MEMORANDUM
PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
FROM: Priscilla Wynn, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP
TO: Kevin Ostrowski, Responsible Partner, Privacy & Data Security, Calderwood & Harkness LLP; Thomas Elridge, General Counsel / Chief Privacy Officer, Skybridge Fintech Ltd.
DATE: December 3, 2025
RE: Regulatory Landscape Overview — Applicable Privacy and Data Security Laws Governing the Skybridge Fintech Ltd. Customer-Facing Data Processing Agreement and Standard Contractual Clauses Package
MATTER NO.: 1009-00004
CLIENT: Skybridge Fintech Ltd.
COUNTERPARTY: Meridian Federal Savings Bank
This memorandum is protected by the attorney-client privilege and constitutes attorney work product. It is intended solely for use by the individuals and entities identified above in connection with the subject matter described herein. This memorandum should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP.
Right-click to update Table of Contents
I. Purpose and Scope of Memorandum
The purpose of this memorandum is to provide a comprehensive overview of the federal, state, and international privacy and data security regulatory frameworks applicable to Skybridge Fintech Ltd. ("Skybridge" or "SBF"), a Delaware-incorporated fintech software-as-a-service ("SaaS") company headquartered at 4100 Silverside Road, Suite 310, Wilmington, DE 19810, in connection with the negotiation of a standardized customer-facing Data Processing Agreement ("DPA") and Standard Contractual Clauses ("SCC") package. This memorandum is intended to inform the structure and substantive provisions of the DPA and SCC package and to ensure that both instruments satisfy the requirements of all applicable regulatory regimes.
Skybridge provides real-time payment processing, anti-fraud analytics, and regulatory reporting software (marketed under the trade name "SBF Core") to FDIC-insured banks and credit unions throughout the United States. SBF Core ingests, processes, and analyzes consumer financial transaction data on behalf of Skybridge's bank clients, enabling those clients to meet their regulatory obligations while detecting and mitigating fraudulent activity in real time. Given the nature of the data processed and the regulatory posture of Skybridge's client base, the DPA and SCC package must be drafted to meet the highest standards of regulatory compliance applicable to financial services technology providers.
The initial counterparty for the DPA negotiation is Meridian Federal Savings Bank ("Meridian" or "MFSB"), a federally chartered savings bank supervised by the Office of the Comptroller of the Currency ("OCC") under OCC Charter No. 14-2238. Meridian is headquartered at 900 Broad Street, Suite 1200, Newark, NJ 07102, and operates as an FDIC-insured depository institution with approximately $6.1 billion in total assets, $4.3 billion in deposits, 47 retail branches across the states of New Jersey, New York, Pennsylvania, and Connecticut, and approximately 412,000 accountholders. As a federally chartered savings bank and insured depository institution, Meridian is subject to oversight by the OCC, the Federal Deposit Insurance Corporation ("FDIC"), and the Consumer Financial Protection Bureau ("CFPB"), and its Third-Party Risk Management ("TPRM") program reflects the requirements of each of those supervisory authorities.
The underlying transaction is a five-year SaaS subscription agreement pursuant to which Meridian will subscribe to and deploy SBF Core across its retail banking operations. The annual contract value of the subscription is $2.74 million, yielding a total contract value over the five-year term of approximately $13.7 million. Meridian's TPRM program, which is aligned with OCC Bulletin 2023-17 (Interagency Guidance on Third-Party Relationships: Risk Management) and applicable FFIEC examination guidance, requires that a fully negotiated DPA and SCC package be executed as a precondition to execution of the subscription agreement. The parties have established a target signing date of February 15, 2026, for both the subscription agreement and the DPA/SCC package.
Importantly, the DPA is not intended solely for the Meridian engagement. Once negotiated and finalized with Meridian, the DPA will serve as Skybridge's "bank-grade" template for all similarly situated future bank clients. Accordingly, the DPA must be drafted with scalability in mind, incorporating provisions that are sufficiently flexible to accommodate varying regulatory footprints, asset sizes, and operational profiles of other FDIC-insured banks and credit unions that may subscribe to SBF Core in the future.
This memorandum analyzes the implications of each applicable regulatory framework for the structure, specific provisions, and schedules of the DPA and SCC package. A separate gap analysis memorandum, anticipated to be issued on December 5, 2025, will address the specific differences between Meridian's form DPA — received from Meridian's outside counsel, Blackwell, Raines & Stoddard LLP, on November 25, 2025 — and Skybridge's existing template DPA. That gap analysis will build upon the regulatory foundation established in this memorandum and will identify specific negotiation positions and recommended markup language for each material provision.
II. Data Processing Overview — Factual Foundation
Before turning to the regulatory analysis, it is necessary to establish the factual foundation regarding the nature, scope, and context of the personal data processing that will occur under the DPA. A clear understanding of the data processing activities is essential to determining the applicability and specific requirements of each regulatory framework.
A. Party Roles
Skybridge — Data Processor. In connection with the provision of SBF Core services, Skybridge processes personal data of Meridian's end customers (i.e., Meridian accountholders) on behalf of, and pursuant to the instructions of, Meridian. Skybridge does not independently determine the purposes or means of processing the personal data of Meridian's accountholders; rather, Skybridge processes such data solely for the purpose of providing the contracted services. Under the General Data Protection Regulation ("GDPR"), Skybridge functions as a "processor" within the meaning of Article 4(8). Under the Gramm-Leach-Bliley Act ("GLBA"), Skybridge functions as a "service provider" that receives, maintains, and processes nonpublic personal information on behalf of a financial institution. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), Skybridge functions as a "service provider" within the meaning of Cal. Civ. Code § 1798.140(ag).
Meridian — Data Controller. Meridian determines the purposes and means of processing personal data of its accountholders. Meridian collects personal data from its accountholders in the ordinary course of its retail and commercial banking operations and transmits such data to Skybridge (via SBF Core) for the purpose of real-time payment processing, anti-fraud analytics, and regulatory reporting. Under the GDPR, Meridian functions as a "controller" within the meaning of Article 4(7). Under the CCPA/CPRA, Meridian functions as a "business" within the meaning of Cal. Civ. Code § 1798.140(d).
B. Categories of Data Subjects
The personal data processed through SBF Core pertains to the following categories of data subjects:
• Meridian retail accountholders (individual consumers holding checking, savings, and/or loan accounts);
• Meridian small-business accountholders;
• Authorized signers on Meridian accounts;
• Beneficial owners of entities that maintain accounts with Meridian (as identified pursuant to Meridian's Customer Identification Program and beneficial ownership verification procedures under 31 CFR § 1010.230);
• Meridian employees whose personal data passes through or is processed by SBF Core in connection with internal transactions, payroll processing, or administrative functions.
C. Categories of Personal Data Processed Through SBF Core
The following categories of personal data are processed through SBF Core in connection with the provision of services to Meridian:
• Full legal name (first, middle, last, and any applicable suffixes);
• Date of birth;
• Social Security number ("SSN");
• Taxpayer identification number ("TIN"), including Employer Identification Numbers ("EINs") for business accounts;
• Account numbers (checking, savings, and loan account numbers);
• Routing numbers;
• Transaction amounts and transaction metadata (including transaction date, time, originating and receiving account information, transaction type, and merchant codes);
• Internet Protocol ("IP") addresses associated with online and mobile banking sessions;
• Device identifiers (including mobile device IDs and browser fingerprints);
• Geolocation data (city-level), derived from IP address and, where applicable, device-level location services;
• Email addresses;
• Telephone numbers (mobile and landline); and
• Anti-fraud behavioral biometric data, including keystroke dynamics (typing speed, dwell time, flight time between keystrokes) and mouse movement patterns (velocity, curvature, click patterns), collected through SBF Core's behavioral analytics module for the purpose of continuous authentication and fraud detection.
D. Sensitive Data
Certain categories of personal data processed through SBF Core are classified as "sensitive" under applicable law. Specifically:
• Social Security numbers are classified as sensitive personal information under the CCPA/CPRA (Cal. Civ. Code § 1798.140(ae)(1)(A)), and are protected under virtually all state breach notification statutes as a component of the definition of "personal information" triggering notification obligations. SSNs also constitute nonpublic personal information under GLBA.
• Behavioral biometric data (keystroke dynamics and mouse movement patterns) is classified as sensitive personal information under the CCPA/CPRA and is likely to be classified as sensitive data under the New Jersey Data Privacy Act (NJ S3377), which is expected to take effect on January 15, 2026. Behavioral biometric data may also be subject to the protections of the Illinois Biometric Information Privacy Act ("BIPA"), 740 ILCS 14/1 et seq., to the extent any Meridian accountholders reside in Illinois, although BIPA's applicability in this context is beyond the scope of this memorandum.
The classification of SSNs and behavioral biometric data as sensitive under applicable law has implications for the DPA's data handling provisions, including the need for enhanced safeguards and, under certain state laws, limitations on the purposes for which sensitive data may be processed.
E. Volume
The data processing activities under the DPA will encompass approximately 412,000 data subjects and approximately 18.6 million transactions per month processed through SBF Core. These figures reflect the current scale of Meridian's retail banking operations and are expected to grow over the five-year term of the subscription agreement. The volume of data processed is relevant to the applicability of certain regulatory provisions, including the GDPR's provisions regarding "large-scale" processing and the need for data protection impact assessments under Article 35.
F. EU Data Subjects
Approximately 3,200 of Meridian's accountholders are residents of the European Union, consisting primarily of expatriate and dual-resident individuals who maintain accounts with Meridian. The presence of EU-resident data subjects whose personal data is processed through SBF Core triggers the applicability of the GDPR and necessitates the inclusion of Standard Contractual Clauses and related transfer mechanisms in the DPA package. The specific GDPR requirements and transfer mechanisms are discussed in detail in Section V of this memorandum.
G. Data Locations
Personal data processed through SBF Core is stored and processed in the following locations:
• Primary (US): Osprey Cloud Infrastructure, Inc. ("Osprey Cloud" or "OCI"), US-East data center region, located in Ashburn, Virginia. Osprey Cloud serves as Skybridge's primary infrastructure-as-a-service ("IaaS") and platform-as-a-service ("PaaS") provider for all SBF Core workloads.
• Secondary / EU: Osprey Cloud EU data center, located in Frankfurt, Germany; and Skybridge Fintech Europe B.V. ("SBF Europe"), located at Keizersgracht 482, 1017 EG Amsterdam, Netherlands (KvK No. 82104593). SBF Europe serves as the EU-based entity responsible for managing EU personal data processing on behalf of Skybridge.
• Disaster Recovery: Osprey Cloud US-East secondary availability zone, located in Ashburn, Virginia. This facility provides geographic redundancy within the US-East region for disaster recovery and business continuity purposes.
H. Key Sub-Processors
Skybridge engages the following sub-processors in connection with the provision of SBF Core services to Meridian:
1. Osprey Cloud Infrastructure, Inc., 2200 Campus Drive, San Jose, CA 95131. Osprey Cloud is Skybridge's primary IaaS/PaaS provider and hosts all SBF Core workloads across its US-East and EU data center regions. An existing Data Processing Agreement between Skybridge and Osprey Cloud, dated March 1, 2024, governs Osprey Cloud's processing of personal data on behalf of Skybridge's clients and includes Module 3 Standard Contractual Clauses (Processor-to-Sub-processor) for EU data transfers.
2. Skybridge Fintech Europe B.V., Keizersgracht 482, 1017 EG Amsterdam, Netherlands (KvK No. 82104593). SBF Europe is a wholly owned subsidiary of Skybridge and serves as an EU-based sub-processor responsible for managing the processing of EU personal data for Skybridge's bank clients. SBF Europe employs 14 individuals — eight engineers, four customer support personnel, and two compliance professionals — and is managed by Lena Vogt, Managing Director. SBF Europe is registered with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority).
The DPA must include a schedule listing all approved sub-processors, together with provisions governing the engagement of new sub-processors, as described in greater detail below.
III. Federal Banking Privacy and Security Laws
This section addresses the principal federal banking privacy and security laws and regulatory guidance applicable to the Skybridge–Meridian relationship, with a focus on the implications of each for the structure and provisions of the DPA.
A. Gramm-Leach-Bliley Act (GLBA) / Regulation P (12 CFR Part 1016)
1. Overview. The Gramm-Leach-Bliley Act ("GLBA"), 15 U.S.C. §§ 6801–6809, establishes the foundational federal framework for the privacy and security of consumer financial information. GLBA applies to "financial institutions" — defined broadly to include any institution the business of which is engaging in financial activities as described in Section 4(k) of the Bank Holding Company Act of 1956 — and imposes two principal categories of obligations: (i) privacy and notice requirements governing the disclosure of "nonpublic personal information" ("NPI") of consumers and customers, and (ii) safeguarding requirements mandating the implementation and maintenance of administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of NPI.
The privacy and notice requirements of GLBA are implemented through Regulation P (12 CFR Part 1016), promulgated by the Consumer Financial Protection Bureau. Regulation P requires financial institutions to provide initial and annual privacy notices to consumers and customers describing the institution's information sharing practices, and to offer consumers the opportunity to opt out of certain disclosures of NPI to nonaffiliated third parties.
The safeguarding requirements of GLBA are implemented through the Interagency Guidelines Establishing Information Security Standards (codified in various regulations specific to each federal banking agency) and, for entities subject to FTC jurisdiction, through the FTC Safeguards Rule (16 CFR Part 314). While the FTC Safeguards Rule does not directly apply to banking organizations supervised by the OCC, FDIC, or Federal Reserve (which are subject to their own interagency guidelines), the principles articulated in the Safeguards Rule are broadly consistent with the interagency guidelines and are instructive in establishing baseline expectations for service provider security practices.
2. Applicability to Meridian and Skybridge
Meridian, as an FDIC-insured federally chartered savings bank, is unambiguously a "financial institution" subject to GLBA. Meridian is subject to the privacy provisions of Regulation P and to the interagency guidelines on information security promulgated by the OCC and FDIC.
Skybridge, in its capacity as a provider of SBF Core services to Meridian, qualifies as a "service provider" under GLBA. Specifically, Skybridge receives, maintains, and processes NPI of Meridian's consumers and customers in connection with providing real-time payment processing, anti-fraud analytics, and regulatory reporting services. As a service provider, Skybridge is subject to the contractual safeguarding and use-restriction requirements that GLBA imposes on financial institutions with respect to their service provider relationships.
Under GLBA and Regulation P, Meridian is required to ensure, by contract or otherwise, that its service providers maintain appropriate safeguards for the NPI that Meridian discloses to them. Meridian is also required to limit the purposes for which NPI is disclosed to service providers and to restrict the service provider's ability to re-disclose or re-use NPI beyond the scope of the services being provided. These obligations flow through to the DPA as contractual requirements that Skybridge must accept.
3. NPI Classification
The categories of personal data processed through SBF Core, as described in Section II.C above, include numerous data elements that constitute NPI under GLBA. NPI is defined, in relevant part, as personally identifiable financial information provided by a consumer to a financial institution, resulting from a transaction with the consumer, or otherwise obtained by the financial institution. The following data elements processed through SBF Core constitute NPI: full legal name (when associated with financial account information), account numbers, routing numbers, transaction amounts and metadata, SSNs, and TINs. IP addresses, device identifiers, and geolocation data associated with online banking sessions also constitute NPI to the extent they are linked to a consumer's financial relationship with Meridian.
4. DPA Implications
The GLBA framework creates several specific requirements that must be addressed in the DPA:
Safeguards Provisions. The DPA must expressly require Skybridge to implement and maintain administrative, technical, and physical safeguards that are appropriate to the size and complexity of Skybridge's operations, the nature and scope of the data processing activities, and the sensitivity of the NPI at issue. These safeguards must be consistent with the interagency guidelines on information security and must be sufficient to ensure the security, confidentiality, and integrity of NPI. Skybridge's current security measures — including SOC 2 Type II certification, AES-256 encryption for data at rest, TLS 1.2+ encryption for data in transit, multi-factor authentication ("MFA") for all personnel with access to production environments, and annual penetration testing conducted by Ironvault Security Group LLC — should be documented in a security schedule annexed to the DPA and cross-referenced in the body of the agreement.
Use and Disclosure Restrictions. The DPA must include provisions expressly restricting Skybridge's use and disclosure of NPI to the purposes authorized by Meridian and the underlying subscription agreement. Skybridge must be prohibited from using NPI for its own commercial purposes, from disclosing NPI to any third party except as expressly authorized by the DPA, and from re-disclosing NPI received from Meridian to any downstream recipient except as necessary to perform the contracted services (e.g., to approved sub-processors) and subject to equivalent contractual protections.
Re-Disclosure and Re-Use Restrictions. The DPA should include an affirmative covenant by Skybridge that it will not sell, lease, or otherwise monetize NPI and will not use NPI for purposes unrelated to the performance of the SBF Core services. These restrictions align with both GLBA requirements and the parallel requirements of the CCPA/CPRA (discussed in Section IV.A below), and their inclusion in the DPA ensures a unified approach to use restrictions across regulatory frameworks.
Security Schedule Cross-References. The DPA should include a detailed security schedule (anticipated as Schedule B) that documents Skybridge's technical and organizational security measures. This schedule should reference the SOC 2 Type II report (issued by Graystone & Ketchum LLP, with a report period of October 1, 2024 through September 15, 2025, under the lead oversight of partner Sandra Clearfield), and should describe the specific encryption standards, access controls, network segmentation, logging and monitoring capabilities, vulnerability management practices, and incident response procedures that Skybridge maintains. The security schedule should be subject to periodic review and update as Skybridge's security posture evolves.
B. OCC Bulletin 2023-17 — Third-Party Risk Management (Interagency Guidance)
1. Overview. OCC Bulletin 2023-17 (June 6, 2023), titled "Third-Party Relationships: Risk Management Guidance," supersedes the prior OCC Bulletin 2013-29 and provides comprehensive interagency guidance — jointly issued by the OCC, FDIC, and Federal Reserve — on the risk management practices that banking organizations should adopt with respect to their third-party relationships. The guidance articulates the expectation that banking organizations will manage the risks arising from third-party relationships throughout the lifecycle of the relationship, from planning and due diligence through contract negotiation, ongoing monitoring, and termination.
2. Application to the Skybridge–Meridian Relationship
Meridian is supervised by the OCC as a federally chartered savings bank and by the FDIC as an insured depository institution. Meridian is also subject to CFPB oversight with respect to consumer financial protection matters. Accordingly, Meridian is required to maintain a TPRM program consistent with OCC Bulletin 2023-17 and related interagency guidance.
Within the framework of OCC Bulletin 2023-17, Skybridge qualifies as a "critical" third-party service provider. The guidance identifies third-party relationships involving critical activities — defined as activities that could cause a banking organization to face significant risk if the third party fails to meet expectations, including activities that could have significant customer impacts, require significant investment in resources to implement or change, and involve access to sensitive customer data — as warranting particularly rigorous risk management. The provision of real-time payment processing, fraud detection, and regulatory reporting services, combined with the volume and sensitivity of the personal data processed (412,000 data subjects, approximately 18.6 million transactions per month, including SSNs and behavioral biometric data), clearly places the Skybridge relationship within the "critical" category.
3. Key Contractual Requirements
OCC Bulletin 2023-17 identifies a number of specific contractual provisions that banking organizations should include in agreements with third-party service providers, particularly those providing critical activities. Each of these requirements must be addressed in the DPA:
Audit Rights. The guidance emphasizes that banking organizations must retain the right to audit their third-party service providers and, critically, must ensure that their primary federal regulators (OCC, FDIC, and CFPB) have unrestricted rights of access to examine the third-party service provider's records, operations, and facilities. This is a non-negotiable regulatory requirement. The DPA's audit rights provision must be drafted to distinguish between (i) the Controller's (Meridian's) ordinary-course audit rights, which may be subject to reasonable limitations on frequency and scope, and (ii) regulatory access rights, which must be preserved without limitation.
Business Continuity and Disaster Recovery. The DPA must include provisions requiring Skybridge to maintain, test, and update business continuity and disaster recovery plans that are commensurate with the nature and criticality of the services provided. The guidance contemplates that the banking organization will have the ability to review the third party's business continuity and disaster recovery plans and test results. Given Skybridge's reliance on Osprey Cloud for infrastructure, the DPA should also address Skybridge's obligations to ensure that its sub-processor's (Osprey Cloud's) business continuity capabilities are adequate.
Data Security and Confidentiality. The DPA must include robust contractual assurances regarding information security, including specific requirements for encryption (at rest and in transit), access controls (including role-based access and MFA), network segmentation, logging and monitoring, vulnerability management, and incident response. These requirements overlap with the GLBA safeguards requirements discussed in Section III.A above and should be addressed through the DPA's security schedule.
Sub-Contractor / Sub-Processor Oversight. OCC Bulletin 2023-17 emphasizes the importance of managing risks associated with "fourth parties" — i.e., entities to which the third-party service provider itself outsources functions or activities. The banking organization must have visibility into, and contractual protections regarding, the use of sub-contractors and sub-processors by the primary service provider. The DPA's sub-processor management provisions — which, as described below, will follow a general written authorization model with thirty-day prior notice and Controller right to object — must be robust enough to satisfy OCC expectations regarding fourth-party risk oversight.
Incident Notification. The DPA must include provisions requiring Skybridge to provide timely notification of security incidents, operational disruptions, and material changes to the services, systems, or personnel involved in providing SBF Core services to Meridian. The specific breach notification timeline is discussed in greater detail in Section III.C below in connection with 12 CFR Part 53.
Performance Monitoring. The guidance contemplates that the banking organization will have the ability to monitor the third party's performance on an ongoing basis, including through the use of service level agreements, key performance indicators, and periodic reporting. The DPA should include provisions enabling Meridian to monitor Skybridge's performance and compliance, including through regular reporting on security incidents, system availability, and compliance status.
Termination and Transition Planning. The DPA must address the parties' rights and obligations upon termination of the relationship, including Skybridge's obligations with respect to data return and/or deletion, transition assistance, and the orderly wind-down of services. The guidance emphasizes that the banking organization should have the ability to terminate the relationship in a timely manner and to transition to an alternative service provider or in-house solution without undue disruption to its operations or customers.
4. DPA Implications
Audit Rights Clause. The DPA should provide that the Controller (Meridian) or its duly authorized representatives may audit the Processor (Skybridge) upon thirty (30) days' advance written notice, no more than once per twelve-month period under ordinary circumstances, at the Controller's expense. However, this frequency limitation should not apply in the event of a confirmed personal data breach, a material security incident, or a regulatory inquiry or examination requiring access to the Processor's records or facilities. In lieu of an on-site audit, Skybridge may satisfy the Controller's audit request by providing its most recent SOC 2 Type II report (currently issued by Graystone & Ketchum LLP, with a report period of October 1, 2024 through September 15, 2025, under the lead oversight of partner Sandra Clearfield), together with written responses to a supplemental audit questionnaire provided by the Controller. Notwithstanding the foregoing, the DPA must include an express provision preserving the unrestricted right of the Controller's applicable regulatory authorities — including the OCC, FDIC, CFPB, and any successor agencies — to access, examine, and audit the Processor's records, operations, facilities, and personnel without prior notice limitations, frequency caps, or other restrictions. This regulatory access provision is a regulatory non-negotiable and cannot be subject to any waiver or limitation.
Sub-Processor Management. The DPA's sub-processor provisions must reflect a general written authorization model with a thirty-day prior notice requirement and Controller right to object, consistent with both OCC expectations and GDPR Article 28(2). The Controller must have the right to receive advance notice of any proposed new sub-processor engagement or replacement of an existing sub-processor, together with sufficient information to evaluate the proposed sub-processor's ability to meet the security, confidentiality, and compliance requirements of the DPA. If the Controller objects to a proposed sub-processor on reasonable grounds, the Processor must work in good faith to provide an alternative arrangement that does not involve the objected-to sub-processor. These provisions must be robust enough to address OCC concerns regarding fourth-party risk while remaining practically workable for Skybridge as a SaaS provider that may need to engage new sub-processors from time to time.
C. FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53)
1. Overview. The Computer-Security Incident Notification Rule, codified at 12 CFR Part 53 (OCC) and parallel provisions at 12 CFR Part 304 (FDIC) and 12 CFR Part 225 (Federal Reserve), became effective on April 1, 2022. The rule establishes two related notification requirements:
Bank-to-Regulator Notification. A banking organization must notify its primary federal regulator no later than thirty-six (36) hours after the banking organization determines that a "notification incident" has occurred. A "notification incident" is defined as a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization's ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business; or that has resulted in, or is reasonably likely to result in, customers being unable to access their deposit and other accounts; or that poses a threat to the financial stability of the United States.
Bank Service Provider Notification. A bank service provider — including a technology service provider such as Skybridge — is required to notify at least one bank-designated point of contact at each affected banking organization as soon as possible after the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to the banking organization for four (4) or more hours.
2. Interplay with DPA Breach Notification Timeline
The interplay between the 12 CFR Part 53 notification requirements and the DPA breach notification provisions is critical and must be carefully structured to ensure that all parties can meet their respective notification obligations:
The bank-to-regulator notification timeline under 12 CFR Part 53 is thirty-six (36) hours from the banking organization's determination that a notification incident has occurred. This means that Meridian must have sufficient time, after receiving notification from Skybridge, to assess the nature and scope of the incident and determine whether it rises to the level of a "notification incident" requiring OCC notification.
Market practice for bank-vendor DPAs typically establishes a notification window of either forty-eight (48) or seventy-two (72) hours for vendor-to-bank notification of security incidents. Meridian's TPRM program specifically requires notification within forty-eight (48) hours. A forty-eight-hour notification window from Skybridge to Meridian provides Meridian with a reasonable period to receive the notification, convene its incident response team, assess the incident, and make the determination required under 12 CFR Part 53, while still preserving Meridian's ability to comply with its own thirty-six-hour notification obligation to the OCC (assuming that Meridian's internal assessment can be completed in a timely manner after receipt of the notification).
3. Recommendation. The DPA should specify that Skybridge must notify Meridian of a Personal Data Breach (as defined in the DPA) within forty-eight (48) hours of becoming aware of the breach. However, for incidents that are reasonably likely to constitute "notification incidents" under 12 CFR Part 53 — i.e., incidents that have materially disrupted or are reasonably likely to materially disrupt SBF Core services for four or more hours, or that have resulted or are reasonably likely to result in the compromise of a significant volume of NPI — the DPA should require Skybridge to provide immediate telephone notification to Meridian's designated incident response contact, in addition to the formal written notification required within the forty-eight-hour window.
The escalation matrix for incident notification should be documented in a schedule to the DPA (anticipated as Schedule D) and should specify the following chain of communication:
(i) Skybridge CISO Rebecca Muñoz → Skybridge GC / CPO Thomas Elridge;
(ii) Skybridge GC / CPO Thomas Elridge → Meridian Chief Compliance Officer Andrea Sokolov and Meridian VP, Third-Party Risk Management Marcus Tibaldi;
(iii) For incidents reasonably likely to constitute "notification incidents" under 12 CFR Part 53, immediate phone notification to Meridian CCO Andrea Sokolov, followed by formal written notification within forty-eight (48) hours.
This dual-track notification approach — immediate phone notification for the most serious incidents, coupled with a forty-eight-hour formal written notification window for all Personal Data Breaches — ensures that Meridian has adequate time to comply with its own regulatory notification obligations while providing Skybridge with a commercially reasonable timeline for incident assessment and notification.
IV. State Privacy Laws
This section addresses the state-level comprehensive privacy laws and data breach notification statutes that are applicable to the Skybridge–Meridian relationship, with particular focus on the CCPA/CPRA and the New Jersey Data Privacy Act, and their implications for the DPA.
A. California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)
1. Overview. The California Consumer Privacy Act ("CCPA"), as substantially amended by the California Privacy Rights Act ("CPRA"), establishes a comprehensive framework of consumer privacy rights for California residents. The CPRA amendments became effective on January 1, 2023, with enforcement commencing on July 1, 2023. The CCPA/CPRA is administered and enforced by the California Privacy Protection Agency ("CPPA") and the California Attorney General's office.
The CCPA/CPRA applies to businesses that collect, process, or share the personal information of California residents and that satisfy one or more statutory thresholds (annual gross revenues exceeding $25 million, processing of personal information of 100,000 or more California residents or households, or derivation of 50% or more of annual revenues from the sale or sharing of personal information). The CCPA/CPRA grants California residents a suite of privacy rights, including the right to know what personal information is collected and how it is used, the right to delete personal information, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of personal information, and the right to limit the use of sensitive personal information.
2. Applicability to the Skybridge–Meridian Relationship
Although Meridian does not operate retail branches in California — its physical footprint spans New Jersey, New York, Pennsylvania, and Connecticut — Meridian likely has accountholders who are California residents. This may include individuals who opened accounts at Meridian branches before relocating to California, individuals who maintain online-only banking relationships with Meridian from California, and individuals who hold accounts at Meridian as authorized signers or beneficial owners while residing in California. Given Meridian's substantial customer base of approximately 412,000 accountholders and the mobile nature of the US population, it is reasonable to assume that some number of Meridian accountholders are California residents whose personal information is processed through SBF Core.
Further, the CCPA/CPRA's definition of "sensitive personal information" encompasses both SSNs and certain biometric information. While the CCPA/CPRA defines "biometric information" by reference to physiological, biological, or behavioral characteristics that can be used to establish individual identity, the behavioral biometric data collected by SBF Core (keystroke dynamics, mouse movement patterns) may fall within this definition if it is used or capable of being used to identify a specific consumer. Accordingly, the DPA should treat SSNs and behavioral biometric data as sensitive personal information for CCPA/CPRA purposes and should include appropriate use limitations and safeguards.
It is also worth noting that the CCPA/CPRA includes a partial exemption for personal information collected, processed, sold, or disclosed pursuant to GLBA. Specifically, Cal. Civ. Code § 1798.145(e) provides that the CCPA/CPRA does not apply to personal information "collected, processed, sold, or disclosed pursuant to" GLBA and its implementing regulations, provided that such collection, processing, sale, or disclosure is in compliance with GLBA. This exemption may limit the applicability of the CCPA/CPRA to certain categories of NPI processed through SBF Core. However, the scope of the GLBA exemption is fact-specific and may not extend to all categories of personal data processed through SBF Core (e.g., behavioral biometric data may not be "collected pursuant to GLBA"). Accordingly, it is prudent to include CCPA/CPRA-compliant service provider provisions in the DPA to ensure compliance even if the GLBA exemption applies to only a subset of the data at issue.
3. Service Provider Obligations
Under the CCPA/CPRA, a "service provider" is a person or entity that processes personal information on behalf of a business pursuant to a written contract that, among other things, prohibits the service provider from selling or sharing the personal information, retaining, using, or disclosing the personal information for any purpose other than performing the services specified in the contract, and requires the service provider to comply with the CCPA/CPRA and provide the same level of privacy protection as required of the business. The key obligations imposed on service providers by the CCPA/CPRA include:
(a) Prohibition on selling or sharing personal information. The service provider must be contractually prohibited from selling or sharing (as those terms are defined in the CCPA/CPRA) the personal information received from or on behalf of the business.
(b) Purpose limitation. The service provider must be contractually prohibited from retaining, using, or disclosing the personal information for any purpose other than for performing the services specified in the written contract, including retaining, using, or disclosing the personal information for a commercial purpose other than providing the services specified in the contract.
(c) CCPA/CPRA compliance obligation. The service provider must contractually agree to comply with applicable provisions of the CCPA/CPRA and to provide the same level of privacy protection as the business is required to provide under the CCPA/CPRA.
(d) Notification of inability to comply. The service provider must contractually agree to notify the business if the service provider determines that it can no longer meet its obligations under the CCPA/CPRA.
(e) Right to monitor. The business must have the right to take reasonable and appropriate steps to ensure that the service provider uses the personal information in a manner consistent with the business's obligations under the CCPA/CPRA. This right to monitor is distinct from, but complementary to, the audit rights required under OCC Bulletin 2023-17 and GDPR Article 28(3)(h).
(f) Cooperation with consumer rights requests. The service provider must assist the business in responding to consumer requests to exercise their rights under the CCPA/CPRA, including requests to access, delete, or correct personal information.
4. DPA Implications
The DPA must include CCPA/CPRA-specific service provider provisions that address each of the requirements outlined above. These provisions may be incorporated as a standalone section or schedule within the DPA (anticipated as Schedule F — US State Privacy Law Supplement) or woven into the body of the DPA alongside analogous provisions addressing GDPR and other regulatory frameworks. Given the DPA's intended use as a scalable template for all future bank clients, it is advisable to draft the CCPA/CPRA provisions in a modular format that can be activated or deactivated depending on the geographic footprint and customer base of each bank client.
Specific provisions that should be included in the DPA to address CCPA/CPRA requirements include:
• An express prohibition on the sale or sharing of personal information received from or on behalf of the Controller;
• A use restriction limiting the Processor's use of personal information to the performance of services specified in the subscription agreement and DPA;
• An obligation on the Processor to provide the same level of privacy protection as the Controller is required to provide under the CCPA/CPRA;
• A covenant by the Processor to notify the Controller if the Processor determines that it can no longer meet its CCPA/CPRA obligations, with the Controller having the right to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information;
• An obligation on the Processor to cooperate with the Controller in responding to consumer rights requests, including by providing relevant personal information in the Processor's possession within a commercially reasonable timeframe;
• Provisions addressing the processing of sensitive personal information, including restrictions on the purposes for which such information may be processed and requirements for enhanced safeguards.
B. New Jersey Data Privacy Act (NJ S3377)
1. Overview. The New Jersey Data Privacy Act, enacted as NJ S3377, establishes a comprehensive framework of consumer privacy rights for New Jersey residents. The law is expected to take effect on January 15, 2026 — just one month before the target signing date of February 15, 2026 for the Skybridge–Meridian DPA. The timing of the NJ S3377 effective date is directly relevant to this engagement, as Meridian is headquartered in New Jersey, operates branches across New Jersey, and a significant portion of its 412,000 accountholders are New Jersey residents.
The NJ S3377 follows the general structure of other comprehensive state privacy laws enacted in recent years, establishing a framework of controller and processor obligations and granting consumers a suite of privacy rights. However, certain aspects of NJ S3377 are particularly noteworthy for purposes of this engagement.
2. Key Provisions
Controller-Processor Framework. NJ S3377 establishes distinct obligations for controllers (entities that determine the purposes and means of processing personal data) and processors (entities that process personal data on behalf of controllers). Meridian is the controller; Skybridge is the processor.
Consumer Rights. The law grants New Jersey consumers the following rights: the right to access their personal data, the right to correct inaccuracies in their personal data, the right to delete personal data, the right to data portability, and the right to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.
Data Protection Assessments. NJ S3377 requires controllers to conduct data protection assessments for certain processing activities that present a heightened risk of harm to consumers, including processing of sensitive data and processing that involves profiling. This requirement is analogous to the GDPR's Data Protection Impact Assessment ("DPIA") requirement under Article 35 and has implications for Skybridge's obligation to assist Meridian with such assessments.
Processor Requirements. NJ S3377 requires that the processing relationship between a controller and a processor be governed by a contract that establishes the following:
(a) Clear instructions for processing personal data;
(b) The nature and purpose of processing;
(c) The type of personal data subject to processing and the duration of processing;
(d) The rights and obligations of both parties;
(e) An obligation on the processor to ensure that each person processing personal data is subject to a duty of confidentiality;
(f) A requirement that the processor delete or return personal data to the controller at the controller's direction upon completion of the processing, unless retention is required by law;
(g) An obligation on the processor to make available to the controller all information in its possession necessary to demonstrate compliance with the Act;
(h) An obligation on the processor to allow and cooperate with reasonable assessments (audits) by the controller or the controller's designated assessor;
(i) Requirements for the engagement of sub-processors, including notice to the controller and the right to object.
Sensitive Data. NJ S3377 classifies certain categories of personal data as "sensitive data" requiring enhanced protections, including genetic data, biometric data, precise geolocation data, and personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status. Behavioral biometric data (keystroke dynamics, mouse movement patterns) and SSNs processed through SBF Core are likely to fall within the Act's definition of sensitive data, triggering additional consent and purpose limitation requirements.
3. DPA Implications
Given that NJ S3377 is expected to take effect on January 15, 2026, just one month before the DPA target signing date, the DPA must be drafted to comply with NJ S3377's processor requirements from the outset. Specific implications include:
Processor Contract Requirements. The DPA must satisfy each of the contractual requirements specified in NJ S3377, as enumerated above. Fortunately, these requirements are largely consistent with the parallel requirements of GDPR Article 28 and the CCPA/CPRA, and a DPA drafted to satisfy GDPR and CCPA/CPRA requirements will, with relatively modest additions, also satisfy NJ S3377.
Data Protection Assessment Cooperation. The DPA must include a provision requiring Skybridge to assist Meridian with data protection assessments required under NJ S3377, analogous to the GDPR DPIA cooperation obligation under Article 35. This assistance should include providing information regarding Skybridge's processing activities, technical and organizational measures, and any other information reasonably necessary for Meridian to conduct the required assessment.
Consumer Rights Cooperation. The DPA must include provisions requiring Skybridge to cooperate with Meridian in responding to consumer rights requests from New Jersey residents, including requests to access, correct, delete, or port personal data. The DPA should specify the timeframe within which Skybridge must respond to such cooperation requests to enable Meridian to meet its own statutory response deadlines.
Sub-Processor Management. NJ S3377's sub-processor management requirements are consistent with the general written authorization model with notice and right to object that is contemplated for the DPA. No additional structural modifications to the DPA's sub-processor provisions should be necessary to satisfy NJ S3377.
Forward-Looking Drafting. Given that NJ S3377 has not yet taken effect as of the date of this memorandum, and will take effect during the DPA negotiation period, it is advisable to draft the DPA's state law compliance provisions in a forward-looking manner that ensures automatic compliance with NJ S3377 upon its effective date. This can be accomplished through a general compliance provision requiring both parties to comply with all applicable data protection laws as in effect from time to time, supplemented by specific references to NJ S3377 in the relevant schedules or annexes.
C. Other State Laws (Brief Survey)
In addition to the CCPA/CPRA and NJ S3377, a number of other state-level privacy and data security laws may be applicable to the Skybridge–Meridian relationship, depending on the residency of Meridian's accountholders and the geographic scope of Meridian's operations.
Connecticut Data Privacy Act (CTDPA). The Connecticut Data Privacy Act became effective on July 1, 2023, and establishes comprehensive privacy rights for Connecticut residents, including the right to access, correct, delete, and port personal data, and the right to opt out of targeted advertising and the sale of personal data. Given that Meridian operates retail branches in Connecticut, a significant number of Meridian accountholders are likely Connecticut residents. The CTDPA imposes processor requirements that are substantively similar to those of other state comprehensive privacy laws and GDPR Article 28, and a DPA drafted to satisfy those parallel frameworks should also satisfy the CTDPA.
New York. New York currently lacks a comprehensive consumer privacy statute comparable to the CCPA/CPRA or CTDPA, although various comprehensive privacy bills have been introduced in the New York State Legislature in recent sessions. However, New York has robust data breach notification requirements under the New York General Business Law § 899-aa and the Stop Hacks and Improve Electronic Data Security Act ("NY SHIELD Act"), which imposes data security requirements on businesses that own or license computerized data that includes private information of New York residents. Given that Meridian is headquartered in the New York metropolitan area and operates branches in New York, compliance with New York breach notification and data security requirements is essential. The DPA's breach notification provisions and security requirements should be drafted to satisfy New York law in addition to the other frameworks discussed herein.
Pennsylvania. Pennsylvania similarly lacks a comprehensive consumer privacy statute, although the state has data breach notification requirements codified at 73 P.S. § 2303. Given that Meridian operates branches in Pennsylvania, the DPA's breach notification provisions should account for Pennsylvania's notification requirements.
Other State Laws. Depending on the residency of Meridian's accountholders, other state comprehensive privacy laws may also be applicable, including the Virginia Consumer Data Protection Act (effective January 1, 2023), the Colorado Privacy Act (effective July 1, 2023), the Utah Consumer Privacy Act (effective December 31, 2023), and laws enacted in various other states that have taken or may take effect during the term of the DPA. A complete analysis of all potentially applicable state laws is beyond the scope of this memorandum but will be addressed as appropriate in the DPA drafting process.
Recommendation. The DPA should include a general compliance provision requiring both parties to comply with all applicable data protection laws (defined broadly to encompass federal, state, local, and international laws relating to the protection, privacy, or security of personal data), supplemented by specific schedules or annexes that address the requirements of particular jurisdictions. This approach ensures that the DPA remains current as new state laws take effect and can be adapted to the varying geographic footprints of future bank clients without requiring substantive amendments to the body of the agreement.
V. European Union General Data Protection Regulation (GDPR)
A. Applicability
The General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") applies to the processing of personal data of individuals who are in the European Union. The GDPR has extraterritorial reach and applies to the processing of personal data of EU residents by controllers or processors established in the EU, as well as to controllers or processors not established in the EU that offer goods or services to, or monitor the behavior of, individuals in the EU.
As noted in Section II.F above, approximately 3,200 of Meridian's accountholders are residents of the European Union, consisting primarily of expatriate and dual-resident individuals who maintain checking, savings, and/or loan accounts with Meridian. The personal data of these EU-resident accountholders is processed through SBF Core in the same manner as the personal data of US-resident accountholders. This triggers the applicability of the GDPR to the Skybridge–Meridian data processing relationship with respect to these data subjects.
Skybridge maintains an EU presence through Skybridge Fintech Europe B.V. ("SBF Europe"), a wholly owned subsidiary incorporated under Dutch law and located at Keizersgracht 482, 1017 EG Amsterdam, Netherlands (KvK No. 82104593). SBF Europe is managed by Lena Vogt, Managing Director, and employs fourteen (14) individuals — eight engineers, four customer support personnel, and two compliance professionals. SBF Europe processes EU personal data for Skybridge's bank clients and is registered with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority). The presence of SBF Europe within the EU means that GDPR Article 3(1) applies directly to SBF Europe's processing activities.
Additionally, Osprey Cloud operates an EU data center in Frankfurt, Germany, which hosts certain SBF Core workloads involving EU personal data. The processing of personal data in the Frankfurt data center is governed by the Skybridge–Osprey Cloud DPA dated March 1, 2024.
B. Controller-Processor Obligations (Article 28 GDPR)
Article 28 of the GDPR establishes mandatory requirements for the contractual relationship between a controller and a processor. The DPA between Meridian (as controller) and Skybridge (as processor) must satisfy all of the requirements set forth in Article 28(3), which provides that the processing by the processor shall be governed by a contract that sets out, at a minimum:
(a) Processing on documented instructions. The processor must process personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organization, unless required to do so by EU or Member State law.
(b) Confidentiality obligations. The processor must ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) Technical and organizational measures. The processor must implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32. For Skybridge, these measures include SOC 2 Type II certification, AES-256 encryption for data at rest, TLS 1.2+ encryption for data in transit, multi-factor authentication for all personnel with access to production environments, and annual penetration testing conducted by Ironvault Security Group LLC. These measures should be documented in the DPA's security schedule (anticipated as Schedule B) and cross-referenced in the body of the agreement.
(d) Sub-processor engagement. The processor must not engage another processor (sub-processor) without prior specific or general written authorization of the controller. In the case of general written authorization, the processor must inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. The DPA will follow the general written authorization model, requiring Skybridge to provide Meridian with at least thirty (30) days' prior written notice of any proposed new sub-processor engagement or replacement, together with the identity, location, and scope of processing of the proposed sub-processor. Meridian will have the right to object to a proposed sub-processor on reasonable grounds within the notice period.
(e) Data subject rights assistance. The processor must assist the controller, by appropriate technical and organizational measures and insofar as this is possible, in fulfilling the controller's obligations to respond to data subject rights requests (Articles 15–22, including rights of access, rectification, erasure, restriction, data portability, and objection).
(f) Security, breach notification, DPIA, and prior consultation assistance. The processor must assist the controller in ensuring compliance with its obligations under Articles 32–36, including obligations relating to security of processing (Article 32), notification of a personal data breach to the supervisory authority (Article 33), communication of a personal data breach to the data subject (Article 34), data protection impact assessments (Article 35), and prior consultation with the supervisory authority (Article 36).
(g) Deletion or return of personal data. At the choice of the controller, the processor must delete or return all personal data to the controller after the end of the provision of services relating to processing, and delete existing copies unless EU or Member State law requires storage. The DPA should specify a ninety (90)-day post-termination period within which Skybridge must return or securely delete all personal data, with certification of deletion provided to Meridian upon completion.
(h) Audit and inspection rights. The processor must make available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
Each of the foregoing requirements maps directly to specific DPA provisions and schedules and must be addressed comprehensively in the agreement. The DPA's structu