PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
MEMORANDUM
TO: James Prentice, Partner; Sandra Tung, Partner — Calderwood & Harkness LLP
FROM: Naomi Petersen, Associate; Ryan Kowalski, Associate — Calderwood & Harkness LLP
DATE: March 28, 2025
RE: intellectual Property Due Diligence — Skybridge Fintech Ltd. (the "Company") in connection with the proposed de-SPAC business combination with Pinnacle Growth Acquisition Corp. ("PGAC")
Matter: Skybridge Fintech Ltd. / Pinnacle Growth Acquisition Corp. De-SPAC Business Combination
Right-click to update Table of Contents
I. Executive Summary
This memorandum summarizes the results of the intellectual property due diligence review conducted by Calderwood & Harkness LLP from February 10, 2025 through March 28, 2025, in connection with the proposed $450,000,000 de-SPAC business combination (the "Transaction") between Skybridge Fintech Ltd. ("Skybridge" or the "Company"), a Delaware corporation headquartered at 1200 Market Street, Suite 1400, Wilmington, DE 19801, and Pinnacle Growth Acquisition Corp. ("PGAC"), a Cayman Islands exempted company formed for the purpose of effecting a business combination.
Calderwood & Harkness LLP represents Skybridge in this Transaction. PGAC is represented by its own counsel, and this memorandum is prepared solely for the benefit of the Calderwood & Harkness deal team and the Company. This memorandum is protected by the attorney-client privilege, the attorney work product doctrine, and any other applicable protections.
Transaction Structure. The Transaction is structured as a forward triangular merger, pursuant to which Pinnacle Merger Sub Inc., a newly formed Delaware corporation and wholly owned subsidiary of PGAC (following its domestication as a Delaware corporation), will merge with and into Skybridge (the "Merger"), with Skybridge surviving the Merger as a wholly owned subsidiary of the domesticated PGAC. Upon the closing of the Transaction, PGAC will be renamed "Skybridge Fintech Holdings, Inc." and is expected to list on the Nasdaq Stock Market under the ticker symbol "SBFT." The Transaction is being effected pursuant to the Business Combination Agreement, dated as of January 17, 2025, by and among PGAC, Pinnacle Merger Sub Inc., and Skybridge (as amended, the "BCA").
Company Overview. Skybridge operates a cloud-based payment orchestration and embedded-finance software-as-a-service ("SaaS") platform serving mid-market financial institutions and neobanks. The Company was incorporated in the State of Delaware on June 15, 2018, and currently employs approximately 340 individuals across its offices in Wilmington, Delaware and San Francisco, California. The Company's principal engineering and product development operations are based at 450 Folsom Street, 7th Floor, San Francisco, CA 94105.
Financial Overview. For the fiscal year ended December 31, 2024, the Company reported total revenue of approximately $87.3 million, annual recurring revenue ("ARR") of approximately $94.6 million, and adjusted EBITDA of approximately $14.1 million. The Company has demonstrated consistent revenue growth since its founding, with a compound annual growth rate exceeding 50% over the past three fiscal years.
Key IP Assets. The Company's intellectual property portfolio consists of the following principal categories of assets: (i) its proprietary SaaS platform, comprising the Skybridge Orchestrate payment orchestration engine and the Skybridge Connect embedded-finance API suite; (ii) a U.S. patent portfolio consisting of four issued utility patents and three pending utility patent applications; (iii) registered and common law trademarks, including the SKYBRIDGE word mark and related product marks; (iv) trade secrets and proprietary know-how, including proprietary payment routing algorithms, machine learning models, and analytics methodologies; and (v) domain names associated with the Company's products and corporate identity.
Overall Assessment. Based on our review, the Company's IP portfolio is generally well-maintained, appropriately documented, and supportive of the Company's core business operations and growth strategy. The portfolio is consistent with what would be expected of a growth-stage fintech SaaS company of Skybridge's size and maturity. We have identified certain risk items, which are described in detail in Section IX of this memorandum. None of these risk items constitutes, individually or in the aggregate, a material impediment to the closing of the Transaction, and all are addressable through the remediation steps recommended herein.
Scope of Review. Our review encompassed the following sources of information:
(a) Documents produced by the Company in the virtual data room maintained by Thackeray Solutions (the "Data Room"), organized across categories for intellectual property, technology and engineering, employment and human resources, and material contracts;
(b) Public records searches conducted against the databases of the United States Patent and Trademark Office ("USPTO"), including the Patent Full-Text and Image Database, the Trademark Electronic Search System, and the Patent Assignment Search database;
(c) Searches of state trademark databases in Delaware, California, and New York;
(d) Automated open-source software scanning conducted by Calderwood & Harkness using commercially available software composition analysis tools, cross-referenced against the Company's internal open-source bill of materials;
(e) Interviews conducted with Daniel Hsiao, the Company's Chief Technology Officer, on February 19, 2025 and March 6, 2025; and
(f) Interviews conducted with Teresa Okafor, the Company's General Counsel, on February 21, 2025, March 4, 2025, and March 18, 2025.
In total, we reviewed approximately 420 documents across the relevant Data Room categories, including patent and trademark registration certificates, license agreements, customer contracts, employment and contractor agreements, corporate policies, technical documentation, and correspondence. This memorandum reflects the state of our review as of the date hereof and is based on the materials and information made available to us through the date of this memorandum.
II. Proprietary Software Platform
A. Overview of the Skybridge Platform
The Company's business is built upon its proprietary software platform, which is comprised of two principal product offerings:
Skybridge Orchestrate. The Company's core product, marketed as "Skybridge Orchestrate," is a cloud-native payment orchestration platform that enables mid-market financial institutions, neobanks, and other payment-dependent businesses to route, process, and reconcile payments across multiple payment rails and processors through a single unified integration. The platform provides intelligent routing capabilities that optimize transaction success rates, reduce processing costs, and enable failover redundancy across a network of connected payment processors, acquirers, and payment methods. Key features include real-time transaction monitoring, customizable routing logic, multi-currency support, and automated settlement reconciliation. Skybridge Orchestrate represents the substantial majority of the Company's revenue base.
Skybridge Connect. The Company's secondary product, marketed as "Skybridge Connect," is a comprehensive API suite that enables the Company's customers to embed banking-as-a-service ("BaaS") functionality directly into their own applications and platforms. Skybridge Connect provides APIs for account issuance, card issuance (virtual and physical), ledger management, KYC/KYB onboarding workflows, and related financial service capabilities. Skybridge Connect is designed to operate in conjunction with Skybridge Orchestrate but is also offered as a standalone product for customers that do not require the full payment orchestration functionality. The embedded-finance product line is a growing component of the Company's revenue base and a significant element of its forward-looking growth strategy, as highlighted in the PGAC proxy statement/prospectus.
Platform Architecture. The Skybridge platform is built on a microservices-based architecture designed for high availability, horizontal scalability, and multi-tenancy. The platform is deployed on major cloud infrastructure providers in a multi-cloud configuration, providing geographic redundancy and flexibility. The engineering team employs containerized deployment methodologies using industry-standard orchestration tooling.
The platform's codebase is written primarily in Go (for core payment processing and routing services), Python (for machine learning, data analytics, and back-office services), and TypeScript/Node.js (for customer-facing APIs, developer portal, and front-end dashboard applications). Supporting infrastructure and tooling utilize additional languages and frameworks as appropriate.
Development History. Development of the Skybridge platform commenced in 2018 by the Company's co-founder and Chief Executive Officer, Priya Chandrasekaran, and the Company's Chief Technology Officer, Daniel Hsiao. The initial platform architecture and core payment routing engine were designed and built by Ms. Chandrasekaran and Mr. Hsiao, together with a small team of early-stage engineers. Since that time, the engineering team has grown to approximately 130 engineers, based primarily at the Company's San Francisco office. Mr. Hsiao confirmed during our interview on February 19, 2025 that substantially all of the platform code has been developed internally by the Company's engineering team, with limited use of third-party contractors for specific, non-core feature development as described further below.
B. Source Code Ownership and Control
The Company's source code is maintained in private repositories hosted on a commercially available cloud-based source code management platform. The Company utilizes Git-based version control, and access to the repositories is restricted to authorized engineering personnel through role-based access controls. Mr. Hsiao confirmed that the Company maintains audit logs of repository access and code changes, consistent with standard software development practices.
Source Code Escrow. The Company does not currently maintain any standing source code escrow arrangements. However, as discussed in greater detail in Section VII.B below, certain of the Company's enterprise customer agreements contain provisions that require the Company to establish source code escrow arrangements upon the customer's request, with release conditions typically limited to the Company's bankruptcy, insolvency, or material breach of the applicable customer agreement. To date, no customer has exercised such a request, and no escrow arrangements are currently in place. Teresa Okafor confirmed that the Company views these provisions as standard enterprise customer protections and that the Company has not received any indications from customers that escrow requests are forthcoming.
Third-Party Co-Development. We did not identify any third-party co-development agreements, joint development agreements, or similar arrangements that would give any third party ownership or joint ownership of the core platform source code. The Company has not participated in any collaborative development projects with external partners that would result in shared IP ownership of the platform.
Employee Development. All source code developed by the Company's employees has been created within the scope of their employment and is subject to the Proprietary Information and Inventions Assignment Agreements ("PIIAs") described in Section VIII below. Subject to the limited exceptions noted in Section VIII.A regarding four employees without PIIAs on file, the IP chain of title from employee-developers to the Company appears to be complete and well-documented.
Contractor Contributions. The Company has engaged independent contractors for limited software development work, primarily relating to non-core feature development, user interface design, and supplementary tooling. All current and recent contractor agreements that we reviewed include work-for-hire provisions and express IP assignment clauses, as described in greater detail in Section VIII.B. Three historical contractor agreements from the 2018–2019 period were not located in the Data Room, as noted in Section IX below.
C. Technology Stack and Third-Party Components
The Skybridge platform incorporates certain third-party commercial software components and services pursuant to license agreements, in addition to the open-source software components addressed in Section VI. The principal categories of third-party commercial technology utilized by the Company include:
(a) Cloud Infrastructure Services. The Company maintains an enterprise-tier cloud hosting agreement for its production and development environments, providing compute, storage, networking, and managed database services.
(b) Payment Gateway and Network SDKs. The Company integrates with multiple payment processors and card networks through commercially licensed software development kits ("SDKs") and APIs provided by those networks and processors. These integrations are fundamental to the Company's payment orchestration functionality.
(c) Monitoring and Observability Tools. The Company utilizes a commercial SaaS-based monitoring and observability platform for application performance management, logging, and infrastructure monitoring in its production environment.
(d) Database Systems. The Company utilizes both commercially licensed and open-source database management systems within its platform architecture.
(e) Data Feeds and Reference Data. The Company licenses financial data feeds and reference data from third-party data providers, which are used in the Company's payment routing optimization and cross-border payment capabilities.
The material third-party commercial license agreements are summarized in Section VII.A and in Appendix D. We reviewed each of these agreements for IP ownership provisions, restrictions on use, sublicensing limitations, and change-of-control clauses. With the exception of the anti-assignment issues noted in Section VII.A and Section IX, we did not identify any material issues with the Company's inbound commercial licenses.
III. Patent Portfolio
A. Issued Patents
Skybridge holds four (4) issued United States utility patents, all of which are assigned to Skybridge Fintech Ltd. and recorded with the USPTO. The following table provides a summary of each issued patent:
We confirmed through USPTO records that assignments from the named inventors to Skybridge Fintech Ltd. have been properly executed and recorded for each of the four issued patents. The reel and frame numbers for the recorded assignments are set forth in the detailed patent schedule attached as Appendix A. All named inventors are current or former employees of the Company who executed PIIAs containing invention assignment provisions prior to or contemporaneously with their respective invention disclosures.
Maintenance fees are current on all four issued patents. The next maintenance fee deadline falls on March 8, 2026 (the 3.5-year maintenance fee for U.S. Patent No. 11,270,318). The Company's outside patent counsel, Quelston Kramer LLP, maintains a docketing system for tracking all patent maintenance deadlines. We confirmed through correspondence with Quelston Kramer LLP that all future maintenance fee deadlines are properly calendared.
The four issued patents cover key aspects of the Company's core technology, including intelligent payment routing across multiple processing networks, real-time transaction risk scoring in multi-rail payment environments, API-based embedded financial service provisioning, and automated reconciliation of cross-network payment settlements. These patents are directly relevant to the Company's Skybridge Orchestrate and Skybridge Connect product offerings and provide a meaningful degree of protection for the Company's differentiated technology.
B. Pending Patent Applications
Skybridge has three (3) pending United States utility patent applications, as summarized below:
All three pending applications are assigned to Skybridge Fintech Ltd., and the assignments have been recorded with the USPTO. The named inventors on each application are current employees of the Company who have executed PIIAs.
With respect to Application No. 18/471,209, a non-final Office Action was received from the USPTO in December 2024 raising obviousness rejections under 35 U.S.C. § 103. A response was timely filed by Quelston Kramer LLP in February 2025, and prosecution is ongoing. No final rejections have been issued. Quelston Kramer LLP has advised that the examiner's rejections are based on combinations of prior art references that, in counsel's view, do not adequately disclose the claimed inventions, and that there are reasonable bases for distinguishing the cited prior art. We do not express a view on the merits of the pending prosecution.
The remaining two applications (Nos. 18/612,845 and 18/783,116) are at earlier stages of examination and are awaiting the issuance of first Office Actions from the USPTO. No substantive prosecution issues have arisen to date with respect to either application.
C. Foreign Patent Filings
The Company has not filed any patent applications outside the United States. Mr. Hsiao confirmed during our interview that the Company has historically focused its patent protection efforts on the U.S. market, consistent with the fact that substantially all of the Company's revenue to date has been derived from domestic customers.
We note that as the combined company expands internationally following the Transaction — a stated element of the Company's growth strategy as described in the PGAC proxy statement/prospectus — the absence of foreign patent protection may become a more significant concern. The Company's core payment orchestration and embedded-finance technologies may be practiced by competitors or other parties in foreign jurisdictions without the protection afforded by corresponding foreign patent rights. We recommend that the post-closing IP strategy for Skybridge Fintech Holdings, Inc. include an evaluation of foreign patent filing priorities, particularly in key target markets such as the United Kingdom, the European Union, Canada, and Singapore.
D. Patent Encumbrances and Litigation
Encumbrances. We did not identify any liens, security interests, pledges, or other encumbrances on any of the Company's issued patents or pending patent applications. The Company's existing credit facility with Velthorn Commerce Bank, N.A., governed by the Credit Agreement dated March 22, 2023 (as amended), includes a general security interest in substantially all assets of the Company; however, registered intellectual property (including patents, patent applications, trademarks, and trademark applications) is specifically excluded from the collateral package pursuant to Section 2.04(b)(iii) of the Credit Agreement. The revolving credit facility has a commitment amount of $25,000,000, of which approximately $18,500,000 was outstanding as of April 14, 2025. Teresa Okafor confirmed that the outstanding balance under the credit facility is expected to be repaid in full at the closing of the Transaction using a portion of the Transaction proceeds, and the security interest will be released upon such repayment.
Litigation. We did not identify any pending or threatened patent infringement actions by or against the Company. No patent-related cease-and-desist letters have been received by or sent on behalf of the Company. No inter partes review, post-grant review, or other patent validity challenge proceedings are pending before the Patent Trial and Appeal Board with respect to any of the Company's issued patents.
Freedom-to-Operate. The Company has not conducted a formal freedom-to-operate ("FTO") analysis with respect to its products and services. While the absence of a formal FTO analysis is not unusual for a company of Skybridge's size and stage, we note that the patent landscape in the payment orchestration and embedded-finance spaces is increasingly crowded, with significant patent portfolios held by both established financial technology companies and emerging competitors. We recommend that the combined company consider conducting a targeted FTO review post-closing, focusing on the Company's core payment routing, embedded-finance provisioning, and fraud detection functionalities, in order to identify and assess any third-party patent rights that may be relevant to the Company's product roadmap. This recommendation is noted as an informational item in Section IX below.
IV. Trademarks
A. Registered Trademarks
Skybridge holds four (4) active United States trademark registrations with the USPTO, all owned by Skybridge Fintech Ltd. The following table summarizes the Company's registered trademark portfolio:
All registrations are in force and in good standing. Section 8 Declarations of Continued Use have been timely filed for all registrations that have reached the applicable filing window. Section 15 Declarations of Incontestability have been filed for the SKYBRIDGE word mark (Reg. No. 5,863,214) and the Skybridge logo design mark (Reg. No. 5,869,407), both of which have been in continuous use for more than five consecutive years since registration. Renewal deadlines are tracked by Quelston Kramer LLP's trademark docketing system. The earliest renewal deadline (Section 9 renewal for Reg. No. 5,863,214 and Reg. No. 5,869,407) falls in September 2029.
The registrations cover services in International Class 42 (computer services, namely, providing a cloud-based software platform for payment orchestration and embedded financial services; software as a service) and, with respect to the design mark, also International Class 9 (downloadable software development kits for integrating payment and financial services functionality into third-party applications). The scope of the registrations is consistent with the Company's current product offerings and use of its marks in commerce.
We confirmed through USPTO assignment records that all trademark registrations are recorded as owned by Skybridge Fintech Ltd. No assignments, licenses, or security interests have been recorded against any of the registrations.
B. Pending Trademark Applications
The Company has one (1) pending trademark application with the USPTO:
The SKYBRIDGE INTELLIGENCE application was filed in connection with a new analytics and business intelligence product module that the Company is developing and expects to launch in the second half of 2025. The application is based on a Section 1(b) intent-to-use filing. The application is currently in the examination stage, and no Office Actions or refusals have been issued. A Statement of Use will need to be filed following the commencement of use in commerce if the application proceeds to allowance.
C. Common Law and Unregistered Marks
In addition to its registered trademarks, the Company uses various product feature names, sub-brand identifiers, and marketing taglines in connection with its products and services that are not the subject of federal trademark registrations. These include, without limitation, names for specific product features within the Skybridge Orchestrate and Skybridge Connect platforms, as well as marketing slogans used in the Company's advertising and promotional materials. While these marks have not been registered with the USPTO or any state trademark office, the Company may hold common law trademark rights in such marks to the extent they have been used in commerce and have acquired distinctiveness or secondary meaning among the relevant consuming public.
We did not conduct a comprehensive assessment of the Company's common law trademark rights, as such an assessment was outside the scope of this review. However, we note that the Company's primary brand elements — the SKYBRIDGE name, the SKYBRIDGE ORCHESTRATE and SKYBRIDGE CONNECT product names, and the Skybridge logo — are all protected by federal registrations as described above.
D. Domain Names
The Company owns the following key domain names, which are used in connection with its business and products:
All domain registrations are current and have auto-renewal enabled through the registrar. The registrant for all domain names is listed as Skybridge Fintech Ltd. The domain name skybridgefintech.com is used as the Company's primary corporate website. The remaining domains are used for product-specific marketing pages and developer documentation portals, or are held defensively. A complete domain name schedule is attached as Appendix C.
We note that the Company does not own the domain "skybridge.com," which is registered to an unaffiliated third party. Teresa Okafor confirmed that the Company has not pursued acquisition of this domain and does not view it as material to the Company's operations, given that the Company has consistently branded itself as "Skybridge Fintech" in the market.
E. Trademark Disputes
We did not identify any pending opposition or cancellation proceedings involving any of the Company's trademark registrations or applications before the Trademark Trial and Appeal Board. No trademark-related litigation is pending by or against the Company in any federal or state court.
The Company received one informal inquiry in 2022 from counsel for a financial services company regarding the Company's use of the "Skybridge" name. Teresa Okafor provided us with copies of the correspondence, which consisted of a single letter from the inquiring party's counsel expressing concern about potential consumer confusion in the financial services space, followed by a response from the Company's then-outside trademark counsel explaining the Company's prior use, distinct branding, and different customer base. The matter was resolved informally without any formal legal action, settlement agreement, consent agreement, or other arrangement that would limit the Company's use of the SKYBRIDGE mark or any of its other trademarks.
We conducted a search of the USPTO's Trademark Electronic Search System to identify potentially conflicting marks. We noted that the "Skybridge" name is used by several entities in unrelated industries (e.g., real estate, telecommunications infrastructure, and investment management). We did not identify any conflicting uses of "Skybridge" or substantially similar marks in the fintech, payment orchestration, or SaaS industries that would, in our assessment, present a material risk of confusion or a challenge to the Company's trademark rights in its field of use.
V. Trade Secrets and Proprietary Know-How
The Company maintains trade secret protections for a range of proprietary information that is core to its competitive position. Based on our review of the Company's policies and procedures, and our interviews with Mr. Hsiao and Ms. Okafor, the principal categories of trade secrets and proprietary know-how maintained by the Company include:
(a) Proprietary Payment Routing Algorithms. The Company's intelligent payment routing engine employs proprietary algorithms that optimize transaction routing decisions in real time based on range factors, including processor performance data, transaction success rates, processing costs, geographical factors, and payment method-specific parameters. These algorithms represent a core element of the Company's competitive differentiation and are not disclosed to customers or third parties.
(b) Machine Learning Models for Fraud Detection. The Company has developed proprietary machine learning models that are trained on anonymized and aggregated transaction data to detect fraudulent transactions within the payment flows orchestrated through the Skybridge platform. The architecture, training methodologies, feature engineering techniques, and model parameters are maintained as confidential information.
(c) Customer Data Analytics Methodologies. The Company employs proprietary data analytics methodologies to generate insights for its customers regarding payment performance, customer behavior, and operational efficiency. The specific analytical frameworks, data processing pipelines, and visualization techniques are treated as proprietary know-how.
(d) Pricing Models and Business Methodologies. The Company's pricing structures, discount models, customer segmentation strategies, and related commercial methodologies are maintained as confidential business information.
Protective Measures. The Company has implemented a range of measures to protect its trade secrets and proprietary information, consistent with the requirements for trade secret protection under the Defend Trade Secrets Act of 2016 (18 U.S.C. § 1836 et seq.) and applicable state trade secret laws. These measures include:
(a) Confidentiality Agreements. All employees of the Company are required to execute Proprietary Information and Inventions Assignment Agreements that include robust confidentiality obligations, as described in Section VIII.A. All independent contractors engaged by the Company are subject to confidentiality provisions in their contractor agreements, as described in Section VIII.B. Non-disclosure agreements ("NDAs") are required for all business partners, vendors, and prospective customers during the sales process prior to the disclosure of any confidential or proprietary information.
(b) Access Controls. The Company maintains role-based access controls on its source code repositories, internal documentation systems, and production environments. Access to sensitive systems and information is restricted to personnel with a legitimate business need, and access levels are reviewed periodically. Multi-factor authentication is required for all access to the Company's code repositories and internal systems.
(c) Information Security Program. The Company maintains an information security program overseen by CTO Daniel Hsiao, with day-to-day management by the Company's Director of Information Security. The program includes policies and procedures for data handling, incident response, employee security training, and vendor security assessments.
(d) Data Classification Policy. The Company adopted a formal data classification policy in 2022 that categorizes information into tiers (Public, Internal, Confidential, and Restricted) and prescribes handling requirements for each tier. Trade secrets and proprietary algorithms are classified at the "Restricted" level, which imposes the highest level of access controls and handling requirements.
Trade Secret Claims. We did not identify any pending or threatened trade secret misappropriation claims by or against the Company. Ms. Okafor confirmed that the Company has not been the subject of any allegations of trade secret misappropriation by former employers of its employees, and that the Company has not initiated any trade secret claims against former employees or competitors. No departing employees have been identified as presenting a trade secret risk warranting legal action.
VI. Open-Source Software Compliance
A. Overview of Open-Source Usage
Like virtually all modern software companies, Skybridge's engineering team makes significant use of open-source software ("OSS") components throughout the platform stack. Open-source components are utilized for a wide range of functions, including web application frameworks, HTTP libraries, cryptographic primitives, data serialization, logging, testing frameworks, build tools, and database drivers, among others.
Mr. Hsiao confirmed during our interview on March 6, 2025 that the Company maintains an internal open-source usage policy (the "OSS Policy"), which was formally adopted in 2021. The OSS Policy sets forth guidelines for the evaluation, approval, and use of open-source components within the Company's products and internal tools. Under the OSS Policy, the use of any new open-source component requires review and approval by a designated senior engineer or engineering manager, with escalation to the CTO or General Counsel for components under copyleft licenses (as described below). The Company also maintains a bill-of-materials ("BOM") tracking process that catalogs open-source components used in the platform, together with their applicable license types.
In connection with our review, Calderwood & Harkness engaged a commercially available automated software composition analysis ("SCA") tool to scan the Company's production codebase and verify the Company's internal BOM records against the actual composition of the codebase. The results of this scan are summarized below and in the open-source BOM summary attached as Appendix F.
B. Permissive Licenses
The substantial majority of open-source components utilized by the Company are licensed under permissive open-source licenses, including the MIT License, the BSD 2-Clause License ("Simplified BSD License"), the BSD 3-Clause License ("New BSD License"), the Apache License Version 2.0, and the ISC License. These permissive licenses generally permit the use, modification, reproduction, and distribution of the licensed software — including incorporation into proprietary software products — subject to relatively straightforward compliance obligations, primarily consisting of the inclusion of copyright notices and license texts in documentation or source code distributions.
The Company's use of permissively licensed open-source components is consistent with standard industry practices for SaaS companies. Based on our review of the SCA scan results and the Company's internal BOM, the Company appears to be meeting the attribution and notice requirements of the applicable permissive licenses. We did not identify any material compliance gaps with respect to permissively licensed OSS components.
C. Copyleft Licenses
Our review identified the Company's use of certain open-source components licensed under copyleft licenses, which impose more restrictive conditions on the use and distribution of the licensed software. Copyleft licenses generally require that derivative works or works that incorporate copyleft-licensed code be made available under the same copyleft license terms, which can include an obligation to disclose the source code of the combined work. The implications of copyleft license obligations differ depending on the specific license and the manner in which the licensed component is used. Our findings are summarized below:
GNU General Public License, Version 2 (GPL v2). The SCA scan identified a limited number of components licensed under the GPL v2 within the Company's codebase. Based on our review and Mr. Hsiao's confirmation, these GPL v2-licensed components are used exclusively in the Company's internal build and test tooling (e.g., certain build scripts and testing utilities). They are not incorporated into, linked with, or distributed as part of the customer-facing production platform or any code delivered to customers. The Company's use of these components in standalone internal tooling that does not form part of a larger combined work with the Company's proprietary code does not, in our assessment, trigger copyleft obligations that would require disclosure of the Company's proprietary source code.
GNU Lesser General Public License, Version 2.1 (LGPL v2.1). The SCA scan identified two (2) libraries licensed under the LGPL v2.1 that are used within the Skybridge platform. Mr. Hsiao confirmed that both libraries are integrated via dynamic linking (i.e., the LGPL-licensed libraries are called at runtime as separate shared libraries rather than being statically compiled into the Company's proprietary code). The Company has not modified the source code of either LGPL library. Under the LGPL v2.1, use of an LGPL-licensed library via dynamic linking, without modification of the library itself, is generally understood to avoid triggering the strong copyleft obligation to license the proprietary application code under the LGPL. The Company's architecture appears to be designed to maintain this separation. The LGPL v2.1 does require that the recipient be able to modify and re-link the LGPL-licensed library, which is satisfied by the dynamic linking approach. We believe the Company's use of these LGPL v2.1 libraries is consistent with the license terms.
GNU Affero General Public License, Version 3 (AGPL v3). The SCA scan identified one (1) monitoring and observability tool licensed under the AGPL v3 that is installed and used within the Company's internal development environment. Mr. Hsiao confirmed that this AGPL-licensed component is used exclusively for internal development environment observability and debugging purposes. It is not incorporated into, linked with, or deployed as part of the Company's production SaaS platform, and it is not delivered to or made available to the Company's customers.
The AGPL v3 is the most restrictive commonly encountered copyleft license in the software industry. Unlike the GPL, the AGPL includes a provision (Section 13) that extends copyleft obligations to software that is made available to users over a network (i.e., as a service), not only to software that is distributed in binary or source form. If an AGPL-licensed component were incorporated into the Company's production SaaS platform, it could trigger an obligation to make the source code of the entire combined work available to users of the platform under the AGPL, which would be highly detrimental to the Company's proprietary IP position.
Based on our review, the Company's current use of the AGPL-licensed component appears to be limited to internal purposes in a manner that does not trigger the AGPL's copyleft obligations with respect to the Company's proprietary code. However, this represents an area of ongoing risk that requires continued vigilance. We strongly recommend that the Company implement automated controls — as described in our recommendations in Section IX — to prevent AGPL-licensed components from being introduced into production builds, either directly or as transitive dependencies.
D. Compliance Assessment
Based on our review of the SCA scan results, the Company's internal BOM, the OSS Policy, and our discussions with Mr. Hsiao, we conclude that the Company's open-source software usage is generally consistent with good industry practices for a SaaS company of Skybridge's size and stage. The Company has implemented a governance framework for open-source usage, maintains a BOM tracking process, and has adopted an internal policy that requires review and approval for new open-source components. The Company's use of copyleft-licensed components appears to be structured in a manner that avoids triggering copyleft obligations on the Company's proprietary codebase.
We did identify certain areas where the Company's open-source compliance practices could be strengthened:
(a) Transitive Dependency Tracking. The Company's BOM tracking is comprehensive for directly declared dependencies but is less rigorous with respect to transitive (indirect) dependencies — i.e., open-source packages that are pulled in automatically as dependencies of other dependencies. This gap is most pronounced in the Python package ecosystem, where transitive dependency chains can be extensive. While we did not identify any specific compliance violations arising from untracked transitive dependencies, the lack of comprehensive visibility into the full dependency tree represents a gap in the Company's compliance posture.
(b) Automated Scanning Integration. The Company's OSS compliance process relies in part on manual review and periodic audits rather than continuous automated scanning integrated into the software development lifecycle. We recommend that the Company integrate an SCA tool into its continuous integration/continuous deployment ("CI/CD") pipeline to provide real-time visibility into new open-source components as they are introduced into the codebase.
These recommendations are reflected in our risk item summary in Section IX.
VII. Key IP-Related Contracts
A. Inbound Licenses (License-In Agreements)
Skybridge is a licensee under a number of third-party software and technology license agreements that are material to its business operations. We reviewed each material inbound license for terms relating to IP ownership, scope of licensed rights, restrictions on use, sublicensing limitations, term and termination provisions, and change-of-control or anti-assignment clauses. The following is a summary of the principal categories of inbound licenses:
1. Cloud Infrastructure Services Agreement. The Company maintains an enterprise-tier cloud hosting agreement (the "Cloud Services Agreement") with a major cloud infrastructure provider for the hosting of its production and development environments. The Cloud Services Agreement is governed by standard enterprise terms and conditions, with a customized pricing addendum negotiated by the Company. The agreement grants the Company a non-exclusive, non-transferable right to use the provider's cloud services during the term. IP ownership provisions are standard: the provider retains all IP rights in its services, and the Company retains all IP rights in its applications and data. The Cloud Services Agreement does not contain a change-of-control or anti-assignment clause that would be triggered by the Transaction, as it permits assignment in connection with a merger or acquisition without consent.
2. Payment Network SDK Licenses. The Company holds developer license agreements with four (4) major card network processors and payment infrastructure providers for the use of their respective SDKs, APIs, and related integration tools. These agreements are governed by the respective networks' standard developer terms and conditions, which include requirements to comply with network operating rules, data security standards (including PCI DSS compliance), and branding guidelines. The SDK licenses are generally non-exclusive and non-transferable, and grant the Company the right to integrate the networks' payment processing functionality into the Skybridge platform. One of these agreements (with a major card network) contains an anti-assignment clause requiring prior written consent for assignment in connection with a change of control. This has been identified as a closing condition item, and the consent request was submitted on March 12, 2025. As of the date of this memorandum, consent has not yet been received, but Teresa Okafor has indicated that the Company does not anticipate any impediment to obtaining consent.
3. Data Provider Agreements. The Company licenses financial data feeds, foreign exchange rate data, and reference data from two (2) third-party data providers under commercial license agreements. These agreements provide for usage-based pricing and include standard terms regarding data ownership (the provider retains ownership of the data feeds; the Company is licensed to use the data within its platform for the benefit of its customers), data security requirements, and restrictions on redistribution. One of these agreements contains a change-of-control clause requiring 30 days' prior written notice to the data provider in connection with any change of control of the licensee. Notice under this provision is planned to be delivered in connection with the closing of the Transaction. This agreement does not grant the data provider a termination right upon a change of control; the notice provision is informational only.
4. Monitoring and Observability Platform. The Company subscribes to a commercial SaaS-based application performance monitoring and observability platform under a standard enterprise subscription agreement. The agreement grants the Company a non-exclusive right to access and use the monitoring platform during the subscription term. The agreement includes standard terms and does not contain change-of-control or anti-assignment provisions that would be triggered by the Transaction.
A detailed summary table of all material inbound licenses, including licensor, product or technology licensed, license type, key restrictions, change-of-control provisions, and expiration dates, is attached as Appendix D.
Change-of-Control Summary. Of the material inbound licenses reviewed, two (2) agreements contain anti-assignment or change-of-control provisions that may be triggered by the Transaction:
(i) The card network SDK license agreement described in paragraph 2 above, which requires prior written consent for assignment in connection with a change of control. A consent request has been submitted and is pending.
(ii) The data provider agreement described in paragraph 3 above, which requires 30 days' prior written notice (but does not include a termination right). Notice is planned to be delivered in connection with closing.
Both items are being tracked on the closing conditions tracker maintained by the deal team. We do not anticipate that either consent or notice requirement will present a material obstacle to closing, but we recommend continued monitoring of the consent request for the card network SDK license.
B. Outbound Licenses (License-Out / Customer Agreements)
Skybridge licenses its SaaS platform to its customers under standard subscription agreements. The Company's standard form customer subscription agreement (the "Standard Customer Agreement"), a copy of which was provided in the Data Room, grants each customer a non-exclusive, non-transferable, non-sublicensable, limited right to access and use the Skybridge platform (Skybridge Orchestrate and/or Skybridge Connect, as applicable) during the subscription term, solely for the customer's internal business purposes and subject to the terms and conditions of the agreement.
Source Code Access. Under the Standard Customer Agreement, no customer receives access to the Company's source code. The SaaS delivery model means that customers access the platform through web-based interfaces and APIs; they do not receive copies of the underlying software. As noted in Section II.B above, certain enterprise customer agreements contain source code escrow provisions, but no escrow arrangements have been established to date.
Enterprise Customer Variations. The Company has entered into negotiated enterprise subscription agreements with its larger customers that depart from the Standard Customer Agreement in certain respects. We reviewed the agreements with the Company's top 20 customers by ARR, as well as all customer agreements flagged by the Company as containing non-standard terms. Approximately eight (8) enterprise customer agreements include one or more of the following enhanced provisions:
(i) Source Code Escrow Provisions. These provisions require the Company, upon the customer's written request, to deposit a copy of the source code for the platform (or the relevant portions thereof) into escrow with a third-party escrow agent. Release conditions are typically limited to the Company's bankruptcy, insolvency, cessation of business, or material uncured breach of the customer agreement. As noted above, no customer has exercised the escrow request right to date.
(ii) Broader Data Portability Rights. Certain enterprise agreements include enhanced data portability provisions that require the Company to provide the customer's data in specified machine-readable formats upon termination or expiration of the agreement, with extended data retrieval periods beyond the standard contractual terms.
(iii) Limited Customization IP Ownership Provisions. A small number of enterprise agreements include provisions addressing the ownership of custom configurations, integrations, or workflows built by or for the customer on top of the Skybridge platform. Under these provisions, the customer owns the specific custom configurations and any customer-specific data models, while Skybridge retains all rights in the underlying platform, including all code, algorithms, frameworks, tools, methodologies, and general knowledge that form part of the platform or are developed by Skybridge in connection with the customization engagement. These provisions are structured to preserve Skybridge's ownership of its core IP while granting the customer ownership of their unique configurations.
Change-of-Control Provisions. Approximately twelve (12) customer agreements contain change-of-control clauses that may be triggered by the Transaction. The specific provisions vary by agreement but generally fall into the following categories:
(a) Notice Requirements. Several agreements require the Company to notify the customer within a specified period (typically 30 to 60 days) of a change of control.
(b) Consent Requirements. A smaller number of agreements require the customer's prior written consent to any assignment of the agreement in connection with a change of control. However, many of these agreements include carveouts for assignments to affiliates or successors-in-interest in connection with a merger, which may apply to the Transaction structure.
(c) Termination Rights. Several agreements grant the customer a right to terminate the agreement (typically upon 30 to 90 days' notice) following a change of control, without liability for early termination fees.
The customer agreements with change-of-control provisions have been identified and are being tracked on the closing conditions tracker. The deal team and the Company's customer success team are coordinating customer outreach to provide required notices and obtain consents where necessary. Teresa Okafor has advised that, based on her assessment of the Company's customer relationships and the nature of the Transaction, none of the change-of-control provisions is expected to result in material customer losses. The aggregate ARR attributable to customers with change-of-control clauses is estimated at approximately $14 million, representing approximately 14.8% of the Company's total ARR. A summary of the customer agreements with change-of-control provisions is attached as Appendix E.
C. Partnership and Integration Agreements
Skybridge has entered into technology partnership and integration agreements with approximately six (6) banking-as-a-service and payment infrastructure providers (collectively, the "Partnership Agreements"). These agreements establish the terms under which the parties integrate their respective platforms and technologies, enable mutual API access, and engage in co-marketing and joint go-to-market activities.
We reviewed each of the Partnership Agreements for IP ownership provisions, joint development obligations, non-compete or exclusivity restrictions, and change-of-control clauses. Our findings are as follows:
(a) IP Ownership. Each Partnership Agreement includes clear provisions establishing that each party retains sole and exclusive ownership of its pre-existing intellectual property and any intellectual property developed independently by such party during the term of the agreement. No Partnership Agreement provides for joint ownership of any intellectual property. Where integration work is performed by one party to enable connectivity with the other party's platform, the performing party retains ownership of the integration code, with a limited license granted to the other party to use the integration for the purposes of the partnership.
(b) Joint Development. None of the Partnership Agreements includes provisions for joint development of new products or technology. The partnerships are structured as integration and co-marketing relationships rather than collaborative development arrangements.
(c) Non-Compete and Exclusivity. Several Partnership Agreements include limited non-compete or non-solicitation provisions, which are narrowly scoped to prevent one party from directly soliciting the other party's customers through the integrated platform for competing services during the term of the agreement. None of the non-compete provisions is so broad as to restrict the Company's ability to develop, market, or sell its products and services generally.
(d) Change of Control. Two (2) Partnership Agreements include change-of-control provisions requiring notice to the partner within a specified period following a change of control. Neither agreement grants the partner a termination right upon a change of control. Notice obligations are being tracked on the closing conditions tracker.
(e) Confidentiality. All Partnership Agreements include mutual confidentiality provisions that restrict the disclosure and use of each party's confidential and proprietary information.
Based on our review, the Partnership Agreements do not present material IP-related concerns in connection with the Transaction.
VIII. Employee and Contractor IP Assignment Agreements
A. Employee IP Assignment
The Company utilizes a standard form Proprietary Information and Inventions Assignment Agreement ("PIIA") for all employees. The PIIA was drafted by the Company's outside employment counsel and is substantially consistent with market-standard employee IP assignment agreements used by technology companies in California and Delaware. The key provisions of the PIIA include:
(a) Invention Assignment. The employee assigns to the Company all right, title, and interest in and to any and all inventions, discoveries, developments, improvements, works of authorship, designs, algorithms, source code, formulas, processes, techniques, trade secrets, and other intellectual property created, conceived, or reduced to practice by the employee, whether alone or jointly with others, during the period of employment, that (i) relate to the Company's business or actual or demonstrably anticipated research or development, (ii) result from any work performed by the employee for the Company, or (iii) are developed using the Company's equipment, supplies, facilities, or trade secret information. The assignment includes a prospective assignment of future inventions falling within the scope of the foregoing.
(b) California Labor Code Compliance. For employees based in California (approximately 130, primarily engineering personnel), the PIIA includes a carveout in compliance with California Labor Code Sections 2870 through 2872, which exclude from the scope of the assignment any inventions that the employee develops entirely on their own time without using the Company's equipment, supplies, facilities, or trade secret information, and that do not relate to the Company's business or to the Company's actual or demonstrably anticipated research or development.
(c) Confidentiality. The employee agrees to hold in strict confidence all Proprietary Information (as defined in the PIIA) of the Company and not to disclose, use, or publish such information except as necessary in the performance of their duties for the Company. The confidentiality obligations survive termination of employment.
(d) Non-Solicitation. The employee agrees not to, for a period of twelve (12) months following termination of employment, directly or indirectly solicit, recruit, or encourage any employee or contractor of the Company to leave the Company's service. The PIIA does not contain a non-competition covenant, consistent with the Company's approach and applicable restrictions under California law.
(e) Prior Inventions Disclosure. The employee is required to disclose on an attached schedule any pre-existing inventions that the employee wishes to exclude from the scope of the assignment. Employees with no prior inventions to disclose are required to indicate "None" on the schedule.
Execution Status. We reviewed the Company's human resources records and PIIA files provided in the Data Room. Our review confirmed that PIIAs have been executed by substantially all current employees of the Company — specifically, 336 of the Company's approximately 340 employees. We identified four (4) employees who do not have executed PIIAs on file:
(i) Employee A — Hired January 2025; Marketing Coordinator (non-engineering role). PIIA was included in onboarding materials but has not yet been returned as executed. HR has confirmed that follow-up is in progress.
(ii) Employee B — Hired February 2025; Account Manager (non-engineering role). PIIA was included in onboarding materials but has not yet been returned as executed. HR has confirmed that follow-up is in progress.
(iii) Employee C — Hired July 2018; Operations Manager (non-engineering role). One of the Company's earliest employees, hired during the Company's pre-revenue phase. No PIIA was located in the Data Room. Teresa Okafor acknowledged the gap and confirmed that efforts are underway to obtain an executed PIIA from this employee.
(iv) Employee D — Hired August 2018; Finance Associate (non-engineering role). One of the Company's earliest employees. No PIIA was located in the Data Room. Similar remediation efforts are underway.
We note that all four identified employees are in non-engineering roles and are not involved in the development of the Company's software platform or other technical intellectual property. Accordingly, the risk that any of these employees has created or contributed to Company IP that is not subject to a valid assignment is assessed as low. Nevertheless, we recommend that the Company obtain executed PIIAs from all four employees prior to the closing of the Transaction to ensure completeness of the IP chain of title and to satisfy the representations and warranties in the BCA.
B. Contractor IP Assignment
The Company has engaged approximately twenty-five (25) independent contractors over its history for software development and related technical work. The Company's standard form independent contractor agreement includes the following IP-related provisions:
(a) Work-for-Hire. The agreement provides that all work product created by the contractor in connection with the engagement constitutes a "work made for hire" within the meaning of the U.S. Copyright Act (17 U.S.C. § 101), to the maximum extent permitted by applicable law, and that all right, title, and interest in and to such work product is owned by the Company.
(b) Express Assignment. As a belt-and-suspenders measure (recognizing that the "work made for hire" doctrine may not apply to all categories of works or in all circumstances for independent contractors), the agreement also includes an express, irrevocable assignment of all right, title, and interest in and to any and all intellectual property rights in the contractor's work product to the Company.
(c) Moral Rights Waiver. The contractor waives, to the fullest extent permitted by applicable law, any and all moral rights in the work product.
(d) Confidentiality. The contractor agrees to maintain the confidentiality of all Company proprietary information during and after the engagement.
(e) Representations. The contractor represents that the work product will be original, will not infringe the intellectual property rights of any third party, and will not incorporate any pre-existing intellectual property of the contractor or any third party without the Company's prior written approval.
We reviewed the contractor agreements for all fifteen (15) current and recent contractors (i.e., those with engagements active within the past 24 months). All fifteen agreements contain the IP assignment provisions described above, and all have been duly executed by both parties. We did not identify any material deviations from the standard terms in these agreements.
Historical Contractor Agreements. Three (3) contractor agreements from the Company's 2018–2019 period (during the initial platform development phase) were not located in the Data Room despite our requests and the Company's diligent search efforts. Teresa Okafor confirmed that the Company engaged three individual con