1009-00004 · Skybridge Fintech Ltd · Analysis & Advice

sub-processor-risk-allocation-memo.docx DOCUMENT Finance & Banking

4 / 35 ← → ✕

Contract analysis Extract to table

MEMORANDUM

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

TO: Priscilla Wynn, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP

FROM: Alan Burke, Working Associate, Privacy & Data Security, Calderwood & Harkness LLP

DATE: December 6, 2025

RE: Sub-Processor Risk Allocation Framework — Skybridge Fintech Ltd. Customer-Facing DPA

MATTER NO.: 1009-00004

CLIENT: Skybridge Fintech Ltd.

I. Executive Summary

This memorandum analyzes the sub-processor risk allocation structure for Skybridge Fintech Ltd.'s customer-facing Data Processing Agreement ("DPA") with Meridian Federal Savings Bank ("Meridian" or "Controller") and recommends a comprehensive framework that can serve as Skybridge's bank-grade template for all future similarly situated bank clients. The analysis addresses the unique regulatory, contractual, and operational considerations arising from Skybridge's role as a Processor under both European and U.S. data protection regimes, and from Meridian's status as a federally chartered savings bank subject to heightened third-party risk management obligations.

Skybridge Fintech Ltd. ("Skybridge" or "Processor"), in its capacity as Processor under the forthcoming DPA, engages two sub-processors to perform specific processing activities in connection with the services provided through the SBF Core platform: (1) Osprey Cloud Infrastructure, Inc. ("Osprey Cloud" or "OCI"), the primary Infrastructure-as-a-Service and Platform-as-a-Service ("IaaS/PaaS") provider hosting the SBF Core environment, and (2) Skybridge Fintech Europe B.V. ("SBF Europe"), Skybridge's wholly-owned EU affiliate that processes EU personal data on behalf of Skybridge's customers with European accountholders. Each sub-processor performs distinct but critical functions in the data processing chain, and each presents its own set of risk allocation considerations that must be addressed in the DPA.

The sub-processor risk allocation framework must simultaneously satisfy several overlapping regulatory and contractual requirements. First, the framework must satisfy Meridian's Third-Party Risk Management ("TPRM") program, which is aligned with OCC Bulletin 2023-17 (superseding OCC Bulletin 2013-29) and relevant FFIEC guidance on outsourcing technology services. Second, the framework must comply with GDPR Article 28 requirements, which are triggered because approximately 3,200 of Meridian's accountholders are residents of EU Member States. Third, the framework must address applicable U.S. regulatory requirements, including the Gramm-Leach-Bliley Act ("GLBA") and Regulation P, the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53), and applicable state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") and the New Jersey Data Privacy Act (S3377, expected effective January 15, 2026).

Based on the analysis set forth below, I recommend a general written authorization model with a 30-day prior written notice period and a Controller right to object, coupled with mandatory flow-down of data protection obligations to each sub-processor. This model is consistent with market practice for bank-vendor DPAs in the fintech sector, satisfies the requirements of GDPR Article 28(2), and preserves the degree of Controller oversight that Meridian's TPRM program and its prudential regulators expect. The framework should be structured to serve as a reusable template component for Skybridge's engagements with all similarly situated FDIC-insured bank clients.

II. Background

A. The Parties and Transaction Context

Skybridge Fintech Ltd. is a Delaware C-corporation headquartered at 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810. Skybridge operates the "SBF Core" platform, a Software-as-a-Service ("SaaS") solution that provides real-time payment processing, anti-fraud analytics, and regulatory reporting functionality to FDIC-insured depository institutions. SBF Core is designed to integrate with a bank's core banking system and processes significant volumes of consumer financial data, including personally identifiable information, account information, and transaction data. Skybridge's client base consists primarily of mid-size and regional banks and savings institutions, and the company has been expanding its customer base among federally chartered institutions in recent quarters.

Meridian Federal Savings Bank is a federally chartered savings bank, operating under OCC Charter No. 14-2238, and headquartered at 900 Broad Street, Suite 1200, Newark, New Jersey 07102. Meridian is an FDIC-insured institution with approximately $6.1 billion in total assets and serves approximately 412,000 accountholders across its retail and small-business banking segments. Of particular relevance to this analysis, approximately 3,200 of Meridian's accountholders are residents of European Union Member States, which triggers the application of the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") to certain processing activities performed by Skybridge and its sub-processors.

The underlying transaction is a 5-year SaaS subscription agreement pursuant to which Meridian will license the SBF Core platform from Skybridge. The subscription agreement carries an annual contract value ("ACV") of $2.74 million per year, yielding a total contract value ("TCV") of $13.7 million over the 5-year term. The DPA will be executed concurrently with the SaaS subscription agreement, with a target execution date of February 15, 2026. The DPA is a critical ancillary agreement that governs the processing of personal data by Skybridge in connection with the SBF Core services and is a precondition to Meridian's execution of the SaaS subscription agreement.

Meridian's outside counsel on this transaction is Blackwell, Raines & Stoddard LLP ("BRS"), with lead partner Constance Liu and associate Derek Faulkner serving as the primary points of contact for DPA negotiations. Our client's engagement team at Calderwood & Harkness LLP consists of Kevin Ostrowski (Responsible Partner), Rachel Bernstein (Billing Partner), Priscilla Wynn (Lead Associate), and Alan Burke (Working Associate).

B. Skybridge's Sub-Processors

Skybridge currently engages two sub-processors in connection with the SBF Core platform, each of which will be involved in the processing of Meridian personal data:

Osprey Cloud Infrastructure, Inc. ("Osprey Cloud" or "OCI") is a Delaware corporation headquartered at 2200 Campus Drive, San Jose, California 95131, with Martin Cho serving as Chief Executive Officer. Osprey Cloud is Skybridge's primary IaaS/PaaS provider and hosts the SBF Core production environment and associated infrastructure. Osprey Cloud operates data center facilities in two primary regions relevant to this engagement: (i) a US-East data center region located in Ashburn, Virginia, which serves as the primary production environment for Skybridge's U.S.-based bank clients, including Meridian, and (ii) an EU data center region located in Frankfurt, Germany, which is used for processing EU personal data in compliance with data localization requirements. Osprey Cloud also maintains a secondary availability zone within the US-East region (also in Ashburn, Virginia) that serves as the designated disaster recovery site for Skybridge's U.S. production environment. Osprey Cloud is a significant infrastructure provider with a substantial client base in the financial services sector and maintains SOC 2 Type II certification.

Skybridge Fintech Europe B.V. ("SBF Europe") is a Dutch besloten vennootschap (private limited company), registered with the Kamer van Koophandel under number 82104593, with its registered office at Keizersgracht 482, 1017 EG Amsterdam, the Netherlands. Lena Vogt serves as Managing Director. SBF Europe is a wholly-owned subsidiary (affiliate) of Skybridge Fintech Ltd. and currently employs 14 individuals: 8 engineers, 4 support personnel, and 2 compliance professionals. SBF Europe's function within the Skybridge corporate structure is to process EU personal data on behalf of Skybridge's bank customers that have European-resident accountholders. SBF Europe is registered with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) and operates under GDPR as a processor established within the European Economic Area.

C. Data Processing Scope Relevant to Sub-Processors

An accurate understanding of the scope of data processing activities performed by Skybridge's sub-processors is essential to structuring appropriate risk allocation provisions. The following summarizes the categories of data subjects, categories of personal data, and data processing locations relevant to the sub-processor analysis.

Categories of Data Subjects. The personal data processed through SBF Core relates to the following categories of data subjects: (i) Meridian accountholders (both retail and small-business), (ii) authorized signers on Meridian accounts, (iii) beneficial owners of Meridian business accounts, and (iv) Meridian employees whose data passes through the SBF Core platform in connection with Meridian's use of the regulatory reporting functionality.

Categories of Personal Data Processed by Sub-Processors. The sub-processors process the following categories of personal data in connection with the SBF Core services: full name, date of birth, Social Security Number ("SSN"), Taxpayer Identification Number ("TIN"), account numbers (checking, savings, and loan accounts), routing numbers, transaction amounts and transaction metadata, IP addresses, device identifiers, geolocation data (city-level), email addresses, phone numbers, and behavioral biometric data (specifically, keystroke dynamics and mouse movement patterns collected in connection with Skybridge's anti-fraud analytics module).

Sensitive Data. Of the categories listed above, SSNs and behavioral biometric data are classified as sensitive personal information under the CCPA/CPRA and are expected to be classified as sensitive data under the New Jersey Data Privacy Act (S3377), which is anticipated to take effect on January 15, 2026. The presence of sensitive data categories within the processing scope heightens the importance of robust sub-processor controls and flow-down obligations.

Volume. Approximately 18.6 million transactions per month are processed through the SBF Core platform in connection with Meridian's operations, reflecting the scale and criticality of the data processing relationship.

Data Locations. Personal data processed in connection with Meridian's use of SBF Core is stored and processed in the following locations: (i) Primary — Osprey Cloud US-East data center (Ashburn, Virginia); (ii) Secondary/EU — Osprey Cloud EU data center (Frankfurt, Germany) and SBF Europe (Amsterdam, Netherlands), each of which processes personal data relating to Meridian's approximately 3,200 EU-resident accountholders; and (iii) Disaster Recovery — Osprey Cloud US-East secondary availability zone (Ashburn, Virginia).

III. Regulatory and Legal Framework for Sub-Processor Oversight

The sub-processor risk allocation framework must be structured to satisfy the requirements of multiple, overlapping regulatory regimes. This section surveys the applicable regulatory and legal requirements governing sub-processor oversight in the context of the Skybridge-Meridian relationship.

A. OCC Bulletin 2023-17 (Third-Party Risk Management)

OCC Bulletin 2023-17, issued on June 6, 2023, supersedes the prior guidance set forth in OCC Bulletin 2013-29 and establishes the OCC's current expectations for banks' management of risks associated with third-party relationships. The Bulletin applies to all banks supervised by the OCC and requires that banks manage the risks arising from third-party relationships throughout the entire relationship life cycle, including planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination.

Of particular relevance to this analysis, OCC Bulletin 2023-17 addresses the risks arising from a third party's use of sub-contractors. The Bulletin provides that banks should ensure that their critical third-party service providers have adequate controls over their own sub-contractors and that contractual provisions governing the third-party relationship should address the bank's ability to oversee and, where appropriate, approve or object to the use of sub-contractors. The Bulletin emphasizes that the bank's risk management practices should extend to understanding the role and significance of sub-contractors in the delivery of critical services and that the bank should have sufficient information to assess the risks introduced by sub-contractor relationships.

Meridian's TPRM program, which is led by Vice President of Third-Party Risk Management Marcus Tibaldi and Chief Compliance Officer Andrea Sokolov, has been structured to align with OCC Bulletin 2023-17. As a precondition to executing the SaaS subscription agreement with Skybridge, Meridian's TPRM program requires that the DPA include contractual provisions providing Meridian with meaningful oversight of Skybridge's sub-processors, including notice and objection rights, flow-down of data protection obligations, audit rights, and regulatory access provisions. These requirements are non-negotiable from Meridian's perspective and reflect the expectations of Meridian's primary federal regulator.

The DPA must therefore be structured to preserve Meridian's — and its regulators', including the OCC, the FDIC, and the Consumer Financial Protection Bureau ("CFPB") — ability to assess the risks introduced by Skybridge's sub-processors and to exercise appropriate oversight over the sub-processing chain.

B. FFIEC Guidance

The Federal Financial Institutions Examination Council ("FFIEC") has issued supplemental guidance on outsourcing technology services that reinforces and expands upon the principles set forth in OCC Bulletin 2023-17. The FFIEC guidance emphasizes that outsourcing arrangements should include contractual provisions requiring the service provider to notify the bank before engaging or changing sub-contractors who will have access to the bank's data or systems. Additionally, the guidance states that the bank should retain the ability to terminate the outsourcing arrangement if a sub-contractor is deemed unacceptable based on the bank's risk assessment. These principles inform the structure of the sub-processor authorization model recommended in Section V of this memorandum.

C. GDPR Article 28 — Sub-Processor Requirements

GDPR Article 28 establishes the legal framework governing the engagement of sub-processors (referred to as "another processor" in the text of Article 28). The sub-processor provisions of Article 28 are directly applicable to the Skybridge-Meridian relationship because approximately 3,200 of Meridian's accountholders are residents of EU Member States, and the processing of their personal data by Skybridge and its sub-processors falls within the material and territorial scope of the GDPR.

Article 28(2) provides that a processor shall not engage another processor (i.e., a sub-processor) without the prior specific or general written authorization of the controller. Where general written authorization has been given, the processor must inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. This provision establishes the two permissible authorization models — specific authorization and general authorization — and sets forth the minimum procedural requirements for the general authorization model.

Article 28(4) requires that where a sub-processor is engaged, the sub-processor must be bound by the same data protection obligations as those set out in the contract between the controller and the processor (i.e., the DPA). This "flow-down" requirement ensures that the chain of data protection obligations is maintained throughout the sub-processing relationship. Article 28(4) further provides that where the sub-processor fails to fulfil its data protection obligations, the initial processor (Skybridge) remains fully liable to the controller (Meridian) for the performance of that sub-processor's obligations.

The applicability of GDPR Article 28 to this transaction also necessitates the inclusion of Standard Contractual Clauses ("SCCs"), specifically Module 3 (Processor-to-Sub-processor), for transfers of EU personal data from Skybridge to its sub-processors. Module 3 SCCs will be required for transfers from Skybridge (a U.S.-based Processor) to Osprey Cloud (a U.S.-based Sub-processor) involving EU personal data, and for the relationship between Skybridge and SBF Europe to address potential re-transfer scenarios and to provide comprehensive contractual coverage of the sub-processing relationship.

D. GLBA / Regulation P

The Gramm-Leach-Bliley Act ("GLBA") and its implementing regulations, including Regulation P (12 CFR Part 1016), impose requirements on financial institutions and their service providers regarding the protection of consumer financial information. Skybridge, as a service provider to Meridian, qualifies as a "service provider" within the meaning of the GLBA. Sub-processors that handle consumer financial information on behalf of Skybridge in connection with the Meridian engagement — specifically, Osprey Cloud and SBF Europe — must also be subject to appropriate safeguards designed to protect the security and confidentiality of consumer financial information.

The contractual flow-down provisions in the sub-processor agreements should include GLBA-level obligations, ensuring that each sub-processor is contractually bound to implement and maintain safeguards appropriate to the nature and sensitivity of the consumer financial information it processes. This requirement supplements the GDPR flow-down obligations and reflects the dual regulatory regime applicable to the processing of personal data of Meridian's accountholders.

E. CCPA/CPRA and NJ Data Privacy Act (S3377)

CCPA/CPRA. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, service providers are prohibited from further disclosing personal information except as permitted under the CCPA/CPRA. Where a service provider engages sub-contractors (sub-processors) to process personal information on its behalf, the contractual restrictions imposed on the service provider must flow down to those sub-contractors. The sub-processor agreements between Skybridge and its sub-processors must include provisions that restrict the sub-processor's use and disclosure of personal information to the purposes specified in the service provider contract and that require the sub-processor to comply with applicable CCPA/CPRA obligations. Given that SSNs and behavioral biometric data are classified as sensitive personal information under the CCPA/CPRA, additional protections and use limitations may be required.

NJ Data Privacy Act (S3377). The New Jersey Data Privacy Act (Senate Bill S3377), which is expected to take effect on January 15, 2026 — one month before the target DPA execution date — imposes controller and processor obligations on entities that process the personal data of New Jersey residents. Because Meridian is headquartered in Newark, New Jersey, and a substantial portion of its accountholders are New Jersey residents, the NJ Data Privacy Act will be directly relevant to the data processing activities performed under the DPA. The Act requires that processors contractually bind their sub-processors to equivalent data protection obligations, consistent with the GDPR Article 28(4) flow-down model. The DPA's sub-processor provisions should be drafted to comply with this requirement.

F. FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53)

The FDIC/OCC Computer-Security Incident Notification Rule, codified at 12 CFR Part 53, requires banking organizations to notify their primary federal regulator no later than 36 hours after the banking organization determines that a "notification incident" has occurred. The rule also requires bank service providers (as defined under the Bank Service Company Act) to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to the banking organization for four or more hours.

The sub-processor data processing agreements must include incident notification obligations that flow upstream through the notification chain — from sub-processor to Skybridge, from Skybridge to Meridian — with sufficient speed to enable Meridian to meet the 36-hour regulatory notification deadline. The specific notification timelines are discussed in greater detail in Section IX of this memorandum.

IV. Existing Sub-Processor Agreements

A. Skybridge–Osprey Cloud DPA (March 1, 2024)

Skybridge and Osprey Cloud are parties to a Data Processing Agreement executed on March 1, 2024 (the "Osprey DPA"). The Osprey DPA includes Module 3 Standard Contractual Clauses (Processor-to-Sub-processor) to provide a lawful transfer mechanism for the transfer of EU personal data from Skybridge to Osprey Cloud's data center facilities. The Osprey DPA was negotiated and executed prior to the commencement of the Meridian engagement and was not specifically tailored to address the requirements of a bank-grade customer DPA.

A thorough review of the Osprey DPA against the requirements of the forthcoming Meridian DPA is necessary to confirm that the existing agreement contains adequate flow-down provisions covering all obligations that Skybridge will assume under the Meridian DPA. The following key areas require verification and, where gaps are identified, may necessitate an amendment to the Osprey DPA:

Breach Notification Obligations. The Osprey DPA must be reviewed to confirm that Osprey Cloud is required to notify Skybridge of a personal data breach within a timeframe that allows Skybridge to meet its 48-hour notification obligation to Meridian under the DPA. If the Osprey DPA currently provides for notification "without undue delay" without a specific hourly deadline, an amendment to impose a 24-hour notification requirement may be necessary. This is discussed further in Section IX below.

Data Location Restrictions. The Osprey DPA should restrict Osprey Cloud's processing of Meridian personal data to the designated data center locations: US-East (Ashburn, Virginia) for primary processing, EU (Frankfurt, Germany) for EU personal data processing, and US-East secondary availability zone (Ashburn, Virginia) for disaster recovery. Any processing at data center locations not expressly authorized in the Meridian DPA would be inconsistent with the data location restrictions that Meridian's TPRM program requires.

Encryption Standards. Confirm that the Osprey DPA requires AES-256 encryption for data at rest and TLS 1.2 or higher for data in transit, consistent with the encryption standards that will be specified in the Meridian DPA.

Audit Cooperation Provisions. Verify that the Osprey DPA includes provisions for audit cooperation, including cooperation with Skybridge's audit requests and, critically, with regulatory examinations by Meridian's prudential supervisors (OCC, FDIC, CFPB). If the Osprey DPA does not currently include provisions for regulator access, this represents a significant gap that must be addressed by amendment.

Data Retention and Deletion Upon Termination. Confirm that the Osprey DPA requires Osprey Cloud to return or delete all personal data upon termination or expiration of the sub-processing agreement, consistent with the data return and deletion obligations in the Meridian DPA.

Regulator Access Rights. This is a potential gap of particular concern. The Osprey DPA was not drafted with bank regulatory requirements in mind, and it may not include provisions permitting Meridian's regulators — specifically the OCC, FDIC, and CFPB — to access, examine, and audit Osprey Cloud's records, systems, controls, and facilities. OCC Bulletin 2023-17 requires that contractual arrangements preserve this ability, and the absence of such provisions in the Osprey DPA would need to be remediated before the Meridian DPA can be executed.

Osprey Cloud's data center infrastructure relevant to this engagement includes: (i) US-East primary data center (Ashburn, Virginia), which serves as the primary production environment; (ii) EU data center (Frankfurt, Germany), which processes EU personal data for Meridian's EU-resident accountholders; and (iii) US-East secondary availability zone (Ashburn, Virginia), which serves as the designated disaster recovery site.

B. Skybridge–SBF Europe Intra-Group Arrangement

SBF Europe is a wholly-owned subsidiary of Skybridge and operates as Skybridge's EU affiliate for the purpose of processing EU personal data. The current data processing arrangement between Skybridge and SBF Europe is governed by an intra-group data processing agreement that was established at the time of SBF Europe's formation. Because SBF Europe is an affiliate rather than an arm's-length third party, the intra-group arrangement may not have been drafted with the same level of formality and specificity as the Osprey DPA. However, for purposes of the Meridian DPA and applicable regulatory requirements, SBF Europe is treated as a sub-processor and must be subject to the same flow-down obligations and contractual controls as any third-party sub-processor.

The existing intra-group arrangement must be reviewed and, where necessary, formalized or amended to ensure compliance with the flow-down requirements of the Meridian DPA. Specifically, the intra-group agreement should include all of the contractual provisions that the Meridian DPA requires Skybridge to impose on its sub-processors, including but not limited to: documented instructions for processing, confidentiality obligations, technical and organizational security measures, data subject rights assistance, breach notification obligations, data return and deletion obligations, audit cooperation rights (including regulatory examination access), and restrictions on further sub-processing.

SBF Europe is established in the Netherlands and its processing of EU personal data is subject to the GDPR and supervised by the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority). SBF Europe's specific role in the sub-processing chain is to process EU personal data for Skybridge's bank customers that have European-resident accountholders. In the context of the Meridian engagement, SBF Europe will process personal data relating to approximately 3,200 Meridian accountholders who are residents of EU Member States.

Module 3 SCCs (Processor-to-Sub-processor) will be included as part of the SCC package for the Skybridge-SBF Europe relationship. Given that SBF Europe is established in the Netherlands, the SCCs will be governed by the law of the Netherlands pursuant to Clause 17, which requires the parties to select the law of a Member State in which one of the parties is established.

V. Recommended Sub-Processor Authorization Model

A. General Written Authorization vs. Specific Written Authorization

GDPR Article 28(2) permits two models for controller authorization of sub-processors: (i) prior specific written authorization, under which the controller must individually authorize each sub-processor before the processor may engage that sub-processor, and (ii) prior general written authorization, under which the controller provides a blanket authorization for the processor to engage sub-processors, subject to the processor's obligation to inform the controller of any intended changes (additions or replacements) and to give the controller the opportunity to object to such changes.

I recommend the general written authorization model with appropriate safeguards for the following reasons:

First, the specific authorization model — which requires the controller to individually pre-approve each sub-processor — is operationally burdensome for a SaaS company serving multiple bank clients. If Skybridge were required to obtain specific prior authorization from each bank client before engaging or changing any sub-processor, the resulting administrative burden and potential for delays would significantly impair Skybridge's ability to manage its infrastructure and sub-processor relationships efficiently. This is particularly true given that Skybridge's sub-processor relationships (especially with Osprey Cloud) affect the infrastructure underlying the SBF Core platform as a whole, not just the processing performed for any single bank client.

Second, the general written authorization model, when combined with prior notice and objection rights (as described in Sections V.B and V.C below), achieves an appropriate balance between the controller's legitimate interest in overseeing sub-processor relationships and the processor's operational need for flexibility in managing its technology infrastructure. The general authorization model preserves the controller's ability to assess and, if necessary, reject proposed sub-processors while allowing the processor to manage sub-processor changes without being dependent on affirmative controller consent.

Third, this approach is market-standard in bank-vendor DPAs for fintech SaaS providers. Based on our review of comparable DPAs in the market, the general written authorization model with prior notice and objection rights is the prevailing approach adopted by fintech companies in their customer-facing DPAs with FDIC-insured bank clients. Adoption of this model positions Skybridge consistently with market expectations and avoids unnecessary friction in negotiations with Meridian and future bank clients.

B. 30-Day Prior Written Notice

Under the recommended general authorization model, Skybridge shall be required to provide the Controller with at least 30 days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor. The 30-day notice period is designed to provide the Controller with sufficient time to evaluate the proposed sub-processor, conduct any necessary due diligence, and exercise its objection right if warranted.

The notice provided by Skybridge must include the following information to enable the Controller to conduct a meaningful assessment of the proposed sub-processor:

(a) the identity of the proposed sub-processor (including legal name, jurisdiction of incorporation or organization, and principal place of business);

(b) a description of the processing activities to be performed by the proposed sub-processor;

(d) a summary of the technical and organizational security measures that the proposed sub-processor will implement to protect personal data.

The notice mechanism shall be written notice delivered to the Controller's designated contacts. For Meridian, the designated contacts for sub-processor notices are Vice President of Third-Party Risk Management Marcus Tibaldi and Chief Compliance Officer Andrea Sokolov, with a copy to General Counsel Vanessa Hartwell. The DPA should specify that notice may be delivered by email to designated email addresses, with confirmation of receipt, or by such other means as the parties may agree in writing.

C. Controller Right to Object

The Controller shall have the right to object to any proposed new or replacement sub-processor within the 30-day notice period. This objection right is a critical safeguard that preserves the Controller's oversight authority over the sub-processing chain and is consistent with the expectations of GDPR Article 28(2), OCC Bulletin 2023-17, and the FFIEC guidance on outsourcing arrangements.

Any objection by the Controller must be made in writing and must be based on reasonable grounds related to data protection. The requirement that the objection be grounded in reasonable data protection concerns is intended to prevent arbitrary or bad-faith objections while preserving the Controller's legitimate right to assess and manage sub-processor risks.

If the Controller objects to a proposed sub-processor, the DPA should provide for the following resolution mechanism:

(a) Good Faith Negotiation. Skybridge and the Controller shall negotiate in good faith to resolve the objection. The negotiation period shall be 15 calendar days from the date of the Controller's objection, during which the parties shall use commercially reasonable efforts to identify an alternative sub-processor or to address the Controller's concerns through additional safeguards or modifications to the proposed sub-processing arrangement.

(b) Termination Right. If no resolution is reached within the 15-day negotiation period, the Controller may terminate the DPA (and the related SaaS subscription agreement) with respect to the affected processing activities without penalty. This termination right shall not give rise to any early termination fees, liquidated damages, or other financial penalties under the SaaS subscription agreement.

The Controller's termination right in the event of an unresolved sub-processor objection is a critical element from Meridian's perspective. This provision is consistent with OCC Bulletin 2023-17's guidance on maintaining the bank's ability to exit third-party relationships when risk conditions change, and it is consistent with the FFIEC guidance's emphasis on the bank's ability to terminate outsourcing arrangements if a sub-contractor is deemed unacceptable. Meridian's TPRM team (Marcus Tibaldi and Andrea Sokolov) has indicated through BRS that this termination right is a condition of Meridian's execution of the DPA, and I do not recommend that Skybridge resist this provision given the strength of the regulatory policy underlying the requirement.

D. Initial Approved Sub-Processor List

The DPA shall include an initial approved sub-processor list as Schedule C, which will identify each sub-processor currently engaged by Skybridge in connection with the processing of Controller personal data. The initial Schedule C shall list the following sub-processors:

The Controller's execution of the DPA shall constitute the Controller's general written authorization for the sub-processors listed on the initial Schedule C. This is consistent with the standard approach under GDPR Article 28(2) for the general authorization model: the initial sub-processor list serves as the baseline authorization, and any subsequent additions or replacements are subject to the 30-day notice and objection procedure described in Sections V.B and V.C above.

VI. Flow-Down Obligations

A. Contractual Requirements

A foundational element of the sub-processor risk allocation framework is the requirement that Skybridge impose on each sub-processor, by way of a written contract, data protection obligations that are no less protective than those set forth in the DPA between Skybridge and Meridian. This "flow-down" requirement ensures that the chain of contractual data protection obligations is maintained throughout the sub-processing relationship and that the Controller's data protection standards are not diluted as data flows to sub-processors.

The flow-down obligations imposed on each sub-processor must include, at a minimum, the following provisions:

(a) Documented Instructions. The sub-processor shall process personal data only on documented instructions from Skybridge, which are themselves based on the Controller's instructions as set forth in the DPA. The sub-processor shall not process personal data for any purpose other than the specific processing activities described in the sub-processing agreement, unless required to do so by applicable law, in which case the sub-processor shall inform Skybridge of that legal requirement before processing (unless prohibited by law from doing so).

(b) Confidentiality Obligations. The sub-processor shall ensure that all personnel authorized to process personal data have committed themselves to confidentiality obligations or are subject to an appropriate statutory obligation of confidentiality. This obligation applies to all employees, contractors, and agents of the sub-processor who may have access to personal data in connection with the sub-processing activities.

(c) Technical and Organizational Security Measures. The sub-processor shall implement and maintain appropriate technical and organizational security measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. At a minimum, these measures shall include: AES-256 encryption for personal data at rest, TLS 1.2 or higher for personal data in transit, multi-factor authentication ("MFA") for all administrative access to systems that process personal data, and annual penetration testing of systems that store or process personal data.

(d) Data Subject Rights Assistance. The sub-processor shall assist Skybridge, by appropriate technical and organizational measures, insofar as this is possible, in fulfilling Skybridge's obligations to respond to requests from data subjects exercising their rights under applicable data protection laws, including rights of access, rectification, erasure, restriction of processing, data portability, and objection.

(e) Personal Data Breach Notification. The sub-processor shall notify Skybridge of any personal data breach within a timeframe that enables Skybridge to meet its 48-hour notification obligation to the Controller under the DPA. As recommended in Section IX of this memorandum, sub-processors should be required to notify Skybridge "without undue delay" and no later than 24 hours after becoming aware of a personal data breach affecting personal data processed on behalf of Skybridge.

(f) Data Return and Deletion. Upon termination or expiration of the sub-processing agreement, or upon Skybridge's instruction, the sub-processor shall, at Skybridge's election, return all personal data to Skybridge or securely delete all personal data and certify such deletion in writing, unless applicable law requires continued storage of the personal data.

(g) Audit and Inspection Cooperation. The sub-processor shall make available to Skybridge, and to the Controller and the Controller's regulatory supervisors (including the OCC, FDIC, and CFPB), all information necessary to demonstrate compliance with the obligations set forth in the sub-processing agreement, and shall allow for and contribute to audits and inspections conducted by Skybridge, the Controller, or their authorized representatives, including regulatory examiners.

(h) Restrictions on Further Sub-Processing. The sub-processor shall not engage its own sub-processors (i.e., sub-sub-processors) to process personal data without Skybridge's prior written consent. This restriction ensures that Skybridge maintains visibility and control over the entire sub-processing chain and can fulfill its obligations to the Controller regarding sub-processor oversight.

(i) DPIA Cooperation. The sub-processor shall cooperate with Skybridge in connection with data protection impact assessments ("DPIAs") as reasonably requested by Skybridge or required by the Controller, including providing information about the sub-processor's processing activities, security measures, and potential risks to data subjects.

B. GDPR-Specific Flow-Down (Article 28(4))

GDPR Article 28(4) imposes a specific requirement that the sub-processor contract must "mirror" the data protection obligations set forth in the controller-processor DPA. This provision ensures that the controller's data protection standards are contractually applied to each level of the sub-processing chain with the same force and specificity as they are applied to the processor itself.

Critically, Article 28(4) also establishes a "full liability" principle: where a sub-processor fails to fulfil its data protection obligations under the sub-processing agreement, the initial processor (Skybridge) remains fully liable to the controller (Meridian) for the performance of that sub-processor's obligations. This full liability principle is a non-negotiable requirement under the GDPR and must be expressly reflected in the DPA. From the Controller's perspective, this provision ensures that the Controller need not pursue claims directly against sub-processors with whom it has no contractual relationship and can instead hold the Processor accountable for the entire sub-processing chain.

The DPA should include clear language to this effect, such as: "Processor shall remain fully liable to Controller for the performance of each Sub-processor's obligations under the applicable sub-processing agreement. Where a Sub-processor fails to fulfil its data protection obligations, Processor shall be liable to Controller for the acts and omissions of such Sub-processor as if they were the acts and omissions of Processor."

C. GLBA and US Regulatory Flow-Down

In addition to GDPR-specific flow-down requirements, the sub-processor agreements must include provisions ensuring compliance with GLBA safeguards for consumer financial information. Because Meridian is a financial institution subject to the GLBA and Skybridge is a service provider processing consumer financial information on Meridian's behalf, the GLBA's safeguards requirements extend to sub-processors that handle consumer financial information in connection with the Meridian engagement.

OCC Bulletin 2023-17 further requires that contractual arrangements governing the Skybridge-Meridian relationship give Meridian (and its regulatory supervisors) the ability to access records, personnel, and facilities of sub-processors as needed for risk management and regulatory examination purposes. This requirement must be reflected in the flow-down provisions of the sub-processor agreements. Specifically, the sub-processor agreements should include provisions granting Meridian and its regulators the contractual right to access sub-processor records and facilities, either directly or through Skybridge as an intermediary.

VII. Liability and Risk Allocation for Sub-Processor Acts

A. Skybridge's Liability to Controller

Under the DPA, Skybridge will assume liability for the acts and omissions of its sub-processors as if they were Skybridge's own acts and omissions. This liability allocation is consistent with GDPR Article 28(4), which establishes the processor's full liability for sub-processor performance, and is a standard market expectation for bank-vendor DPAs. From Meridian's perspective, this provision is essential because it ensures that Meridian has a single point of contractual accountability for all processing activities performed in connection with the SBF Core services, regardless of whether those activities are performed by Skybridge directly or by one of its sub-processors.

Skybridge's liability for sub-processor acts and omissions will be subject to the DPA's overall liability cap. Based on current discussions and consistent with market practice for DPAs of this size and risk profile, the proposed liability cap is the greater of: (a) $5.0 million, or (b) two times (2×) the fees paid by the Controller to the Processor in the trailing 12-month period. For Meridian, with an ACV of $2.74 million, the trailing 12-month fee amount would be $2.74 million, yielding a 2× cap of $5.48 million. Accordingly, the effective liability cap under the DPA would be $5.48 million (the greater of $5.0 million and $5.48 million). It should be noted that certain categories of liability — including indemnification obligations for third-party claims arising from data breaches, GDPR regulatory fines, and willful misconduct — may be excluded from or subject to a higher cap than the general liability cap, depending on the final negotiated terms of the DPA.

B. Skybridge's Recourse Against Sub-Processors

While Skybridge will assume liability to Meridian for sub-processor acts and omissions, Skybridge must also ensure that it has adequate contractual recourse against its sub-processors to recover losses caused by sub-processor breaches. Effective back-to-back liability allocation is critical to Skybridge's risk management posture and ensures that the financial burden of a sub-processor-caused incident does not rest solely with Skybridge.

Osprey Cloud. A review of the Skybridge–Osprey Cloud DPA (dated March 1, 2024) is necessary to confirm that Osprey Cloud's liability cap and indemnification obligations are sufficient to provide meaningful recourse in the event of a breach caused by Osprey Cloud. If Osprey Cloud's liability cap under the existing Osprey DPA is materially lower than Skybridge's exposure under the Meridian DPA (i.e., materially below the $5.48 million effective cap), this would create a gap in Skybridge's back-to-back risk allocation. In such a scenario, I would recommend negotiating an amendment to the Osprey DPA to increase Osprey Cloud's liability cap and/or indemnification coverage, or, alternatively, implementing risk mitigation measures such as requiring Osprey Cloud to carry enhanced cyber-liability insurance coverage. The gap analysis of the Osprey DPA is targeted for completion by December 12, 2025.

SBF Europe. Because SBF Europe is a wholly-owned subsidiary of Skybridge, traditional arm's-length indemnification provisions may be of limited practical significance — any indemnification payment from SBF Europe to Skybridge would effectively be an intra-group transfer of funds. Nevertheless, formal flow-down of obligations to SBF Europe, including documented liability allocation provisions, should still be maintained for several important reasons: (i) regulatory compliance, as the GDPR and applicable bank regulatory guidance require that sub-processor agreements contain appropriate contractual protections regardless of the corporate relationship between the parties; (ii) audit trail purposes, as regulators and external auditors expect to see documented sub-processor agreements with complete flow-down provisions; and (iii) operational clarity, as formalized contractual obligations establish clear expectations and accountability for SBF Europe's data processing activities.

C. Insurance Considerations

Skybridge maintains a cyber-liability insurance policy through Bastion Mutual Insurance Company, Policy No. CYB-2025-04821, with coverage limits of $10 million per occurrence and $20 million in the aggregate. The current policy period runs from January 1, 2025, through December 31, 2025, and the renewal process for the 2026 policy period is currently in progress. This insurance coverage provides an important layer of financial protection for both Skybridge and its clients in the event of a data breach or other cyber-security incident.

The DPA with Meridian requires Skybridge to maintain cyber-liability insurance with per-occurrence coverage of no less than $10 million throughout the term of the DPA. Skybridge's current coverage satisfies this requirement, and the renewal of the policy for the 2026 period (and each subsequent year during the DPA term) should be tracked to ensure ongoing compliance.

An important consideration for the sub-processor risk allocation framework is whether sub-processor-caused incidents are covered under Skybridge's cyber-liability policy. Many cyber-liability policies provide coverage for incidents arising from the acts or omissions of the insured's service providers or sub-processors, but the scope of such coverage can vary. I recommend that Skybridge's insurance broker or coverage counsel confirm that the Bastion Mutual policy provides coverage for data breaches and security incidents that originate at or are caused by Osprey Cloud or SBF Europe. If Osprey Cloud maintains its own cyber-liability coverage — which is typical for a major IaaS/PaaS provider — this would provide an additional layer of risk mitigation, as Skybridge may be able to recover losses from Osprey Cloud's insurer in addition to, or in lieu of, filing a claim under its own policy.

VIII. Audit Rights Over Sub-Processors

A. Controller Audit Rights

The DPA will grant the Controller (or its regulators, including the OCC, FDIC, and CFPB) the right to audit the Processor's data processing activities and security controls. Under the proposed audit framework, the following parameters will apply:

(a) Frequency. The Controller may conduct audits no more than once per 12-month period, unless a more frequent audit is triggered by: (i) a personal data breach involving the Controller's personal data, (ii) a regulatory inquiry or examination directed at the Controller's relationship with Skybridge, or (iii) other material data protection concerns identified by the Controller.

(b) Notice. The Controller must provide at least 30 days' advance written notice of its intention to conduct an audit, specifying the scope and anticipated duration of the audit.

(c) Cost. Audits shall be conducted at the Controller's expense, except where the audit is triggered by a confirmed personal data breach caused by the Processor's failure to comply with its obligations under the DPA.

(d) SOC 2 Report. Skybridge may satisfy audit requests, in whole or in part, by providing the Controller with its most recent SOC 2 Type II report. Skybridge's current SOC 2 Type II report was issued by Graystone & Ketchum LLP and covers the audit period from October 1, 2024, through September 15, 2025. In addition to the SOC 2 report, Skybridge may provide supplemental questionnaire responses addressing specific Controller inquiries.

This audit framework should be extended to sub-processors. Specifically, the Controller should have the right to request that Skybridge obtain and provide sub-processor audit reports (such as Osprey Cloud's SOC 2 Type II report) or facilitate on-site audits of sub-processors in connection with regulatory examinations. The DPA should make clear that Skybridge's obligation to cooperate with Controller audits extends to making available information regarding sub-processor compliance and, where necessary, facilitating direct or indirect access to sub-processor facilities and records.

B. Regulatory Examination Access

OCC Bulletin 2023-17 requires that contractual arrangements governing the bank's third-party relationships preserve the ability of the bank's supervisory agencies — specifically the OCC, FDIC, and CFPB — to access records and examine the activities of both the third party (Skybridge) and its sub-contractors (Osprey Cloud, SBF Europe). This requirement reflects the principle that a bank's use of third parties and sub-contractors does not diminish the bank's regulatory obligations or its regulators' examination authority.

To satisfy this requirement, I recommend including the following provision in the DPA:

"Processor shall ensure that its agreements with Sub-processors include provisions permitting Controller's regulatory supervisors to access, examine, and audit the Sub-processor's records, systems, controls, and facilities to the same extent as Controller's regulators may access, examine, and audit the Processor. Processor shall use commercially reasonable efforts to cooperate with, and to cause its Sub-processors to cooperate with, any regulatory examination or inquiry directed at the Controller's third-party risk management program or the processing activities performed under this DPA."

This language should be reflected in both the DPA and the sub-processor agreements between Skybridge and Osprey Cloud and Skybridge and SBF Europe. As noted in Section IV.A, the existing Osprey DPA may not include adequate regulator access provisions, and this is identified as a potential gap requiring remediation.

C. SOC 2 and Security Certification Relay

As a practical matter, the primary mechanism through which the Controller will exercise oversight of sub-processor security controls is through the review of third-party audit reports and security certifications. Skybridge should commit in the DPA to providing the Controller, upon written request and subject to appropriate confidentiality obligations, with relevant sub-processor SOC 2 Type II reports (or equivalent security certifications) as they become available.

With respect to security testing, Skybridge currently engages Ironvault Security Group LLC (11710 Plaza America Drive, Suite 400, Reston, Virginia 20190) to conduct annual penetration testing of the SBF Core platform. The scope of the annual penetration test covers the SBF Core application and associated infrastructure. It should be confirmed whether the current penetration test scope extends to the Osprey Cloud-hosted infrastructure on which SBF Core is deployed. If the penetration test scope does not currently extend to the infrastructure layer, Skybridge should consider either expanding the scope of its engagement with Ironvault or requesting that Osprey Cloud provide evidence of its own independent penetration testing results.

IX. Sub-Processor Data Breach Notification Chain

A. Upstream Notification Timeline

The sub-processor data breach notification chain must be structured to ensure that breach notifications flow upstream through the processing chain with sufficient speed to enable each party to meet its regulatory and contractual notification obligations. The recommended notification chain is as follows:

Step 1: Sub-Processor → Skybridge. The sub-processor shall notify Skybridge of a personal data breach "without undue delay" and no later than 24 hours after becoming aware of the breach. The 24-hour deadline is designed to preserve sufficient time for Skybridge to conduct an initial investigation, assess the scope and severity of the breach, and prepare a notification to the Controller within the 48-hour window.

Step 2: Skybridge → Meridian. Skybridge shall notify Meridian of a personal data breach within 48 hours of Skybridge becoming aware of the breach (or, in the case of a sub-processor-caused breach, within 48 hours of receiving notification from the sub-processor). The 48-hour notification window to the Controller is a critical DPA obligation and is designed to enable Meridian to meet its own regulatory notification obligations within the required timeframes.

Step 3: Meridian → Primary Federal Regulator. Meridian shall notify its primary federal regulator (OCC or FDIC, as applicable) within 36 hours of determining that a "notification incident" has occurred, as required by 12 CFR Part 53.

The 24-hour sub-processor notification window (Step 1) is designed to work in tandem with the 48-hour Processor-to-Controller notification window (Step 2), providing Skybridge with a 24-hour buffer between receiving a sub-processor notification and its own deadline for notifying the Controller. This buffer is critical to allow Skybridge's incident response team to validate the sub-processor's report, assess the scope of the incident, and prepare a meaningful notification to the Controller.

Escalation contacts within Skybridge for data breach notifications are as follows: primary contact is Chief Information Security Officer ("CISO") Rebecca Muñoz, with escalation to General Counsel and Chief Privacy Officer ("GC/CPO") Thomas Elridge. Escalation contacts at Meridian for receipt of data breach notifications are Chief Compliance Officer Andrea Sokolov and Vice President of Third-Party Risk Management Marcus Tibaldi. The DPA should specify these contacts (or their functional equivalents) in Schedule D (Incident Response and Notification Procedures).

B. Cooperation Obligations

In addition to the notification timelines, the sub-processor agreements must include comprehensive cooperation obligations requiring the sub-processor to assist Skybridge in investigating and remediating a data breach. Specifically, the sub-processor must:

(a) cooperate fully with Skybridge's investigation of the breach, including providing access to relevant personnel, systems, and records;

(b) provide all reasonably necessary information about the nature, scope, categories of personal data affected, approximate number of data subjects affected, and likely impact of the breach;

(d) assist Skybridge in meeting its obligations to the Controller, including providing information necessary for the Controller to fulfill its own notification obligations to data subjects and regulatory authorities.

These cooperation obligations should be documented in both the Osprey Cloud DPA and the SBF Europe intra-group agreement. The existing Osprey DPA should be reviewed to confirm that it includes adequate breach cooperation provisions, and any gaps should be addressed in the planned amendment.

X. International Transfer Considerations (SCC Module 3)

A. Transfers Requiring Module 3 SCCs

The sub-processor risk allocation framework must address the international transfer of EU personal data within the sub-processing chain. The following transfers require Module 3 SCCs (Processor-to-Sub-processor):

Transfer 1: Skybridge (US Processor) → Osprey Cloud (US Sub-processor). This transfer involves the transmission of EU personal data originating from Meridian's approximately 3,200 EU-resident accountholders from Skybridge (a processor established in the United States) to Osprey Cloud (a sub-processor also established in the United States). Because both entities are located outside the EEA and the personal data originates from EU data subjects, Module 3 SCCs are required to provide a lawful transfer mechanism under Chapter V of the GDPR. The existing Osprey DPA (March 1, 2024) includes Module 3 SCCs, which should be reviewed to confirm they remain current and complete.

Transfer 2: Skybridge (US Processor) → SBF Europe (Netherlands Sub-processor). This transfer involves the transmission of personal data from Skybridge (a US-based processor) to SBF Europe (a sub-processor established in the Netherlands). As a general matter, transfers of personal data from a third country to the EEA do not require SCCs because the EEA is not considered to pose an inadequate level of data protection. However, Module 3 SCCs are included in the SCC package for this relationship for completeness and to address potential re-transfer scenarios — for example, situations in which SBF Europe may need to transfer personal data back to Skybridge or to another entity outside the EEA in connection with its processing activities. Including Module 3 SCCs for this transfer relationship also provides an additional layer of contractual protection and ensures consistency across the SCC package.

SCC Governing Law. The SCCs for both transfer relationships will be governed by the law of the Netherlands pursuant to Clause 17 of the SCCs, which requires the parties to select the law of a Member State in which one of the parties is established. Because SBF Europe (Skybridge's EU establishment) is incorporated and registered in the Netherlands, Dutch law is the appropriate choice of governing law for the SCCs.

B. Supplementary Measures

In addition to the SCCs, the sub-processor risk allocation framework benefits from the following supplementary measures:

EU-US Data Privacy Framework. Skybridge has self-certified under the EU-US Data Privacy Framework ("DPF"), Certification ID: DPF-2025-03912, effective July 1, 2025. The DPF self-certification provides an additional lawful transfer mechanism for transfers of EU personal data to the United States and supplements the protections provided

MEMORANDUM
PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
TO: Priscilla Wynn, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP
FROM: Alan Burke, Working Associate, Privacy & Data Security, Calderwood & Harkness LLP
DATE: December 6, 2025
RE: Sub-Processor Risk Allocation Framework — Skybridge Fintech Ltd. Customer-Facing DPA
MATTER NO.: 1009-00004
CLIENT: Skybridge Fintech Ltd.
I. Executive Summary
This memorandum analyzes the sub-processor risk allocation structure for Skybridge Fintech Ltd.'s customer-facing Data Processing Agreement ("DPA") with Meridian Federal Savings Bank ("Meridian" or "Controller") and recommends a comprehensive framework that can serve as Skybridge's bank-grade template for all future similarly situated bank clients. The analysis addresses the unique regulatory, contractual, and operational considerations arising from Skybridge's role as a Processor under both European and U.S. data protection regimes, and from Meridian's status as a federally chartered savings bank subject to heightened third-party risk management obligations.
Skybridge Fintech Ltd. ("Skybridge" or "Processor"), in its capacity as Processor under the forthcoming DPA, engages two sub-processors to perform specific processing activities in connection with the services provided through the SBF Core platform: (1) Osprey Cloud Infrastructure, Inc. ("Osprey Cloud" or "OCI"), the primary Infrastructure-as-a-Service and Platform-as-a-Service ("IaaS/PaaS") provider hosting the SBF Core environment, and (2) Skybridge Fintech Europe B.V. ("SBF Europe"), Skybridge's wholly-owned EU affiliate that processes EU personal data on behalf of Skybridge's customers with European accountholders. Each sub-processor performs distinct but critical functions in the data processing chain, and each presents its own set of risk allocation considerations that must be addressed in the DPA.
The sub-processor risk allocation framework must simultaneously satisfy several overlapping regulatory and contractual requirements. First, the framework must satisfy Meridian's Third-Party Risk Management ("TPRM") program, which is aligned with OCC Bulletin 2023-17 (superseding OCC Bulletin 2013-29) and relevant FFIEC guidance on outsourcing technology services. Second, the framework must comply with GDPR Article 28 requirements, which are triggered because approximately 3,200 of Meridian's accountholders are residents of EU Member States. Third, the framework must address applicable U.S. regulatory requirements, including the Gramm-Leach-Bliley Act ("GLBA") and Regulation P, the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53), and applicable state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") and the New Jersey Data Privacy Act (S3377, expected effective January 15, 2026).
Based on the analysis set forth below, I recommend a general written authorization model with a 30-day prior written notice period and a Controller right to object, coupled with mandatory flow-down of data protection obligations to each sub-processor. This model is consistent with market practice for bank-vendor DPAs in the fintech sector, satisfies the requirements of GDPR Article 28(2), and preserves the degree of Controller oversight that Meridian's TPRM program and its prudential regulators expect. The framework should be structured to serve as a reusable template component for Skybridge's engagements with all similarly situated FDIC-insured bank clients.
II. Background
A. The Parties and Transaction Context
Skybridge Fintech Ltd. is a Delaware C-corporation headquartered at 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810. Skybridge operates the "SBF Core" platform, a Software-as-a-Service ("SaaS") solution that provides real-time payment processing, anti-fraud analytics, and regulatory reporting functionality to FDIC-insured depository institutions. SBF Core is designed to integrate with a bank's core banking system and processes significant volumes of consumer financial data, including personally identifiable information, account information, and transaction data. Skybridge's client base consists primarily of mid-size and regional banks and savings institutions, and the company has been expanding its customer base among federally chartered institutions in recent quarters.
Meridian Federal Savings Bank is a federally chartered savings bank, operating under OCC Charter No. 14-2238, and headquartered at 900 Broad Street, Suite 1200, Newark, New Jersey 07102. Meridian is an FDIC-insured institution with approximately $6.1 billion in total assets and serves approximately 412,000 accountholders across its retail and small-business banking segments. Of particular relevance to this analysis, approximately 3,200 of Meridian's accountholders are residents of European Union Member States, which triggers the application of the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") to certain processing activities performed by Skybridge and its sub-processors.
The underlying transaction is a 5-year SaaS subscription agreement pursuant to which Meridian will license the SBF Core platform from Skybridge. The subscription agreement carries an annual contract value ("ACV") of $2.74 million per year, yielding a total contract value ("TCV") of $13.7 million over the 5-year term. The DPA will be executed concurrently with the SaaS subscription agreement, with a target execution date of February 15, 2026. The DPA is a critical ancillary agreement that governs the processing of personal data by Skybridge in connection with the SBF Core services and is a precondition to Meridian's execution of the SaaS subscription agreement.
Meridian's outside counsel on this transaction is Blackwell, Raines & Stoddard LLP ("BRS"), with lead partner Constance Liu and associate Derek Faulkner serving as the primary points of contact for DPA negotiations. Our client's engagement team at Calderwood & Harkness LLP consists of Kevin Ostrowski (Responsible Partner), Rachel Bernstein (Billing Partner), Priscilla Wynn (Lead Associate), and Alan Burke (Working Associate).
B. Skybridge's Sub-Processors
Skybridge currently engages two sub-processors in connection with the SBF Core platform, each of which will be involved in the processing of Meridian personal data:
Osprey Cloud Infrastructure, Inc. ("Osprey Cloud" or "OCI") is a Delaware corporation headquartered at 2200 Campus Drive, San Jose, California 95131, with Martin Cho serving as Chief Executive Officer. Osprey Cloud is Skybridge's primary IaaS/PaaS provider and hosts the SBF Core production environment and associated infrastructure. Osprey Cloud operates data center facilities in two primary regions relevant to this engagement: (i) a US-East data center region located in Ashburn, Virginia, which serves as the primary production environment for Skybridge's U.S.-based bank clients, including Meridian, and (ii) an EU data center region located in Frankfurt, Germany, which is used for processing EU personal data in compliance with data localization requirements. Osprey Cloud also maintains a secondary availability zone within the US-East region (also in Ashburn, Virginia) that serves as the designated disaster recovery site for Skybridge's U.S. production environment. Osprey Cloud is a significant infrastructure provider with a substantial client base in the financial services sector and maintains SOC 2 Type II certification.
Skybridge Fintech Europe B.V. ("SBF Europe") is a Dutch besloten vennootschap (private limited company), registered with the Kamer van Koophandel under number 82104593, with its registered office at Keizersgracht 482, 1017 EG Amsterdam, the Netherlands. Lena Vogt serves as Managing Director. SBF Europe is a wholly-owned subsidiary (affiliate) of Skybridge Fintech Ltd. and currently employs 14 individuals: 8 engineers, 4 support personnel, and 2 compliance professionals. SBF Europe's function within the Skybridge corporate structure is to process EU personal data on behalf of Skybridge's bank customers that have European-resident accountholders. SBF Europe is registered with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) and operates under GDPR as a processor established within the European Economic Area.
C. Data Processing Scope Relevant to Sub-Processors
An accurate understanding of the scope of data processing activities performed by Skybridge's sub-processors is essential to structuring appropriate risk allocation provisions. The following summarizes the categories of data subjects, categories of personal data, and data processing locations relevant to the sub-processor analysis.
Categories of Data Subjects. The personal data processed through SBF Core relates to the following categories of data subjects: (i) Meridian accountholders (both retail and small-business), (ii) authorized signers on Meridian accounts, (iii) beneficial owners of Meridian business accounts, and (iv) Meridian employees whose data passes through the SBF Core platform in connection with Meridian's use of the regulatory reporting functionality.
Categories of Personal Data Processed by Sub-Processors. The sub-processors process the following categories of personal data in connection with the SBF Core services: full name, date of birth, Social Security Number ("SSN"), Taxpayer Identification Number ("TIN"), account numbers (checking, savings, and loan accounts), routing numbers, transaction amounts and transaction metadata, IP addresses, device identifiers, geolocation data (city-level), email addresses, phone numbers, and behavioral biometric data (specifically, keystroke dynamics and mouse movement patterns collected in connection with Skybridge's anti-fraud analytics module).
Sensitive Data. Of the categories listed above, SSNs and behavioral biometric data are classified as sensitive personal information under the CCPA/CPRA and are expected to be classified as sensitive data under the New Jersey Data Privacy Act (S3377), which is anticipated to take effect on January 15, 2026. The presence of sensitive data categories within the processing scope heightens the importance of robust sub-processor controls and flow-down obligations.
Volume. Approximately 18.6 million transactions per month are processed through the SBF Core platform in connection with Meridian's operations, reflecting the scale and criticality of the data processing relationship.
Data Locations. Personal data processed in connection with Meridian's use of SBF Core is stored and processed in the following locations: (i) Primary — Osprey Cloud US-East data center (Ashburn, Virginia); (ii) Secondary/EU — Osprey Cloud EU data center (Frankfurt, Germany) and SBF Europe (Amsterdam, Netherlands), each of which processes personal data relating to Meridian's approximately 3,200 EU-resident accountholders; and (iii) Disaster Recovery — Osprey Cloud US-East secondary availability zone (Ashburn, Virginia).
III. Regulatory and Legal Framework for Sub-Processor Oversight
The sub-processor risk allocation framework must be structured to satisfy the requirements of multiple, overlapping regulatory regimes. This section surveys the applicable regulatory and legal requirements governing sub-processor oversight in the context of the Skybridge-Meridian relationship.
A. OCC Bulletin 2023-17 (Third-Party Risk Management)
OCC Bulletin 2023-17, issued on June 6, 2023, supersedes the prior guidance set forth in OCC Bulletin 2013-29 and establishes the OCC's current expectations for banks' management of risks associated with third-party relationships. The Bulletin applies to all banks supervised by the OCC and requires that banks manage the risks arising from third-party relationships throughout the entire relationship life cycle, including planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination.
Of particular relevance to this analysis, OCC Bulletin 2023-17 addresses the risks arising from a third party's use of sub-contractors. The Bulletin provides that banks should ensure that their critical third-party service providers have adequate controls over their own sub-contractors and that contractual provisions governing the third-party relationship should address the bank's ability to oversee and, where appropriate, approve or object to the use of sub-contractors. The Bulletin emphasizes that the bank's risk management practices should extend to understanding the role and significance of sub-contractors in the delivery of critical services and that the bank should have sufficient information to assess the risks introduced by sub-contractor relationships.
Meridian's TPRM program, which is led by Vice President of Third-Party Risk Management Marcus Tibaldi and Chief Compliance Officer Andrea Sokolov, has been structured to align with OCC Bulletin 2023-17. As a precondition to executing the SaaS subscription agreement with Skybridge, Meridian's TPRM program requires that the DPA include contractual provisions providing Meridian with meaningful oversight of Skybridge's sub-processors, including notice and objection rights, flow-down of data protection obligations, audit rights, and regulatory access provisions. These requirements are non-negotiable from Meridian's perspective and reflect the expectations of Meridian's primary federal regulator.
The DPA must therefore be structured to preserve Meridian's — and its regulators', including the OCC, the FDIC, and the Consumer Financial Protection Bureau ("CFPB") — ability to assess the risks introduced by Skybridge's sub-processors and to exercise appropriate oversight over the sub-processing chain.
B. FFIEC Guidance
The Federal Financial Institutions Examination Council ("FFIEC") has issued supplemental guidance on outsourcing technology services that reinforces and expands upon the principles set forth in OCC Bulletin 2023-17. The FFIEC guidance emphasizes that outsourcing arrangements should include contractual provisions requiring the service provider to notify the bank before engaging or changing sub-contractors who will have access to the bank's data or systems. Additionally, the guidance states that the bank should retain the ability to terminate the outsourcing arrangement if a sub-contractor is deemed unacceptable based on the bank's risk assessment. These principles inform the structure of the sub-processor authorization model recommended in Section V of this memorandum.
C. GDPR Article 28 — Sub-Processor Requirements
GDPR Article 28 establishes the legal framework governing the engagement of sub-processors (referred to as "another processor" in the text of Article 28). The sub-processor provisions of Article 28 are directly applicable to the Skybridge-Meridian relationship because approximately 3,200 of Meridian's accountholders are residents of EU Member States, and the processing of their personal data by Skybridge and its sub-processors falls within the material and territorial scope of the GDPR.
Article 28(2) provides that a processor shall not engage another processor (i.e., a sub-processor) without the prior specific or general written authorization of the controller. Where general written authorization has been given, the processor must inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. This provision establishes the two permissible authorization models — specific authorization and general authorization — and sets forth the minimum procedural requirements for the general authorization model.
Article 28(4) requires that where a sub-processor is engaged, the sub-processor must be bound by the same data protection obligations as those set out in the contract between the controller and the processor (i.e., the DPA). This "flow-down" requirement ensures that the chain of data protection obligations is maintained throughout the sub-processing relationship. Article 28(4) further provides that where the sub-processor fails to fulfil its data protection obligations, the initial processor (Skybridge) remains fully liable to the controller (Meridian) for the performance of that sub-processor's obligations.
The applicability of GDPR Article 28 to this transaction also necessitates the inclusion of Standard Contractual Clauses ("SCCs"), specifically Module 3 (Processor-to-Sub-processor), for transfers of EU personal data from Skybridge to its sub-processors. Module 3 SCCs will be required for transfers from Skybridge (a U.S.-based Processor) to Osprey Cloud (a U.S.-based Sub-processor) involving EU personal data, and for the relationship between Skybridge and SBF Europe to address potential re-transfer scenarios and to provide comprehensive contractual coverage of the sub-processing relationship.
D. GLBA / Regulation P
The Gramm-Leach-Bliley Act ("GLBA") and its implementing regulations, including Regulation P (12 CFR Part 1016), impose requirements on financial institutions and their service providers regarding the protection of consumer financial information. Skybridge, as a service provider to Meridian, qualifies as a "service provider" within the meaning of the GLBA. Sub-processors that handle consumer financial information on behalf of Skybridge in connection with the Meridian engagement — specifically, Osprey Cloud and SBF Europe — must also be subject to appropriate safeguards designed to protect the security and confidentiality of consumer financial information.
The contractual flow-down provisions in the sub-processor agreements should include GLBA-level obligations, ensuring that each sub-processor is contractually bound to implement and maintain safeguards appropriate to the nature and sensitivity of the consumer financial information it processes. This requirement supplements the GDPR flow-down obligations and reflects the dual regulatory regime applicable to the processing of personal data of Meridian's accountholders.
E. CCPA/CPRA and NJ Data Privacy Act (S3377)
CCPA/CPRA. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, service providers are prohibited from further disclosing personal information except as permitted under the CCPA/CPRA. Where a service provider engages sub-contractors (sub-processors) to process personal information on its behalf, the contractual restrictions imposed on the service provider must flow down to those sub-contractors. The sub-processor agreements between Skybridge and its sub-processors must include provisions that restrict the sub-processor's use and disclosure of personal information to the purposes specified in the service provider contract and that require the sub-processor to comply with applicable CCPA/CPRA obligations. Given that SSNs and behavioral biometric data are classified as sensitive personal information under the CCPA/CPRA, additional protections and use limitations may be required.
NJ Data Privacy Act (S3377). The New Jersey Data Privacy Act (Senate Bill S3377), which is expected to take effect on January 15, 2026 — one month before the target DPA execution date — imposes controller and processor obligations on entities that process the personal data of New Jersey residents. Because Meridian is headquartered in Newark, New Jersey, and a substantial portion of its accountholders are New Jersey residents, the NJ Data Privacy Act will be directly relevant to the data processing activities performed under the DPA. The Act requires that processors contractually bind their sub-processors to equivalent data protection obligations, consistent with the GDPR Article 28(4) flow-down model. The DPA's sub-processor provisions should be drafted to comply with this requirement.
F. FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53)
The FDIC/OCC Computer-Security Incident Notification Rule, codified at 12 CFR Part 53, requires banking organizations to notify their primary federal regulator no later than 36 hours after the banking organization determines that a "notification incident" has occurred. The rule also requires bank service providers (as defined under the Bank Service Company Act) to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to the banking organization for four or more hours.
The sub-processor data processing agreements must include incident notification obligations that flow upstream through the notification chain — from sub-processor to Skybridge, from Skybridge to Meridian — with sufficient speed to enable Meridian to meet the 36-hour regulatory notification deadline. The specific notification timelines are discussed in greater detail in Section IX of this memorandum.
IV. Existing Sub-Processor Agreements
A. Skybridge–Osprey Cloud DPA (March 1, 2024)
Skybridge and Osprey Cloud are parties to a Data Processing Agreement executed on March 1, 2024 (the "Osprey DPA"). The Osprey DPA includes Module 3 Standard Contractual Clauses (Processor-to-Sub-processor) to provide a lawful transfer mechanism for the transfer of EU personal data from Skybridge to Osprey Cloud's data center facilities. The Osprey DPA was negotiated and executed prior to the commencement of the Meridian engagement and was not specifically tailored to address the requirements of a bank-grade customer DPA.
A thorough review of the Osprey DPA against the requirements of the forthcoming Meridian DPA is necessary to confirm that the existing agreement contains adequate flow-down provisions covering all obligations that Skybridge will assume under the Meridian DPA. The following key areas require verification and, where gaps are identified, may necessitate an amendment to the Osprey DPA:
Breach Notification Obligations. The Osprey DPA must be reviewed to confirm that Osprey Cloud is required to notify Skybridge of a personal data breach within a timeframe that allows Skybridge to meet its 48-hour notification obligation to Meridian under the DPA. If the Osprey DPA currently provides for notification "without undue delay" without a specific hourly deadline, an amendment to impose a 24-hour notification requirement may be necessary. This is discussed further in Section IX below.
Data Location Restrictions. The Osprey DPA should restrict Osprey Cloud's processing of Meridian personal data to the designated data center locations: US-East (Ashburn, Virginia) for primary processing, EU (Frankfurt, Germany) for EU personal data processing, and US-East secondary availability zone (Ashburn, Virginia) for disaster recovery. Any processing at data center locations not expressly authorized in the Meridian DPA would be inconsistent with the data location restrictions that Meridian's TPRM program requires.
Encryption Standards. Confirm that the Osprey DPA requires AES-256 encryption for data at rest and TLS 1.2 or higher for data in transit, consistent with the encryption standards that will be specified in the Meridian DPA.
Audit Cooperation Provisions. Verify that the Osprey DPA includes provisions for audit cooperation, including cooperation with Skybridge's audit requests and, critically, with regulatory examinations by Meridian's prudential supervisors (OCC, FDIC, CFPB). If the Osprey DPA does not currently include provisions for regulator access, this represents a significant gap that must be addressed by amendment.
Data Retention and Deletion Upon Termination. Confirm that the Osprey DPA requires Osprey Cloud to return or delete all personal data upon termination or expiration of the sub-processing agreement, consistent with the data return and deletion obligations in the Meridian DPA.
Regulator Access Rights. This is a potential gap of particular concern. The Osprey DPA was not drafted with bank regulatory requirements in mind, and it may not include provisions permitting Meridian's regulators — specifically the OCC, FDIC, and CFPB — to access, examine, and audit Osprey Cloud's records, systems, controls, and facilities. OCC Bulletin 2023-17 requires that contractual arrangements preserve this ability, and the absence of such provisions in the Osprey DPA would need to be remediated before the Meridian DPA can be executed.
Osprey Cloud's data center infrastructure relevant to this engagement includes: (i) US-East primary data center (Ashburn, Virginia), which serves as the primary production environment; (ii) EU data center (Frankfurt, Germany), which processes EU personal data for Meridian's EU-resident accountholders; and (iii) US-East secondary availability zone (Ashburn, Virginia), which serves as the designated disaster recovery site.
B. Skybridge–SBF Europe Intra-Group Arrangement
SBF Europe is a wholly-owned subsidiary of Skybridge and operates as Skybridge's EU affiliate for the purpose of processing EU personal data. The current data processing arrangement between Skybridge and SBF Europe is governed by an intra-group data processing agreement that was established at the time of SBF Europe's formation. Because SBF Europe is an affiliate rather than an arm's-length third party, the intra-group arrangement may not have been drafted with the same level of formality and specificity as the Osprey DPA. However, for purposes of the Meridian DPA and applicable regulatory requirements, SBF Europe is treated as a sub-processor and must be subject to the same flow-down obligations and contractual controls as any third-party sub-processor.
The existing intra-group arrangement must be reviewed and, where necessary, formalized or amended to ensure compliance with the flow-down requirements of the Meridian DPA. Specifically, the intra-group agreement should include all of the contractual provisions that the Meridian DPA requires Skybridge to impose on its sub-processors, including but not limited to: documented instructions for processing, confidentiality obligations, technical and organizational security measures, data subject rights assistance, breach notification obligations, data return and deletion obligations, audit cooperation rights (including regulatory examination access), and restrictions on further sub-processing.
SBF Europe is established in the Netherlands and its processing of EU personal data is subject to the GDPR and supervised by the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority). SBF Europe's specific role in the sub-processing chain is to process EU personal data for Skybridge's bank customers that have European-resident accountholders. In the context of the Meridian engagement, SBF Europe will process personal data relating to approximately 3,200 Meridian accountholders who are residents of EU Member States.
Module 3 SCCs (Processor-to-Sub-processor) will be included as part of the SCC package for the Skybridge-SBF Europe relationship. Given that SBF Europe is established in the Netherlands, the SCCs will be governed by the law of the Netherlands pursuant to Clause 17, which requires the parties to select the law of a Member State in which one of the parties is established.
V. Recommended Sub-Processor Authorization Model
A. General Written Authorization vs. Specific Written Authorization
GDPR Article 28(2) permits two models for controller authorization of sub-processors: (i) prior specific written authorization, under which the controller must individually authorize each sub-processor before the processor may engage that sub-processor, and (ii) prior general written authorization, under which the controller provides a blanket authorization for the processor to engage sub-processors, subject to the processor's obligation to inform the controller of any intended changes (additions or replacements) and to give the controller the opportunity to object to such changes.
I recommend the general written authorization model with appropriate safeguards for the following reasons:
First, the specific authorization model — which requires the controller to individually pre-approve each sub-processor — is operationally burdensome for a SaaS company serving multiple bank clients. If Skybridge were required to obtain specific prior authorization from each bank client before engaging or changing any sub-processor, the resulting administrative burden and potential for delays would significantly impair Skybridge's ability to manage its infrastructure and sub-processor relationships efficiently. This is particularly true given that Skybridge's sub-processor relationships (especially with Osprey Cloud) affect the infrastructure underlying the SBF Core platform as a whole, not just the processing performed for any single bank client.
Second, the general written authorization model, when combined with prior notice and objection rights (as described in Sections V.B and V.C below), achieves an appropriate balance between the controller's legitimate interest in overseeing sub-processor relationships and the processor's operational need for flexibility in managing its technology infrastructure. The general authorization model preserves the controller's ability to assess and, if necessary, reject proposed sub-processors while allowing the processor to manage sub-processor changes without being dependent on affirmative controller consent.
Third, this approach is market-standard in bank-vendor DPAs for fintech SaaS providers. Based on our review of comparable DPAs in the market, the general written authorization model with prior notice and objection rights is the prevailing approach adopted by fintech companies in their customer-facing DPAs with FDIC-insured bank clients. Adoption of this model positions Skybridge consistently with market expectations and avoids unnecessary friction in negotiations with Meridian and future bank clients.
B. 30-Day Prior Written Notice
Under the recommended general authorization model, Skybridge shall be required to provide the Controller with at least 30 days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor. The 30-day notice period is designed to provide the Controller with sufficient time to evaluate the proposed sub-processor, conduct any necessary due diligence, and exercise its objection right if warranted.
The notice provided by Skybridge must include the following information to enable the Controller to conduct a meaningful assessment of the proposed sub-processor:
(a) the identity of the proposed sub-processor (including legal name, jurisdiction of incorporation or organization, and principal place of business);
(b) a description of the processing activities to be performed by the proposed sub-processor;
(c) the location(s) where the proposed sub-processor will process personal data; and
(d) a summary of the technical and organizational security measures that the proposed sub-processor will implement to protect personal data.
The notice mechanism shall be written notice delivered to the Controller's designated contacts. For Meridian, the designated contacts for sub-processor notices are Vice President of Third-Party Risk Management Marcus Tibaldi and Chief Compliance Officer Andrea Sokolov, with a copy to General Counsel Vanessa Hartwell. The DPA should specify that notice may be delivered by email to designated email addresses, with confirmation of receipt, or by such other means as the parties may agree in writing.
C. Controller Right to Object
The Controller shall have the right to object to any proposed new or replacement sub-processor within the 30-day notice period. This objection right is a critical safeguard that preserves the Controller's oversight authority over the sub-processing chain and is consistent with the expectations of GDPR Article 28(2), OCC Bulletin 2023-17, and the FFIEC guidance on outsourcing arrangements.
Any objection by the Controller must be made in writing and must be based on reasonable grounds related to data protection. The requirement that the objection be grounded in reasonable data protection concerns is intended to prevent arbitrary or bad-faith objections while preserving the Controller's legitimate right to assess and manage sub-processor risks.
If the Controller objects to a proposed sub-processor, the DPA should provide for the following resolution mechanism:
(a) Good Faith Negotiation. Skybridge and the Controller shall negotiate in good faith to resolve the objection. The negotiation period shall be 15 calendar days from the date of the Controller's objection, during which the parties shall use commercially reasonable efforts to identify an alternative sub-processor or to address the Controller's concerns through additional safeguards or modifications to the proposed sub-processing arrangement.
(b) Termination Right. If no resolution is reached within the 15-day negotiation period, the Controller may terminate the DPA (and the related SaaS subscription agreement) with respect to the affected processing activities without penalty. This termination right shall not give rise to any early termination fees, liquidated damages, or other financial penalties under the SaaS subscription agreement.
The Controller's termination right in the event of an unresolved sub-processor objection is a critical element from Meridian's perspective. This provision is consistent with OCC Bulletin 2023-17's guidance on maintaining the bank's ability to exit third-party relationships when risk conditions change, and it is consistent with the FFIEC guidance's emphasis on the bank's ability to terminate outsourcing arrangements if a sub-contractor is deemed unacceptable. Meridian's TPRM team (Marcus Tibaldi and Andrea Sokolov) has indicated through BRS that this termination right is a condition of Meridian's execution of the DPA, and I do not recommend that Skybridge resist this provision given the strength of the regulatory policy underlying the requirement.
D. Initial Approved Sub-Processor List
The DPA shall include an initial approved sub-processor list as Schedule C, which will identify each sub-processor currently engaged by Skybridge in connection with the processing of Controller personal data. The initial Schedule C shall list the following sub-processors:
The Controller's execution of the DPA shall constitute the Controller's general written authorization for the sub-processors listed on the initial Schedule C. This is consistent with the standard approach under GDPR Article 28(2) for the general authorization model: the initial sub-processor list serves as the baseline authorization, and any subsequent additions or replacements are subject to the 30-day notice and objection procedure described in Sections V.B and V.C above.
VI. Flow-Down Obligations
A. Contractual Requirements
A foundational element of the sub-processor risk allocation framework is the requirement that Skybridge impose on each sub-processor, by way of a written contract, data protection obligations that are no less protective than those set forth in the DPA between Skybridge and Meridian. This "flow-down" requirement ensures that the chain of contractual data protection obligations is maintained throughout the sub-processing relationship and that the Controller's data protection standards are not diluted as data flows to sub-processors.
The flow-down obligations imposed on each sub-processor must include, at a minimum, the following provisions:
(a) Documented Instructions. The sub-processor shall process personal data only on documented instructions from Skybridge, which are themselves based on the Controller's instructions as set forth in the DPA. The sub-processor shall not process personal data for any purpose other than the specific processing activities described in the sub-processing agreement, unless required to do so by applicable law, in which case the sub-processor shall inform Skybridge of that legal requirement before processing (unless prohibited by law from doing so).
(b) Confidentiality Obligations. The sub-processor shall ensure that all personnel authorized to process personal data have committed themselves to confidentiality obligations or are subject to an appropriate statutory obligation of confidentiality. This obligation applies to all employees, contractors, and agents of the sub-processor who may have access to personal data in connection with the sub-processing activities.
(c) Technical and Organizational Security Measures. The sub-processor shall implement and maintain appropriate technical and organizational security measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. At a minimum, these measures shall include: AES-256 encryption for personal data at rest, TLS 1.2 or higher for personal data in transit, multi-factor authentication ("MFA") for all administrative access to systems that process personal data, and annual penetration testing of systems that store or process personal data.
(d) Data Subject Rights Assistance. The sub-processor shall assist Skybridge, by appropriate technical and organizational measures, insofar as this is possible, in fulfilling Skybridge's obligations to respond to requests from data subjects exercising their rights under applicable data protection laws, including rights of access, rectification, erasure, restriction of processing, data portability, and objection.
(e) Personal Data Breach Notification. The sub-processor shall notify Skybridge of any personal data breach within a timeframe that enables Skybridge to meet its 48-hour notification obligation to the Controller under the DPA. As recommended in Section IX of this memorandum, sub-processors should be required to notify Skybridge "without undue delay" and no later than 24 hours after becoming aware of a personal data breach affecting personal data processed on behalf of Skybridge.
(f) Data Return and Deletion. Upon termination or expiration of the sub-processing agreement, or upon Skybridge's instruction, the sub-processor shall, at Skybridge's election, return all personal data to Skybridge or securely delete all personal data and certify such deletion in writing, unless applicable law requires continued storage of the personal data.
(g) Audit and Inspection Cooperation. The sub-processor shall make available to Skybridge, and to the Controller and the Controller's regulatory supervisors (including the OCC, FDIC, and CFPB), all information necessary to demonstrate compliance with the obligations set forth in the sub-processing agreement, and shall allow for and contribute to audits and inspections conducted by Skybridge, the Controller, or their authorized representatives, including regulatory examiners.
(h) Restrictions on Further Sub-Processing. The sub-processor shall not engage its own sub-processors (i.e., sub-sub-processors) to process personal data without Skybridge's prior written consent. This restriction ensures that Skybridge maintains visibility and control over the entire sub-processing chain and can fulfill its obligations to the Controller regarding sub-processor oversight.
(i) DPIA Cooperation. The sub-processor shall cooperate with Skybridge in connection with data protection impact assessments ("DPIAs") as reasonably requested by Skybridge or required by the Controller, including providing information about the sub-processor's processing activities, security measures, and potential risks to data subjects.
B. GDPR-Specific Flow-Down (Article 28(4))
GDPR Article 28(4) imposes a specific requirement that the sub-processor contract must "mirror" the data protection obligations set forth in the controller-processor DPA. This provision ensures that the controller's data protection standards are contractually applied to each level of the sub-processing chain with the same force and specificity as they are applied to the processor itself.
Critically, Article 28(4) also establishes a "full liability" principle: where a sub-processor fails to fulfil its data protection obligations under the sub-processing agreement, the initial processor (Skybridge) remains fully liable to the controller (Meridian) for the performance of that sub-processor's obligations. This full liability principle is a non-negotiable requirement under the GDPR and must be expressly reflected in the DPA. From the Controller's perspective, this provision ensures that the Controller need not pursue claims directly against sub-processors with whom it has no contractual relationship and can instead hold the Processor accountable for the entire sub-processing chain.
The DPA should include clear language to this effect, such as: "Processor shall remain fully liable to Controller for the performance of each Sub-processor's obligations under the applicable sub-processing agreement. Where a Sub-processor fails to fulfil its data protection obligations, Processor shall be liable to Controller for the acts and omissions of such Sub-processor as if they were the acts and omissions of Processor."
C. GLBA and US Regulatory Flow-Down
In addition to GDPR-specific flow-down requirements, the sub-processor agreements must include provisions ensuring compliance with GLBA safeguards for consumer financial information. Because Meridian is a financial institution subject to the GLBA and Skybridge is a service provider processing consumer financial information on Meridian's behalf, the GLBA's safeguards requirements extend to sub-processors that handle consumer financial information in connection with the Meridian engagement.
OCC Bulletin 2023-17 further requires that contractual arrangements governing the Skybridge-Meridian relationship give Meridian (and its regulatory supervisors) the ability to access records, personnel, and facilities of sub-processors as needed for risk management and regulatory examination purposes. This requirement must be reflected in the flow-down provisions of the sub-processor agreements. Specifically, the sub-processor agreements should include provisions granting Meridian and its regulators the contractual right to access sub-processor records and facilities, either directly or through Skybridge as an intermediary.
VII. Liability and Risk Allocation for Sub-Processor Acts
A. Skybridge's Liability to Controller
Under the DPA, Skybridge will assume liability for the acts and omissions of its sub-processors as if they were Skybridge's own acts and omissions. This liability allocation is consistent with GDPR Article 28(4), which establishes the processor's full liability for sub-processor performance, and is a standard market expectation for bank-vendor DPAs. From Meridian's perspective, this provision is essential because it ensures that Meridian has a single point of contractual accountability for all processing activities performed in connection with the SBF Core services, regardless of whether those activities are performed by Skybridge directly or by one of its sub-processors.
Skybridge's liability for sub-processor acts and omissions will be subject to the DPA's overall liability cap. Based on current discussions and consistent with market practice for DPAs of this size and risk profile, the proposed liability cap is the greater of: (a) $5.0 million, or (b) two times (2×) the fees paid by the Controller to the Processor in the trailing 12-month period. For Meridian, with an ACV of $2.74 million, the trailing 12-month fee amount would be $2.74 million, yielding a 2× cap of $5.48 million. Accordingly, the effective liability cap under the DPA would be $5.48 million (the greater of $5.0 million and $5.48 million). It should be noted that certain categories of liability — including indemnification obligations for third-party claims arising from data breaches, GDPR regulatory fines, and willful misconduct — may be excluded from or subject to a higher cap than the general liability cap, depending on the final negotiated terms of the DPA.
B. Skybridge's Recourse Against Sub-Processors
While Skybridge will assume liability to Meridian for sub-processor acts and omissions, Skybridge must also ensure that it has adequate contractual recourse against its sub-processors to recover losses caused by sub-processor breaches. Effective back-to-back liability allocation is critical to Skybridge's risk management posture and ensures that the financial burden of a sub-processor-caused incident does not rest solely with Skybridge.
Osprey Cloud. A review of the Skybridge–Osprey Cloud DPA (dated March 1, 2024) is necessary to confirm that Osprey Cloud's liability cap and indemnification obligations are sufficient to provide meaningful recourse in the event of a breach caused by Osprey Cloud. If Osprey Cloud's liability cap under the existing Osprey DPA is materially lower than Skybridge's exposure under the Meridian DPA (i.e., materially below the $5.48 million effective cap), this would create a gap in Skybridge's back-to-back risk allocation. In such a scenario, I would recommend negotiating an amendment to the Osprey DPA to increase Osprey Cloud's liability cap and/or indemnification coverage, or, alternatively, implementing risk mitigation measures such as requiring Osprey Cloud to carry enhanced cyber-liability insurance coverage. The gap analysis of the Osprey DPA is targeted for completion by December 12, 2025.
SBF Europe. Because SBF Europe is a wholly-owned subsidiary of Skybridge, traditional arm's-length indemnification provisions may be of limited practical significance — any indemnification payment from SBF Europe to Skybridge would effectively be an intra-group transfer of funds. Nevertheless, formal flow-down of obligations to SBF Europe, including documented liability allocation provisions, should still be maintained for several important reasons: (i) regulatory compliance, as the GDPR and applicable bank regulatory guidance require that sub-processor agreements contain appropriate contractual protections regardless of the corporate relationship between the parties; (ii) audit trail purposes, as regulators and external auditors expect to see documented sub-processor agreements with complete flow-down provisions; and (iii) operational clarity, as formalized contractual obligations establish clear expectations and accountability for SBF Europe's data processing activities.
C. Insurance Considerations
Skybridge maintains a cyber-liability insurance policy through Bastion Mutual Insurance Company, Policy No. CYB-2025-04821, with coverage limits of $10 million per occurrence and $20 million in the aggregate. The current policy period runs from January 1, 2025, through December 31, 2025, and the renewal process for the 2026 policy period is currently in progress. This insurance coverage provides an important layer of financial protection for both Skybridge and its clients in the event of a data breach or other cyber-security incident.
The DPA with Meridian requires Skybridge to maintain cyber-liability insurance with per-occurrence coverage of no less than $10 million throughout the term of the DPA. Skybridge's current coverage satisfies this requirement, and the renewal of the policy for the 2026 period (and each subsequent year during the DPA term) should be tracked to ensure ongoing compliance.
An important consideration for the sub-processor risk allocation framework is whether sub-processor-caused incidents are covered under Skybridge's cyber-liability policy. Many cyber-liability policies provide coverage for incidents arising from the acts or omissions of the insured's service providers or sub-processors, but the scope of such coverage can vary. I recommend that Skybridge's insurance broker or coverage counsel confirm that the Bastion Mutual policy provides coverage for data breaches and security incidents that originate at or are caused by Osprey Cloud or SBF Europe. If Osprey Cloud maintains its own cyber-liability coverage — which is typical for a major IaaS/PaaS provider — this would provide an additional layer of risk mitigation, as Skybridge may be able to recover losses from Osprey Cloud's insurer in addition to, or in lieu of, filing a claim under its own policy.
VIII. Audit Rights Over Sub-Processors
A. Controller Audit Rights
The DPA will grant the Controller (or its regulators, including the OCC, FDIC, and CFPB) the right to audit the Processor's data processing activities and security controls. Under the proposed audit framework, the following parameters will apply:
(a) Frequency. The Controller may conduct audits no more than once per 12-month period, unless a more frequent audit is triggered by: (i) a personal data breach involving the Controller's personal data, (ii) a regulatory inquiry or examination directed at the Controller's relationship with Skybridge, or (iii) other material data protection concerns identified by the Controller.
(b) Notice. The Controller must provide at least 30 days' advance written notice of its intention to conduct an audit, specifying the scope and anticipated duration of the audit.
(c) Cost. Audits shall be conducted at the Controller's expense, except where the audit is triggered by a confirmed personal data breach caused by the Processor's failure to comply with its obligations under the DPA.
(d) SOC 2 Report. Skybridge may satisfy audit requests, in whole or in part, by providing the Controller with its most recent SOC 2 Type II report. Skybridge's current SOC 2 Type II report was issued by Graystone & Ketchum LLP and covers the audit period from October 1, 2024, through September 15, 2025. In addition to the SOC 2 report, Skybridge may provide supplemental questionnaire responses addressing specific Controller inquiries.
This audit framework should be extended to sub-processors. Specifically, the Controller should have the right to request that Skybridge obtain and provide sub-processor audit reports (such as Osprey Cloud's SOC 2 Type II report) or facilitate on-site audits of sub-processors in connection with regulatory examinations. The DPA should make clear that Skybridge's obligation to cooperate with Controller audits extends to making available information regarding sub-processor compliance and, where necessary, facilitating direct or indirect access to sub-processor facilities and records.
B. Regulatory Examination Access
OCC Bulletin 2023-17 requires that contractual arrangements governing the bank's third-party relationships preserve the ability of the bank's supervisory agencies — specifically the OCC, FDIC, and CFPB — to access records and examine the activities of both the third party (Skybridge) and its sub-contractors (Osprey Cloud, SBF Europe). This requirement reflects the principle that a bank's use of third parties and sub-contractors does not diminish the bank's regulatory obligations or its regulators' examination authority.
To satisfy this requirement, I recommend including the following provision in the DPA:
"Processor shall ensure that its agreements with Sub-processors include provisions permitting Controller's regulatory supervisors to access, examine, and audit the Sub-processor's records, systems, controls, and facilities to the same extent as Controller's regulators may access, examine, and audit the Processor. Processor shall use commercially reasonable efforts to cooperate with, and to cause its Sub-processors to cooperate with, any regulatory examination or inquiry directed at the Controller's third-party risk management program or the processing activities performed under this DPA."
This language should be reflected in both the DPA and the sub-processor agreements between Skybridge and Osprey Cloud and Skybridge and SBF Europe. As noted in Section IV.A, the existing Osprey DPA may not include adequate regulator access provisions, and this is identified as a potential gap requiring remediation.
C. SOC 2 and Security Certification Relay
As a practical matter, the primary mechanism through which the Controller will exercise oversight of sub-processor security controls is through the review of third-party audit reports and security certifications. Skybridge should commit in the DPA to providing the Controller, upon written request and subject to appropriate confidentiality obligations, with relevant sub-processor SOC 2 Type II reports (or equivalent security certifications) as they become available.
With respect to security testing, Skybridge currently engages Ironvault Security Group LLC (11710 Plaza America Drive, Suite 400, Reston, Virginia 20190) to conduct annual penetration testing of the SBF Core platform. The scope of the annual penetration test covers the SBF Core application and associated infrastructure. It should be confirmed whether the current penetration test scope extends to the Osprey Cloud-hosted infrastructure on which SBF Core is deployed. If the penetration test scope does not currently extend to the infrastructure layer, Skybridge should consider either expanding the scope of its engagement with Ironvault or requesting that Osprey Cloud provide evidence of its own independent penetration testing results.
IX. Sub-Processor Data Breach Notification Chain
A. Upstream Notification Timeline
The sub-processor data breach notification chain must be structured to ensure that breach notifications flow upstream through the processing chain with sufficient speed to enable each party to meet its regulatory and contractual notification obligations. The recommended notification chain is as follows:
Step 1: Sub-Processor → Skybridge. The sub-processor shall notify Skybridge of a personal data breach "without undue delay" and no later than 24 hours after becoming aware of the breach. The 24-hour deadline is designed to preserve sufficient time for Skybridge to conduct an initial investigation, assess the scope and severity of the breach, and prepare a notification to the Controller within the 48-hour window.
Step 2: Skybridge → Meridian. Skybridge shall notify Meridian of a personal data breach within 48 hours of Skybridge becoming aware of the breach (or, in the case of a sub-processor-caused breach, within 48 hours of receiving notification from the sub-processor). The 48-hour notification window to the Controller is a critical DPA obligation and is designed to enable Meridian to meet its own regulatory notification obligations within the required timeframes.
Step 3: Meridian → Primary Federal Regulator. Meridian shall notify its primary federal regulator (OCC or FDIC, as applicable) within 36 hours of determining that a "notification incident" has occurred, as required by 12 CFR Part 53.
The 24-hour sub-processor notification window (Step 1) is designed to work in tandem with the 48-hour Processor-to-Controller notification window (Step 2), providing Skybridge with a 24-hour buffer between receiving a sub-processor notification and its own deadline for notifying the Controller. This buffer is critical to allow Skybridge's incident response team to validate the sub-processor's report, assess the scope of the incident, and prepare a meaningful notification to the Controller.
Escalation contacts within Skybridge for data breach notifications are as follows: primary contact is Chief Information Security Officer ("CISO") Rebecca Muñoz, with escalation to General Counsel and Chief Privacy Officer ("GC/CPO") Thomas Elridge. Escalation contacts at Meridian for receipt of data breach notifications are Chief Compliance Officer Andrea Sokolov and Vice President of Third-Party Risk Management Marcus Tibaldi. The DPA should specify these contacts (or their functional equivalents) in Schedule D (Incident Response and Notification Procedures).
B. Cooperation Obligations
In addition to the notification timelines, the sub-processor agreements must include comprehensive cooperation obligations requiring the sub-processor to assist Skybridge in investigating and remediating a data breach. Specifically, the sub-processor must:
(a) cooperate fully with Skybridge's investigation of the breach, including providing access to relevant personnel, systems, and records;
(b) provide all reasonably necessary information about the nature, scope, categories of personal data affected, approximate number of data subjects affected, and likely impact of the breach;
(c) take all reasonable steps to contain and remediate the breach and to mitigate its effects on data subjects; and
(d) assist Skybridge in meeting its obligations to the Controller, including providing information necessary for the Controller to fulfill its own notification obligations to data subjects and regulatory authorities.
These cooperation obligations should be documented in both the Osprey Cloud DPA and the SBF Europe intra-group agreement. The existing Osprey DPA should be reviewed to confirm that it includes adequate breach cooperation provisions, and any gaps should be addressed in the planned amendment.
X. International Transfer Considerations (SCC Module 3)
A. Transfers Requiring Module 3 SCCs
The sub-processor risk allocation framework must address the international transfer of EU personal data within the sub-processing chain. The following transfers require Module 3 SCCs (Processor-to-Sub-processor):
Transfer 1: Skybridge (US Processor) → Osprey Cloud (US Sub-processor). This transfer involves the transmission of EU personal data originating from Meridian's approximately 3,200 EU-resident accountholders from Skybridge (a processor established in the United States) to Osprey Cloud (a sub-processor also established in the United States). Because both entities are located outside the EEA and the personal data originates from EU data subjects, Module 3 SCCs are required to provide a lawful transfer mechanism under Chapter V of the GDPR. The existing Osprey DPA (March 1, 2024) includes Module 3 SCCs, which should be reviewed to confirm they remain current and complete.
Transfer 2: Skybridge (US Processor) → SBF Europe (Netherlands Sub-processor). This transfer involves the transmission of personal data from Skybridge (a US-based processor) to SBF Europe (a sub-processor established in the Netherlands). As a general matter, transfers of personal data from a third country to the EEA do not require SCCs because the EEA is not considered to pose an inadequate level of data protection. However, Module 3 SCCs are included in the SCC package for this relationship for completeness and to address potential re-transfer scenarios — for example, situations in which SBF Europe may need to transfer personal data back to Skybridge or to another entity outside the EEA in connection with its processing activities. Including Module 3 SCCs for this transfer relationship also provides an additional layer of contractual protection and ensures consistency across the SCC package.
SCC Governing Law. The SCCs for both transfer relationships will be governed by the law of the Netherlands pursuant to Clause 17 of the SCCs, which requires the parties to select the law of a Member State in which one of the parties is established. Because SBF Europe (Skybridge's EU establishment) is incorporated and registered in the Netherlands, Dutch law is the appropriate choice of governing law for the SCCs.
B. Supplementary Measures
In addition to the SCCs, the sub-processor risk allocation framework benefits from the following supplementary measures:
EU-US Data Privacy Framework. Skybridge has self-certified under the EU-US Data Privacy Framework ("DPF"), Certification ID: DPF-2025-03912, effective July 1, 2025. The DPF self-certification provides an additional lawful transfer mechanism for transfers of EU personal data to the United States and supplements the protections provided

MEMORANDUM

MATTER NO.: 1009-00004

Record

Parties

Dates

Amounts