PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP Attorneys at Law One Liberty Plaza, 50th Floor New York, New York 10006
MEMORANDUM
March 28, 2025 (Updated as of May 2025 for Pre-Closing Supplement)
TO: James Prentice, Sandra Tung — Calderwood & Harkness LLP
FROM: Naomi Petersen, Ryan Kowalski — Calderwood & Harkness LLP
RE: Regulatory and Licensing Memorandum — Skybridge Fintech Ltd. (Delaware corporation, EIN 83-2471560)
CLIENT/MATTER: Skybridge Fintech Ltd. — De-SPAC Business Combination with Pinnacle Growth Acquisition Corp.
This memorandum is a privileged and confidential communication prepared at the direction of counsel for the purpose of rendering legal advice in connection with the proposed de-SPAC business combination between Skybridge Fintech Ltd. and Pinnacle Growth Acquisition Corp. This memorandum is protected by the attorney-client privilege and constitutes attorney work product under Federal Rule of Civil Procedure 26(b)(3) and its state-law equivalents. This memorandum should not be disclosed to any person other than those to whom it is addressed without the prior written consent of Calderwood & Harkness LLP.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
This memorandum summarizes the regulatory and licensing posture of Skybridge Fintech Ltd. ("Skybridge" or the "Company"), a Delaware corporation headquartered at 1200 Market Street, Suite 1400, Wilmington, Delaware 19801, with an engineering office located at 450 Folsom Street, 7th Floor, San Francisco, California 94105, in connection with the proposed approximately $450,000,000 de-SPAC business combination (the "Business Combination" or the "Transaction") with Pinnacle Growth Acquisition Corp., a Cayman Islands exempted company ("Pinnacle" or "PGAC"). The Transaction is being effected pursuant to the Business Combination Agreement dated as of January 12, 2025, as amended (the "BCA"), by and among Pinnacle, Pinnacle Merger Sub Inc., a Delaware corporation and wholly owned subsidiary of Pinnacle ("Merger Sub"), and Skybridge.
Transaction Structure. The Transaction is structured as a forward triangular merger pursuant to which Merger Sub will merge with and into Skybridge, with Skybridge surviving the merger as a wholly owned subsidiary of Pinnacle, which will have domesticated as a Delaware corporation prior to closing and will be renamed "Skybridge Fintech Holdings, Inc." (the "Combined Company" or "Holdings"). Upon consummation of the Transaction, the Combined Company is expected to list its shares of common stock on the Nasdaq Global Market under the ticker symbol "SBFT."
Business Description. Skybridge operates a cloud-based payment orchestration and embedded-finance software-as-a-service ("SaaS") platform that serves mid-market financial institutions and neobanks across the United States. The platform provides payment routing, processing, and reconciliation services, as well as embedded-finance functionalities including virtual account management, ledger-as-a-service, and API-based payment initiation. The Company currently employs approximately 340 employees across its Wilmington and San Francisco offices and reported fiscal year 2024 revenue of approximately $87.3 million, with annualized recurring revenue ("ARR") of approximately $94.6 million. The Company was founded on June 15, 2018, and incorporated in the State of Delaware on that date.
Scope of Analysis. This memorandum analyzes the following key regulatory areas as they apply to Skybridge's business operations and, critically, as they are affected by the proposed change of control resulting from the Business Combination:
(a) State money transmitter licensing, including change-of-control approval and notification requirements;
(b) Payment processor and payment facilitator registrations with card networks and ACH participants;
(c) Bank Secrecy Act ("BSA") and anti-money laundering ("AML") compliance, including FinCEN registration and OFAC sanctions screening;
(d) Federal and state data privacy and cybersecurity requirements, including the Gramm-Leach-Bliley Act, the California Consumer Privacy Act / California Privacy Rights Act, and other state comprehensive privacy laws;
(e) Consumer financial protection, including the Consumer Financial Protection Bureau's supervisory authority and Regulation E compliance; and
(f) Change-of-control implications for all existing licenses, registrations, and regulatory approvals held by the Company.
Overall Assessment. Based on our review of the Company's regulatory filings, compliance programs, licensing documentation, and discussions with Company management and counsel, we conclude that Skybridge's regulatory posture is generally sound and that the Company has established a compliance infrastructure reasonably designed to satisfy its obligations under applicable federal and state law. However, several specific items require attention in connection with the change of control that will occur upon consummation of the Business Combination, most significantly the requirement to obtain prior regulatory approval from multiple state financial regulators before the projected closing date of July 21, 2025. These items, along with our recommendations for addressing them, are detailed throughout this memorandum and summarized in Section X below.
Coordination Note. This memorandum was prepared in coordination with Leonard Cross of Calderwood & Harkness LLP's Tax Practice Group and Martin Cho of Cedarhurst Advisory Group LLC, the Company's outside tax advisor, with respect to tax-related aspects of the regulatory analysis. This memorandum supplements the Legal Due Diligence Summary Memorandum dated March 15, 2025, and the intellectual Property Due Diligence Memorandum dated March 20, 2025, each prepared by Calderwood & Harkness LLP in connection with the Transaction, and should be read in conjunction with those documents.
II. COMPANY OVERVIEW AND REGULATORY FRAMEWORK
A. Business Model and Regulatory Characterization
Skybridge operates a cloud-based payment orchestration platform that routes, processes, and reconciles payment transactions on behalf of its financial institution and neobank clients. The platform is designed to serve as a middle-layer infrastructure connecting Skybridge's clients to the payment rails — including card networks, the ACH system, and wire transfer networks — enabling those clients to offer seamless payment experiences to their end users without having to build and maintain their own integrations with multiple payment processors and banking partners.
In addition to its core payment orchestration functionality, Skybridge offers a suite of embedded-finance SaaS capabilities, including:
• Virtual Account Management: The platform enables clients to create and manage virtual sub-accounts on behalf of their end users, facilitating fund segregation, account-level transaction tracking, and balance management.
• Ledger-as-a-Service: Skybridge provides a real-time, double-entry ledger infrastructure that clients use to track fund movements, maintain account balances, and generate regulatory reporting.
• API-Based Payment Initiation: Through a comprehensive set of RESTful APIs, Skybridge enables its clients to initiate ACH transfers, card payments, and wire transfers programmatically, integrating payment functionality directly into the client's own applications.
A key distinction in the regulatory characterization of Skybridge's business model is that Skybridge generally acts as a technology provider and software platform rather than as a money transmitter itself. The Company's platform routes payment instructions and facilitates the movement of funds, but in the majority of its transaction flows, Skybridge does not take possession, custody, or control of customer funds. Instead, funds flow through the accounts of Skybridge's licensed banking partners, which serve as the depository institutions and settlement counterparties.
However, the analysis of whether Skybridge's activities constitute "money transmission" varies by state, depending on the specific statutory definitions in each jurisdiction and whether Skybridge at any point exercises control over customer funds, even briefly or constructively, in the course of processing transactions. As discussed in Section III below, Skybridge has obtained money transmitter licenses in twelve states where its activities have been determined — in consultation with outside regulatory counsel — to potentially constitute money transmission based on the specific features of its payment orchestration product and the applicable state statutory frameworks.
Skybridge's platform integrates with licensed banking partners for settlement purposes. The Company does not hold deposits, maintain customer funds in its own accounts for extended periods, or engage in lending activities. Skybridge's banking partner relationships are structured to ensure that customer funds are held in custodial or for-benefit-of ("FBO") accounts at the partner banks, with Skybridge acting solely as the technology layer facilitating the movement of funds at the direction of its clients.
Revenue Model. Skybridge generates revenue through two primary streams: (i) SaaS subscription fees charged on an annual recurring basis for access to the platform and its embedded-finance features; and (ii) per-transaction processing fees charged as a percentage of transaction volume or as a flat per-transaction fee. For fiscal year 2024, the Company reported total revenue of approximately $87.3 million, representing growth of approximately 41% over fiscal year 2023 revenue of approximately $61.8 million. The Company's annualized recurring revenue as of December 31, 2024 was approximately $94.6 million.
B. Applicable Regulatory Regimes — Overview
The following is a summary of the principal regulatory regimes applicable to Skybridge's business operations. Each of these regimes is discussed in greater detail in the sections that follow.
Federal Regulatory Framework. At the federal level, Skybridge's operations are subject to the following principal regulatory requirements:
• Bank Secrecy Act (BSA) and USA PATRIOT Act. As a money services business ("MSB") registered with the Financial Crimes Enforcement Network ("FinCEN"), Skybridge is subject to the BSA's requirements for MSBs, including the obligation to maintain an AML compliance program, file Suspicious Activity Reports ("SARs") and Currency Transaction Reports ("CTRs"), and comply with recordkeeping and reporting requirements. The USA PATRIOT Act imposes additional requirements, including information-sharing obligations under Sections 314(a) and 314(b).
• FinCEN Registration Requirements. Federal law (31 U.S.C. § 5330) requires MSBs to register with FinCEN. Skybridge maintains a current FinCEN MSB registration, as discussed in Section V.A below.
• Gramm-Leach-Bliley Act (GLBA). As a "financial institution" under the GLBA, Skybridge is subject to the Act's privacy and data security requirements, including the obligation to provide privacy notices to clients, limit the sharing of nonpublic personal information, and maintain a comprehensive information security program consistent with the FTC Safeguards Rule.
• Electronic Fund Transfer Act (EFTA) / Regulation E. To the extent that Skybridge's platform facilitates electronic fund transfers to or from consumer accounts, certain provisions of the EFTA and its implementing regulation (Regulation E, 12 C.F.R. Part 1005) may apply. The application of Regulation E to Skybridge's operations is discussed in Section VII.B below.
• Consumer Financial Protection Bureau (CFPB) Oversight. The CFPB has supervisory authority over "larger participants" in certain consumer financial product markets, as well as enforcement authority under the Dodd-Frank Act's prohibition on unfair, deceptive, or abusive acts or practices ("UDAAP"). The potential applicability of CFPB oversight to Skybridge is discussed in Section VII.A.
State Regulatory Framework. At the state level, Skybridge is subject to the following principal regulatory requirements:
• Money Transmitter Licensing. Nearly all U.S. states, as well as the District of Columbia, Puerto Rico, and the U.S. Virgin Islands, have enacted money transmitter or money services business licensing statutes. The applicability of these statutes to Skybridge, the Company's current licensing status, and the change-of-control implications of the Transaction are discussed in detail in Section III.
• Uniform Money Services Act. Several states have adopted some version of the Uniform Money Services Act, which provides a standardized framework for the regulation of money services businesses. However, state-by-state variations remain significant.
• State Payment Processor Exemptions. Certain states provide exemptions from money transmitter licensing for entities that function solely as payment processors or technology platforms, rather than as money transmitters. Skybridge relies on such exemptions in certain jurisdictions, as discussed in Section III.B.
• State Consumer Protection Laws. Skybridge is subject to state unfair and deceptive acts or practices ("UDAP") statutes in the states where it operates, as discussed in Section VII.C.
Data Privacy Framework. Skybridge's data privacy and cybersecurity obligations arise under multiple overlapping federal and state regimes:
• California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA). Applicable to Skybridge's processing of personal information of California residents, as discussed in Section VI.B.1.
• Other State Comprehensive Privacy Laws. Including the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), and the Connecticut Data Privacy Act ("CTDPA"), among others, as discussed in Section VI.B.2.
• GLBA (Financial Data). The GLBA's privacy and data security requirements apply to Skybridge's handling of nonpublic personal information of consumers, as discussed in Section VI.A.
• State Data Breach Notification Laws. All fifty states, the District of Columbia, and U.S. territories have enacted data breach notification statutes imposing obligations on entities that experience breaches of personally identifiable information, as discussed in Section VI.C.
International Considerations. Skybridge is not currently licensed in any non-U.S. jurisdiction and does not maintain offices or employees outside the United States. However, certain platform users may be non-U.S. entities accessing the Skybridge platform through U.S.-based banking partners. To the extent that Skybridge's operations involve cross-border transactions or data flows, the Company is subject to OFAC sanctions compliance requirements, as discussed in Section V.D, and may have limited obligations under international data protection regimes, as discussed in Section VI.D.
III. STATE MONEY TRANSMITTER LICENSING ANALYSIS
A. Overview of Money Transmission Regulation
Nearly all U.S. states, as well as the District of Columbia, Puerto Rico, and the U.S. Virgin Islands, have enacted money transmitter or money services business licensing statutes that regulate the business of money transmission within their borders. The definition of "money transmission" varies by state but generally includes receiving money or monetary value for the purpose of transmitting it to another location or person by any means, including by wire, electronic transfer, or other mechanism. Some states define money transmission broadly to include any activity involving the receipt of money for transmission, while others focus on whether the entity exercises control over the funds during the transmission process.
The regulatory landscape for money transmission is complex and fragmented, with significant variations among states regarding the scope of regulated activities, available exemptions, licensing requirements, bonding and net worth thresholds, examination and reporting obligations, and change-of-control procedures. There is no single federal money transmitter license, and state licensing requirements must be analyzed on a jurisdiction-by-jurisdiction basis.
The key analytical question for Skybridge is whether the Company's handling of payment instructions and routing of funds through its payment orchestration platform constitutes "money transmission" requiring licensure in each state, or whether Skybridge's activities fall within an applicable exemption. The most relevant exemptions for Skybridge's business model include:
• Agent-of-Payee Exemption. Several states exempt from money transmitter licensing requirements entities that receive funds on behalf of the payee (i.e., the entity to whom a payment is owed) pursuant to an agency agreement with the payee. Where Skybridge acts as an agent of its financial institution clients in receiving and processing payments, this exemption may apply.
• Bank-Agent Exemption. Certain states exempt from licensing entities that act as agents of licensed banks or other depository institutions in connection with the transmission of funds. Skybridge's relationships with its banking partners may support reliance on this exemption in certain states.
• Technology Platform / Software Provider Exclusion. Some states exclude from the definition of "money transmission" activities that consist solely of providing technology platforms or software that facilitate payment processing, where the technology provider does not at any point take possession, custody, or control of the funds being transmitted.
The applicability of these exemptions depends on the specific statutory language in each state, the operational details of how Skybridge's platform handles fund flows in that state, and the regulatory guidance or interpretive positions adopted by each state's financial regulatory agency. Skybridge has engaged regulatory counsel to analyze these issues on a state-by-state basis and has obtained legal opinions supporting its exemption claims in the relevant jurisdictions, as discussed below.
B. Skybridge's Current Licensing Status
Based on our review of the Company's regulatory files and discussions with Teresa Okafor, General Counsel, Skybridge holds money transmitter licenses in twelve (12) states where its activities have been determined — in consultation with outside regulatory counsel — to potentially constitute money transmission based on the specific features of its payment orchestration product and the applicable state statutory frameworks. The following table summarizes the Company's current money transmitter licensing status:
A complete schedule of all money transmitter licenses, including detailed license terms, conditions, and associated bonding requirements, is attached hereto as Exhibit A.
In approximately twenty-six (26) additional states, Skybridge operates under the "agent of the payee" exemption or a technology-platform / software-provider exclusion, supported by legal opinions obtained from outside regulatory counsel at the time of market entry in each state. These legal opinions analyze the specific statutory provisions in each jurisdiction and conclude that Skybridge's activities, as conducted in that state, do not constitute money transmission requiring licensure. A list of these jurisdictions and the legal basis for each exemption claim is attached hereto as Exhibit C.
In the remaining states, Skybridge's operations are limited to SaaS platform access without fund-flow involvement (i.e., the Company provides only software tools and does not route, process, or facilitate the transmission of funds in those states), making money transmitter licensure unnecessary. In these states, the Company's relationship with its clients is purely a software licensing arrangement, and the clients themselves — or their banking partners — handle all fund movements.
New York Considerations. We note that Skybridge holds a New York money transmitter license issued under the New York Banking Law. In connection with its initial licensing in New York, the Company confirmed with the New York Department of Financial Services ("NYDFS") that its activities do not require a BitLicense under 23 NYCRR Part 200, as Skybridge does not engage in virtual currency business activity as defined by that regulation. Skybridge's platform does not process, store, or transmit virtual currencies, and the Company does not offer virtual currency exchange, custody, or related services. This determination was memorialized in correspondence with the NYDFS on file with the Company.
C. Surety Bond and Net Worth Requirements
Each state in which Skybridge holds a money transmitter license imposes bonding or net worth requirements as a condition of licensure. These requirements are designed to protect consumers in the event of a licensee's insolvency or failure to remit transmitted funds. Skybridge maintains surety bonds in each licensed state, with bond amounts ranging from $25,000 (in states with lower transaction volume thresholds) to $2,000,000 (in states such as New York and California with higher requirements). The specific bonding amount in each state is determined by the applicable statute or regulation, often based on the licensee's transaction volume in that state.
The aggregate surety bond obligations maintained by Skybridge across all twelve licensed states total approximately $6,500,000. All bonds are currently in force and in good standing.
Net worth requirements imposed by certain states are satisfied based on Skybridge's audited financial statements. For fiscal year 2024, the Company reported EBITDA of approximately $14.1 million and maintained a positive cash position. The Company's independent auditor, Graystone Thornton LLP, has issued unqualified audit opinions on the Company's financial statements for fiscal years 2022, 2023, and 2024.
Skybridge's existing surety bond provider is Northbridge Surety & Casualty Co. ("Northbridge"), a nationally recognized surety provider. All bonds are issued by Northbridge under a master surety bond program and are subject to annual renewal. In connection with the Transaction, certain surety bonds may require endorsement or re-issuance to reflect the change in the Company's ownership structure. We recommend that the Company engage Northbridge promptly following the execution of the BCA to discuss the process for endorsing or replacing existing bonds post-closing and to ensure that there is no lapse in bonding coverage.
D. Change-of-Control Implications for Money Transmitter Licenses
The change-of-control implications of the Business Combination for Skybridge's existing money transmitter licenses represent the most significant regulatory workstream associated with the Transaction. This section provides a detailed analysis of these implications and the steps required to address them.
Characterization of the Change of Control. The Business Combination constitutes a change of control of Skybridge for purposes of state money transmitter licensing statutes. Upon consummation of the Transaction, Skybridge will become a wholly owned subsidiary of Skybridge Fintech Holdings, Inc. (the renamed, domesticated PGAC). The Company's ultimate ownership structure will change from its current private, venture capital-backed ownership — consisting principally of Harborview Partners (holding approximately 38.2% of outstanding equity), Atlas Horizon Ventures Fund II, LP (holding approximately 22.7%), and founder and management (holding approximately 31.4%, inclusive of vested options and restricted stock) — to a publicly traded corporation with a diverse and dispersed shareholder base. This change in ultimate beneficial ownership clearly constitutes a "change of control" under virtually every state money transmitter statute that includes a change-of-control provision.
State-by-State Analysis. Most state money transmitter statutes require some form of regulatory notification or approval in connection with a change of control of a licensed entity. The specific requirements vary significantly by state and can be broadly categorized as follows:
Prior Approval Required. Approximately eight to twelve of Skybridge's licensed states require the Company to submit a change-of-control application to the state regulatory authority and obtain affirmative approval before the change of control takes effect. These states include, most notably:
• New York: The NYDFS requires prior written approval of any change of control of a licensed money transmitter. The application must include biographical information on all new controlling persons (including directors, officers, and significant shareholders of the acquiring entity), audited financial statements of the acquiring entity, a business plan for the combined entity, and background investigation authorizations. The NYDFS may also require individual interviews with key principals. Estimated processing time: 60 to 90 days from submission of a complete application, although actual processing times can be longer depending on the complexity of the transaction and the current regulatory workload.
• California: The California Department of Financial Protection and Innovation ("DFPI") requires prior approval of a change of control pursuant to California Financial Code Section 2050 et seq. The application requires biographical and financial information regarding the acquiring entity and its principals, including personal financial statements and authorization for background checks. Estimated processing time: 60 to 120 days.
• Texas: The Texas Department of Banking requires notification and approval of a change of control under Texas Finance Code Chapter 151. The application includes financial and biographical information for the acquiring entity and its control persons. Estimated processing time: 45 to 90 days.
• Other Prior Approval States: Florida, Illinois, Pennsylvania, Washington, and Connecticut each require some form of prior approval or non-objection from the applicable state regulator before a change of control takes effect. Processing times vary but generally range from 30 to 90 days.
Prior Notice Required. Several additional states require advance written notice to the state regulator before a change of control takes effect but do not require affirmative regulatory approval. The notice period is typically fifteen to thirty days. In these states, the change of control may proceed unless the regulator objects within the notice period.
Post-Closing Notice Only. A smaller number of states allow the licensee to notify the state regulator within a specified period (typically thirty days) after the change of control has taken effect. In these states, no prior approval or advance notice is required.
A comprehensive tracker of all required change-of-control filings, organized by jurisdiction, filing type, deadline, estimated processing time, and current status, is attached hereto as Exhibit B.
Status of Filings. As of the date of this updated memorandum (May 2025), change-of-control applications and notification packages have been prepared for submission in all jurisdictions requiring prior approval. Filings are targeted for submission in late May to early June 2025, in order to allow maximum processing time before the projected closing date of July 21, 2025. In certain jurisdictions where pre-filing conferences or consultations are customary (including New York and California), the Company and its regulatory counsel have initiated preliminary discussions with the relevant regulators.
New York DFS Timeline. Given the significance of the New York license and the NYDFS's typically deliberate processing timeline, the Company's change-of-control application to the NYDFS should be submitted no later than early June 2025. We intend to request expedited processing, and we will provide the NYDFS with a letter explaining the Transaction timeline and the regulatory context. However, there can be no assurance that the NYDFS will grant an expedited processing request, and the Company should be prepared for the possibility that the New York approval may not be received before the projected closing date.
Risk Analysis. If any required state regulatory approval is not obtained by the projected closing date, several options are available:
• Proceed to closing without the approval. In certain states, the practical consequence of proceeding with a change of control before receiving regulatory approval is limited to administrative penalties or the potential for a remedial order from the regulator, rather than automatic revocation of the license. However, this approach carries regulatory risk and could adversely affect the Company's relationship with the applicable state regulator.
• Operate under interim arrangements. In some states, it may be possible to operate under an interim license extension or a temporary order permitting continued operations while the change-of-control application is pending, particularly where the application was filed in good faith and within the required timeframe.
• Delay closing. The BCA may permit an extension of the outside closing date under certain circumstances, although this would require the agreement of both parties and may have implications for the SPAC's trust account and redemption timeline.
We note that the BCA does not condition closing on the receipt of any specific state regulatory approval. The closing conditions set forth in the BCA are limited to: (i) SEC effectiveness of the Registration Statement on Form S-4; (ii) PGAC shareholder approval; (iii) no Material Adverse Effect; (iv) no legal impediment to the closing; and (v) Nasdaq listing approval for the Combined Company's shares. Accordingly, the failure to receive any particular state regulatory approval prior to closing would not, by itself, prevent the closing from occurring, but it would create a post-closing regulatory compliance issue that would need to be remedied promptly.
Recommendations. We recommend the following approach to managing the change-of-control filing process:
1. Commence all change-of-control filings promptly, with a target filing date of no later than early June 2025 for all jurisdictions requiring prior approval.
2. Engage local regulatory counsel in New York, California, and Texas — the jurisdictions with the longest expected processing times and the most complex application requirements — to assist with the preparation and submission of change-of-control applications and to manage follow-up communications with the applicable regulators.
3. Calendar follow-up dates for each state's processing timeline relative to the projected closing date of July 21, 2025, and establish a weekly reporting cadence to monitor the status of all pending filings.
4. Prepare contingency plans for any jurisdiction where approval may not be received prior to closing, including drafts of requests for interim operating authority or temporary extensions.
IV. PAYMENT PROCESSOR AND PAYMENT FACILITATOR REGISTRATIONS
A. Card Network Registration
Skybridge is registered as a payment facilitator ("PayFac") with major card networks through its sponsoring acquiring bank relationships. Payment facilitator registration is required for entities that process card-based payment transactions on behalf of sub-merchants or clients, providing those clients with access to the card network rails without requiring each client to maintain its own direct relationship with an acquiring bank.
Skybridge maintains payment facilitator registrations with the following card networks through its processing bank partners:
• Visa: Skybridge is registered as a Visa PayFac through its sponsoring acquiring bank, Velthorn Commerce Bank, N.A. The registration is current and in good standing.
• Hollowell Partners LLC: Skybridge is registered as a Hollowell Partners LLC PayFac through Velthorn Commerce Bank, N.A. The registration is current and in good standing.
• Other Networks: Skybridge maintains registrations or is otherwise authorized to process transactions through additional card networks as required by its clients' transaction flows.
The Company's registration status with all applicable card networks has been confirmed as current and in good standing as of the date of diligence. Card network registration requirements, including any change-of-control notification provisions, are governed by the applicable card network operating rules and the Company's agreements with its sponsoring acquiring banks. We have reviewed these agreements and note that certain of them contain provisions requiring notification to the card network and/or the sponsoring bank in connection with a change of control of the registered PayFac entity. These provisions are addressed in the Material Contracts Summary memorandum prepared in connection with the Transaction.
B. ACH and Wire Transfer Operations
Skybridge processes ACH (Automated Clearing House) transactions as a third-party sender ("TPS") through its banking partners. As a TPS, Skybridge originates ACH entries on behalf of its clients by submitting those entries to an originating depository financial institution ("ODFI"), which in turn submits the entries to the ACH network. Skybridge is not itself a direct participant in the ACH network; rather, it relies on its ODFI relationships to access the ACH rails.
Skybridge's primary banking relationships for ACH processing include:
• Velthorn Commerce Bank, N.A. (100 Federal Street, Boston, Massachusetts 02110): Velthorn Commerce serves as both an ODFI for certain of Skybridge's ACH transaction flows and as a general banking partner. Additionally, Skybridge maintains a credit facility with Velthorn Commerce Bank, N.A., pursuant to a Credit Agreement dated March 22, 2023, providing for a $25,000,000 revolving credit facility. As of April 14, 2025, the outstanding balance under the revolving credit facility was approximately $18,500,000. The credit facility is a separate lending relationship from Velthorn Commerce's role as a processing partner, although both relationships are governed by overlapping contractual arrangements.
• Additional Sponsor Banks: Skybridge maintains ODFI relationships with additional sponsor banks for redundancy, geographic coverage, and risk management purposes. The identities of these banks and the terms of the applicable agreements are detailed in the Material Contracts Summary.
The change of control resulting from the Business Combination may trigger notice or consent requirements under the Company's ACH processing agreements with its ODFI partners. These provisions vary by agreement, with some requiring advance notice of a change of control and others requiring the ODFI's consent before the change of control takes effect. We have flagged these provisions in the Material Contracts Summary and recommend that the Company promptly engage its ODFI partners to initiate the notification and consent process.
Skybridge also facilitates wire transfer transactions through its banking partners, although wire transfers represent a smaller portion of the Company's overall transaction volume compared to ACH. The same ODFI and sponsor bank relationships are used for wire transfer processing.
C. NACHA Compliance
Skybridge represents that it complies with the NACHA Operating Rules and Guidelines applicable to third-party senders, including the rules governing the origination, processing, and return of ACH entries. NACHA compliance is a condition of Skybridge's ODFI relationships and is critical to the Company's ability to process ACH transactions.
Skybridge conducts annual NACHA compliance audits, which are performed by a qualified independent auditor in accordance with NACHA's requirements for third-party senders. The most recent NACHA compliance audit was completed in the fourth quarter of 2024. The audit resulted in no material findings, and the Company was determined to be in compliance with all applicable NACHA Operating Rules.
We note that NACHA has implemented certain rules regarding the registration and oversight of third-party senders by their ODFI partners. Skybridge's ODFI partners maintain ongoing monitoring and oversight of Skybridge's ACH activities in compliance with these rules, and Skybridge provides its ODFI partners with regular compliance certifications and reporting as required.
V. BANK SECRECY ACT / AML COMPLIANCE
A. FinCEN Registration
Skybridge is registered with the Financial Crimes Enforcement Network ("FinCEN") as a money services business — specifically as a money transmitter — pursuant to 31 C.F.R. § 1022.380. Federal law (31 U.S.C. § 5330) requires every money services business to register with FinCEN, and Skybridge maintains a current and effective FinCEN MSB registration.
FinCEN MSB registration must be renewed biennially. The Company's current registration is effective and has not expired. The FinCEN registration number is on file with the Company's General Counsel and has been provided to Calderwood & Harkness LLP for inclusion in the diligence records. As discussed in Section V.F below, the FinCEN registration must be updated within 180 days after the change of control resulting from the Business Combination to reflect the new controlling person(s) of Skybridge.
B. AML Program
Skybridge maintains a written AML compliance program as required by the BSA and applicable state money transmitter licensing laws. The BSA requires each MSB to develop, implement, and maintain an effective AML program that is reasonably designed to prevent the MSB from being used to facilitate money laundering or the financing of terrorism. Skybridge's AML program includes the following elements:
(i) Compliance Officer. Teresa Okafor, General Counsel, serves as the interim BSA Officer with overall responsibility for the AML compliance program. A dedicated AML compliance manager reports directly to Ms. Okafor and is responsible for the day-to-day administration of the program, including transaction monitoring, SAR filing, and training. The Company has represented that it intends to hire a full-time, standalone Chief Compliance Officer following the closing of the Business Combination, consistent with the increased compliance infrastructure expected of a public company.
(ii) Internal Policies and Procedures. The Company maintains detailed written policies and procedures for the detection and reporting of suspicious activity, including transaction monitoring rules, escalation procedures, and documentation standards. These policies and procedures are reviewed and updated at least annually to reflect changes in regulatory requirements and the Company's business operations.
(iii) Training Program. Skybridge provides AML training to all employees upon hire and on an annual basis thereafter. Specialized training is provided to employees in compliance, operations, and client-facing roles who are most likely to encounter potential money laundering or terrorist financing activity.
(iv) Independent Testing. The Company engages a third-party AML consultancy to conduct an annual independent test of the AML compliance program. The independent test evaluates the adequacy of the program's policies, procedures, and internal controls, as well as the Company's compliance with applicable BSA requirements. The most recent independent test was completed in the second quarter of 2024 and identified no material deficiencies in the Company's AML program.
Suspicious Activity Reports (SARs). Skybridge files SARs with FinCEN as required by federal law. We reviewed the Company's SAR filing history during the diligence period and identified no material deficiencies, including no instances where the Company failed to file a SAR in connection with a transaction or pattern of transactions that warranted reporting. The Company's SAR filing volume is consistent with the size and nature of its business operations.
Currency Transaction Reports (CTRs). CTR filing obligations are not typically applicable to Skybridge given the Company's electronic transaction model — the Company does not receive, disburse, or exchange currency in physical form. However, the Company maintains procedures for CTR filing in the event that such obligations arise.
C. Customer Identification Program (CIP) and Know Your Customer (KYC)
Skybridge maintains a Customer Identification Program ("CIP") and Know Your Customer ("KYC") procedures for the onboarding of institutional clients, including financial institutions and neobanks. The CIP/KYC program requires the collection and verification of identifying information for each prospective client, including legal entity name, taxpayer identification number, principal place of business, authorized representatives, and beneficial ownership information consistent with FinCEN's Customer Due Diligence ("CDD") Rule.
Enhanced due diligence ("EDD") procedures are applied to clients that are assessed as higher risk based on the Company's risk scoring methodology. Risk factors that may trigger EDD include the client's geographic location, the nature of the client's business, the volume and frequency of transactions, and the client's regulatory status and licensing history.
With respect to KYC for end consumers who use the platforms of Skybridge's clients, Skybridge's platform clients — which are themselves licensed financial institutions — bear primary responsibility for conducting KYC on their end users in accordance with applicable BSA/AML requirements. Skybridge performs platform-level monitoring of transaction patterns and volumes that may indicate suspicious activity at the end-user level, but the primary KYC obligation rests with the licensed financial institution client.
D. OFAC Sanctions Screening
Skybridge screens transactions and counterparties against the Office of Foreign Assets Control ("OFAC") Specially Designated Nationals and blocked Persons ("SDN") List and other restricted party lists maintained by OFAC and other U.S. government agencies. Sanctions screening is a critical component of the Company's compliance program, given that violations of U.S. sanctions laws can result in severe civil and criminal penalties.
The Company has integrated automated OFAC screening functionality into its payment orchestration platform, enabling real-time screening of transaction parties and beneficiaries against the SDN list and other restricted party lists. Potential matches are flagged for manual review by the compliance team before the transaction is permitted to proceed.
During the diligence period, no OFAC violations or voluntary self-disclosures were identified. The Company has not been the subject of any OFAC enforcement action, investigation, or inquiry.
E. USA PATRIOT Act Section 314(a) and (b)
Skybridge participates in FinCEN's Section 314(a) information-sharing program, which enables federal law enforcement agencies to request information from financial institutions regarding accounts and transactions that may be relevant to money laundering or terrorist financing investigations. The Company has designated a point of contact for Section 314(a) requests and maintains procedures for responding to such requests within the timeframes required by FinCEN.
Additionally, Skybridge participates in the Section 314(b) voluntary information-sharing program, which permits financial institutions to share information with one another for the purpose of identifying and reporting potential money laundering or terrorist financing activity. The Company has filed the requisite notice with FinCEN to participate in the Section 314(b) program and has entered into information-sharing agreements with certain other financial institutions.
F. Change-of-Control Implications
The change of control resulting from the Business Combination has several implications for Skybridge's BSA/AML compliance program:
• FinCEN MSB Registration. Under 31 C.F.R. § 1022.380(b)(4), an MSB must file a revised registration with FinCEN not later than 180 days after a change in the information previously reported on the MSB's registration, including a change in the identity of the MSB's owner or controlling person. The change from private, VC-backed ownership to publicly traded ownership under Skybridge Fintech Holdings, Inc. constitutes such a change, and a revised FinCEN registration must be filed within 180 days after the closing of the Business Combination. This is a post-closing filing and does not require FinCEN approval before closing.
• AML Program Continuity. No regulatory gap in the Company's AML program is anticipated as a result of the Business Combination. Skybridge will continue as the surviving entity in the merger and will retain its existing AML compliance program, policies, procedures, and personnel. Teresa Okafor, the interim BSA Officer, is expected to continue in her role following the closing, providing continuity of compliance leadership.
• State-Level AML Requirements. State-level AML compliance obligations are addressed through the money transmitter license change-of-control filings discussed in Section III.D above. Most state money transmitter statutes require licensees to maintain AML programs as a condition of licensure, and the change-of-control applications will include information regarding the post-closing AML compliance structure.
VI. DATA PRIVACY AND CYBERSECURITY
A. Federal Privacy Framework
1. Gramm-Leach-Bliley Act (GLBA). Skybridge qualifies as a "financial institution" under the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq., by virtue of its payment-related activities. As a financial institution under the GLBA, Skybridge is subject to the Act's requirements for the protection of nonpublic personal information ("NPI") of consumers, including the obligation to provide initial and annual privacy notices to clients regarding the collection, use, and sharing of NPI.
Skybridge maintains a written information security program consistent with the requirements of the Federal Trade Commission ("FTC") Safeguards Rule, 16 C.F.R. Part 314, as applicable to financial institutions subject to the FTC's jurisdiction under the GLBA. The Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive information security program that contains administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of customer information.
The Company conducts an annual risk assessment to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information and to evaluate the sufficiency of the Company's existing safeguards in controlling these risks. The most recent annual risk assessment was completed in January 2025 and identified no material gaps in the Company's information security program.
2. FTC Safeguards Rule Compliance. In accordance with the revised FTC Safeguards Rule, which became effective on June 9, 2023, Skybridge has implemented the following updated safeguards:
• Designated Qualified Individual. The Company has designated Daniel Hsiao, Chief Technology Officer, as the qualified individual responsible for overseeing and implementing the Company's information security program. Mr. Hsiao has more than fifteen years of experience in information security and technology management and holds relevant industry certifications.
• Encryption. All customer data is encrypted at rest and in transit using industry-standard encryption protocols (AES-256 for data at rest; TLS 1.2 or higher for data in transit).
• Access Controls. The Company maintains role-based access controls that limit access to customer information to those employees who have a legitimate business need for such access. Access privileges are reviewed on a quarterly basis.
• Multi-Factor Authentication (MFA). MFA is required for all employees and authorized users accessing the Company's systems and customer data, including remote access.
• Incident Response Plan. The Company maintains a written incident response plan that establishes procedures for responding to security incidents, including identification, containment, eradication, recovery, notification, and post-incident review.
• Penetration Testing and Vulnerability Assessments. Annual penetration testing and semi-annual vulnerability assessments are conducted by a qualified third-party security firm. The most recent penetration test was completed in the first quarter of 2025 and identified no critical or high-severity vulnerabilities.
B. State Privacy Laws
1. California (CCPA / CPRA). Skybridge processes personal information of California residents, both through its clients' end users whose transaction data flows through the platform and through its own employees, many of whom are based at the Company's San Francisco engineering office. The Company meets the applicability thresholds under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA"), based on its annual gross revenue and the volume of personal information it processes.
Skybridge has implemented the following CCPA/CPRA compliance measures:
• Updated privacy policy disclosing the categories of personal information collected, the purposes for which personal information is used, the categories of third parties with whom personal information is shared, and consumer rights under the CCPA/CPRA.
• Data processing agreements ("DPAs") with all service providers and contractors that receive personal information from Skybridge, as required by the CCPA/CPRA.
• Mechanisms for receiving and responding to consumer rights requests, including requests to know, requests to delete, requests to correct, and requests to opt out of the sale or sharing of personal information.
• Data inventory and mapping documentation identifying the categories of personal information collected, the sources from which it is collected, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Data Protection Impact Assessments ("DPIAs") conducted for high-risk processing activities, including certain profiling and automated decision-making functions within the platform.
2. Other State Privacy Laws. In addition to the CCPA/CPRA, Skybridge is subject to the following state comprehensive privacy laws, each of which has been enacted and become effective:
• Virginia Consumer Data Protection Act (VCDPA). Applicable to Skybridge based on the Company's processing of personal data of Virginia residents. The Company has implemented compliance procedures consistent with the VCDPA's requirements, including consumer rights mechanisms, data protection assessments, and contractual protections for data processing agreements.
• Colorado Privacy Act (CPA). Applicable to Skybridge based on the Company's processing of personal data of Colorado residents. Compliance procedures are in place, including opt-out mechanisms and data protection assessments.
• Connecticut Data Privacy Act (CTDPA). Applicable to Skybridge, and particularly relevant given the Company's Delaware incorporation and operations in the northeastern United States. Compliance procedures are in place consistent with the CTDPA's requirements.
• Additional Emerging State Privacy Laws. The Company monitors the enactment and effective dates of additional state comprehensive privacy laws on an ongoing basis, including those enacted in states such as Utah, Iowa, Indiana, Tennessee, Montana, Oregon, and Texas. The Company's privacy compliance program is designed to be scalable and adaptable to new state requirements as they take effect.
C. Data Breach Notification
Skybridge has not experienced any reportable data breaches during the diligence period. The Company has not been required to provide breach notification to any individual, state attorney general, or federal regulatory agency in connection with a data security incident.
The Company maintains a written incident response plan that addresses data breach notification obligations under all fifty state data breach notification statutes, as well as applicable federal requirements. The incident response plan includes:
• Procedures for identifying and classifying security incidents based on severity and scope.
• Escalation procedures to ensure that potential breaches are reported to appropriate internal stakeholders, including the CTO, General Counsel, and CEO, within defined timeframes.
• A decision matrix for determining whether a security incident constitutes a "breach" requiring notification under applicable law, taking into account the nature of the compromised data, the number of affected individuals, and the applicable state statutory thresholds and exemptions.
• Templates for breach notification letters and regulatory filings in all fifty states, pre-populated with standard language to enable rapid deployment in the event of a qualifying breach.
The Company maintains cyber insurance as part of its overall insurance program, providing coverage for certain costs associated with data breaches and security incidents, including notification costs, forensic investigation costs, regulatory fines and penalties (to the extent insurable), credit monitoring services, and legal defense costs. The current cyber insurance policy is issued by Pinnacle Specialty Insurance Group (a separate entity from Pinnacle Growth Acquisition Corp.) with a policy limit of $10,000,000 per occurrence.
D. International Data Transfers
Skybridge's operations are primarily U.S.-based, and the Company does not maintain offices, employees, or infrastructure in any non-U.S. jurisdiction. However, the Company's operations involve limited cross-border data flows in the following circumstances:
• Certain of the Company's engineering team members, while based at the San Francisco office, may access development or testing environments that involve data mirrored or replicated in cloud computing infrastructure located in multiple geographic regions, including non-U.S. regions.
• Certain of the Company's clients are non-U.S. entities that access the Skybridge platform through U.S.-based banking partners, and transaction data related to these clients may include personal data of non-U.S. individuals.
During diligence, we confirmed that the EU General Data Protection Regulation ("GDPR") and the UK GDPR do not have direct applicability to Skybridge, as the Company does not directly serve EU or UK data subjects and does not have an establishment in the EU or UK. However, as a precautionary measure, the Company has included Standard Contractual Clauses ("SCCs") in certain vendor agreements where the vendor may be located outside the United States and may process personal data on behalf of Skybridge.
E. Change-of-Control Implications
The Business Combination does not trigger any affirmative regulatory approval requirement for data privacy purposes. No federal or state privacy law requires a change-of-control filing with a regulatory agency in connection with a corporate transaction. However, the following data privacy considerations should be addressed in connection with the Transaction:
• Privacy Policies. Skybridge's existing privacy policies should be reviewed in connection with the closing to ensure that any material changes in data practices resulting from the Business Combination — including any changes in the identity of the corporate entity collecting or processing personal information, any new data sharing arrangements with the Combined Company or its affiliates, or any changes in the purposes for which personal information is processed — are reflected in updated privacy notices provided to affected individuals. Under the CCPA/CPRA, a "material change" to a privacy policy requires notification to consumers.
• Data Processing Agreements. Certain of Skybridge's client DPAs may contain assignment or change-of-control provisions that restrict the Company's ability to assign its obligations under the DPA in connection with a corporate transaction, or that require notice to or consent from the client. These provisions are identified in the Material Contracts Summary memorandum, and the Company should initiate the notification and consent process as appropriate.
• Employee Privacy. To the extent the Business Combination results in changes to the Company's employee data practices, including changes in the entity that serves as the employer of record or changes in the benefits and human resources platforms used by the Company, updated employee privacy notices may be required under state law.
VII. CONSUMER FINANCIAL PROTECTION
A. CFPB Oversight
The Consumer Financial Protection Bureau ("CFPB") has supervisory authority over "larger participants" in certain consumer financial product markets under the Dodd-Frank Wall Street Reform and Consumer Protection Act, 12 U.S.C. § 5514. The CFPB has promulgated rules defining "larger participant" thresholds for several consumer financial product markets, including international money transfers and certain aspects of consumer payments processing.
Based on Skybridge's current transaction volumes and revenue, it is possible that the Company may meet or approach the "larger participant" threshold for CFPB examination authority in the consumer payments market, particularly as the Company's revenue and transaction volumes continue to grow. The CFPB's "larger participant" threshold for the international money transfer market (12 C.F.R. § 1090.107) is set at one million or more aggregate international money transfers annually, and while Skybridge's domestic transaction volumes significantly exceed this threshold, the international component is limited. However, the CFPB has broad authority to issue new "larger participant" rules and has signaled interest in expanding its supervisory reach to additional consumer financial product markets.
To date, Skybridge has not been subject to a CFPB examination, investigation, or enforcement action. The Company has not received a Civil Investigative Demand ("CID") or any other form of inquiry from the CFPB.
Skybridge's primary clients are financial institutions and neobanks, operating on a business-to-business ("B2B") basis, which somewhat limits the Company's direct exposure to consumer-facing regulatory requirements. However, the Company's embedded-finance features — including virtual account management and API-based payment initiation — may reach end consumers through the Company's clients' platforms, which could bring certain of the Company's activities within the CFPB's purview. We recommend that the Company monitor its transaction volumes and revenue relative to the CFPB's "larger participant" thresholds on an ongoing basis and prepare proactively for a potential CFPB examination.
B. Electronic Fund Transfer Act (EFTA) / Regulation E
To the extent that Skybridge's platform facilitates electronic fund transfers to or from consumer accounts, the Electronic Fund Transfer Act ("EFTA"), 15 U.S.C. § 1693 et seq., and its implementing regulation (Regulation E, 12 C.F.R. Part 1005) may impose compliance obligations. Regulation E requires, among other things, initial disclosures to consumers, periodic statements, error resolution procedures, and limitations on consumer liability for unauthorized transactions.
Skybridge's contractual arrangements with its financial institution clients allocate primary Regulation E compliance responsibility to the licensed financial institution client, which is the entity that maintains the consumer's account and initiates the electronic fund transfer. Skybridge's role is limited to providing the technology platform that facilitates the transaction; the client bears the direct regulatory obligation to comply with Regulation E's disclosure, error resolution, and liab