MEMORANDUM
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION
This memorandum is a privileged and confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP for the exclusive use of the addressees identified below. This memorandum is not intended for distribution to, or reliance by, any third party and may not be reproduced, disseminated, or disclosed without the prior written consent of Calderwood & Harkness LLP. Receipt of this memorandum by any person other than the intended recipients does not constitute a waiver of the attorney-client privilege or work product protection.
From: Priscilla Wynn, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP
To: Kevin Ostrowski, Responsible Partner, Privacy & Data Security, Calderwood & Harkness LLP; Thomas Elridge, General Counsel / Chief Privacy Officer, Skybridge Fintech Ltd.
Date: December 4, 2025
Re: Analysis of Indemnification and Liability Cap Structures in Bank-Vendor Data Processing Agreements
Matter No.: 1009-00004
Firm: Calderwood & Harkness LLP, 1735 Market Street, Suite 2800, Philadelphia, PA 19103
I. Executive Summary
The purpose of this memorandum is to analyze market-standard indemnification and liability cap structures in data processing agreements ("DPAs") between financial technology ("fintech") software-as-a-service ("SaaS") vendors and FDIC-insured banking institutions, and to recommend a framework for Skybridge Fintech Ltd. ("Skybridge" or "SBF") to adopt in its customer-facing DPA template. The analysis is undertaken in the specific context of the DPA currently under negotiation with Meridian Federal Savings Bank ("Meridian" or "MFSB"), Skybridge's largest prospective bank client, but the recommendations are designed to serve as Skybridge's baseline template for all similarly situated bank customer engagements going forward.
Skybridge provides payment processing, anti-fraud analytics, and regulatory reporting capabilities to mid-market and regional banks through its proprietary SBF Core platform. Meridian, a federally chartered savings bank with approximately $6.1 billion in total assets and approximately 412,000 accountholders, is seeking to migrate from legacy in-house systems to SBF Core under a five-year SaaS subscription agreement. The annual contract value ("ACV") of the Meridian engagement is $2.74 million per year, yielding a total contract value ("TCV") of approximately $13.7 million over the five-year term. The DPA is a prerequisite to execution of the SaaS subscription agreement and must satisfy the rigorous third-party risk management ("TPRM") requirements applicable to FDIC-insured institutions under OCC Bulletin 2023-17 and related guidance.
Following a comprehensive review of market precedent, regulatory expectations, and the specific commercial parameters of the Meridian engagement, we recommend the following liability cap structure for the Skybridge template DPA:
Liability Cap: The greater of (a) $5.0 million or (b) two times (2×) the fees paid by Controller to Processor in the twelve-month period immediately preceding the event giving rise to the claim. For Meridian, this formula yields an effective cap of $5.48 million (2 × $2.74 million = $5.48 million, which exceeds the $5.0 million floor).
The DPA should include operative indemnification provisions under which Skybridge, as Processor, indemnifies the Controller for third-party claims arising from Skybridge's breach of the DPA, including regulatory fines and penalties to the extent permissible under applicable law, subject in all cases to the liability cap. The indemnification structure should be mutual, with reciprocal indemnification from Controller to Processor for claims arising from Controller's unlawful processing instructions.
Skybridge's existing cyber-liability insurance policy with Bastion Mutual Insurance Company (Policy No. CYB-2025-04821) provides $10 million per occurrence and $20 million in aggregate coverage, which materially exceeds the recommended liability cap and provides a meaningful risk backstop. The DPA should include a covenant requiring Skybridge to maintain cyber-liability insurance with minimum per-occurrence limits of $10 million throughout the term of the agreement.
This memorandum addresses in detail: (i) the market landscape for liability cap and indemnification structures in bank-vendor DPAs (Section III); (ii) the recommended liability cap formula and its rationale (Section IV); (iii) the recommended indemnification provisions, including the treatment of regulatory fines (Section V); (iv) carve-outs and super-cap items (Section VI); (v) the interaction between indemnification, liability caps, and insurance coverage (Section VII); (vi) the regulatory framework considerations affecting the DPA's liability allocation provisions (Section VIII); (vii) a comparison of our recommendations with the positions advanced in Meridian's outside counsel's form DPA (Section IX); and (viii) specific recommendations and next steps (Section X). An illustrative liability cap calculation table is appended as Appendix A (Section XI).
II. Background and Engagement Context
A. The Parties
An understanding of the parties to this transaction and their respective roles is necessary to contextualize the liability and indemnification analysis that follows.
Skybridge Fintech Ltd. Skybridge is a Delaware C-corporation headquartered at 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810. Founded in 2019 by Nadia Karimova (Chief Executive Officer), Skybridge has grown rapidly as a provider of cloud-based financial infrastructure services, with a current employee headcount of 187. Thomas Elridge serves as General Counsel and Chief Privacy Officer, and Rebecca Muñoz serves as Chief Information Security Officer. Skybridge's projected annual recurring revenue ("ARR") for 2025 is $38.7 million. The SBF Core platform offers integrated payment processing, real-time anti-fraud analytics leveraging behavioral biometric data, and automated regulatory reporting modules tailored to the compliance needs of FDIC-insured banking institutions.
Skybridge Fintech Europe B.V. Skybridge operates a European subsidiary, Skybridge Fintech Europe B.V., a Dutch besloten vennootschap registered with the Kamer van Koophandel under number 82104593, with its registered office at Keizersgracht 482, 1017 EG Amsterdam, Netherlands. Lena Vogt serves as Managing Director. The European entity employs 14 individuals and functions as a sub-processor for personal data of EU-resident data subjects processed through the SBF Core platform. The existence of this entity is relevant to the GDPR and Standard Contractual Clause ("SCC") requirements discussed in Section VIII below.
Meridian Federal Savings Bank. Meridian is a federally chartered savings bank operating under OCC Charter No. 14-2238. Meridian is insured by the Federal Deposit Insurance Corporation and is headquartered at 900 Broad Street, Suite 1200, Newark, New Jersey 07102. Lawrence C. Driscoll serves as Chief Executive Officer; Vanessa Hartwell serves as General Counsel; Andrea Sokolov serves as Chief Compliance Officer; and Marcus Tibaldi serves as Vice President of Third-Party Risk Management. Meridian maintains total assets of approximately $6.1 billion, deposits of approximately $4.3 billion, and operates 47 retail branches across New Jersey, New York, Pennsylvania, and Connecticut. Meridian's customer base comprises approximately 412,000 accountholders, of which approximately 3,200 are residents of European Union member states. The presence of EU-resident data subjects within the processing scope is a material consideration for the DPA's liability architecture, as it triggers the application of the General Data Protection Regulation ("GDPR") and the requirement for Standard Contractual Clauses governing cross-border data transfers.
Halcyon Ridge Capital Partners, LP. Halcyon Ridge Capital Partners, LP is a private equity sponsor that served as the lead investor in Skybridge's Series B financing round and currently holds 34.2% of Skybridge's outstanding equity. Gregory Falcone serves as Managing Partner of Halcyon Ridge, and Catherine Shin serves as a board observer on Skybridge's board of directors. The significance of Halcyon Ridge's equity position and board representation is discussed in the context of investor expectations regarding liability exposure in Sections IV.B and VI below. Any liability cap structure adopted by Skybridge must be defensible to Halcyon Ridge from an enterprise risk management perspective, and unbounded or disproportionately high liability commitments could raise concerns under Skybridge's existing investor rights agreement.
B. Transaction Structure
Meridian is undertaking a comprehensive migration from its legacy in-house payment processing and regulatory reporting systems to Skybridge's SBF Core platform. The engagement is structured as a five-year SaaS subscription agreement with an ACV of $2.74 million per year, yielding a TCV of approximately $13.7 million. The SaaS subscription agreement and the DPA are to be executed concurrently, with a target signing date of February 15, 2026.
The DPA is a contractual prerequisite to the execution of the SaaS subscription agreement. Meridian's TPRM program, which is aligned with OCC Bulletin 2023-17 ("Third-Party Relationships: Risk Management Guidance") and the Federal Financial Institutions Examination Council ("FFIEC") guidance on technology service providers, requires that a fully negotiated DPA—addressing data processing scope, security obligations, breach notification procedures, sub-processor management, and, critically, indemnification and liability allocation—be in place before the bank's Risk Committee and Board of Directors will approve the vendor engagement.
Meridian has retained Blackwell, Raines & Stoddard LLP ("BRS") as outside counsel for the DPA negotiation. The BRS team is led by Constance Liu (partner) and Derek Faulkner (associate), both of BRS's New York office at 200 Park Avenue, 31st Floor, New York, NY 10166. BRS provided Meridian's form DPA to our office on November 25, 2025. A separate gap analysis memorandum comparing the BRS form DPA with Skybridge's existing template DPA, and identifying the key areas of divergence, is being prepared by our team and will be circulated under cover dated December 5, 2025. This memorandum focuses specifically on the indemnification and liability cap provisions, which we anticipate will be among the most heavily negotiated terms of the DPA.
C. Data Processing Scope
A clear understanding of the nature, scope, and sensitivity of the personal data to be processed under the DPA is essential to calibrating an appropriate liability allocation framework. The data processing activities contemplated by the SBF Core engagement are described below.
Categories of Data Subjects. The DPA will cover the personal data of the following categories of data subjects: (i) Meridian accountholders, including both retail consumers and small-business entities; (ii) authorized signers on Meridian accounts; (iii) beneficial owners identified through Meridian's customer due diligence and anti-money laundering ("AML") processes; and (iv) Meridian employees whose data may be processed incidentally through the SBF Core platform.
Sensitive Data Categories. Among the categories of personal data to be processed, several warrant heightened attention from a liability and risk perspective. First, the processing will involve Social Security numbers ("SSNs"), which are classified as sensitive personal information under the Gramm-Leach-Bliley Act ("GLBA"), the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), and the forthcoming New Jersey Data Privacy Act (S3377). Second, the SBF Core platform's anti-fraud analytics module processes behavioral biometric data, specifically keystroke dynamics and mouse movement patterns, which qualify as biometric information under an increasing number of state privacy statutes. The presence of these sensitive data categories materially affects the risk profile of the engagement and supports the recommendation for a robust indemnification framework with adequate cap levels.
Volume. Skybridge will process personal data pertaining to approximately 412,000 data subjects. The SBF Core platform is projected to handle approximately 18.6 million transactions per month on behalf of Meridian. The volume of data subjects and transaction throughput is relevant to the assessment of potential damages in the event of a data breach, as notification costs, credit monitoring expenses, and potential class action exposure scale with the size of the affected population.
EU Data Subjects. Approximately 3,200 of Meridian's accountholders are residents of EU member states. The presence of EU-resident data subjects triggers the application of the GDPR, including the processor liability provisions of Article 82, and necessitates the incorporation of Standard Contractual Clauses for the transfer of personal data from the EU to the United States. The SCCs will be governed by Netherlands law per Clause 17, consistent with the jurisdiction of Skybridge's European subsidiary, Skybridge Fintech Europe B.V.
Sub-Processors. Skybridge engages two sub-processors in connection with the SBF Core platform: (i) Osprey Cloud Infrastructure, Inc. ("Osprey"), which provides infrastructure-as-a-service ("IaaS") and platform-as-a-service ("PaaS") hosting in its US-East data center located in Ashburn, Virginia and its EU data center located in Frankfurt, Germany; and (ii) Skybridge Fintech Europe B.V., Skybridge's Dutch subsidiary described above. The liability allocation framework must account for Skybridge's responsibility for the acts and omissions of its sub-processors, as Skybridge remains contractually liable to Meridian for sub-processor performance under both the DPA and the GDPR (Article 28(4)).
III. Market Survey — Indemnification and Liability Cap Structures in Bank-Vendor DPAs
A. Methodology. To develop a market-informed recommendation for the Skybridge template DPA, our team conducted a review of indemnification and liability cap structures in data processing agreements between fintech SaaS vendors and FDIC-insured banking institutions. Our review encompassed the following sources and frameworks:
1. Precedent Transaction Review. We reviewed DPA terms from approximately thirty precedent transactions in the financial services sector involving fintech SaaS vendors and FDIC-insured institutions, including agreements from our firm's prior representations as well as publicly available terms where applicable. The sample included vendors with ARR ranging from $15 million to $250 million and bank clients with total assets ranging from $1.5 billion to $50 billion. Contract values ranged from approximately $500,000 ACV to $12 million ACV.
2. Regulatory Frameworks. We considered the following regulatory frameworks and guidance documents that inform liability allocation expectations in bank-vendor agreements:
• OCC Bulletin 2023-17 ("Third-Party Relationships: Risk Management Guidance"), which sets forth the OCC's expectations for banks' management of third-party relationships, including specific guidance on contractual provisions relating to indemnification, limitation of liability, and insurance;
• GLBA / Regulation P (15 U.S.C. §§ 6801–6809; 12 CFR Part 1016), which impose service provider oversight obligations on financial institutions and inform the scope of indemnification for breaches involving consumer financial information;
• FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53), which requires banking organizations to notify their primary federal regulator within 36 hours of a "notification incident" and requires bank service providers to notify the banking organization as soon as possible, and in no event later than 36 hours, after the service provider determines that it has experienced an incident that has materially affected, or is reasonably likely to materially affect, the banking organization;
• GDPR Article 82 (right to compensation and processor liability), which provides that any person who has suffered material or non-material damage as a result of a GDPR infringement has the right to receive compensation from the controller or processor, and imposes direct liability on processors for damage caused by processing that does not comply with processor-specific GDPR obligations;
• CCPA/CPRA (Cal. Civ. Code §§ 1798.100 et seq.), which impose service provider obligations and establish a private right of action (Section 1798.150) for data breaches involving certain categories of unencrypted or non-redacted personal information; and
• New Jersey Data Privacy Act (S3377), expected to become effective on January 15, 2026, which will impose new controller and processor obligations applicable to Meridian by virtue of its New Jersey headquarters and its New Jersey-based accountholders.
3. Industry Guidance. We also considered guidance from the International Association of Privacy Professionals ("IAPP"), industry model DPA templates published by trade associations, and secondary literature addressing liability allocation best practices in technology services agreements.
B. Typical Liability Cap Structures
Based on our market survey, we identified four principal approaches to structuring liability caps in bank-vendor DPAs. Each is discussed in turn below.
Fixed-Dollar Caps. Under a fixed-dollar cap approach, the parties agree to an absolute dollar amount as the maximum aggregate liability of one or both parties for all claims arising under the DPA. Fixed-dollar caps are common in enterprise SaaS transactions generally and are sometimes used in bank-vendor agreements, particularly where the contract value is modest or where the vendor's overall financial capacity is limited. In the bank-vendor DPA context, fixed-dollar caps typically range from $2 million to $10 million, depending on the size of the vendor, the contract value, and the sensitivity of the data being processed. The primary advantage of a fixed-dollar cap is its simplicity and certainty; the primary disadvantage is that it does not automatically scale with the economic value of the engagement, which can create misalignment between risk assumption and economic benefit as the engagement grows.
Fee-Multiple Caps. The fee-multiple approach expresses the liability cap as a multiple of the fees paid or payable by the Controller to the Processor over a defined period, typically the trailing twelve months preceding the event giving rise to the claim. This is the most prevalent structure in bank-vendor DPAs based on our review. Fee multiples in our sample ranged from 1× to 3× trailing twelve-month fees, with the following distribution:
• 1× trailing twelve-month fees: approximately 20% of reviewed agreements;
• 2× trailing twelve-month fees: approximately 45% of reviewed agreements;
• 3× trailing twelve-month fees: approximately 25% of reviewed agreements; and
• Multiples above 3×: approximately 10% of reviewed agreements (typically limited to agreements with very large banks or agreements involving processing of particularly sensitive data categories, such as health information or biometric data).
The 2× trailing twelve-month fees formulation represents the market median and is the most commonly adopted structure. The fee-multiple approach has the advantage of scaling proportionally with the economic value of the relationship, which aligns the vendor's liability exposure with its revenue from the engagement. However, a pure fee-multiple approach can produce inadequately low caps for smaller engagements where the ACV is modest but the volume of sensitive data processed is substantial.
Greater-Of Formulations. Increasingly, bank-vendor DPAs employ a "greater-of" formulation that combines a fixed-dollar floor with a fee multiple. Under this approach, the liability cap is set at the greater of (a) a fixed dollar amount (e.g., $5 million) or (b) a specified multiple (e.g., 2×) of the trailing twelve-month fees. This hybrid structure addresses the principal limitation of both the fixed-dollar and fee-multiple approaches: it ensures a minimum level of liability protection for the Controller even in smaller engagements (where the fee multiple alone would produce an insufficient cap), while preserving the proportionality benefits of a fee-multiple cap for larger engagements. Based on our review, greater-of formulations have become the preferred approach in the bank-vendor DPA market, particularly among PE-backed fintech vendors that serve multiple bank clients across a range of ACV levels and need a template structure that adapts dynamically to each engagement.
This is the approach we recommend for the Skybridge template DPA, as discussed in Section IV below.
Uncapped Liability. A small minority of the agreements in our review (fewer than 5%) provide for uncapped liability. Uncapped liability structures are generally disfavored by vendors and are typically rejected outright by PE-backed companies. In the case of Skybridge, uncapped liability would be particularly problematic given that Halcyon Ridge Capital Partners, LP holds 34.2% of Skybridge's equity and maintains a board observer (Catherine Shin). An uncapped liability commitment of the magnitude that a $6.1 billion bank could assert in the event of a major data breach would represent an existential-level risk for a company with $38.7 million in projected ARR and could potentially violate covenants or investor consent rights under the existing investor rights agreement. Accordingly, uncapped liability is not a viable option for Skybridge and should be rejected in any negotiation.
Contextual Calibration. In evaluating the appropriate cap level for the Skybridge-Meridian engagement, it is important to consider the relationship between the cap and several key financial parameters. Skybridge's projected 2025 ARR is $38.7 million. The Meridian engagement, at $2.74 million ACV, represents approximately 7.1% of Skybridge's total ARR. A liability cap of $5.48 million (2× Meridian's ACV) represents approximately 14.2% of Skybridge's total ARR—a material but bounded exposure that is defensible from an enterprise risk management perspective, particularly given the insurance backstop discussed in Section VII.
C. Typical Indemnification Structures
Indemnification provisions in bank-vendor DPAs address the obligation of one party to hold the other harmless from and against losses arising from specified events. Our market survey revealed the following common indemnification structures:
Mutual Indemnification. Under a mutual indemnification structure, each party indemnifies the other for third-party claims arising from its own breach of the DPA or its negligent or wrongful conduct in connection with the processing of personal data. Mutual indemnification is the most common structure in technology services agreements generally, though in the bank-vendor DPA context, the balance of indemnification obligations tends to be asymmetric, with more extensive indemnification running from the Processor to the Controller.
Processor-to-Controller Indemnification. The majority of bank-facing DPAs in our sample require the Processor (the fintech vendor) to provide indemnification to the Controller (the bank) for third-party claims arising from the Processor's breach of the DPA, including: (i) claims by data subjects alleging unauthorized access to, disclosure of, or loss of their personal data; (ii) consumer class actions arising from data breaches; and (iii) claims by governmental authorities or regulators, including enforcement actions and the imposition of fines and penalties. This structure reflects the fundamental risk allocation principle in the processing relationship: the Controller entrusts personal data to the Processor, and the Processor assumes responsibility for claims arising from its failure to protect that data in accordance with the DPA's requirements.
Controller-to-Processor Indemnification. Reciprocal indemnification from the Controller to the Processor is less commonly included in bank-vendor DPAs but is present in approximately 30% of the agreements in our sample. Where included, Controller-to-Processor indemnification typically covers third-party claims arising from the Controller's unlawful processing instructions—that is, situations where the Processor acted in accordance with the Controller's documented instructions but those instructions were themselves unlawful or resulted in processing that violated applicable data protection law. We recommend including reciprocal indemnification in the Skybridge template DPA, as discussed in Section V below.
Direct Claims vs. Third-Party Claims. Market standard in bank-vendor DPAs is to limit the scope of indemnification to third-party claims—that is, claims asserted against the indemnified party by persons or entities other than the parties to the DPA. Direct damages between the parties (e.g., the Controller's own costs associated with a data breach, or the Controller's lost revenue) are addressed separately under the general liability cap provision rather than through the indemnification mechanism. This distinction is important because it clarifies the function of each provision: indemnification addresses the allocation of risk from external claims, while the liability cap governs the overall ceiling on inter-party liability.
Regulatory Expectations. OCC Bulletin 2023-17 places significant emphasis on the contractual allocation of liability for data breaches and security incidents in bank-vendor relationships. The Bulletin states that a banking organization's contract with a third party should include provisions that clearly establish "the extent to which the third party will indemnify the bank, its customers, or both for any loss, damage, or liability arising from the third party's activities" and should address "limitations on the bank's liability." While the OCC does not mandate a specific indemnification structure or liability cap amount, the supervisory expectation is clear: banks must negotiate contracts that provide meaningful protection against losses arising from vendor failures, and the allocation of liability should be commensurate with the risk profile of the engagement.
D. Market Comparison Summary Table
The following table summarizes the range of liability cap and indemnification structures observed in our market survey across different deal sizes:
As illustrated, the Meridian engagement ($2.74 million ACV) falls squarely within the $1M–$3M ACV range, where a greater-of formulation with a 2× multiple and a $3M–$5M dollar floor is standard. Our recommended $5.0 million floor is at the upper end of the range for this ACV band, reflecting the heightened sensitivity of the data being processed (SSNs, behavioral biometrics) and the scale of the affected population (412,000 data subjects).
IV. Recommended Liability Cap Structure for Skybridge Template DPA
A. Proposed Formula
Based on the market survey and the considerations discussed above, we recommend the following liability cap formula for the Skybridge template DPA:
Liability Cap. The aggregate liability of Processor to Controller under or in connection with this Data Processing Agreement, whether arising in contract, tort (including negligence), strict liability, or otherwise, shall not exceed the greater of (a) Five Million Dollars ($5,000,000) or (b) two times (2×) the aggregate fees actually paid by Controller to Processor in the twelve (12) month period immediately preceding the date of the event giving rise to the claim.
Application to the Meridian Engagement. For Meridian, with an ACV of $2.74 million, the formula operates as follows:
• Component (a): $5,000,000 (fixed floor)
• Component (b): 2 × $2,740,000 = $5,480,000
• Effective Cap: Greater of $5,000,000 and $5,480,000 = $5,480,000
Because $5.48 million exceeds the $5.0 million floor, the fee-multiple component governs for the Meridian engagement. However, the floor remains operative and provides the binding constraint for Skybridge's bank customers with ACVs below $2.5 million. Specifically:
• For customers with ACV below $2.5 million, the $5.0 million fixed floor will exceed the 2× fee multiple, and the floor will govern as the effective cap;
• For customers with ACV at or above $2.5 million, the 2× fee multiple will exceed the $5.0 million floor, and the fee-multiple component will govern as the effective cap.
This dynamic structure ensures that the template DPA can be deployed across Skybridge's entire bank customer base without requiring bespoke cap negotiations for each engagement, while providing an adequate minimum level of protection for all customers.
Resistance to BRS's 3× Proposal. It is important to note that BRS's form DPA proposes a liability cap of 3× trailing twelve-month fees. For Meridian, this would yield a cap of $8.22 million (3 × $2.74 million). We recommend resisting the 3× formulation for the following reasons: (i) as demonstrated by our market survey, 2× is the market median and 3× falls at the 75th percentile of observed multiples—it is an above-market position that does not reflect the prevailing norm for engagements of this size and risk profile; (ii) the $2.78 million differential between the 2× cap ($5.48 million) and the 3× cap ($8.22 million) is material for a company of Skybridge's size and represents an unnecessary incremental exposure that is not proportionate to Skybridge's revenue from the engagement; and (iii) the 2× cap, combined with the $5.0 million floor and the insurance backstop, provides adequate protection for Meridian's data subjects and aligns with prudential regulatory expectations.
B. Rationale. The recommended liability cap structure is supported by the following considerations:
Proportionality. The fee-multiple approach ensures that Skybridge's liability exposure scales proportionally with the fees it receives from each bank customer. This proportionality is a foundational principle of risk allocation in technology services agreements: the vendor's maximum exposure should bear a reasonable relationship to the economic benefit it derives from the engagement. A 2× multiple provides meaningful protection for the Controller while ensuring that the Processor's maximum liability does not create an outsized financial risk relative to the revenue generated by the engagement.
Investor Expectations. Halcyon Ridge Capital Partners, LP holds 34.2% of Skybridge's outstanding equity and maintains a board observer (Catherine Shin). PE sponsors typically expect portfolio companies to maintain defined, bounded liability exposures in their commercial contracts, particularly in agreements involving the processing of sensitive personal data. Uncapped liability or disproportionately high cap levels (such as the 3× formulation proposed by BRS) create risk concentration that could adversely affect Skybridge's enterprise valuation, its ability to secure additional financing, and its ultimate exit trajectory. The recommended 2× cap with a $5.0 million floor represents a balanced position that is defensible to Halcyon Ridge and consistent with market norms for PE-backed fintech companies.
Regulatory Acceptability. OCC Bulletin 2023-17 does not prescribe a specific liability cap amount or formula but requires that banks' contracts with service providers "allocate liability appropriately" and include provisions that are "commensurate with the nature and scope of the third-party relationship and the related risks." The recommended cap exceeds minimum market norms for engagements of this size and, combined with the indemnification provisions and insurance covenant discussed below, should satisfy the expectations of Meridian's prudential regulators. We note that Meridian's TPRM program, overseen by VP TPRM Marcus Tibaldi and CCO Andrea Sokolov, will evaluate the adequacy of the cap as part of its third-party risk assessment, and we are confident that the recommended structure will pass this review.
Aggregate Exposure Management. The greater-of formula enables Skybridge to manage its aggregate liability exposure across its entire customer base in a predictable manner. At a 2× multiple with a $5.0 million floor, Skybridge can model its maximum aggregate exposure based on its total ARR and the distribution of ACV levels across its customer portfolio. This is essential for financial planning, insurance procurement, and investor reporting purposes.
V. Indemnification Provisions — Recommended Structure
A. Scope of Indemnification
We recommend that the Skybridge template DPA include an indemnification provision under which Skybridge, as Processor, agrees to indemnify, defend, and hold harmless the Controller and its officers, directors, employees, agents, and affiliates from and against any and all losses, damages, costs, liabilities, and expenses (including reasonable attorneys' fees and costs of litigation) arising from or relating to any third-party claim resulting from:
(a) Skybridge's breach of any provision of the DPA, including its data processing obligations, security obligations, and breach notification obligations;
(b) Skybridge's negligence or willful misconduct in connection with the processing of personal data under the DPA;
(c) any unauthorized access to, unauthorized disclosure of, or loss or destruction of personal data processed by Skybridge or its sub-processors under the DPA, to the extent caused by Skybridge's failure to implement and maintain the security measures required by the DPA; and
(d) any claim by a governmental authority or regulatory body alleging that Skybridge's processing of personal data under the DPA violated applicable data protection law, to the extent such claim arises from Skybridge's acts or omissions (as distinguished from claims arising from the Controller's own conduct or instructions).
For purposes of the indemnification provision, "third-party claims" should be defined to include: (i) claims by data subjects, whether asserted individually or as part of a class action; (ii) claims by governmental authorities or regulators, including enforcement actions, investigations, and the imposition of fines or penalties; and (iii) claims by other third parties (e.g., payment card networks, business partners of the Controller) that are affected by Skybridge's processing activities.
The indemnification obligation should be expressly subject to the liability cap described in Section IV. This ensures that the cap functions as a comprehensive ceiling on Skybridge's total liability, encompassing both direct damages and indemnification obligations. Without this linkage, the indemnification obligation could effectively render the liability cap meaningless, as a Controller could characterize direct damages as third-party indemnification claims to circumvent the cap.
B. Regulatory Fines and Penalties
The treatment of regulatory fines and penalties is among the most contentious issues in bank-vendor DPA negotiations and warrants careful analysis. BRS's form DPA includes a provision requiring Skybridge to indemnify Meridian for all regulatory fines and penalties imposed on Meridian arising from or relating to Skybridge's breach of the DPA. Critically, the BRS form also attempts to carve regulatory fines out of the liability cap entirely, effectively imposing uncapped liability on Skybridge for regulatory fine indemnification. As discussed in Section VI below, we recommend resisting this carve-out.
The threshold question is whether regulatory fines are legally indemnifiable under the governing law of the DPA. This analysis varies by jurisdiction and by the nature of the fine:
Delaware Law. The DPA is expected to be governed by Delaware law. Under Delaware law, contractual indemnification for regulatory fines and penalties is generally permissible as a matter of freedom of contract, subject to public policy limitations. Delaware courts have enforced indemnification provisions covering regulatory penalties where the underlying conduct giving rise to the fine was negligent rather than intentional. However, fines imposed for intentional, willful, or criminal conduct may be non-indemnifiable as contrary to public policy, because permitting indemnification in such circumstances would undermine the deterrent purpose of the fine. Accordingly, the DPA should include a carve-out excluding indemnification for fines that are imposed as a result of the Processor's intentional or criminal conduct, and should include the qualifier "to the extent permissible under applicable law" to account for jurisdictional variations.
GDPR Article 83 Fines. The GDPR contemplates joint controller/processor liability under Article 82 and imposes administrative fines under Article 83, which can reach up to €20 million or 4% of total worldwide annual turnover, whichever is higher. Contractual allocation of GDPR fines between the parties is permissible under EU law—the GDPR does not prohibit parties from agreeing on the allocation of financial responsibility for GDPR fines as between themselves. However, such contractual allocation does not affect the supervisory authority's discretion to impose fines directly on either the controller or the processor, and a supervisory authority is not bound by the parties' contractual allocation. In practice, this means that Meridian cannot contractually transfer its own GDPR fine liability to Skybridge as against the supervisory authority, but the parties can agree that Skybridge will reimburse Meridian for fines imposed on Meridian that are attributable to Skybridge's acts or omissions. Given the approximately 3,200 EU-resident data subjects in the processing scope, the GDPR fine risk is material, though the relatively small number of EU-resident data subjects (compared to the total population of 412,000) may moderate the magnitude of any fine.
Federal Banking Regulator Fines. Fines imposed by the OCC or FDIC on Meridian for violations of banking laws and regulations are Meridian's primary and direct regulatory obligation. The imposition of such fines reflects the regulator's assessment of the bank's own compliance posture, and the bank cannot delegate this regulatory obligation to a third party. However, to the extent a banking regulator imposes a fine on Meridian that is directly attributable to a service provider's failure (e.g., a fine arising from a data breach caused by the service provider's inadequate security controls), contractual indemnification shifts the economic burden of the fine to the service provider. This risk-shifting is permissible under federal law, though it does not affect the bank's regulatory relationship or its obligations to the OCC.
Recommendation. We recommend including regulatory fines within the scope of indemnification, but with two important qualifications: (i) the indemnification for regulatory fines should be limited to fines that are "to the extent permissible under applicable law" indemnifiable, thereby preserving public policy limitations across jurisdictions; and (ii) the indemnification should include a carve-out for regulatory fines that result from the Controller's own conduct, the Controller's unlawful processing instructions, or the Controller's failure to comply with its own regulatory obligations independent of the Processor's performance. This balanced approach provides meaningful protection for Meridian while avoiding the imposition of unlimited and potentially uninsurable liability on Skybridge.
C. Indemnification Procedures
The DPA should include standard indemnification procedural requirements to ensure that the indemnification mechanism operates effectively and to preserve both parties' rights. Specifically:
Prompt Written Notice. The indemnified party (i.e., the party seeking indemnification) must provide prompt written notice to the indemnifying party upon becoming aware of a third-party claim that may give rise to an indemnification obligation. The notice should describe the claim in reasonable detail and include copies of any relevant pleadings, demands, or correspondence. The failure to provide prompt notice should not relieve the indemnifying party of its indemnification obligation except to the extent that the indemnifying party is materially prejudiced by the delay.
Right to Control or Participate in Defense. The indemnifying party should have the right, at its election and expense, to assume control of the defense of any third-party claim for which indemnification is sought, using counsel of its reasonable selection. If the indemnifying party does not assume control of the defense within a specified period (typically fifteen to thirty business days after receipt of notice), the indemnified party may assume control of the defense at the indemnifying party's expense, subject to the liability cap. Even where the indemnifying party assumes control, the indemnified party should retain the right to participate in the defense at its own expense with counsel of its own choosing.
Cooperation Obligations. Each party should cooperate fully with the other in connection with the defense of any indemnified claim, including by providing access to relevant documents, records, and personnel. The indemnified party should take commercially reasonable steps to mitigate its losses.
No Settlement Without Consent. Neither party should settle any indemnified claim without the prior written consent of the other party, which consent shall not be unreasonably withheld, conditioned, or delayed. The indemnifying party should not consent to any settlement that imposes non-monetary obligations on the indemnified party (such as an injunction, admission of liability, or compliance undertaking) without the indemnified party's prior written consent.
Interaction with Insurance. The indemnification provisions should be coordinated with Skybridge's cyber-liability insurance coverage. Skybridge's duty to indemnify Meridian is a first-party contractual obligation that is independent of, but complemented by, Skybridge's insurance coverage with Bastion Mutual Insurance Company. Upon receiving notice of a third-party claim that may trigger the indemnification obligation, Skybridge should promptly tender the claim to Bastion Mutual under Policy No. CYB-2025-04821. The DPA should clarify that Skybridge's indemnification obligation is not contingent on insurance coverage—i.e., Skybridge remains obligated to indemnify Meridian regardless of whether Bastion Mutual accepts the claim or the extent of insurance proceeds—but that Skybridge will use commercially reasonable efforts to recover insurance proceeds to satisfy its indemnification obligations. Standard subrogation principles should apply, with Bastion Mutual retaining any subrogation rights against responsible third parties.
VI. Carve-Outs and Super-Cap Items
A. Items Typically Carved Out from the Liability Cap
In bank-vendor DPAs, certain categories of claims are frequently "carved out" from the general liability cap—meaning that the cap does not apply and liability for such claims is either uncapped or subject to a separate, higher "super-cap." The following carve-out categories are most commonly encountered:
Willful Misconduct or Gross Negligence. It is market standard to carve out liability arising from a party's willful misconduct or gross negligence from the general liability cap. The rationale is that a party should not be able to invoke a contractual cap to limit the consequences of its intentional wrongdoing. Under Delaware law, contractual provisions that purport to limit liability for willful misconduct or fraud are generally unenforceable as contrary to public policy. We recommend that the Skybridge template DPA carve out willful misconduct and fraud from the liability cap, rendering liability for such conduct uncapped.
Breach of Confidentiality / Unauthorized Disclosure. Bank DPAs frequently carve out liability for breaches of confidentiality obligations from the general cap, reflecting the extreme sensitivity of financial data (including SSNs, account numbers, and transaction data). However, in our experience, this carve-out is more commonly requested by banks than it is agreed to by vendors, and there is meaningful variation in market practice. We recommend that confidentiality breaches remain within the general liability cap for the Skybridge template DPA. The general cap of the greater of $5.0 million or 2× trailing twelve-month fees provides adequate coverage for confidentiality-related claims, and carving out confidentiality breaches from the cap would effectively create an unbounded exposure for the most likely category of claims (data breaches), which is precisely the risk that the cap is designed to bound.
Indemnification Obligations for intellectual Property Infringement. Many SaaS agreements include a separate indemnification provision in the SaaS subscription agreement (as opposed to the DPA) addressing intellectual property infringement claims. IP indemnification is not directly relevant to the DPA's liability cap, but the interaction between the DPA cap and the SaaS subscription agreement's IP indemnification cap should be addressed through cross-reference provisions to avoid ambiguity.
Data Breach Response Costs. Certain bank DPAs carve out from the general cap the costs associated with data breach response, including notification costs (mailing, call center, publication), credit monitoring and identity theft protection services for affected individuals, and forensic investigation expenses. In our sample, approximately 35% of agreements carved out data breach response costs, while the remainder included them within the general cap. We recommend including data breach response costs within the general cap for the Skybridge template, but this may be a point of negotiation with Meridian, and we should be prepared to discuss whether a separate sub-limit or partial carve-out would be appropriate.
Regulatory Fines. As noted above, BRS's form DPA attempts to carve regulatory fines out of the liability cap entirely, imposing uncapped liability on Skybridge for regulatory fine indemnification. This position is above-market and should be resisted. In our sample, approximately 25% of agreements carved out regulatory fines from the cap, approximately 40% included them within the cap, and approximately 35% addressed them through a separate sub-cap or super-cap. We recommend including regulatory fines within the general cap, with the "to the extent permissible under applicable law" qualifier.
B. Recommended Super-Cap Structure
Based on our analysis, we recommend the following approach to carve-outs and super-cap items for the Skybridge template DPA:
Primary Recommendation: No Super-Cap (Two-Tier Structure). Our primary recommendation is a two-tier approach:
Tier 1 — General Liability Cap: The greater of $5.0 million or 2× trailing twelve-month fees. This cap applies to all claims under the DPA, including indemnification obligations, direct damages, confidentiality breaches, data breach response costs, and regulatory fines (to the extent permissible under applicable law).
Tier 2 — Uncapped: Willful misconduct and fraud only. Consistent with Delaware law principles and market standard, liability for willful misconduct and fraud is not subject to any cap.
This two-tier structure is clean, predictable, and commercially defensible. It avoids the complexity and potential for dispute that arises when multiple categories of claims are subject to different caps or super-caps, and it ensures that Skybridge's maximum non-fraud/non-misconduct exposure is bounded and insurable.
Alternative (Fallback) Position: Super-Cap. If BRS insists on a super-cap for certain categories of claims (e.g., data breach claims, confidentiality breaches, or regulatory fines), we recommend offering a super-cap of 3× trailing twelve-month fees, not to exceed $10 million. For Meridian, this would yield a super-cap of $8.22 million (3 × $2.74 million), which is below the $10 million ceiling and therefore $8.22 million would be the operative super-cap. The $10 million ceiling is designed to align with the per-occurrence limit of Skybridge's Bastion Mutual cyber-liability policy, ensuring that any super-cap exposure remains within the scope of available insurance coverage.
Under this alternative structure, the DPA would operate as follows:
Tier 1 — General Liability Cap: The greater of $5.0 million or 2× trailing twelve-month fees (for Meridian: $5.48 million), applicable to all claims except those subject to the super-cap or the uncapped carve-out.
Tier 2 — Super-Cap: 3× trailing twelve-month fees, not to exceed $10 million (for Meridian: $8.22 million), applicable to data breach claims, confidentiality breaches, and/or regulatory fines (as agreed in negotiation).
Tier 3 — Uncapped: Willful misconduct and fraud.
We emphasize that the super-cap alternative should be offered only as a fallback position in negotiation and only if BRS makes the super-cap a condition of closing. The primary recommendation (no super-cap) is preferred for its simplicity and for the certainty it provides to Skybridge and its investors.
VII. Insurance Coverage — Interaction with Liability Cap and Indemnification
A. Skybridge's Existing Cyber-Liability Insurance
Skybridge maintains a Technology Errors & Omissions and Cyber Liability insurance policy with the following key terms:
The policy provides coverage for, among other things: (i) third-party claims arising from technology errors and omissions in the delivery of Skybridge's SaaS platform; (ii) third-party claims arising from data breaches, including unauthorized access to or disclosure of personal data; (iii) data breach response costs, including notification expenses, credit monitoring, forensic investigation, and public relations expenses; (iv) regulatory proceedings and defense costs; and (v) network security liability, including liability arising from transmission of malware or failure to prevent unauthorized access to Skybridge's systems.
B. Insurance as Risk Backstop
The recommended liability cap of $5.48 million for the Meridian engagement is well within the $10 million per-occurrence limit of the Bastion Mutual policy. This provides Skybridge with a meaningful insurance backstop: in the event of a covered claim, Skybridge can tender the claim to Bastion Mutual and expect that the policy will respond to cover the claim up to the per-occurrence limit, which exceeds the contractual liability cap by a margin of $4.52 million (82.5% headroom above the cap). This headroom is significant because it accommodates defense costs, which may be payable in addition to indemnity amounts depending on the policy terms, and provides a buffer for claims that may exceed the liability cap due to the willful misconduct/fraud carve-out.
The $20 million aggregate limit provides additional capacity for claims from multiple bank clients. Given that Skybridge's template DPA applies the same cap formula across its customer base, the aggregate limit is an important consideration for managing Skybridge's total portfolio risk. If Skybridge were to experience a systemic data breach affecting multiple bank clients simultaneously, the aggregate limit would need to absorb claims from multiple controllers. At current portfolio levels, the $20 million aggregate provides reasonable capacity, but this should be monitored as Skybridge's customer base grows and as total ACV increases.
Insurance Covenant in the DPA. The DPA should include a covenant requiring Skybridge to maintain cyber-liability insurance with minimum per-occurrence limits of $10 million and minimum aggregate limits of $20 million throughout the term of the DPA and for a period of twelve months following its termination or expiration. This covenant provides Meridian with contractual assurance that insurance coverage will be in place to backstop Skybridge's indemnification obligations for the duration of the data processing relationship.
Additional Insured Status. BRS's form DPA includes a requirement that Skybridge name Meridian as an additional insured on its cyber-liability policy. We recommend resisting this requirement. Additional insured status is non-standard in SaaS vendor DPAs and would: (i) give Meridian direct rights under Skybridge's policy, potentially complicating claims management and creating conflicts with Skybridge's interests; (ii) erode the policy limits available to Skybridge for its own claims and claims from other customers; and (iii) require endorsement of the Bastion Mutual policy, which may increase premiums or trigger underwriting review. Instead, we recommend offering to provide Meridian with a certificate of insurance evidencing the required coverage upon request and at each policy renewal.
Loss Payee Status. Similarly, if BRS requests loss payee status for Meridian, this should be resisted on the same grounds. Skybridge should retain sole control over claims under its cyber-liability policy, with a contractual obligation to apply any insurance proceeds received in respect of a covered claim toward the satisfaction of its indemnification obligations to the affected Controller.
Interaction Between Indemnification and Insurance. The relationship between Skybridge's contractual indemnification obligation and its insurance coverage should be clearly addressed in the DPA. Specifically:
(a) Skybridge's indemnification obligation is a primary contractual obligation that exists independently of insurance coverage. The availability or unavailability of insurance does not affect Skybridge's duty to indemnify.
(b) Skybridge shall use commercially reasonable efforts to tender any claim that may be covered under its cyber-liability policy to Bastion Mutual promptly upon receipt of notice of the claim.
(c) Insurance proceeds received by Skybridge in respect of a covered claim shall be applied toward the satisfaction of Skybridge's indemnification obligations, thereby reducing the amount payable by Skybridge directly.
(d) Bastion Mutual's subrogation rights shall be preserved, and Meridian shall cooperate with any subrogation action brought by Bastion Mutual against third parties responsible for the loss.
(e) Skybridge shall not take any action that would void or materially impair its insurance coverage without prior notice to Controllers that may be affected.
C. Policy Renewal Considerations
A critical timing issue must be addressed. The current Bastion Mutual policy (CYB-2025-04821) expires on December 31, 2025. The target execution date for the Meridian DPA is February 15, 2026. This means that the DPA will be executed during the renewal policy period, not under the current policy. It is therefore essential that Skybridge confirm, prior to the execution of the DPA, that:
(i) the renewal policy has been bound and is in effect;
(ii) the renewal policy maintains per-occurrence limits of at least $10 million and aggregate limits of at least $20 million, consistent with the insurance covenant to be included in the DPA;
(iii) the scope of coverage under the renewal policy is materially consistent with the current policy, including coverage for third-party claims, data breach response costs, and regulatory proceedings; and
(iv) there are no new exclusions, sublimits, or deductible changes in the renewal policy that would materially impair the coverage available for claims arising under the DPA.
Thomas Elridge and Rebecca Muñoz should coordinate with Kestrel Risk Advisors LLC (Skybridge's insurance broker) to confirm the renewal timeline and obtain preliminary indication of renewal terms as soon as practicable. If the renewal terms include material changes from the current policy, our team should be consulted to assess whether the DPA's insurance covenant language needs to be adjusted.
The DPA should include a provision requiring Skybridge to: (a) provide Controller with evidence of insurance (in the form of a certificate of insurance) upon request and promptly following each policy renewal; and (b) notify Controller promptly in writing of any material reduction in the limits, scope, or terms of its cyber-liability insurance coverage.
VIII. Regulatory Framework Considerations Affecting Indemnification and Liability
A. OCC Bulletin 2023-17 (Third-Party Risk Management)
OCC Bulletin 2023-17, issued on June 6, 2023, provides comprehensive guidance on the risk management practices that the OCC expects banks to apply to their third-party relationships. The Bulletin applies to all bank-third-party relationships, with a particular emphasis on relationships involving "critical activities"—activities that could cause a banking organization to face significant risk if the third party fails to meet expectations or that could have significant customer impacts. Skybridge's provision of payment processing, anti-fraud analytics, and regulatory reporting services to Meridian clearly constitutes a "critical activity" within the meaning of the Bulletin, as these services involve access to sensitive customer financial information and are integral to Meridian's core banking operations.
With respect to contractual provisions, the Bulletin states that a bank's contract with a third party should include, among other things:
• "Clear allocation of rights and responsibilities, including how and when each party is to perform its obligations";
• "The extent to which the third party will indemnify the bank, its customers, or both for any loss, damage, or liability arising from the third party's activities";
• "Any limitations on the bank's liability"; and
• "Insurance coverage the third party is expected to maintain."
The recommended structure—comprising indemnification from Processor to Controller for third-party claims, a liability cap of the greater of $5.0 million or 2× trailing twelve-month fees, and a covenant to maintain $10 million per-occurrence cyber-liability insurance—aligns squarely with these expectations and should satisfy the scrutiny of Meridian's TPRM program (overseen by VP TPRM Marcus Tibaldi) and its regulatory examiners.
B. GLBA / Regulation P
The Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809) and its implementing regulations, including Regulation P (12 CFR Part 1016), impose obligations on financial institutions to protect the security and confidentiality of customer information. Under Section 501(b) of GLBA, financial institutions must establish appropriate safeguards for customer information, and this obligation extends to ensuring that service providers who receive customer information implement and maintain appropriate safeguards.
Skybridge qualifies as a "service provider" under GLBA by virtue of its receipt and processing of Meridian's customer financial information (including account information, transaction data, and SSNs) in connection with the SBF Core platform. GLBA requires that Meridian's contract with Skybridge include provisions requiring Skybridge to implement and maintain appropriate safeguards. While GLBA does not specifically mandate indemnification provisions, the inclusion of indemnification for data breaches involving consumer financial information is a well-established best practice in GLBA-compliant service provider agreements and is expected by prudential regulators during examination of banks' third-party risk management programs.
C. GDPR — Article 82 and Processor Liability
The presence of approximately 3,200 EU-resident data subjects within the scope of processing triggers the application of the GDPR. Three GDPR provisions are particularly relevant to the DPA's liability allocation framework: