1009-00001 · Skybridge Fintech Ltd · Diligence

supplemental-dd-request-list.docx DOCUMENT Funds

42 / 74 ← → ✕

Contract analysis Extract to table

SUPPLEMENTAL DUE DILIGENCE REQUEST LIST

Skybridge Fintech Ltd. $60,000,000 Convertible Note Bridge Financing

December 6, 2023

From:

Calderwood & Harkness LLP 600 Lexington Avenue New York, NY 10022

To:

Skybridge Fintech Ltd. 1400 Market Street, Suite 2200 Wilmington, DE 19801

Attention: Priya Ramanathan, General Counsel

Matter No.: 1009-00001

Prepared by:

Leonard Ashford, Of Counsel, Emerging Company & Venture Capital Practice Group

Nina Reyes, Senior Associate, Emerging Company & Venture Capital Practice Group

Peter Vassiliev, Lead Associate, intellectual Property Practice Group

Wendy Schultz, Working Associate, intellectual Property Practice Group

Right-click to update Table of Contents

I. Introduction and Purpose

This Supplemental Due Diligence Request List (this "Supplemental Request List") is delivered by Calderwood & Harkness LLP ("Calderwood & Harkness") to Skybridge Fintech Ltd. (the "Company" or "Skybridge") as a supplement to the initial Due Diligence Request List dated November 13, 2023 (the "Initial Request List"), which was previously delivered to the Company in connection with the proposed $60,000,000 convertible promissory note bridge financing (the "Transaction") led by Ridgeline Ventures Fund IV, L.P. ("Ridgeline" or the "Lead Investor").

This Supplemental Request List identifies additional items and categories of information that have arisen from the Calderwood & Harkness team's preliminary review and analysis of the materials produced by the Company in response to the Initial Request List. The requests set forth herein are intended to address areas where additional documentation, clarification, or supplemental information is required to complete the legal due diligence review and to facilitate preparation of the transaction documentation.

It is anticipated that initial drafts of the Note Purchase Agreement and related transaction documents will be circulated on or about December 11, 2023. Completion of the diligence review reflected in this Supplemental Request List is necessary in order to finalize the Company Disclosure Schedule, representations and warranties, and closing deliverables to be included in the definitive transaction documents. Accordingly, the Company is requested to treat the production of the materials described herein with appropriate urgency.

The Company is requested to provide all responsive materials via the Thackeray Solutions virtual data room previously established for this Transaction (the "VDR"), organized in accordance with the numbered request categories set forth below. Alternatively, materials may be delivered directly to Leonard Ashford or Nina Reyes at Calderwood & Harkness LLP, 600 Lexington Avenue, New York, NY 10022. The Company should contact Priya Ramanathan, General Counsel, or any member of the Calderwood & Harkness team identified below with any questions regarding the scope, interpretation, or applicability of any specific request contained herein.

All materials produced in response to this Supplemental Request List, together with all materials previously produced in response to the Initial Request List, remain subject to and protected by the attorney-client privilege, the work product doctrine, and any other applicable evidentiary privileges and protections. Production of materials pursuant to this Supplemental Request List shall not be deemed a waiver of any such privilege or protection.

II. General Instructions

The following general instructions apply to all requests set forth in this Supplemental Request List and should be read in conjunction with the general instructions contained in the Initial Request List:

1. Organization. All responsive materials should be organized by numbered request category, corresponding to the section and subsection numbers used in this Supplemental Request List (e.g., materials responsive to Request III.A should be uploaded to a VDR folder labeled "III.A — Money Transmission Licenses and Permits"). Where a single document is responsive to multiple requests, the document should be uploaded once and cross-referenced in each applicable folder.

2. Non-Existence or Inapplicability. If any requested item does not exist or is not applicable to the Company, the Company is requested to provide written confirmation to that effect, specifically identifying the request number and providing a brief explanation. A blanket statement of inapplicability will not be sufficient; each such determination should be made on a request-by-request basis.

3. Amendments and Restatements. Where any requested document has been amended, supplemented, restated, or otherwise modified since its original execution, the Company should provide all versions of such document, including the current effective version and all prior amendments, supplements, restatements, or modifications, in chronological order.

4. Status Updates. For any ongoing or pending matters (including, without limitation, pending regulatory applications, ongoing litigation, pending negotiations, and unresolved disputes), the Company should provide status updates reflecting the most current information available as of the most recent practicable date prior to production.

5. Cross-References to Initial Request List. Where a request in this Supplemental Request List supplements, updates, or expands upon a request contained in the Initial Request List, a cross-reference to the corresponding Initial Request List item number has been provided where practicable. In instances where additional materials are being requested to supplement a prior production, the Company should identify the new materials and distinguish them from materials previously produced.

6. Privilege Log. To the extent the Company withholds any responsive document or portion of a document on the basis of attorney-client privilege, work product protection, or any other applicable privilege, the Company should maintain a privilege log identifying each such document by date, author, recipient(s), subject matter, and the basis for the privilege assertion.

III. Regulatory and Licensing — Money Transmission

A. Money Transmission Licenses and Permits

1. A complete list of all states and jurisdictions (including the District of Columbia, U.S. territories, and any non-U.S. jurisdictions) in which Skybridge Fintech Ltd. currently holds a money transmitter license, money services business registration, or any equivalent permit, authorization, or approval. For each such license, registration, or permit, the list should include: (a) the name of the issuing regulatory authority; (b) the license, registration, or permit number; (c) the date of initial issuance; (d) the current expiration or renewal date; and (e) the status of the license (e.g., active, conditional, provisional, suspended, or pending renewal).

2. Copies of all currently effective money transmitter licenses, money services business registrations, or equivalent permits held by the Company in any jurisdiction, including any licenses that are conditional, provisional, or subject to special terms, conditions, or restrictions imposed by the issuing regulatory authority.

3. Copies of all license applications currently pending in any state or jurisdiction where the Company has applied for but not yet received a money transmitter license, money services business registration, or equivalent permit. For each pending application, the Company should provide: (a) a description of the current status of the application; (b) copies of all correspondence between the Company and the relevant state regulator relating to the application; (c) identification of any outstanding requests for information, supplemental filings, or deficiencies identified by the regulator; and (d) the Company's estimated timeline for receipt of a decision on the application.

B. FinCEN Registration

4. A copy of the Company's current Financial Crimes Enforcement Network ("FinCEN") Money Services Business ("MSB") registration confirmation, together with copies of any amendments, updates, or renewals filed since the initial registration.

5. To the extent not subject to applicable legal privilege or regulatory confidentiality restrictions, copies of any Suspicious Activity Reports ("SARs") filed by the Company with FinCEN during the three-year period preceding the date of this Supplemental Request List. In the event the Company determines that production of individual SARs is prohibited or inadvisable under applicable law or regulation, the Company should provide an aggregate summary indicating the total number of SARs filed during each calendar year (2021, 2022, and 2023 year-to-date) and a general description of the categories of suspicious activity reported.

6. Copies of any Currency Transaction Reports ("CTRs") filed by the Company with FinCEN during the three-year period preceding the date of this Supplemental Request List. If production of individual CTRs is impracticable due to volume, the Company should provide an aggregate summary indicating the total number of CTRs filed during each calendar year.

C. Regulatory Examinations and Inquiries

7. Copies of any examination reports, supervisory letters, deficiency notices, findings letters, matters requiring attention ("MRAs"), cease-and-desist orders, consent orders, civil money penalty assessments, or other regulatory correspondence, orders, or actions received from any state or federal financial regulator (including, without limitation, state banking departments, state departments of financial institutions, FinCEN, and the Consumer Financial Protection Bureau ("CFPB")) at any time during the three-year period preceding the date of this Supplemental Request List.

8. A summary description of any pending or threatened regulatory inquiries, investigations, or enforcement actions relating to the Company's money transmission, payments processing, or money services business activities. For each such matter, the summary should include: (a) the identity of the regulatory authority; (b) the nature and subject matter of the inquiry, investigation, or enforcement action; (c) the current status; and (d) any potential financial exposure or remedial obligations.

9. Copies of any remediation plans, corrective action plans, or compliance improvement programs developed, submitted, or undertaken by the Company in response to any regulatory examination findings, supervisory letters, deficiency notices, or other regulatory directives during the three-year period preceding the date of this Supplemental Request List, together with documentation reflecting the Company's completion or current status of implementation of each such plan.

D. Compliance Program Documentation

10. A summary description of the Company's anti-money laundering ("AML") and Bank Secrecy Act ("BSA") compliance program, including a description of the program's key components (e.g., written policies and procedures, internal controls, customer identification and due diligence procedures, transaction monitoring, suspicious activity reporting, employee training, and independent testing). To the extent available, the Company should provide copies of the program's governing policy documents.

11. Identification of the Company's designated BSA/AML compliance officer, including the individual's name, title, reporting structure, qualifications, and the date of appointment to the role.

12. A copy of the most recent independent AML/BSA audit or assessment report prepared by an external firm, including the date of the audit, the scope of the assessment, and the identity of the firm that conducted it. If any findings, recommendations, or deficiencies were identified in the report, the Company should also provide documentation reflecting the Company's response or remediation efforts.

E. Surety Bonds and Financial Security

13. Copies of all surety bonds, letters of credit, certificates of deposit, or other financial security instruments posted or maintained by the Company in connection with its money transmitter licenses or money services business registrations in any jurisdiction. For each such instrument, the Company should provide: (a) the name of the issuing surety company or financial institution; (b) the principal amount or face value of the bond or instrument; (c) the effective date and expiration date; (d) the jurisdiction and license to which the instrument relates; and (e) any applicable terms or conditions, including renewal provisions and claim provisions.

IV. Intellectual Property — Open-Source Software

A. Open-Source Software Inventory

14. A complete inventory or software bill of materials ("SBOM") listing all open-source software components that are incorporated into, linked with, bundled with, distributed with, or otherwise used in connection with the Company's payments orchestration platform and embedded lending platform (collectively, the "Company Products"). For each open-source component identified, the inventory should include the following information:

(a) The name of the open-source component or library;

(b) The version number currently in use;

(c) The applicable open-source license or licenses under which the component is distributed (e.g., MIT License, Apache License 2.0, GNU General Public License v2 ("GPL v2"), GNU General Public License v3 ("GPL v3"), GNU Lesser General Public License ("LGPL"), GNU Affero General Public License v3 ("AGPL v3"), BSD 2-Clause License, BSD 3-Clause License, Mozilla Public License 2.0 ("MPL 2.0"), or any other license);

(d) The manner of use or integration (e.g., statically linked, dynamically linked, modified and incorporated, used as a standalone service, included in distributed or deployed code, accessed via API, used solely in development or build tooling);

(e) Whether any modifications, enhancements, or derivative works have been created by the Company based on the open-source component, and if so, a brief description of the nature and extent of such modifications;

(f) Whether the component is incorporated into customer-facing products or services, or is used solely in connection with internal tools, development environments, testing frameworks, or build infrastructure.

B. Copyleft and Reciprocal License Exposure

15. Identification of any open-source components included in the inventory described in Request 14 above that are subject to "copyleft" or reciprocal licensing obligations, including without limitation components licensed under GPL v2, GPL v3, AGPL v3, LGPL (any version), or MPL 2.0. For each such component, the Company should provide:

(a) A description of how the copyleft-licensed component interacts with the Company's proprietary source code, including whether the component and proprietary code are compiled together, linked (statically or dynamically), communicate via inter-process communication, or are otherwise combined in a manner that could implicate the copyleft license's scope;

(b) An assessment or analysis of whether the applicable copyleft obligations have been triggered or could reasonably be triggered under the circumstances of the Company's use (e.g., by distribution of compiled binaries, provision of access to the software over a network in the case of AGPL v3, linking with proprietary libraries, or modification and redistribution);

(c) A description of any technical, architectural, or organizational steps taken by the Company to isolate copyleft-licensed components from proprietary code, including without limitation the use of separate processes, microservices architectures, API boundaries, or container-based isolation.

C. Open-Source Compliance Policies and Procedures

16. Copies of any internal policies, procedures, guidelines, or governance frameworks adopted by the Company governing the selection, evaluation, approval, use, integration, and tracking of open-source software within the Company's products, services, and internal systems. This request includes any policies that establish approved or prohibited license categories, required review or approval workflows, or documentation requirements for open-source adoption.

17. A description of any automated scanning tools, software composition analysis ("SCA") tools, or other technical systems used by the Company to detect, identify, catalog, and monitor open-source software usage across its codebase and deployed environments. For each such tool or system, the Company should provide: (a) the name of the tool or vendor (e.g., Larkspur Data Systems, Crestline Health IT, Glenrock Systems, Crowne Albany Solutions, Strathmore Services Inc.); (b) the frequency of scans (e.g., continuous integration, weekly, quarterly); (c) the scope of coverage (e.g., all repositories, production code only, specific products); and (d) a description of the remediation or escalation workflow triggered when a license compliance issue or vulnerability is detected.

D. Open-Source Contributions

18. A description of any contributions of the Company's proprietary source code, documentation, or other materials to any open-source projects, communities, or foundations, whether initiated by the Company or by individual employees or contractors acting within the scope of their engagement. For each such contribution, the Company should identify: (a) the open-source project to which the contribution was made; (b) the nature and scope of the contribution; (c) the open-source license under which the contribution was made or released; and (d) whether the Company received any intellectual property assignment or license-back rights in connection with the contribution.

V. Data Privacy and Customer Contracts

A. Customer Data Processing Agreements

19. Copies of the Company's current standard form data processing agreement ("DPA") or data processing addendum, including any standard attachments, exhibits, or schedules (e.g., descriptions of processing activities, technical and organizational security measures, subprocessor lists, and standard contractual clauses).

20. A list of all customers with which Skybridge has entered into non-standard, negotiated, or materially modified data processing agreements or data processing addenda that deviate from the Company's standard form. For each such customer, the Company should provide: (a) the identity of the customer; (b) a brief description of the material deviations from the standard form; and (c) a complete copy of the executed, non-standard DPA.

21. Identification of any customers who have requested a data processing agreement or data processing addendum from the Company but have not yet received an executed agreement, or where DPA negotiations are currently pending. For each such customer, the Company should indicate the current status of negotiations and any anticipated timeline for execution.

B. Privacy Policies and Notices

22. Copies of all current versions of the Company's customer-facing privacy policies and privacy notices, including any product-specific, service-specific, or jurisdiction-specific privacy notices (e.g., California Consumer Privacy Act notices, GDPR-specific notices, or notices applicable to particular Company Products).

23. A history of all material amendments, updates, or revisions to the Company's privacy policies during the two-year period preceding the date of this Supplemental Request List, together with copies of each prior version of the privacy policy in effect during that period. For each material amendment, the Company should provide a brief description of the nature of the change and the effective date.

C. Data Protection Impact Assessments

24. Copies of any data protection impact assessments ("DPIAs") or privacy impact assessments ("PIAs") conducted by or on behalf of the Company in connection with the payments orchestration platform or the embedded lending platform during the two-year period preceding the date of this Supplemental Request List. This request includes any DPIAs or PIAs conducted in connection with the introduction of new product features, the processing of new categories of personal data, or the adoption of new data processing technologies (including any assessments conducted in connection with the use of automated decision-making or machine learning models).

D. Cross-Border Data Transfers

25. A description of any cross-border transfers of personal data conducted by or on behalf of the Company, including without limitation transfers of personal data to or from the European Union/European Economic Area ("EU/EEA"), the United Kingdom ("UK"), Canada, or any other jurisdiction that imposes data localization requirements or restrictions on the international transfer of personal data. For each category of cross-border transfer, the description should identify: (a) the originating jurisdiction; (b) the receiving jurisdiction; (c) the categories of personal data transferred; (d) the purpose of the transfer; and (e) the legal basis or data transfer mechanism relied upon.

26. Copies of any Standard Contractual Clauses ("SCCs") adopted pursuant to Commission Implementing Decision (EU) 2021/914, Binding Corporate Rules ("BCRs"), transfer impact assessments, or other data transfer mechanisms executed, implemented, or relied upon by the Company in connection with cross-border transfers of personal data.

27. Identification of any data hosting, data processing, or data storage that occurs outside the United States, including: (a) the geographic location of each data center or server facility; (b) the identity of each hosting, infrastructure, or cloud services provider (e.g., Ridgeway Industries, Crestline Systems, Aldermere Technologies); (c) the categories of data hosted or processed at each location; and (d) any contractual or regulatory restrictions applicable to the data stored at each location.

E. Data Breach History

28. A summary of any data security incidents, unauthorized access events, data breaches, or other security events occurring during the three-year period preceding the date of this Supplemental Request List that involved or potentially involved the unauthorized access, acquisition, disclosure, or loss of personal data, customer data, or other confidential information. For each such incident, the summary should include: (a) the date of the incident and the date of discovery; (b) the nature and cause of the incident; (c) the scope and categories of data affected; (d) the number of individuals affected; (e) a description of the notification actions taken (including notifications to affected individuals, regulatory authorities, and law enforcement); and (f) a description of any resulting regulatory inquiry, litigation, claims, settlements, or financial liability.

29. Copies of any breach notification letters, notices, or communications sent by the Company to affected individuals, state attorneys general, data protection authorities, or law enforcement agencies in connection with any data security incident occurring during the period described above.

F. Data Security Standards and Certifications

30. A description of the Company's information security program, including an overview of the technical, administrative, and physical security controls implemented to protect personal data, customer data, and other sensitive information. The description should identify any applicable industry standards, certifications, or frameworks to which the Company adheres, including without limitation SOC 2 Type II, PCI-DSS (Payment Card Industry Data Security Standard), ISO/IEC 27001, and NIST Cybersecurity Framework.

31. Copies of the most recent SOC 2 Type II report issued to the Company, including any management assertions, system descriptions, and complementary user entity controls. If the Company has obtained PCI-DSS certification, copies of the most recent Report on Compliance ("ROC") or Self-Assessment Questionnaire ("SAQ"), as applicable.

32. The date and scope of the most recent third-party penetration test or security audit conducted on the Company's systems, networks, and applications, together with the identity of the firm that conducted the assessment. To the extent not subject to applicable privilege, a summary of any critical or high-severity findings identified during the assessment and the Company's remediation status with respect to such findings.

VI. Existing Indebtedness — Kelvantis Lending Corp. Venture Debt Facility

A. Complete Loan Documentation

33. A complete copy of the Loan and Security Agreement, dated August 15, 2022, by and between Kelvantis Lending Corp. ("Kelvantis") and Skybridge Fintech Ltd. (the "Kelvantis LSA"), together with all exhibits, schedules, annexes, side letters, and attachments thereto.

34. Copies of all amendments, supplements, modifications, waivers, consents, forbearance agreements, or other written instruments that amend, supplement, modify, or otherwise relate to the Kelvantis LSA, executed or delivered at any time since August 15, 2022.

35. Copies of all promissory notes, warrants, warrant agreements, or other instruments or securities issued by the Company to Kelvantis or any of its affiliates in connection with the Kelvantis venture debt facility.

36. Copies of all UCC-1 financing statements, UCC-3 amendments, UCC-3 continuation statements, and any other lien filings made by or on behalf of Kelvantis Lending Corp. (or any agent, successor, or assignee thereof) in connection with the Kelvantis facility, in any jurisdiction.

B. Current Outstanding Balance and Payment Status

37. A statement of the current outstanding principal balance, accrued and unpaid interest, and any other amounts outstanding under the Kelvantis facility as of the most recent practicable date. The original facility amount is understood to be $15,000,000, and the Company is requested to confirm or correct this understanding.

38. A schedule of all principal and interest payments made by the Company to Kelvantis under the facility from the date of origination through the most recent payment date, including the date of each payment, the amount of each payment, and the allocation between principal, interest, and fees.

39. Confirmation of the stated maturity date of the Kelvantis facility. Based on the Company's prior productions, the maturity date is understood to be August 15, 2025; the Company is requested to confirm or correct this understanding, and to identify any provisions that could accelerate the maturity date or otherwise modify the scheduled repayment terms.

40. Identification of any amounts held in restricted accounts, reserve accounts, escrow accounts, or other segregated accounts in connection with the Kelvantis facility, together with the current balance of each such account, the purpose of the restriction, and the conditions under which the restricted funds may be released.

C. Covenant Compliance

41. A complete list of all financial covenants and material operating covenants contained in the Kelvantis LSA, including without limitation any minimum cash covenants, minimum revenue covenants, maximum leverage ratio covenants, minimum liquidity covenants, and any negative covenants restricting the Company's business activities or financial operations.

42. A copy of the most recent compliance certificate delivered by the Company to Kelvantis pursuant to the Kelvantis LSA, together with the supporting calculations and certifications demonstrating the Company's compliance with each financial covenant as of the applicable measurement date.

43. Identification of any covenant violations, defaults, events of default (whether payment defaults, financial covenant defaults, or other defaults), or potential defaults that have occurred at any time during the term of the Kelvantis facility, including any such defaults that were subsequently cured, waived, or subject to forbearance arrangements. For each such event, the Company should provide: (a) a description of the covenant or provision breached; (b) the date of the breach; (c) the nature and circumstances of the breach; and (d) a description of the cure, waiver, or other resolution.

44. Identification and copies of any provisions in the Kelvantis LSA (including any side letters, amendments, or other related agreements) that restrict, condition, or require the prior written consent of Kelvantis for any of the following actions by the Company:

(i) the incurrence of additional indebtedness (including the issuance of convertible promissory notes);

(ii) the issuance of convertible securities, options, warrants, or other equity-linked instruments;

(iii) the granting of liens, security interests, pledges, or encumbrances on the Company's assets;

(iv) the payment of dividends, distributions, or other returns of capital to stockholders;

(v) mergers, consolidations, acquisitions, dispositions, or changes of control;

(vi) the creation or dissolution of subsidiaries; or

(vii) any other material corporate actions or transactions.

D. Intercreditor and Subordination Provisions

45. Copies of any existing intercreditor agreements, subordination agreements, standstill agreements, or similar arrangements to which Kelvantis Lending Corp. is a party, including any agreements governing the relative priority of claims, payment waterfalls, or enforcement rights among multiple creditors of the Company.

46. Identification of the specific provisions of the Kelvantis LSA (including any definitions of "Permitted Indebtedness," "Subordinated Debt," or equivalent terms) that establish the terms and conditions upon which additional indebtedness may be incurred on a subordinated basis, and any limitations or requirements imposed on the form, terms, or conditions of any such subordinated indebtedness.

47. Copies of any correspondence, term sheets, draft agreements, or other communications between the Company (or its counsel) and Kelvantis Lending Corp. (or its counsel) regarding the proposed convertible note financing, the proposed terms of subordination, or any request for lender consent or waiver in connection with the Transaction. This request supplements materials already produced and specifically includes, but is not limited to, any responses or correspondence relating to the Calderwood & Harkness letter to Theodore "Ted" Marsh, counsel to Kelvantis, dated December 15, 2023, requesting lender consent under the Kelvantis LSA.

E. Warrants.

48. Copies of any warrants or warrant agreements issued to Kelvantis Lending Corp. or any of its affiliates in connection with the venture debt facility. For each such warrant, the Company should provide or confirm: (a) the exercise price per share; (b) the number of shares underlying the warrant; (c) the class and series of equity subject to the warrant; (d) the expiration date; (e) any anti-dilution, adjustment, or ratchet provisions; and (f) any transfer or assignability restrictions.

49. Confirmation of whether any warrants issued to Kelvantis have been exercised, in whole or in part, and if so, the date of exercise, the number of shares issued, and the aggregate exercise price paid.

VII. Capitalization — Supplemental Items

A. Updated Capitalization Table

50. A fully diluted capitalization table as of the most recent practicable date, reflecting all outstanding shares of common stock, all outstanding shares of preferred stock (Series A, Series B, and Series C), all outstanding stock options (whether vested or unvested), all outstanding warrants (including any warrants issued to Kelvantis Lending Corp.), all outstanding restricted stock units ("RSUs"), and any other convertible securities, convertible notes, SAFEs, or contractual rights to acquire equity in the Company. The capitalization table should set forth, for each class and series of securities, the number of shares or units outstanding on both an outstanding basis and a fully diluted, as-converted basis.

51. A reconciliation of the fully diluted share count to the approximately 48,500,000 fully diluted shares previously reported by the Company in its initial diligence response. To the extent the current fully diluted share count differs from the previously reported figure, the Company should identify the sources of any variance (e.g., new option grants, warrant exercises, share repurchases, or corrections to prior calculations).

52. A list of all holders of one percent (1%) or more of the Company's outstanding equity securities, on a fully diluted, as-converted basis, identifying for each such holder: (a) the holder's name; (b) the class and series of securities held; (c) the number of shares or units held; and (d) the holder's percentage ownership on a fully diluted basis.

B. 409A Valuation

53. A complete copy of the most recent independent fair market value determination (commonly referred to as a "409A valuation") prepared by Atlas Valuation Services, Inc., dated September 15, 2023. This request includes all supporting schedules, exhibits, assumptions, methodologies, discount analyses, and back-up calculations. Based on prior representations by the Company, the fair market value of common stock was determined to be $8.42 per share in this report; the Company is requested to confirm this figure.

54. Copies of any prior independent 409A valuations prepared during the three-year period preceding the date of this Supplemental Request List, including all supporting schedules and assumptions.

C. Stock Option Plan and Outstanding Grants

55. An updated schedule of all outstanding stock option grants as of the most recent practicable date, including for each grant: (a) the name of the optionee; (b) the date of grant; (c) the exercise price per share; (d) the total number of shares subject to the option; (e) the vesting commencement date and vesting schedule (including any acceleration provisions); (f) the number of shares vested and the number of shares unvested as of the date of the schedule; (g) the expiration date; and (h) whether the option is an incentive stock option ("ISO") or a non-qualified stock option ("NSO").

56. A complete copy of the Company's equity incentive plan document(s), including all amendments, restatements, and board or stockholder resolutions approving the plan or any increases to the share reserve. Copies of the Company's standard form of stock option agreement and any standard form of restricted stock unit agreement.

57. A statement of the remaining number of authorized shares available for issuance under the equity incentive plan (the "share pool"), together with identification of any board or stockholder authorizations to increase the share pool.

D. Preemptive Rights and Rights of First Refusal

58. Identification of any preemptive rights, rights of first refusal, pro rata participation rights, anti-dilution rights, co-sale or tag-along rights, or similar contractual or statutory rights held by any existing stockholders of the Company, including without limitation Crestpoint Seed Partners, Halcyon Growth Equity, Ridgeline Ventures Fund III, L.P., and Beacon Hill Capital Partners, that may be triggered by the issuance of the convertible promissory notes or any conversion thereof into equity securities. For each such right, the Company should identify: (a) the holder(s); (b) the instrument or agreement in which the right is set forth; (c) the triggering event(s); (d) the scope of the right (including any exceptions, carve-outs, or thresholds); and (e) any applicable notice or exercise periods.

59. Copies of any waivers, consents, or amendments obtained or requested from any such holders in connection with the Transaction, together with any correspondence relating thereto.

VIII. Material Contracts — Supplemental Items

A. Revenue Concentration and Key Customer Agreements

60. A list of the Company's top twenty (20) customers by revenue for the twelve-month period ended September 30, 2023, together with the aggregate revenue attributable to each such customer during that period. The list should include both the dollar amount and the percentage of the Company's total revenue represented by each customer during the measurement period.

61. Copies of the master services agreements, subscription agreements, order forms, terms of service, or other definitive agreements applicable to any customer that represented five percent (5%) or more of the Company's annualized recurring revenue during the twelve-month period ended September 30, 2023. Based on previously reported annualized recurring revenue of approximately $78,000,000, the five percent (5%) threshold corresponds to approximately $3,900,000 in annualized recurring revenue.

62. Identification of any customer contracts or agreements that contain: (a) change-of-control provisions that could be triggered by the convertible note financing or a future Series D equity round; (b) assignment restrictions or requirements for customer consent to assignment; (c) termination for convenience provisions with notice periods of ninety (90) days or less; (d) most-favored-nation pricing provisions; or (e) any other provisions that could be triggered by or material to the Transaction or a subsequent equity financing.

B. Key Vendor and Technology Agreements

63. Copies of any agreements with payment processors, acquiring banks, issuing banks, payment networks (e.g., Visa, Hollowell Partners LLC, Nacha), card brand sponsors, payment facilitators, or other financial infrastructure providers that are material to the operation of the Company's payments orchestration platform. For purposes of this request, an agreement is "material" if the services provided thereunder are necessary for the continued operation of the platform or if the annual expenditure under the agreement exceeds $500,000.

64. Copies of any agreements with cloud hosting providers, infrastructure-as-a-service providers, platform-as-a-service providers, or data center operators (e.g., Ridgeway Industries, Crestline Systems, Aldermere Technologies) that are material to the Company's operations, including the applicable service level agreements, terms of service, and any enterprise-level commercial agreements or committed-use discount agreements.

C. Partnership and Channel Agreements

65. Copies of any strategic partnership agreements, reseller agreements, referral agreements, integration agreements, distribution agreements, or other channel arrangements entered into by the Company since the date on which the Initial Request List was delivered (November 13, 2023), or that were in existence but not previously produced.

D. Contracts with Related Parties

66. An updated list of any contracts, agreements, arrangements, or transactions (whether written or oral) between the Company and any of its directors, officers, stockholders holding five percent (5%) or more of the Company's outstanding equity securities, employees with annual compensation exceeding $250,000, or any affiliates, family members, or related entities of the foregoing. For each such contract, agreement, or arrangement, the Company should provide: (a) the identity of the related party; (b) the nature of the relationship; (c) a description of the terms and conditions; and (d) copies of any written agreements.

IX. Litigation and Disputes — Supplemental Items

A. Updates on Pending Matters

67. Updated status reports for any pending or threatened litigation, arbitration, mediation, or regulatory proceedings previously identified by the Company in its response to the Initial Request List. For each such matter, the Company should provide: (a) a description of any material developments since the date of the initial production; (b) copies of any new pleadings, motions, orders, or dispositive rulings entered since November 13, 2023; (c) any updated assessment of the probable outcome or potential financial exposure; and (d) any settlement discussions, demands, or offers.

68. Copies of any demand letters, cease-and-desist letters, pre-litigation correspondence, subpoenas, civil investigative demands, or other pre-litigation or investigative communications received by the Company from any party since November 13, 2023.

B. IP-Related Claims

69. Identification of any claims, demands, threats, assertions, or allegations by any third party that any of the Company's products, services, technologies, or business methods infringe, misappropriate, or otherwise violate any patent, trademark, copyright, trade secret, or other intellectual property right of such third party. For each such claim or assertion, the Company should provide: (a) the identity of the claimant; (b) the intellectual property right(s) at issue; (c) the date of the claim or assertion; (d) copies of any related correspondence or filings; and (e) the current status and the Company's response.

70. Identification of any claims, demands, or actions initiated by the Company against any third party for infringement, misappropriation, or other violation of the Company's intellectual property rights, together with copies of any related correspondence, filings, or orders.

X. Insurance — Supplemental Items

A. Cyber and Technology E&O Insurance

71. Copies of the complete policy forms (including the full policy language, endorsements, exclusions, and conditions — not solely the declarations pages) for the Company's current cyber liability insurance and technology errors and omissions ("E&O") insurance policies.

72. Identification of any claims made, incidents reported, or notices given under the Company's cyber liability or technology E&O insurance policies during the three-year period preceding the date of this Supplemental Request List, together with the current status of each such claim, a description of the underlying event, and the amount of any payments or reserves.

B. Key Person Insurance

73. Confirmation of whether the Company currently maintains key person life insurance policies on Arjun Mehta, Chief Executive Officer, and/or Elena Vasquez, Chief Technology Officer. If such policies are maintained, the Company should provide copies of each policy, including: (a) the name of the insurer; (b) the face amount or coverage limit; (c) the premium amount and payment schedule; (d) the beneficiary designation; and (e) the policy term and any renewal provisions.

XI. Employee and Benefits — Supplemental Items

A. Independent Contractor Classification

74. A list of all current independent contractors, consultants, staffing agency personnel, and other non-employee workers engaged by the Company, together with: (a) a description of the services performed by each individual; (b) the compensation arrangement (e.g., hourly rate, fixed fee, retainer); (c) the duration of the engagement; (d) whether the individual has executed a proprietary information and inventions assignment agreement ("PIIA") or equivalent agreement in favor of the Company; and (e) the individual's geographic location.

75. A description of the Company's methodology, criteria, and procedures for classifying workers as employees versus independent contractors, including any legal analyses, written policies, or third-party assessments conducted in connection with such classifications.

B. Foreign Employees

76. Identification of all employees, independent contractors, consultants, or other workers engaged by the Company who are located outside the United States. For each such individual, the Company should provide: (a) the jurisdiction in which the individual is located; (b) the nature of the engagement (employee, contractor, or other); (c) whether the individual is engaged directly by the Company or through an employer-of-record, professional employer organization, or other intermediary arrangement; and (d) a summary of any applicable employment law, data privacy law, tax, or social security considerations that may affect the Company's obligations.

C. Employment Disputes

77. A summary of any pending or threatened employment-related disputes, claims, grievances, arbitration proceedings, or charges filed with any governmental agency (including without limitation the Equal Employment Opportunity Commission, state fair employment agencies, state labor boards or departments, the Department of Labor, and OSHA) during the two-year period preceding the date of this Supplemental Request List. For each such matter, the summary should include: (a) the identity of the claimant; (b) the nature of the claim; (c) the governmental agency or forum; (d) the current status; and (e) any potential financial exposure.

XII. Financial Statements — Supplemental Items

A. Management Financials

78. Unaudited monthly financial statements for October 2023 and November 2023, including: (a) an income statement (statement of operations); (b) a balance sheet (statement of financial position); and (c) a statement of cash flows for each such month. These financial statements should be prepared on a basis consistent with the Company's prior interim financial statements and should include a comparison to budget and to the prior year period, to the extent such comparisons are regularly prepared by the Company.

79. The Company's updated cash position as of the most recent available date, including the aggregate amount of unrestricted cash and cash equivalents on hand. Based on information previously reported by the Company, the cash on hand was approximately $18,500,000 and the monthly cash burn rate was approximately $4,800,000 as of the date of the Initial Request List. The Company is requested to confirm or update these figures.

B. Audit Matters

80. Copies of any management letters, internal control deficiency communications, or other written communications from Pinnacle Audit Group LLP (engagement partner: Lisa Johannsen) to the Company's management or audit committee issued in connection with: (a) the audit of the Company's financial statements for the fiscal year ended December 31, 2022; and/or (b) the review of the Company's interim financial statements for the period ended September 30, 2023.

81. Identification of any material weaknesses or significant deficiencies in internal controls over financial reporting identified by the Company's independent auditors, management, or audit committee at any time during the two fiscal years preceding the date of this Supplemental Request List, together with a description of the nature of each such weakness or deficiency and the Company's remediation efforts and current status.

C. Tax Matters

82. Copies of the Company's federal income tax returns (Form 1120 or applicable form) for the fiscal years ended December 31, 2021 and December 31, 2022, together with all schedules, exhibits, and attachments thereto.

83. Copies of the Company's state income or franchise tax returns for Delaware and all other states in which the Company files income or franchise tax returns for the fiscal years ended December 31, 2021 and December 31, 2022.

84. Identification of any pending or threatened tax audits, examinations, assessments, proposed adjustments, or disputes with any federal, state, local, or foreign taxing authority, together with copies of any related notices, correspondence, or filings.

85. A schedule of the Company's net operating loss ("NOL") carryforwards as of December 31, 2022 (and updated to the most recent practicable date, if available), including the amount of federal and state NOLs, the year of origin, and any applicable expiration dates or Section 382 limitations. The schedule should also include a summary of any research and development tax credits (federal and state) generated and available for utilization.

86. Confirmation of the Company's Employer Identification Number ("EIN"), which is understood to be 83-2147605 based on prior productions. The Company is also requested to confirm the current status of its Delaware franchise tax filings and payments, including confirmation that all franchise tax obligations are current and that no delinquent amounts are outstanding.

XIII. Subsidiary and Affiliate Matters

87. A complete list of all subsidiaries, affiliates, joint ventures, and other related entities of Skybridge Fintech Ltd., including for each such entity: (a) the legal name; (b) the jurisdiction of organization or incorporation; (c) the date of organization or incorporation; (d) the Company's direct or indirect ownership percentage; (e) a brief description of the entity's principal activities; and (f) the entity's current operational status (e.g., active, dormant, in the process of dissolution).

88. An organizational chart depicting the Company's complete corporate structure, including all direct and indirect subsidiaries, minority-owned affiliates, and other related entities, together with the ownership percentages and any intercompany management, licensing, services, or funding arrangements.

89. Identification of any subsidiary, affiliate, or related entity that holds or is the registered owner of: (a) any money transmitter license, money services business registration, or other financial regulatory license or permit; (b) any patents, trademarks, copyrights, domain names, or other intellectual property assets; (c) any material contracts, customer agreements, or vendor agreements; or (d) any other material assets, liabilities, or obligations. For each such subsidiary or affiliate identified, the Company should describe the assets held and the basis for maintaining such assets at the subsidiary or affiliate level rather than at the parent company level.

XIV. Timing and Contact Information

The Company is requested to provide the materials described in this Supplemental Request List as promptly as practicable, and in any event no later than December 20, 2023, in order to permit completion of the due diligence review in advance of the targeted signing and closing of the Transaction. The Company is reminded that timely production is critical to the preparation and finalization of the Company Disclosure Schedule, the closing deliverables, and the representations and warranties to be included in the Note Purchase Agreement.

The primary contacts at Calderwood & Harkness LLP for purposes of this Supplemental Request List are as follows:

Leonard Ashford Of Counsel, Emerging Company & Venture Capital Practice Group Calderwood & Harkness LLP 600 Lexington Avenue New York, NY 10022 General diligence coordinator; primary contact for all requests

Nina Reyes Senior Associate, Emerging Company & Venture Capital Practice Group Calderwood & Harkness LLP 600 Lexington Avenue New York, NY 10022 General diligence coordinator; primary contact for all requests

Peter Vassiliev Lead Associate, intellectual Property Practice Group Calderwood & Harkness LLP 600 Lexington Avenue New York, NY 10022 Primary contact for Section IV requests (open-source software and intellectual property) and Section IX.B requests (IP-related claims)

Wendy Schultz Working Associate, intellectual Property Practice Group Calderwood & Harkness LLP 600 Lexington Avenue New York, NY 10022 Contact for Section IV and Section IX.B requests

The primary contact at the Company is:

Priya Ramanathan General Counsel Skybridge Fintech Ltd. 1400 Market Street, Suite 2200 Wilmington, DE 19801

The Company should also coordinate with Marcus Tillman, Vice President, Corporate Development, and David Lindstrom, Chief Financial Officer, as needed to compile, assemble, and verify the requested financial, business, and operational information responsive to the requests contained herein.

XV. Reservation of Rights

Calderwood & Harkness LLP reserves the right to request additional documents, information, data, materials, and access to personnel as the due diligence review progresses and as the Calderwood & Harkness team's understanding of the Company's business, operations, liabilities, and risks develops. This Supplemental Request List is not intended to be, and should not be construed as, an exhaustive or final enumeration of all information or materials that may be required to complete the due diligence review or to prepare the transaction documentation.

The delivery of information and materials by the Company in response to this Supplemental Request List or the Initial Request List shall not limit, qualify, or otherwise affect any representations, warranties, covenants, indemnification obligations, or other provisions to be contained in the Note Purchase Agreement, the convertible promissory notes, the Subordination Agreement, or any other definitive transaction documents executed and delivered in connection with the Transaction. The scope of the Company's representations and warranties in the definitive transaction documents shall be determined solely by reference to the terms of such documents as negotiated and agreed upon by the parties, and shall not be limited by the scope of the diligence requests or the materials produced in response thereto.

This Supplemental Request List is prepared by Calderwood & Harkness LLP solely in connection with its representation of Skybridge Fintech Ltd. in connection with the proposed $60,000,000 convertible note bridge financing (Matter No. 1009-00001) and does not constitute legal advice to, or create an attorney-client relationship with, Ridgeline Ventures Fund IV, L.P., Kelvantis Lending Corp., any stockholder of the Company, or any other third party.

— End of Supplemental Due Diligence Request List —

Calderwood & Harkness LLP

SUPPLEMENTAL DUE DILIGENCE REQUEST LIST
Skybridge Fintech Ltd. $60,000,000 Convertible Note Bridge Financing
December 6, 2023
From:
Calderwood & Harkness LLP 600 Lexington Avenue New York, NY 10022
To:
Skybridge Fintech Ltd. 1400 Market Street, Suite 2200 Wilmington, DE 19801
Attention: Priya Ramanathan, General Counsel
Matter No.: 1009-00001
Prepared by:
Leonard Ashford, Of Counsel, Emerging Company & Venture Capital Practice Group
Nina Reyes, Senior Associate, Emerging Company & Venture Capital Practice Group
Peter Vassiliev, Lead Associate, intellectual Property Practice Group
Wendy Schultz, Working Associate, intellectual Property Practice Group
Right-click to update Table of Contents
I. Introduction and Purpose
This Supplemental Due Diligence Request List (this "Supplemental Request List") is delivered by Calderwood & Harkness LLP ("Calderwood & Harkness") to Skybridge Fintech Ltd. (the "Company" or "Skybridge") as a supplement to the initial Due Diligence Request List dated November 13, 2023 (the "Initial Request List"), which was previously delivered to the Company in connection with the proposed $60,000,000 convertible promissory note bridge financing (the "Transaction") led by Ridgeline Ventures Fund IV, L.P. ("Ridgeline" or the "Lead Investor").
This Supplemental Request List identifies additional items and categories of information that have arisen from the Calderwood & Harkness team's preliminary review and analysis of the materials produced by the Company in response to the Initial Request List. The requests set forth herein are intended to address areas where additional documentation, clarification, or supplemental information is required to complete the legal due diligence review and to facilitate preparation of the transaction documentation.
It is anticipated that initial drafts of the Note Purchase Agreement and related transaction documents will be circulated on or about December 11, 2023. Completion of the diligence review reflected in this Supplemental Request List is necessary in order to finalize the Company Disclosure Schedule, representations and warranties, and closing deliverables to be included in the definitive transaction documents. Accordingly, the Company is requested to treat the production of the materials described herein with appropriate urgency.
The Company is requested to provide all responsive materials via the Thackeray Solutions virtual data room previously established for this Transaction (the "VDR"), organized in accordance with the numbered request categories set forth below. Alternatively, materials may be delivered directly to Leonard Ashford or Nina Reyes at Calderwood & Harkness LLP, 600 Lexington Avenue, New York, NY 10022. The Company should contact Priya Ramanathan, General Counsel, or any member of the Calderwood & Harkness team identified below with any questions regarding the scope, interpretation, or applicability of any specific request contained herein.
All materials produced in response to this Supplemental Request List, together with all materials previously produced in response to the Initial Request List, remain subject to and protected by the attorney-client privilege, the work product doctrine, and any other applicable evidentiary privileges and protections. Production of materials pursuant to this Supplemental Request List shall not be deemed a waiver of any such privilege or protection.
II. General Instructions
The following general instructions apply to all requests set forth in this Supplemental Request List and should be read in conjunction with the general instructions contained in the Initial Request List:
1. Organization. All responsive materials should be organized by numbered request category, corresponding to the section and subsection numbers used in this Supplemental Request List (e.g., materials responsive to Request III.A should be uploaded to a VDR folder labeled "III.A — Money Transmission Licenses and Permits"). Where a single document is responsive to multiple requests, the document should be uploaded once and cross-referenced in each applicable folder.
2. Non-Existence or Inapplicability. If any requested item does not exist or is not applicable to the Company, the Company is requested to provide written confirmation to that effect, specifically identifying the request number and providing a brief explanation. A blanket statement of inapplicability will not be sufficient; each such determination should be made on a request-by-request basis.
3. Amendments and Restatements. Where any requested document has been amended, supplemented, restated, or otherwise modified since its original execution, the Company should provide all versions of such document, including the current effective version and all prior amendments, supplements, restatements, or modifications, in chronological order.
4. Status Updates. For any ongoing or pending matters (including, without limitation, pending regulatory applications, ongoing litigation, pending negotiations, and unresolved disputes), the Company should provide status updates reflecting the most current information available as of the most recent practicable date prior to production.
5. Cross-References to Initial Request List. Where a request in this Supplemental Request List supplements, updates, or expands upon a request contained in the Initial Request List, a cross-reference to the corresponding Initial Request List item number has been provided where practicable. In instances where additional materials are being requested to supplement a prior production, the Company should identify the new materials and distinguish them from materials previously produced.
6. Privilege Log. To the extent the Company withholds any responsive document or portion of a document on the basis of attorney-client privilege, work product protection, or any other applicable privilege, the Company should maintain a privilege log identifying each such document by date, author, recipient(s), subject matter, and the basis for the privilege assertion.
III. Regulatory and Licensing — Money Transmission
A. Money Transmission Licenses and Permits
1. A complete list of all states and jurisdictions (including the District of Columbia, U.S. territories, and any non-U.S. jurisdictions) in which Skybridge Fintech Ltd. currently holds a money transmitter license, money services business registration, or any equivalent permit, authorization, or approval. For each such license, registration, or permit, the list should include: (a) the name of the issuing regulatory authority; (b) the license, registration, or permit number; (c) the date of initial issuance; (d) the current expiration or renewal date; and (e) the status of the license (e.g., active, conditional, provisional, suspended, or pending renewal).
2. Copies of all currently effective money transmitter licenses, money services business registrations, or equivalent permits held by the Company in any jurisdiction, including any licenses that are conditional, provisional, or subject to special terms, conditions, or restrictions imposed by the issuing regulatory authority.
3. Copies of all license applications currently pending in any state or jurisdiction where the Company has applied for but not yet received a money transmitter license, money services business registration, or equivalent permit. For each pending application, the Company should provide: (a) a description of the current status of the application; (b) copies of all correspondence between the Company and the relevant state regulator relating to the application; (c) identification of any outstanding requests for information, supplemental filings, or deficiencies identified by the regulator; and (d) the Company's estimated timeline for receipt of a decision on the application.
B. FinCEN Registration
4. A copy of the Company's current Financial Crimes Enforcement Network ("FinCEN") Money Services Business ("MSB") registration confirmation, together with copies of any amendments, updates, or renewals filed since the initial registration.
5. To the extent not subject to applicable legal privilege or regulatory confidentiality restrictions, copies of any Suspicious Activity Reports ("SARs") filed by the Company with FinCEN during the three-year period preceding the date of this Supplemental Request List. In the event the Company determines that production of individual SARs is prohibited or inadvisable under applicable law or regulation, the Company should provide an aggregate summary indicating the total number of SARs filed during each calendar year (2021, 2022, and 2023 year-to-date) and a general description of the categories of suspicious activity reported.
6. Copies of any Currency Transaction Reports ("CTRs") filed by the Company with FinCEN during the three-year period preceding the date of this Supplemental Request List. If production of individual CTRs is impracticable due to volume, the Company should provide an aggregate summary indicating the total number of CTRs filed during each calendar year.
C. Regulatory Examinations and Inquiries
7. Copies of any examination reports, supervisory letters, deficiency notices, findings letters, matters requiring attention ("MRAs"), cease-and-desist orders, consent orders, civil money penalty assessments, or other regulatory correspondence, orders, or actions received from any state or federal financial regulator (including, without limitation, state banking departments, state departments of financial institutions, FinCEN, and the Consumer Financial Protection Bureau ("CFPB")) at any time during the three-year period preceding the date of this Supplemental Request List.
8. A summary description of any pending or threatened regulatory inquiries, investigations, or enforcement actions relating to the Company's money transmission, payments processing, or money services business activities. For each such matter, the summary should include: (a) the identity of the regulatory authority; (b) the nature and subject matter of the inquiry, investigation, or enforcement action; (c) the current status; and (d) any potential financial exposure or remedial obligations.
9. Copies of any remediation plans, corrective action plans, or compliance improvement programs developed, submitted, or undertaken by the Company in response to any regulatory examination findings, supervisory letters, deficiency notices, or other regulatory directives during the three-year period preceding the date of this Supplemental Request List, together with documentation reflecting the Company's completion or current status of implementation of each such plan.
D. Compliance Program Documentation
10. A summary description of the Company's anti-money laundering ("AML") and Bank Secrecy Act ("BSA") compliance program, including a description of the program's key components (e.g., written policies and procedures, internal controls, customer identification and due diligence procedures, transaction monitoring, suspicious activity reporting, employee training, and independent testing). To the extent available, the Company should provide copies of the program's governing policy documents.
11. Identification of the Company's designated BSA/AML compliance officer, including the individual's name, title, reporting structure, qualifications, and the date of appointment to the role.
12. A copy of the most recent independent AML/BSA audit or assessment report prepared by an external firm, including the date of the audit, the scope of the assessment, and the identity of the firm that conducted it. If any findings, recommendations, or deficiencies were identified in the report, the Company should also provide documentation reflecting the Company's response or remediation efforts.
E. Surety Bonds and Financial Security
13. Copies of all surety bonds, letters of credit, certificates of deposit, or other financial security instruments posted or maintained by the Company in connection with its money transmitter licenses or money services business registrations in any jurisdiction. For each such instrument, the Company should provide: (a) the name of the issuing surety company or financial institution; (b) the principal amount or face value of the bond or instrument; (c) the effective date and expiration date; (d) the jurisdiction and license to which the instrument relates; and (e) any applicable terms or conditions, including renewal provisions and claim provisions.
IV. Intellectual Property — Open-Source Software
A. Open-Source Software Inventory
14. A complete inventory or software bill of materials ("SBOM") listing all open-source software components that are incorporated into, linked with, bundled with, distributed with, or otherwise used in connection with the Company's payments orchestration platform and embedded lending platform (collectively, the "Company Products"). For each open-source component identified, the inventory should include the following information:
(a) The name of the open-source component or library;
(b) The version number currently in use;
(c) The applicable open-source license or licenses under which the component is distributed (e.g., MIT License, Apache License 2.0, GNU General Public License v2 ("GPL v2"), GNU General Public License v3 ("GPL v3"), GNU Lesser General Public License ("LGPL"), GNU Affero General Public License v3 ("AGPL v3"), BSD 2-Clause License, BSD 3-Clause License, Mozilla Public License 2.0 ("MPL 2.0"), or any other license);
(d) The manner of use or integration (e.g., statically linked, dynamically linked, modified and incorporated, used as a standalone service, included in distributed or deployed code, accessed via API, used solely in development or build tooling);
(e) Whether any modifications, enhancements, or derivative works have been created by the Company based on the open-source component, and if so, a brief description of the nature and extent of such modifications;
(f) Whether the component is incorporated into customer-facing products or services, or is used solely in connection with internal tools, development environments, testing frameworks, or build infrastructure.
B. Copyleft and Reciprocal License Exposure
15. Identification of any open-source components included in the inventory described in Request 14 above that are subject to "copyleft" or reciprocal licensing obligations, including without limitation components licensed under GPL v2, GPL v3, AGPL v3, LGPL (any version), or MPL 2.0. For each such component, the Company should provide:
(a) A description of how the copyleft-licensed component interacts with the Company's proprietary source code, including whether the component and proprietary code are compiled together, linked (statically or dynamically), communicate via inter-process communication, or are otherwise combined in a manner that could implicate the copyleft license's scope;
(b) An assessment or analysis of whether the applicable copyleft obligations have been triggered or could reasonably be triggered under the circumstances of the Company's use (e.g., by distribution of compiled binaries, provision of access to the software over a network in the case of AGPL v3, linking with proprietary libraries, or modification and redistribution);
(c) A description of any technical, architectural, or organizational steps taken by the Company to isolate copyleft-licensed components from proprietary code, including without limitation the use of separate processes, microservices architectures, API boundaries, or container-based isolation.
C. Open-Source Compliance Policies and Procedures
16. Copies of any internal policies, procedures, guidelines, or governance frameworks adopted by the Company governing the selection, evaluation, approval, use, integration, and tracking of open-source software within the Company's products, services, and internal systems. This request includes any policies that establish approved or prohibited license categories, required review or approval workflows, or documentation requirements for open-source adoption.
17. A description of any automated scanning tools, software composition analysis ("SCA") tools, or other technical systems used by the Company to detect, identify, catalog, and monitor open-source software usage across its codebase and deployed environments. For each such tool or system, the Company should provide: (a) the name of the tool or vendor (e.g., Larkspur Data Systems, Crestline Health IT, Glenrock Systems, Crowne Albany Solutions, Strathmore Services Inc.); (b) the frequency of scans (e.g., continuous integration, weekly, quarterly); (c) the scope of coverage (e.g., all repositories, production code only, specific products); and (d) a description of the remediation or escalation workflow triggered when a license compliance issue or vulnerability is detected.
D. Open-Source Contributions
18. A description of any contributions of the Company's proprietary source code, documentation, or other materials to any open-source projects, communities, or foundations, whether initiated by the Company or by individual employees or contractors acting within the scope of their engagement. For each such contribution, the Company should identify: (a) the open-source project to which the contribution was made; (b) the nature and scope of the contribution; (c) the open-source license under which the contribution was made or released; and (d) whether the Company received any intellectual property assignment or license-back rights in connection with the contribution.
V. Data Privacy and Customer Contracts
A. Customer Data Processing Agreements
19. Copies of the Company's current standard form data processing agreement ("DPA") or data processing addendum, including any standard attachments, exhibits, or schedules (e.g., descriptions of processing activities, technical and organizational security measures, subprocessor lists, and standard contractual clauses).
20. A list of all customers with which Skybridge has entered into non-standard, negotiated, or materially modified data processing agreements or data processing addenda that deviate from the Company's standard form. For each such customer, the Company should provide: (a) the identity of the customer; (b) a brief description of the material deviations from the standard form; and (c) a complete copy of the executed, non-standard DPA.
21. Identification of any customers who have requested a data processing agreement or data processing addendum from the Company but have not yet received an executed agreement, or where DPA negotiations are currently pending. For each such customer, the Company should indicate the current status of negotiations and any anticipated timeline for execution.
B. Privacy Policies and Notices
22. Copies of all current versions of the Company's customer-facing privacy policies and privacy notices, including any product-specific, service-specific, or jurisdiction-specific privacy notices (e.g., California Consumer Privacy Act notices, GDPR-specific notices, or notices applicable to particular Company Products).
23. A history of all material amendments, updates, or revisions to the Company's privacy policies during the two-year period preceding the date of this Supplemental Request List, together with copies of each prior version of the privacy policy in effect during that period. For each material amendment, the Company should provide a brief description of the nature of the change and the effective date.
C. Data Protection Impact Assessments
24. Copies of any data protection impact assessments ("DPIAs") or privacy impact assessments ("PIAs") conducted by or on behalf of the Company in connection with the payments orchestration platform or the embedded lending platform during the two-year period preceding the date of this Supplemental Request List. This request includes any DPIAs or PIAs conducted in connection with the introduction of new product features, the processing of new categories of personal data, or the adoption of new data processing technologies (including any assessments conducted in connection with the use of automated decision-making or machine learning models).
D. Cross-Border Data Transfers
25. A description of any cross-border transfers of personal data conducted by or on behalf of the Company, including without limitation transfers of personal data to or from the European Union/European Economic Area ("EU/EEA"), the United Kingdom ("UK"), Canada, or any other jurisdiction that imposes data localization requirements or restrictions on the international transfer of personal data. For each category of cross-border transfer, the description should identify: (a) the originating jurisdiction; (b) the receiving jurisdiction; (c) the categories of personal data transferred; (d) the purpose of the transfer; and (e) the legal basis or data transfer mechanism relied upon.
26. Copies of any Standard Contractual Clauses ("SCCs") adopted pursuant to Commission Implementing Decision (EU) 2021/914, Binding Corporate Rules ("BCRs"), transfer impact assessments, or other data transfer mechanisms executed, implemented, or relied upon by the Company in connection with cross-border transfers of personal data.
27. Identification of any data hosting, data processing, or data storage that occurs outside the United States, including: (a) the geographic location of each data center or server facility; (b) the identity of each hosting, infrastructure, or cloud services provider (e.g., Ridgeway Industries, Crestline Systems, Aldermere Technologies); (c) the categories of data hosted or processed at each location; and (d) any contractual or regulatory restrictions applicable to the data stored at each location.
E. Data Breach History
28. A summary of any data security incidents, unauthorized access events, data breaches, or other security events occurring during the three-year period preceding the date of this Supplemental Request List that involved or potentially involved the unauthorized access, acquisition, disclosure, or loss of personal data, customer data, or other confidential information. For each such incident, the summary should include: (a) the date of the incident and the date of discovery; (b) the nature and cause of the incident; (c) the scope and categories of data affected; (d) the number of individuals affected; (e) a description of the notification actions taken (including notifications to affected individuals, regulatory authorities, and law enforcement); and (f) a description of any resulting regulatory inquiry, litigation, claims, settlements, or financial liability.
29. Copies of any breach notification letters, notices, or communications sent by the Company to affected individuals, state attorneys general, data protection authorities, or law enforcement agencies in connection with any data security incident occurring during the period described above.
F. Data Security Standards and Certifications
30. A description of the Company's information security program, including an overview of the technical, administrative, and physical security controls implemented to protect personal data, customer data, and other sensitive information. The description should identify any applicable industry standards, certifications, or frameworks to which the Company adheres, including without limitation SOC 2 Type II, PCI-DSS (Payment Card Industry Data Security Standard), ISO/IEC 27001, and NIST Cybersecurity Framework.
31. Copies of the most recent SOC 2 Type II report issued to the Company, including any management assertions, system descriptions, and complementary user entity controls. If the Company has obtained PCI-DSS certification, copies of the most recent Report on Compliance ("ROC") or Self-Assessment Questionnaire ("SAQ"), as applicable.
32. The date and scope of the most recent third-party penetration test or security audit conducted on the Company's systems, networks, and applications, together with the identity of the firm that conducted the assessment. To the extent not subject to applicable privilege, a summary of any critical or high-severity findings identified during the assessment and the Company's remediation status with respect to such findings.
VI. Existing Indebtedness — Kelvantis Lending Corp. Venture Debt Facility
A. Complete Loan Documentation
33. A complete copy of the Loan and Security Agreement, dated August 15, 2022, by and between Kelvantis Lending Corp. ("Kelvantis") and Skybridge Fintech Ltd. (the "Kelvantis LSA"), together with all exhibits, schedules, annexes, side letters, and attachments thereto.
34. Copies of all amendments, supplements, modifications, waivers, consents, forbearance agreements, or other written instruments that amend, supplement, modify, or otherwise relate to the Kelvantis LSA, executed or delivered at any time since August 15, 2022.
35. Copies of all promissory notes, warrants, warrant agreements, or other instruments or securities issued by the Company to Kelvantis or any of its affiliates in connection with the Kelvantis venture debt facility.
36. Copies of all UCC-1 financing statements, UCC-3 amendments, UCC-3 continuation statements, and any other lien filings made by or on behalf of Kelvantis Lending Corp. (or any agent, successor, or assignee thereof) in connection with the Kelvantis facility, in any jurisdiction.
B. Current Outstanding Balance and Payment Status
37. A statement of the current outstanding principal balance, accrued and unpaid interest, and any other amounts outstanding under the Kelvantis facility as of the most recent practicable date. The original facility amount is understood to be $15,000,000, and the Company is requested to confirm or correct this understanding.
38. A schedule of all principal and interest payments made by the Company to Kelvantis under the facility from the date of origination through the most recent payment date, including the date of each payment, the amount of each payment, and the allocation between principal, interest, and fees.
39. Confirmation of the stated maturity date of the Kelvantis facility. Based on the Company's prior productions, the maturity date is understood to be August 15, 2025; the Company is requested to confirm or correct this understanding, and to identify any provisions that could accelerate the maturity date or otherwise modify the scheduled repayment terms.
40. Identification of any amounts held in restricted accounts, reserve accounts, escrow accounts, or other segregated accounts in connection with the Kelvantis facility, together with the current balance of each such account, the purpose of the restriction, and the conditions under which the restricted funds may be released.
C. Covenant Compliance
41. A complete list of all financial covenants and material operating covenants contained in the Kelvantis LSA, including without limitation any minimum cash covenants, minimum revenue covenants, maximum leverage ratio covenants, minimum liquidity covenants, and any negative covenants restricting the Company's business activities or financial operations.
42. A copy of the most recent compliance certificate delivered by the Company to Kelvantis pursuant to the Kelvantis LSA, together with the supporting calculations and certifications demonstrating the Company's compliance with each financial covenant as of the applicable measurement date.
43. Identification of any covenant violations, defaults, events of default (whether payment defaults, financial covenant defaults, or other defaults), or potential defaults that have occurred at any time during the term of the Kelvantis facility, including any such defaults that were subsequently cured, waived, or subject to forbearance arrangements. For each such event, the Company should provide: (a) a description of the covenant or provision breached; (b) the date of the breach; (c) the nature and circumstances of the breach; and (d) a description of the cure, waiver, or other resolution.
44. Identification and copies of any provisions in the Kelvantis LSA (including any side letters, amendments, or other related agreements) that restrict, condition, or require the prior written consent of Kelvantis for any of the following actions by the Company:
(i) the incurrence of additional indebtedness (including the issuance of convertible promissory notes);
(ii) the issuance of convertible securities, options, warrants, or other equity-linked instruments;
(iii) the granting of liens, security interests, pledges, or encumbrances on the Company's assets;
(iv) the payment of dividends, distributions, or other returns of capital to stockholders;
(v) mergers, consolidations, acquisitions, dispositions, or changes of control;
(vi) the creation or dissolution of subsidiaries; or
(vii) any other material corporate actions or transactions.
D. Intercreditor and Subordination Provisions
45. Copies of any existing intercreditor agreements, subordination agreements, standstill agreements, or similar arrangements to which Kelvantis Lending Corp. is a party, including any agreements governing the relative priority of claims, payment waterfalls, or enforcement rights among multiple creditors of the Company.
46. Identification of the specific provisions of the Kelvantis LSA (including any definitions of "Permitted Indebtedness," "Subordinated Debt," or equivalent terms) that establish the terms and conditions upon which additional indebtedness may be incurred on a subordinated basis, and any limitations or requirements imposed on the form, terms, or conditions of any such subordinated indebtedness.
47. Copies of any correspondence, term sheets, draft agreements, or other communications between the Company (or its counsel) and Kelvantis Lending Corp. (or its counsel) regarding the proposed convertible note financing, the proposed terms of subordination, or any request for lender consent or waiver in connection with the Transaction. This request supplements materials already produced and specifically includes, but is not limited to, any responses or correspondence relating to the Calderwood & Harkness letter to Theodore "Ted" Marsh, counsel to Kelvantis, dated December 15, 2023, requesting lender consent under the Kelvantis LSA.
E. Warrants.
48. Copies of any warrants or warrant agreements issued to Kelvantis Lending Corp. or any of its affiliates in connection with the venture debt facility. For each such warrant, the Company should provide or confirm: (a) the exercise price per share; (b) the number of shares underlying the warrant; (c) the class and series of equity subject to the warrant; (d) the expiration date; (e) any anti-dilution, adjustment, or ratchet provisions; and (f) any transfer or assignability restrictions.
49. Confirmation of whether any warrants issued to Kelvantis have been exercised, in whole or in part, and if so, the date of exercise, the number of shares issued, and the aggregate exercise price paid.
VII. Capitalization — Supplemental Items
A. Updated Capitalization Table
50. A fully diluted capitalization table as of the most recent practicable date, reflecting all outstanding shares of common stock, all outstanding shares of preferred stock (Series A, Series B, and Series C), all outstanding stock options (whether vested or unvested), all outstanding warrants (including any warrants issued to Kelvantis Lending Corp.), all outstanding restricted stock units ("RSUs"), and any other convertible securities, convertible notes, SAFEs, or contractual rights to acquire equity in the Company. The capitalization table should set forth, for each class and series of securities, the number of shares or units outstanding on both an outstanding basis and a fully diluted, as-converted basis.
51. A reconciliation of the fully diluted share count to the approximately 48,500,000 fully diluted shares previously reported by the Company in its initial diligence response. To the extent the current fully diluted share count differs from the previously reported figure, the Company should identify the sources of any variance (e.g., new option grants, warrant exercises, share repurchases, or corrections to prior calculations).
52. A list of all holders of one percent (1%) or more of the Company's outstanding equity securities, on a fully diluted, as-converted basis, identifying for each such holder: (a) the holder's name; (b) the class and series of securities held; (c) the number of shares or units held; and (d) the holder's percentage ownership on a fully diluted basis.
B. 409A Valuation
53. A complete copy of the most recent independent fair market value determination (commonly referred to as a "409A valuation") prepared by Atlas Valuation Services, Inc., dated September 15, 2023. This request includes all supporting schedules, exhibits, assumptions, methodologies, discount analyses, and back-up calculations. Based on prior representations by the Company, the fair market value of common stock was determined to be $8.42 per share in this report; the Company is requested to confirm this figure.
54. Copies of any prior independent 409A valuations prepared during the three-year period preceding the date of this Supplemental Request List, including all supporting schedules and assumptions.
C. Stock Option Plan and Outstanding Grants
55. An updated schedule of all outstanding stock option grants as of the most recent practicable date, including for each grant: (a) the name of the optionee; (b) the date of grant; (c) the exercise price per share; (d) the total number of shares subject to the option; (e) the vesting commencement date and vesting schedule (including any acceleration provisions); (f) the number of shares vested and the number of shares unvested as of the date of the schedule; (g) the expiration date; and (h) whether the option is an incentive stock option ("ISO") or a non-qualified stock option ("NSO").
56. A complete copy of the Company's equity incentive plan document(s), including all amendments, restatements, and board or stockholder resolutions approving the plan or any increases to the share reserve. Copies of the Company's standard form of stock option agreement and any standard form of restricted stock unit agreement.
57. A statement of the remaining number of authorized shares available for issuance under the equity incentive plan (the "share pool"), together with identification of any board or stockholder authorizations to increase the share pool.
D. Preemptive Rights and Rights of First Refusal
58. Identification of any preemptive rights, rights of first refusal, pro rata participation rights, anti-dilution rights, co-sale or tag-along rights, or similar contractual or statutory rights held by any existing stockholders of the Company, including without limitation Crestpoint Seed Partners, Halcyon Growth Equity, Ridgeline Ventures Fund III, L.P., and Beacon Hill Capital Partners, that may be triggered by the issuance of the convertible promissory notes or any conversion thereof into equity securities. For each such right, the Company should identify: (a) the holder(s); (b) the instrument or agreement in which the right is set forth; (c) the triggering event(s); (d) the scope of the right (including any exceptions, carve-outs, or thresholds); and (e) any applicable notice or exercise periods.
59. Copies of any waivers, consents, or amendments obtained or requested from any such holders in connection with the Transaction, together with any correspondence relating thereto.
VIII. Material Contracts — Supplemental Items
A. Revenue Concentration and Key Customer Agreements
60. A list of the Company's top twenty (20) customers by revenue for the twelve-month period ended September 30, 2023, together with the aggregate revenue attributable to each such customer during that period. The list should include both the dollar amount and the percentage of the Company's total revenue represented by each customer during the measurement period.
61. Copies of the master services agreements, subscription agreements, order forms, terms of service, or other definitive agreements applicable to any customer that represented five percent (5%) or more of the Company's annualized recurring revenue during the twelve-month period ended September 30, 2023. Based on previously reported annualized recurring revenue of approximately $78,000,000, the five percent (5%) threshold corresponds to approximately $3,900,000 in annualized recurring revenue.
62. Identification of any customer contracts or agreements that contain: (a) change-of-control provisions that could be triggered by the convertible note financing or a future Series D equity round; (b) assignment restrictions or requirements for customer consent to assignment; (c) termination for convenience provisions with notice periods of ninety (90) days or less; (d) most-favored-nation pricing provisions; or (e) any other provisions that could be triggered by or material to the Transaction or a subsequent equity financing.
B. Key Vendor and Technology Agreements
63. Copies of any agreements with payment processors, acquiring banks, issuing banks, payment networks (e.g., Visa, Hollowell Partners LLC, Nacha), card brand sponsors, payment facilitators, or other financial infrastructure providers that are material to the operation of the Company's payments orchestration platform. For purposes of this request, an agreement is "material" if the services provided thereunder are necessary for the continued operation of the platform or if the annual expenditure under the agreement exceeds $500,000.
64. Copies of any agreements with cloud hosting providers, infrastructure-as-a-service providers, platform-as-a-service providers, or data center operators (e.g., Ridgeway Industries, Crestline Systems, Aldermere Technologies) that are material to the Company's operations, including the applicable service level agreements, terms of service, and any enterprise-level commercial agreements or committed-use discount agreements.
C. Partnership and Channel Agreements
65. Copies of any strategic partnership agreements, reseller agreements, referral agreements, integration agreements, distribution agreements, or other channel arrangements entered into by the Company since the date on which the Initial Request List was delivered (November 13, 2023), or that were in existence but not previously produced.
D. Contracts with Related Parties
66. An updated list of any contracts, agreements, arrangements, or transactions (whether written or oral) between the Company and any of its directors, officers, stockholders holding five percent (5%) or more of the Company's outstanding equity securities, employees with annual compensation exceeding $250,000, or any affiliates, family members, or related entities of the foregoing. For each such contract, agreement, or arrangement, the Company should provide: (a) the identity of the related party; (b) the nature of the relationship; (c) a description of the terms and conditions; and (d) copies of any written agreements.
IX. Litigation and Disputes — Supplemental Items
A. Updates on Pending Matters
67. Updated status reports for any pending or threatened litigation, arbitration, mediation, or regulatory proceedings previously identified by the Company in its response to the Initial Request List. For each such matter, the Company should provide: (a) a description of any material developments since the date of the initial production; (b) copies of any new pleadings, motions, orders, or dispositive rulings entered since November 13, 2023; (c) any updated assessment of the probable outcome or potential financial exposure; and (d) any settlement discussions, demands, or offers.
68. Copies of any demand letters, cease-and-desist letters, pre-litigation correspondence, subpoenas, civil investigative demands, or other pre-litigation or investigative communications received by the Company from any party since November 13, 2023.
B. IP-Related Claims
69. Identification of any claims, demands, threats, assertions, or allegations by any third party that any of the Company's products, services, technologies, or business methods infringe, misappropriate, or otherwise violate any patent, trademark, copyright, trade secret, or other intellectual property right of such third party. For each such claim or assertion, the Company should provide: (a) the identity of the claimant; (b) the intellectual property right(s) at issue; (c) the date of the claim or assertion; (d) copies of any related correspondence or filings; and (e) the current status and the Company's response.
70. Identification of any claims, demands, or actions initiated by the Company against any third party for infringement, misappropriation, or other violation of the Company's intellectual property rights, together with copies of any related correspondence, filings, or orders.
X. Insurance — Supplemental Items
A. Cyber and Technology E&O Insurance
71. Copies of the complete policy forms (including the full policy language, endorsements, exclusions, and conditions — not solely the declarations pages) for the Company's current cyber liability insurance and technology errors and omissions ("E&O") insurance policies.
72. Identification of any claims made, incidents reported, or notices given under the Company's cyber liability or technology E&O insurance policies during the three-year period preceding the date of this Supplemental Request List, together with the current status of each such claim, a description of the underlying event, and the amount of any payments or reserves.
B. Key Person Insurance
73. Confirmation of whether the Company currently maintains key person life insurance policies on Arjun Mehta, Chief Executive Officer, and/or Elena Vasquez, Chief Technology Officer. If such policies are maintained, the Company should provide copies of each policy, including: (a) the name of the insurer; (b) the face amount or coverage limit; (c) the premium amount and payment schedule; (d) the beneficiary designation; and (e) the policy term and any renewal provisions.
XI. Employee and Benefits — Supplemental Items
A. Independent Contractor Classification
74. A list of all current independent contractors, consultants, staffing agency personnel, and other non-employee workers engaged by the Company, together with: (a) a description of the services performed by each individual; (b) the compensation arrangement (e.g., hourly rate, fixed fee, retainer); (c) the duration of the engagement; (d) whether the individual has executed a proprietary information and inventions assignment agreement ("PIIA") or equivalent agreement in favor of the Company; and (e) the individual's geographic location.
75. A description of the Company's methodology, criteria, and procedures for classifying workers as employees versus independent contractors, including any legal analyses, written policies, or third-party assessments conducted in connection with such classifications.
B. Foreign Employees
76. Identification of all employees, independent contractors, consultants, or other workers engaged by the Company who are located outside the United States. For each such individual, the Company should provide: (a) the jurisdiction in which the individual is located; (b) the nature of the engagement (employee, contractor, or other); (c) whether the individual is engaged directly by the Company or through an employer-of-record, professional employer organization, or other intermediary arrangement; and (d) a summary of any applicable employment law, data privacy law, tax, or social security considerations that may affect the Company's obligations.
C. Employment Disputes
77. A summary of any pending or threatened employment-related disputes, claims, grievances, arbitration proceedings, or charges filed with any governmental agency (including without limitation the Equal Employment Opportunity Commission, state fair employment agencies, state labor boards or departments, the Department of Labor, and OSHA) during the two-year period preceding the date of this Supplemental Request List. For each such matter, the summary should include: (a) the identity of the claimant; (b) the nature of the claim; (c) the governmental agency or forum; (d) the current status; and (e) any potential financial exposure.
XII. Financial Statements — Supplemental Items
A. Management Financials
78. Unaudited monthly financial statements for October 2023 and November 2023, including: (a) an income statement (statement of operations); (b) a balance sheet (statement of financial position); and (c) a statement of cash flows for each such month. These financial statements should be prepared on a basis consistent with the Company's prior interim financial statements and should include a comparison to budget and to the prior year period, to the extent such comparisons are regularly prepared by the Company.
79. The Company's updated cash position as of the most recent available date, including the aggregate amount of unrestricted cash and cash equivalents on hand. Based on information previously reported by the Company, the cash on hand was approximately $18,500,000 and the monthly cash burn rate was approximately $4,800,000 as of the date of the Initial Request List. The Company is requested to confirm or update these figures.
B. Audit Matters
80. Copies of any management letters, internal control deficiency communications, or other written communications from Pinnacle Audit Group LLP (engagement partner: Lisa Johannsen) to the Company's management or audit committee issued in connection with: (a) the audit of the Company's financial statements for the fiscal year ended December 31, 2022; and/or (b) the review of the Company's interim financial statements for the period ended September 30, 2023.
81. Identification of any material weaknesses or significant deficiencies in internal controls over financial reporting identified by the Company's independent auditors, management, or audit committee at any time during the two fiscal years preceding the date of this Supplemental Request List, together with a description of the nature of each such weakness or deficiency and the Company's remediation efforts and current status.
C. Tax Matters
82. Copies of the Company's federal income tax returns (Form 1120 or applicable form) for the fiscal years ended December 31, 2021 and December 31, 2022, together with all schedules, exhibits, and attachments thereto.
83. Copies of the Company's state income or franchise tax returns for Delaware and all other states in which the Company files income or franchise tax returns for the fiscal years ended December 31, 2021 and December 31, 2022.
84. Identification of any pending or threatened tax audits, examinations, assessments, proposed adjustments, or disputes with any federal, state, local, or foreign taxing authority, together with copies of any related notices, correspondence, or filings.
85. A schedule of the Company's net operating loss ("NOL") carryforwards as of December 31, 2022 (and updated to the most recent practicable date, if available), including the amount of federal and state NOLs, the year of origin, and any applicable expiration dates or Section 382 limitations. The schedule should also include a summary of any research and development tax credits (federal and state) generated and available for utilization.
86. Confirmation of the Company's Employer Identification Number ("EIN"), which is understood to be 83-2147605 based on prior productions. The Company is also requested to confirm the current status of its Delaware franchise tax filings and payments, including confirmation that all franchise tax obligations are current and that no delinquent amounts are outstanding.
XIII. Subsidiary and Affiliate Matters
87. A complete list of all subsidiaries, affiliates, joint ventures, and other related entities of Skybridge Fintech Ltd., including for each such entity: (a) the legal name; (b) the jurisdiction of organization or incorporation; (c) the date of organization or incorporation; (d) the Company's direct or indirect ownership percentage; (e) a brief description of the entity's principal activities; and (f) the entity's current operational status (e.g., active, dormant, in the process of dissolution).
88. An organizational chart depicting the Company's complete corporate structure, including all direct and indirect subsidiaries, minority-owned affiliates, and other related entities, together with the ownership percentages and any intercompany management, licensing, services, or funding arrangements.
89. Identification of any subsidiary, affiliate, or related entity that holds or is the registered owner of: (a) any money transmitter license, money services business registration, or other financial regulatory license or permit; (b) any patents, trademarks, copyrights, domain names, or other intellectual property assets; (c) any material contracts, customer agreements, or vendor agreements; or (d) any other material assets, liabilities, or obligations. For each such subsidiary or affiliate identified, the Company should describe the assets held and the basis for maintaining such assets at the subsidiary or affiliate level rather than at the parent company level.
XIV. Timing and Contact Information
The Company is requested to provide the materials described in this Supplemental Request List as promptly as practicable, and in any event no later than December 20, 2023, in order to permit completion of the due diligence review in advance of the targeted signing and closing of the Transaction. The Company is reminded that timely production is critical to the preparation and finalization of the Company Disclosure Schedule, the closing deliverables, and the representations and warranties to be included in the Note Purchase Agreement.
The primary contacts at Calderwood & Harkness LLP for purposes of this Supplemental Request List are as follows:
Leonard Ashford Of Counsel, Emerging Company & Venture Capital Practice Group Calderwood & Harkness LLP 600 Lexington Avenue New York, NY 10022 General diligence coordinator; primary contact for all requests
Nina Reyes Senior Associate, Emerging Company & Venture Capital Practice Group Calderwood & Harkness LLP 600 Lexington Avenue New York, NY 10022 General diligence coordinator; primary contact for all requests
Peter Vassiliev Lead Associate, intellectual Property Practice Group Calderwood & Harkness LLP 600 Lexington Avenue New York, NY 10022 Primary contact for Section IV requests (open-source software and intellectual property) and Section IX.B requests (IP-related claims)
Wendy Schultz Working Associate, intellectual Property Practice Group Calderwood & Harkness LLP 600 Lexington Avenue New York, NY 10022 Contact for Section IV and Section IX.B requests
The primary contact at the Company is:
Priya Ramanathan General Counsel Skybridge Fintech Ltd. 1400 Market Street, Suite 2200 Wilmington, DE 19801
The Company should also coordinate with Marcus Tillman, Vice President, Corporate Development, and David Lindstrom, Chief Financial Officer, as needed to compile, assemble, and verify the requested financial, business, and operational information responsive to the requests contained herein.
XV. Reservation of Rights
Calderwood & Harkness LLP reserves the right to request additional documents, information, data, materials, and access to personnel as the due diligence review progresses and as the Calderwood & Harkness team's understanding of the Company's business, operations, liabilities, and risks develops. This Supplemental Request List is not intended to be, and should not be construed as, an exhaustive or final enumeration of all information or materials that may be required to complete the due diligence review or to prepare the transaction documentation.
The delivery of information and materials by the Company in response to this Supplemental Request List or the Initial Request List shall not limit, qualify, or otherwise affect any representations, warranties, covenants, indemnification obligations, or other provisions to be contained in the Note Purchase Agreement, the convertible promissory notes, the Subordination Agreement, or any other definitive transaction documents executed and delivered in connection with the Transaction. The scope of the Company's representations and warranties in the definitive transaction documents shall be determined solely by reference to the terms of such documents as negotiated and agreed upon by the parties, and shall not be limited by the scope of the diligence requests or the materials produced in response thereto.
This Supplemental Request List is prepared by Calderwood & Harkness LLP solely in connection with its representation of Skybridge Fintech Ltd. in connection with the proposed $60,000,000 convertible note bridge financing (Matter No. 1009-00001) and does not constitute legal advice to, or create an attorney-client relationship with, Ridgeline Ventures Fund IV, L.P., Kelvantis Lending Corp., any stockholder of the Company, or any other third party.
— End of Supplemental Due Diligence Request List —
Calderwood & Harkness LLP | 600 Lexington Avenue, New York, NY 10022 | Matter No. 1009-00001 | PRIVILEGED & CONFIDENTIAL

SUPPLEMENTAL DUE DILIGENCE REQUEST LIST

Record

Parties

Dates

Amounts