the scope of the CFPB's existing larger participant rules, the CFPB's general supervisory and enforcement authority under the Consumer Financial Protection Act (12 U.S.C. § 5514) could extend to the Company's activities to the extent they are deemed to constitute offering or providing a "consumer financial product or service" as defined in the statute. The CFPB has also signaled increasing interest in the supervision of payments companies and embedded finance providers.
Federal Banking Agency Oversight. To the extent the Company operates through bank partnerships, the Company's bank partners are subject to oversight by their primary federal regulators—the Office of the Comptroller of the Currency ("OCC") in the case of Pacific Commerce Bank, N.A. (a nationally chartered bank), and the Federal Deposit Insurance Corporation ("FDIC") and applicable state banking regulator in the case of Keystone Federal Savings Bank (a state-chartered savings bank). Federal banking agencies have issued interagency guidance regarding third-party risk management (including the June 2023 Interagency Guidance on Third-Party Relationships), and the Company, as a significant third-party service provider to its bank partners, may be subject to examination by those agencies in connection with their oversight of the banks.
IV. Federal Regulatory Compliance
A. FinCEN Registration
Skybridge is registered with FinCEN as a Money Services Business in the category of "Money Transmitter" pursuant to 31 C.F.R. § 1022.380. The Company's initial MSB registration was filed on March 15, 2018, and became effective upon filing. The Company's registration has been renewed in accordance with FinCEN's biennial renewal requirement, with the most recent renewal filed on February 28, 2022, effective through February 2024. The Company's FinCEN registration number is 31000179840762.
We reviewed the Company's FinCEN registration filings and confirmed that they are current and accurately reflect the Company's legal name, principal place of business, and the categories of MSB activity in which the Company engages. The registration identifies the Company as a "Money Transmitter" and lists the appropriate agent and branch information. The Company has represented that it has not received any correspondence from FinCEN indicating any deficiencies or issues with its registration.
We note that the Company's next biennial renewal is due on or before February 28, 2024, which falls during the anticipated closing period for the Bridge Financing. The Company's compliance team has confirmed that the renewal filing is being prepared and will be submitted in January 2024, well in advance of the deadline. We recommend that the Company ensure that the renewal is filed and acknowledged by FinCEN prior to the Initial Closing, currently anticipated for January 15, 2024, or, at a minimum, that the status of the pending renewal be disclosed in the Company Disclosure Schedule.
We identified no deficiencies, late filings, or adverse correspondence with respect to the Company's FinCEN registration.
B. Bank Secrecy Act / Anti-Money Laundering (BSA/AML) Program
The Company has implemented a BSA/AML compliance program designed to comply with the requirements of the BSA and its implementing regulations, including 31 C.F.R. § 1022.210 (requiring MSBs to develop, implement, and maintain an effective AML program reasonably designed to prevent the MSB from being used to facilitate money laundering and the financing of terrorism).
BSA/AML Compliance Officer. The Company has designated Reginald H. Tanaka as its BSA/AML Compliance Officer. Mr. Tanaka holds the title of Chief Compliance Officer and has served in that role since August 2021. He reports functionally to the Company's General Counsel, Priya Ramanathan, and has a dotted-line reporting relationship to the Audit Committee of the Board of Directors. Mr. Tanaka holds a Certified Anti-Money Laundering Specialist (CAMS) designation and has over fourteen years of experience in financial services compliance, including prior roles at Ostrander & Co. and Ridgeline Holdings We note that the dual reporting structure (to General Counsel rather than directly to the CEO) is common among fintech companies of Skybridge's size and stage, but certain regulators prefer a direct reporting line to the CEO or the Board. We recommend that the Company consider whether a direct reporting line to the CEO, Arjun Mehta, would strengthen the independence of the compliance function and better position the Company for potential CFPB supervisory engagement.
Customer Identification Program (CIP) and Know-Your-Customer (KYC) Procedures. The Company has implemented a CIP and KYC program applicable to all merchant onboarding. The program requires the collection and verification of identifying information for each merchant applicant, including legal name, employer identification number (EIN) or Social Security number (for sole proprietors), business address, date of formation, beneficial ownership information (for entities with 25% or greater ownership stakes), and the identity of control persons. Verification is conducted through a combination of documentary verification (government-issued identification, articles of incorporation, and business licenses) and non-documentary verification (cross-referencing information against third-party data sources, including Harborview Software and Crestline Data Systems). The Company also conducts enhanced due diligence ("EDD") on merchants operating in higher-risk industries, including gaming, nutraceuticals, travel, and digital goods.
Our review of the CIP/KYC procedures indicates that they are generally consistent with FinCEN guidance and industry best practices. However, we note that the Company's beneficial ownership identification threshold of 25% is set at the minimum required by the Customer Due Diligence ("CDD") rule (31 C.F.R. § 1010.230), and certain state regulators and bank partners have adopted a lower threshold of 10%. Given the evolving regulatory landscape—including the implementation of the Corporate Transparency Act ("CTA") beneficial ownership reporting requirements, which became effective January 1, 2024—the Company may wish to consider lowering its beneficial ownership identification threshold to 10% or aligning it with the CTA framework.
Transaction Monitoring. The Company utilizes Quillon Systems's ARIC platform for real-time transaction monitoring, supplemented by custom rule sets developed by the Company's compliance engineering team. The transaction monitoring system is designed to identify potentially suspicious activity, including unusual transaction patterns, rapid movement of funds, structuring, and transactions involving high-risk jurisdictions or counterparties. Alerts generated by the monitoring system are reviewed by a team of four (4) BSA analysts within the compliance department, who escalate cases for SAR filing as appropriate.
Our review of the transaction monitoring system's configuration and alert management processes revealed the following observations:
• The system generated approximately 12,400 alerts during the twelve-month period ending September 30, 2023, of which approximately 9,100 (73%) were dispositioned as false positives after initial review. While a false-positive rate in the range of 70-75% is not uncommon in the payments industry, the Company should evaluate whether recalibration of its monitoring rules could reduce the false-positive rate and improve the efficiency of the BSA analyst team.
• Of the remaining approximately 3,300 alerts escalated for further review, the Company filed approximately 287 SARs during the same period. This SAR filing rate of approximately 2.3% of total alerts and 8.7% of escalated alerts is within the range observed for similarly situated payments companies.
• The Company's SAR filing timeliness has been generally within the thirty (30) calendar day filing requirement, although the DFPI's June 2023 examination (discussed in Section VI.A below) identified three instances in which SAR filings were made between thirty-one (31) and forty-two (42) days after the initial detection of suspicious activity, which the DFPI characterized as a deficiency.
Independent Audit/Testing. The Company engages Severin Beck CPAs LLP to perform an independent audit and assessment of its BSA/AML compliance program on an annual basis. The most recent independent audit covered the twelve-month period ending June 30, 2023, and the audit report was issued on August 15, 2023. The audit concluded that the Company's BSA/AML program is "generally effective" in meeting the requirements of the BSA and applicable regulations, with certain recommendations for enhancement. Key recommendations from the most recent audit included: (i) recalibrating transaction monitoring thresholds to reduce false-positive rates; (ii) enhancing the documentation of SAR filing decisions, particularly with respect to narrative descriptions of suspicious activity; and (iii) increasing the frequency of BSA/AML training for the Company's merchant onboarding and customer success teams. The Company has represented that it has implemented or is in the process of implementing all recommendations from the audit. We recommend that the Company document its implementation efforts and maintain records of remedial actions taken for regulatory examination purposes.
Training Program. The Company conducts BSA/AML training for all employees upon hire and on an annual basis thereafter. Enhanced training modules are provided to the compliance team, the merchant onboarding team, and the customer success team. The most recent annual training was completed in October 2023. Training records were made available for our review and appear to be complete and current.
C. OFAC Compliance
The Company has implemented a sanctions compliance program that includes screening of all merchant applicants and counterparties against the OFAC SDN List, the Consolidated Sanctions List, and other applicable restricted party lists at the time of onboarding and on an ongoing basis. The Company utilizes Glenrock Solutions for sanctions screening, which is integrated into the payments orchestration platform to enable real-time screening of transaction counterparties.
The sanctions screening system is configured to screen the following data points: merchant legal name, trade name (if different), beneficial owners, authorized signatories, and, for consumer-facing transactions, consumer names and addresses (to the extent available from the merchant's payment data). The system generates alerts for potential matches, which are reviewed by the Company's compliance team and resolved through a manual review process.
During the twelve-month period ending September 30, 2023, the sanctions screening system generated approximately 1,850 alerts, of which approximately 1,820 (98.4%) were determined to be false positives upon review. No true positive matches were identified during this period. The Company has not identified any OFAC-related incidents, and no blocked transactions or voluntary self-disclosures have been filed with OFAC.
We found the Company's OFAC compliance program to be generally consistent with OFAC's Framework for OFAC Compliance Commitments (issued May 2019) and appropriate for the Company's risk profile. We recommend that the Company periodically review and test its screening system's algorithm sensitivity, particularly as the Company expands into additional international markets where sanctions risk may be elevated.
D. CFPB Considerations
We have analyzed whether Skybridge qualifies as a "larger participant" subject to CFPB supervisory authority under the CFPB's existing larger participant rules. The CFPB has promulgated larger participant rules for several markets, including international money transfers (12 C.F.R. Part 1090, Subpart B), consumer reporting, consumer debt collection, student loan servicing, automobile financing, and, most recently, general-use digital consumer payment applications (effective November 1, 2024, if not stayed by litigation). The Company's domestic payments processing activities do not fall squarely within any of the currently effective larger participant rule categories, and the Company's international payment volume, while growing, is principally B2B in nature (merchant settlement) rather than consumer remittance.
However, the CFPB's proposed larger participant rule for providers of general-use digital consumer payment applications (proposed in November 2023) could encompass certain of the Company's activities if the Company's platform is deemed to facilitate consumer payment transactions at a volume exceeding the proposed threshold of five million transactions per year. Given that the Company processes approximately 185 million annualized transactions (of which a substantial majority involve consumer payment data flowing through the Platform), this threshold would likely be met if the Company's activities are deemed to fall within the scope of the rule. We note that the proposed rule is subject to a public comment period and may be modified before finalization, and that industry groups have raised significant concerns about the breadth of the proposed definition.
The Company has confirmed that it has not received any CFPB inquiry, civil investigative demand, supervisory examination notice, or enforcement action from the CFPB as of the date of this memorandum. We recommend that the Company monitor the CFPB's rulemaking activities closely and prepare for potential supervisory engagement in calendar year 2024 or 2025.
V. State Money Transmission Licensing
A. Licensing Framework Overview
Money transmitter licensing is required in forty-nine (49) states and the District of Columbia for entities engaged in the business of money transmission, which is generally defined as receiving money or monetary value for the purpose of transmitting the same by any means, including electronic funds transfer, wire, or other method. Montana is the only state that does not currently have a money transmission licensing statute, although legislation has been introduced in the Montana legislature (HB 307, introduced January 2023) that would impose licensing requirements. The bill did not advance out of committee during the 2023 session but is expected to be reintroduced in the 2025 session.
For a company processing approximately $4.2 billion in GPV, as Skybridge does, the licensing requirements are substantial. Most state statutes impose minimum net worth requirements that scale with transaction volume, surety bond requirements that similarly increase with GPV, and ongoing compliance obligations including periodic call report filings through the NMLS, maintenance of permissible investments or custodial funds equal to outstanding transmission obligations, and submission to periodic regulatory examinations.
The following exemptions are potentially available to Skybridge in certain jurisdictions, and the Company relies on one or more of these exemptions in several states:
• Agent-of-Payee Exemption. Certain states exempt from money transmission licensing entities that receive funds as an agent of the payee (i.e., the merchant) pursuant to a written agreement, where the payment is deemed complete upon receipt by the agent. This exemption is available in some form in approximately twenty (20) states, although the scope and conditions of the exemption vary significantly. The Company has entered into agency agreements with its merchants that are designed to invoke the agent-of-payee exemption where available.
• Payment Processor Exemption. Some states exempt "payment processors" that facilitate payments on behalf of merchants through established banking relationships, provided that the processor does not hold funds in excess of a specified period or amount. The availability and scope of this exemption varies widely among states.
• Bank Partnership/Agent of Bank Exemption. In certain states, an entity acting as an agent of a licensed bank may be exempt from separate money transmission licensing. The Company's relationship with Keystone Federal Savings Bank and Pacific Commerce Bank, N.A. may provide a basis for claiming this exemption in jurisdictions where it is available.
The Company has engaged outside regulatory counsel at Caldwell & Associates, P.C. to perform state-by-state exemption analyses, which we have reviewed in connection with this memorandum. We have identified several jurisdictions where the Company's reliance on exemptions may be subject to challenge, as discussed in Sections V.B and V.D below.
B. State-by-State Licensing Status
Based on our review of the Company's license files, NMLS records, and representations from the Company's compliance team, the following is a summary of the Company's money transmission licensing status across all fifty (50) states, the District of Columbia, and applicable U.S. territories. A comprehensive table is attached as Appendix A. We address key jurisdictions in detail below.
Summary Statistics:
Application filed in Montana in anticipation of potential future legislation; Montana does not currently require a license. *Montana is counted in both "Applications Pending" and "No License Required" categories because the Company has filed a precautionary application in anticipation of possible future legislation, but no license is currently required.
Key Jurisdictions. Delaware. As the Company's state of incorporation and the location of its principal executive offices at 1400 Market Street, Suite 2200, Wilmington, DE 19801, Delaware is the Company's "home state" for regulatory purposes. The Company holds a Delaware Money Transmitter License issued by the Delaware Office of the State Bank Commissioner (the "Commissioner"). License Number: 034781. Date of Issuance: August 22, 2018. Current Status: Active. Expiration/Renewal: The Delaware license does not expire but is subject to ongoing compliance and annual renewal of the surety bond. Surety Bond: $2,000,000, issued by Harborview Assurance (Bond No. 107584692), current through August 2024. Net Worth Requirement: $500,000 minimum; the Company is in compliance with a reported net worth of approximately $24.3 million as of September 30, 2023. The Company has been subject to one routine examination by the Commissioner in 2021, which resulted in no material findings. No conditions, restrictions, or supervisory agreements are attached to the license.
New York. The Company holds a New York Money Transmitter License issued by the New York State Department of Financial Services ("NYDFS") under Article XIII-B of the New York Banking Law. License Number: MT-NYS-102954. Date of Issuance: December 3, 2019. Current Status: Active. The New York money transmitter license does not have a fixed expiration date but is subject to ongoing compliance, annual assessments, and periodic examination. Surety Bond: $5,000,000, issued by Calderon Indemnity Co. (Bond No. HFG-2019-07843), current through December 2024. Net Worth Requirement: The NYDFS imposes a risk-based net worth requirement; the Company has confirmed ongoing compliance based on its most recent financial statements. The Company has not applied for a separate BitLicense under 23 NYCRR Part 200, as the Company does not currently transmit or facilitate the transmission of virtual currency. However, as noted in the Executive Summary, the Company's product roadmap includes the potential integration of stablecoin settlement functionality, which would require a BitLicense or a limited purpose trust company charter. We strongly recommend that the Company engage with the NYDFS early in the product development process if stablecoin functionality is to be pursued, given the notoriously lengthy BitLicense application timeline (historically twelve to eighteen months or longer).
The NYDFS conducted a routine examination of the Company in March 2022. The examination report, issued in July 2022, contained no material findings but included two recommendations: (i) that the Company enhance its transaction monitoring documentation to include more detailed narrative descriptions of alert dispositions, and (ii) that the Company ensure timely updating of its NMLS record to reflect changes in its board composition. Both recommendations have been addressed by the Company.
California. The Company holds a California Money Transmitter License issued by the California Department of Financial Protection and Innovation (the "DFPI") under the California Money Transmission Act (Cal. Fin. Code § 2000 et seq.). License Number: MT-CA-602493. Date of Issuance: October 15, 2019. Current Status: Active. Expiration/Renewal: The California license does not have a fixed expiration date but requires annual assessment payments and ongoing compliance. Surety Bond: $7,000,000, issued by Calderon Assurance (Bond No. ZA-1005738), current through October 2024. Tangible Net Worth Requirement: $500,000 minimum, with additional capital requirements based on GPV; the Company is in compliance. The California license is one of the most operationally significant licenses held by the Company, given that California-based merchants account for approximately 22% of the Company's total GPV.
The DFPI conducted a routine examination of the Company in June 2023. The examination report, issued in September 2023, contained three findings that are discussed in detail in Section VI.A below. The findings relate to timeliness of SAR filings (three instances of filings made between thirty-one and forty-two days after initial detection) and deficiencies in the Company's consumer complaint handling procedures. The Company has submitted a corrective action plan to the DFPI, which was acknowledged by the DFPI on November 8, 2023. Formal closure of the examination findings remains pending.
Massachusetts. The Company holds a Massachusetts Foreign Transmittal Agency License issued by the Massachusetts Division of Banks under Mass. Gen. Laws ch. 169. License Number: FT-MA-073291. Date of Issuance: March 28, 2020. Current Status: Active. Expiration/Renewal: Annual renewal required; most recent renewal completed September 2023, effective through September 2024. Surety Bond: $1,000,000, issued by Granite Harbor Insurance (Bond No. LM-2020-13847), current through March 2024. Net Worth Requirement: $100,000 minimum; the Company is in compliance. Massachusetts is a jurisdiction of particular significance for the Bridge Financing because Ridgeline Ventures Fund IV, L.P., the lead investor committing $30,000,000 (50% of the round), is headquartered at 800 Boylston Street, Boston, MA 02199. While the location of an investor does not, by itself, create additional money transmission licensing requirements, it may be relevant in the context of change-of-control or passive investor reporting obligations discussed in Section XI below. No conditions, restrictions, or supervisory agreements are attached to the Massachusetts license. No examinations have been conducted by the Massachusetts Division of Banks within the past three years.
Illinois. The Company holds an Illinois Transmitters of Money Act License issued by the Illinois Department of Financial and Professional Regulation ("IDFPR") under the Transmitters of Money Act (205 ILCS 657). License Number: TM-IL-000489. Date of Issuance: January 14, 2020. Current Status: Active. Expiration/Renewal: Annual renewal; most recent renewal completed December 2023, effective through December 2024. Surety Bond: $2,000,000, issued by Harborview Assurance (Bond No. 107602155), current through January 2024 (renewal pending; see Section V.C). Net Worth Requirement: $100,000 minimum; the Company is in compliance. Illinois is relevant because Beacon Hill Growth Partners, LP is headquartered at 222 West Adams Street, Chicago, IL 60606. No conditions, restrictions, or supervisory agreements are attached to the Illinois license. The IDFPR conducted a routine examination in February 2022, which resulted in no material findings.
Washington. The Company holds a Washington Money Transmitter License issued by the Washington State Department of Financial Institutions ("DFI") under the Uniform Money Services Act (RCW 19.230). License Number: MT-WA-550192. Date of Issuance: June 7, 2020. Current Status: Active. Expiration/Renewal: Annual renewal; most recent renewal completed June 2023, effective through June 2024. Surety Bond: $1,500,000, issued by Calderon Indemnity Co. (Bond No. HFG-2020-12490), current through June 2024. Net Worth Requirement: Calculated based on a formula tied to outstanding transmission obligations; the Company is in compliance. Washington is relevant because Halcyon Capital Management LLC is headquartered at 1201 Third Avenue, Seattle, WA 98101. No conditions, restrictions, or supervisory agreements are attached to the Washington license. No examinations have been conducted by the Washington DFI within the past three years, though the Company anticipates a routine examination in 2024.
Texas. The Company holds a Texas Money Transmission License issued by the Texas Department of Banking under the Texas Finance Code, Chapter 151. License Number: MT-TX-3219874. Date of Issuance: November 1, 2019. Current Status: Active. Surety Bond: $3,000,000. The Company is in compliance with all Texas requirements. No examinations have been conducted within the past two years.
Florida. The Company holds a Florida Money Services Business License (Part III, Money Transmitter) issued by the Florida Office of Financial Regulation under Chapter 560, Florida Statutes. License Number: FT-FL-0027481. Date of Issuance: April 22, 2020. Current Status: Active. Surety Bond: $2,000,000. The Company is in compliance with all Florida requirements. The Florida Office of Financial Regulation conducted a routine examination in October 2022, which resulted in no material findings.
Georgia. The Company holds a Georgia Money Transmitter License issued by the Georgia Department of Banking and Finance under O.C.G.A. § 7-1-680 et seq. License Number: MT-GA-63018. Date of Issuance: February 10, 2021. Current Status: Active. Surety Bond: $250,000. The Company is in compliance with all Georgia requirements. No examinations have been conducted within the past three years.
Pennsylvania. The Company holds a Pennsylvania Money Transmitter License issued by the Pennsylvania Department of Banking and Securities under the Money Transmission Business Licensing Law (7 Pa.C.S. § 6101 et seq.). License Number: MT-PA-087652. Date of Issuance: September 30, 2020. Current Status: Active. Surety Bond: $1,000,000. The Company is in compliance with all Pennsylvania requirements. No conditions or restrictions are attached to the license.
Ohio. The Company holds an Ohio Money Transmitter License issued by the Ohio Department of Commerce, Division of Financial Institutions, under R.C. 1315. License Number: MT-OH-SM.501.782. Date of Issuance: August 14, 2020. Current Status: Active. Surety Bond: $1,000,000. The Company is in compliance with all Ohio requirements. No examinations have been conducted within the past three years.
Pending Applications. The Company has pending money transmitter license applications in the following four (4) jurisdictions:
1. Alabama. Application filed with the Alabama State Banking Department on April 17, 2023. Status: Pending review. The Company has been processing transactions involving Alabama-based merchants while the application is pending. Alabama does not provide a statutory safe harbor for applicants operating during the pendency of a license application, which creates regulatory risk. The Company's GPV attributable to Alabama-based merchants is approximately $38 million on an annualized basis. We recommend that the Company consider voluntarily suspending onboarding of new Alabama-based merchants until the license is obtained, or, alternatively, routing Alabama transactions through the Keystone Federal Savings Bank bank partnership arrangement to leverage the agent-of-bank exemption.
2. Maine. Application filed with the Maine Bureau of Consumer Credit Protection on June 5, 2023. Status: Pending review; a deficiency notice was received on September 12, 2023 requesting additional documentation regarding the Company's compliance program. The Company submitted the requested documentation on October 20, 2023 and awaits further communication from the Bureau. Maine GPV is approximately $12 million annualized.
3. North Dakota. Application filed with the North Dakota Department of Financial Institutions on August 29, 2023. Status: Pending review. North Dakota GPV is approximately $8 million annualized.
4. Montana. As noted above, Montana does not currently have a money transmission licensing statute. However, the Company filed a precautionary application in anticipation of potential future legislation. This application is not pending before any regulatory body and is maintained internally for readiness purposes.
C. Surety Bond and Net Worth Requirements
The Company is required to maintain surety bonds in each state in which it holds a money transmitter license. The aggregate face amount of all surety bonds currently maintained by the Company is approximately $47.5 million across all licensed jurisdictions. Surety bond amounts are generally determined by state statute or regulation and are typically based on the volume of money transmission activity conducted in the state, the Company's net worth, or a combination of both.
The Company's surety bonds are issued by four principal surety providers:
The Company's annual surety bond premium expense is approximately $712,000, based on the Company's current credit profile and premium rates. We note that the Company's GPV growth from approximately $2.8 billion (FY 2022) to approximately $4.2 billion (annualized Q3 2023) has triggered bond amount increases in several jurisdictions, including California (from $5,000,000 to $7,000,000), New York (from $3,000,000 to $5,000,000), and Texas (from $2,000,000 to $3,000,000). The Company has obtained increased bond amounts in all jurisdictions where increases were required, with the exception of the following:
• Illinois. The Company's surety bond with Kestrel Indemnity Co. is currently set at $2,000,000, which was the required amount based on FY 2022 GPV. The IDFPR has notified the Company that the bond amount must be increased to $3,000,000 based on 2023 GPV, effective upon the Company's next renewal in January 2024. The Company has confirmed that it is in the process of obtaining the increased bond from Kestrel Indemnity Co., and the updated bond certificate is expected to be delivered by January 5, 2024.
• Connecticut. The Company's surety bond with Strathmore Mutual Insurance is currently set at $1,000,000. The Connecticut Department of Banking has indicated that the bond amount must be increased to $1,500,000 based on 2023 activity. The updated bond certificate is pending.
• Arizona. The Company's surety bond with Ridgeline Specialty Insurance is due for renewal in January 2024. The updated bond amount will reflect 2023 GPV.
These pending bond increases and renewals are not anticipated to create material compliance issues, but we recommend that the Company ensure all updated bond certificates are obtained and filed with the applicable state regulators before the respective deadlines.
With respect to net worth requirements, the Company reported a net worth of approximately $24.3 million as of September 30, 2023. This amount exceeds the minimum net worth requirements in all states in which the Company holds a money transmitter license. The highest state-level net worth requirement applicable to the Company is California's tangible net worth requirement, which is currently $500,000 at the statutory minimum but may be increased by the DFPI based on the licensee's volume and risk profile. The Company's net worth comfortably exceeds all applicable requirements. Following the Bridge Financing, the Company's balance sheet will be enhanced by $60,000,000 in convertible note proceeds, although the treatment of subordinated convertible debt for net worth calculation purposes varies by state (discussed in Section XI.B below).
D. Exempt Activities and Bank Partnership Arrangements
The Company conducts a portion of its payments processing and embedded lending activities through bank partnership arrangements, which provide the basis for claiming exemptions from direct money transmission licensing in certain states.
Keystone Federal Savings Bank Partnership. The Company is party to a Master Services Agreement with Keystone Federal Savings Bank ("Keystone"), a state-chartered savings bank regulated by the FDIC and the Delaware Office of the State Bank Commissioner, dated April 12, 2021, as amended by Amendment No. 1 (dated March 15, 2022) and Amendment No. 2 (dated October 1, 2023). Under the Keystone MSA, the Company provides technology, platform, and operational services to facilitate payments processing conducted by Keystone as the "principal" in the money transmission chain. In states where the agent-of-bank exemption is available, the Company relies on its contractual relationship with Keystone to conduct payments processing without a separate money transmitter license. As of the date of this memorandum, the Company relies on the Keystone partnership for purposes of claiming the agent-of-bank exemption in two (2) states: Colorado and South Dakota. We note that the Company also holds direct money transmitter licenses in most states where Keystone operates, providing a dual-track compliance structure.
Pacific Commerce Bank, N.A. Partnership. The Company is party to a Program Agreement with Pacific Commerce Bank, N.A. ("Pacific Commerce"), a nationally chartered bank regulated by the OCC, dated November 3, 2022, pursuant to which Pacific Commerce serves as the lender of record for the Company's SkyCapital embedded lending product. Under this arrangement, Pacific Commerce originates the merchant cash advances, and the Company provides the technology platform, underwriting algorithms, and servicing functions. The Company relies on Pacific Commerce's status as a national bank to benefit from federal preemption of state lending licensing requirements. The Pacific Commerce Agreement includes compliance oversight provisions, audit rights, and risk management protocols that are consistent with OCC and FDIC guidance on bank-fintech partnerships.
Risk Assessment. The Company's reliance on bank partnership arrangements creates several categories of regulatory risk:
• Termination Risk. If either bank partnership were terminated—whether by the bank partner, the Company, or as a result of regulatory action against the bank—the Company would need to obtain direct licenses in the states where it currently relies on the exemption, or discontinue activities in those states. The Keystone MSA has a term of three (3) years with automatic annual renewals, subject to termination on ninety (90) days' notice by either party or immediately for cause. The Pacific Commerce Agreement has a term of two (2) years with a one-year renewal option, subject to termination on sixty (60) days' notice or immediately for cause.
• "True Lender" Risk. Several states and courts have adopted or are considering "true lender" doctrines that look beyond the formal structure of bank partnership lending programs to determine whether the non-bank partner (here, Skybridge) is the "true lender" based on factors such as which entity has the predominant economic interest in the loans, which entity controls the underwriting and pricing, and which entity markets the product. If Skybridge were deemed the "true lender," it would be subject to direct state licensing requirements for lending activities, and t

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE ATTORNEY WORK PRODUCT

MEMORANDUM

MATTER NO.: 1009-00001

Record

Parties

Dates

Amounts