PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 1735 Market Street, Suite 2800 Philadelphia, PA 19103
MEMORANDUM
Matter No.: 1009-00004
To: Priscilla Wynn, Lead Associate, Privacy & Data Security Kevin Ostrowski, Responsible Partner, Privacy & Data Security
From: Alan Burke, Working Associate, Privacy & Data Security
Date: December 8, 2025
Re: Transfer Impact Assessment — EU–US Personal Data Transfers under Standard Contractual Clauses in Connection with Skybridge Fintech Ltd. Customer-Facing DPA and SCC Package (Meridian Federal Savings Bank)
PRIVILEGED & CONFIDENTIAL NOTICE: This memorandum is protected by the attorney-client privilege and work product doctrine. It is prepared in connection with Calderwood & Harkness LLP's representation of Skybridge Fintech Ltd. and should not be disclosed to third parties without prior approval. This document reflects the mental impressions, conclusions, opinions, and legal theories of counsel and is intended solely for the internal use of the client and counsel in this matter.
Right-click to update Table of Contents
I. Executive Summary
This memorandum sets forth a Transfer Impact Assessment ("TIA") evaluating the legal framework governing transfers of personal data from the European Union — specifically, from the Netherlands — to the United States in the context of Skybridge Fintech Ltd.'s ("Skybridge" or "SBF") customer-facing Data Processing Agreement ("DPA") and Standard Contractual Clauses ("SCC") package currently under negotiation with Meridian Federal Savings Bank ("Meridian"). The purpose of this assessment is to determine whether the proposed data transfer mechanisms provide an essentially equivalent level of protection to that afforded to personal data within the European Economic Area ("EEA") under the General Data Protection Regulation, Regulation (EU) 2016/679 ("GDPR"), and, if so, to identify the supplementary measures necessary to sustain that level of protection.
This assessment is required under the framework established by the Court of Justice of the European Union ("CJEU") in Data Protection Commissioner v. Kestrel Services Inc. Ireland Ltd. and Maximillian Schrems (Case C-311/18, judgment of July 16, 2020) ("Schrems II"), as well as the subsequent European Data Protection Board ("EDPB") Recommendations 01/2020 on Measures that Supplement Transfer Tools to Ensure Compliance with the EU Level of Protection of Personal Data, as adopted in their final form on June 18, 2021. Both authorities require data exporters, in cooperation with data importers, to conduct a case-by-case assessment of the third country's legal framework before relying on SCCs or other Article 46 GDPR transfer tools, and to implement supplementary technical, organizational, and contractual measures where the laws of the destination country could impinge on the effectiveness of the chosen transfer tool.
The relevant data transfers that are the subject of this assessment are as follows:
Transfer 1 (Intra-Group Transfer): Skybridge Fintech Europe B.V. ("SBF Europe"), a Dutch besloten vennootschap with registered office at Keizersgracht 482, 1017 EG Amsterdam, Netherlands (KvK No. 82104593), acting as the data exporter, transfers personal data to Skybridge Fintech Ltd., a Delaware C-corporation with principal offices at 4100 Silverside Road, Suite 310, Wilmington, DE 19810, acting as the data importer. This transfer is an intra-group transfer within the Skybridge corporate family, with SBF Europe functioning as the EU-established entity that initially processes European personal data before transferring it to Skybridge's US-based centralized processing environment.
Transfer 2 (Sub-Processor Transfer): Skybridge Fintech Europe B.V. and/or Skybridge Fintech Ltd. transfer personal data to Osprey Cloud Infrastructure, Inc. ("Osprey Cloud" or "OCI"), a Delaware corporation headquartered at 2200 Campus Drive, San Jose, CA 95131, which serves as a sub-processor providing infrastructure-as-a-service and platform-as-a-service hosting for SBF Core. Osprey Cloud operates data at its US-East data center region located in Ashburn, Virginia, and its EU data center region located in Frankfurt, Germany.
Based on the analysis set forth in detail below, it is our recommendation that SCCs adopted pursuant to EU Commission Implementing Decision 2021/914 of June 4, 2021 should serve as the primary transfer mechanism for all EU–US data transfers in this engagement. Specifically, Module 2 (Controller-to-Processor) should be deployed to govern the transfer from Meridian (as Controller, acting through SBF Europe as the EU point of processing) to Skybridge (as Processor, in the US), and Module 3 (Processor-to-Sub-processor) should be deployed to govern the transfer from Skybridge (as Processor) to Osprey Cloud (as Sub-processor) and, on a belt-and-suspenders basis, from Skybridge to SBF Europe for any reverse-flow or round-trip data scenarios. These SCCs should be supplemented by Skybridge's EU-US Data Privacy Framework ("DPF") self-certification (Certification ID: DPF-2025-03912, effective July 1, 2025), which provides an additional adequacy-based layer of protection and subjects Skybridge to Federal Trade Commission ("FTC") enforcement of its DPF commitments, as well as by robust technical and organizational measures including AES-256 encryption at rest, TLS 1.2+ encryption in transit, multi-factor authentication, role-based access controls, annual third-party penetration testing, and SOC 2 Type II certification.
Overall Risk Assessment: The combination of SCCs, DPF self-certification, and the supplementary measures described herein renders the risk of the proposed transfers to the rights and freedoms of the affected data subjects manageable and in compliance with Chapter V of the GDPR. The risk of US government access to the personal data of the approximately 3,200 EU-resident Meridian accountholders in a manner that would undermine the essential equivalence standard required by the CJEU is assessed as low, taking into account the reformed US legal framework (including Executive Order 14086 and the establishment of the Data Protection Review Court), the nature and volume of the data, the fintech/banking industry sector, and the robustness of the supplementary measures in place.
II. Scope of the Assessment
A. Client and Transaction Background
Skybridge Fintech Ltd. ("Skybridge" or "SBF") is a Delaware C-corporation headquartered at 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810. Founded in 2019, Skybridge provides software-as-a-service ("SaaS") payment processing, fraud detection, and regulatory-reporting software, marketed under the trade name "SBF Core," to FDIC-insured banks, credit unions, and other depository institutions operating within the United States. SBF Core is a cloud-hosted platform that enables financial institutions to process consumer and commercial payment transactions, detect and prevent fraudulent activity through real-time analytics (including behavioral biometric analysis), and generate the regulatory reports required by federal and state banking regulators.
Skybridge is currently negotiating a standardized customer-facing DPA and accompanying SCC package that is initially being tailored to Meridian Federal Savings Bank ("Meridian"), a federally chartered savings bank operating under OCC Charter No. 14-2238, with its headquarters located at 900 Broad Street, Suite 1200, Newark, New Jersey 07102. Meridian is supervised by the Office of the Comptroller of the Currency ("OCC") and insured by the Federal Deposit Insurance Corporation ("FDIC"). It is anticipated that, once finalized and executed with Meridian, the DPA and SCC package will serve as a template for Skybridge's future customer engagements involving EU personal data.
Meridian maintains approximately 412,000 accountholders across its retail and small-business banking operations. Of this total accountholder population, approximately 3,200 are EU-resident individuals, consisting primarily of expatriate US citizens residing in EU Member States and dual-resident individuals who maintain both US and EU domiciles. This EU-resident accountholder population — while representing less than one percent of Meridian's total accountholder base — triggers the territorial application of the GDPR pursuant to Article 3(1) (processing by an establishment in the EU, given SBF Europe's role in the processing chain) and, consequently, necessitates a lawful transfer mechanism for personal data flowing from the European Union to the United States.
The projected processing volume through SBF Core in connection with the Meridian engagement is approximately 18.6 million transactions per month. This figure encompasses all payment processing, fraud detection, and regulatory reporting activities conducted through the platform. The pro rata share attributable to EU-resident accountholders is substantially smaller, estimated at approximately 144,000 transactions per month, based on the ratio of EU-resident accountholders to total accountholders.
The DPA itself is governed by the laws of the State of Delaware, consistent with the broader Master Services Agreement between Skybridge and Meridian. The SCCs, however, will be governed by the law of the Netherlands pursuant to Clause 17 of the SCCs, reflecting the Member State in which SBF Europe — the EU-established entity in the processing chain — is located and registered.
B. Entities Involved in Cross-Border Transfers
The following entities are involved in the cross-border data transfers that are the subject of this assessment:
Skybridge Fintech Europe B.V. ("SBF Europe"): SBF Europe is a Dutch besloten vennootschap (private limited liability company) with its registered office at Keizersgracht 482, 1017 EG Amsterdam, Netherlands. It is registered with the Kamer van Koophandel (Dutch Chamber of Commerce) under KvK No. 82104593 and is managed by Lena Vogt, Managing Director. SBF Europe currently employs 14 staff members, consisting of 8 software engineers, 4 customer support personnel, and 2 compliance officers. SBF Europe is registered with the Autoriteit Persoonsgegevens ("AP"), the Dutch data protection supervisory authority. Within the Skybridge corporate structure, SBF Europe serves as the EU-based processing entity that handles EU personal data for Skybridge's bank clients with European accountholders. Functionally, SBF Europe operates as an EU-based sub-processor within Skybridge's processing chain: it receives personal data originating from Meridian's EU-resident accountholders, performs initial processing and localization functions, and then transmits that data to Skybridge's centralized US-based infrastructure for further processing through SBF Core.
Skybridge Fintech Ltd.: As described above, Skybridge is a Delaware C-corporation that acts as the Processor under the DPA with Meridian (the Controller). In the proposed contractual architecture, Skybridge is the primary data importer: it receives personal data from SBF Europe (the EU-based sub-processor) and processes that data in its centralized US-based environment using the SBF Core platform. Skybridge is the entity that holds the DPF self-certification (Certification ID: DPF-2025-03912, effective July 1, 2025) and is the contracting party under the customer-facing DPA and SCC package.
Osprey Cloud Infrastructure, Inc. ("Osprey Cloud" or "OCI"): Osprey Cloud is a Delaware corporation headquartered at 2200 Campus Drive, San Jose, California 95131. Its Chief Executive Officer is Martin Cho. Osprey Cloud is a major US-based provider of infrastructure-as-a-service ("IaaS") and platform-as-a-service ("PaaS") cloud computing solutions. Osprey Cloud serves as the primary hosting provider for SBF Core, operating data center regions in the United States and Europe. Specifically, Osprey Cloud operates a US-East data center region in Ashburn, Virginia, which serves as the primary hosting location for SBF Core, and an EU data center region in Frankfurt, Germany, which is used for EU-localized processing and storage of certain European personal data. Within the Skybridge processing chain, Osprey Cloud acts as a sub-processor. An existing Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024 governs the relationship and includes Module 3 SCCs (Processor-to-Sub-processor) as the transfer mechanism.
C. Categories of Personal Data Transferred
The personal data transferred in connection with the Meridian engagement encompasses the following categories, as documented in Schedule A (Description of Processing) of the proposed DPA:
• Full legal name (first name, middle name or initial, last name, and any suffix)
• Date of birth
• Social Security number ("SSN")
• Taxpayer identification number ("TIN")
• Account numbers (checking, savings, and loan account numbers)
• ABA routing numbers
• Transaction amounts and associated metadata (including transaction date, time, merchant category code, merchant name, and transaction type)
• IP addresses (IPv4 and IPv6)
• Device identifiers (including mobile device IMEI, advertising identifiers, and browser fingerprint data)
• Geolocation data (city-level, derived from IP address)
• Email addresses
• Telephone numbers (mobile and landline)
• Anti-fraud behavioral biometric data, specifically keystroke dynamics (typing speed, key press duration, inter-key intervals) and mouse movement patterns (velocity, acceleration, trajectory, click patterns)
Several of these data categories warrant heightened attention. SSNs and behavioral biometric data are classified as sensitive personal information under applicable US state privacy laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the New Jersey Data Privacy Act (S3377), which is expected to become effective on January 15, 2026.
For purposes of GDPR compliance, particular attention must be given to the anti-fraud behavioral biometric data. Article 9(1) of the GDPR classifies "biometric data" as a special category of personal data when processed "for the purpose of uniquely identifying a natural person." Skybridge's processing of keystroke dynamics and mouse movement patterns is undertaken for the purpose of fraud detection and prevention — i.e., to verify that the individual interacting with the platform is consistent with previously observed behavioral patterns and to flag anomalous behavior indicative of unauthorized access — rather than for the purpose of uniquely identifying the individual per se. While there is a reasonable argument that Skybridge's processing purpose falls outside the scope of Article 9(1) because it does not aim at unique identification, the distinction is fact-dependent and has not been definitively resolved by the CJEU or the AP. Accordingly, conservative treatment is warranted, and we recommend that the DPA and SCC package address the processing of behavioral biometric data as if it may constitute special category data, including the implementation of heightened security measures and explicit documentation of the processing purpose and lawful basis.
D. Categories of Data Subjects
The categories of data subjects whose personal data is transferred in connection with the Meridian engagement include:
• Meridian accountholders (both retail consumers and small-business customers)
• Authorized signers on Meridian accounts
• Beneficial owners of Meridian accounts (as identified pursuant to the Customer Identification Program and beneficial ownership requirements under the Bank Secrecy Act and FinCEN regulations)
• Meridian employees whose personal data passes through SBF Core in connection with internal bank transactions or administrative functions
The population of EU-resident data subjects within these categories is approximately 3,200, out of a total data subject population of approximately 412,000. The EU-resident data subjects are predominantly located in the Netherlands, Germany, France, and Ireland, based on Meridian's account records.
E. Processing Purposes
The personal data described above is processed by Skybridge through SBF Core for three primary purposes:
1. Payment processing: Facilitating the execution, clearing, and settlement of consumer and commercial payment transactions initiated by or on behalf of Meridian accountholders, including ACH transfers, wire transfers, debit card transactions, and real-time payment network transactions.
2. Anti-fraud analytics: Deploying real-time and near-real-time machine learning models and rule-based systems to detect, flag, and prevent fraudulent transactions and unauthorized account access. This includes the analysis of behavioral biometric data (keystroke dynamics and mouse movement patterns) to identify anomalous user behavior.
3. Regulatory reporting: Generating the reports and data exports required by federal and state banking regulators, including Suspicious Activity Reports ("SARs"), Currency Transaction Reports ("CTRs"), and call reports, as well as internal compliance reporting for Meridian's compliance function.
No processing is undertaken for purposes beyond those specified above. The DPA expressly prohibits Skybridge from processing personal data for any purpose other than those documented in the Controller's instructions, which are incorporated by reference in Schedule A of the DPA.
F. Data Locations
Personal data processed through SBF Core in connection with the Meridian engagement is stored and processed at the following locations:
• Primary processing and storage location: Osprey Cloud US-East data center region, Ashburn, Virginia, United States. This is the primary hosting location for SBF Core and the principal location where EU personal data is processed and stored.
• Secondary / EU processing and storage location: Osprey Cloud EU data center region, Frankfurt, Germany. Certain EU personal data is processed and stored at this location for EU-localized processing, latency optimization, and compliance purposes. Additionally, SBF Europe's offices in Amsterdam, Netherlands serve as a secondary processing location for EU-specific operations.
• Disaster recovery location: Osprey Cloud US-East secondary availability zone, Ashburn, Virginia, United States. This facility provides disaster recovery and business continuity capabilities through real-time data replication.
The geographic distribution of processing locations is relevant to the transfer analysis because, while data processed and stored exclusively within the EU (at the Frankfurt and Amsterdam locations) does not constitute a "transfer" subject to Chapter V of the GDPR, the centralization of processing at the Ashburn, Virginia primary location means that the majority of EU personal data will be transferred to, and processed in, the United States. Furthermore, the CLOUD Act implications of data stored at the Frankfurt location (operated by Osprey Cloud, a US corporation) must be considered, as discussed in Section VII below.
III. Legal Framework for International Data Transfers under GDPR
A. Chapter V of the GDPR — General Principles
The GDPR establishes a comprehensive regime governing the transfer of personal data to countries outside the European Economic Area in Articles 44 through 49, collectively comprising Chapter V of the Regulation. The overarching principle, set forth in Article 44, is that any transfer of personal data to a third country or international organization may take place only if the conditions laid down in Chapter V are complied with by the controller and the processor, including for onward transfers. This requirement applies in addition to, and does not override, the other provisions of the GDPR.
Under this framework, transfers of personal data to a third country — such as the United States — may lawfully proceed through one of three principal mechanisms:
(a) Adequacy Decision (Article 45): The European Commission may determine that a third country, a territory or one or more specified sectors within a third country, or an international organization ensures an adequate level of protection. Where such a determination has been made, personal data may flow to that country without the need for any additional safeguard. As discussed below, the European Commission has adopted a partial adequacy decision for the United States under the EU-US Data Privacy Framework, but this decision applies only to transfers to US organizations that have self-certified under the DPF; it does not constitute a blanket adequacy determination for all transfers to the United States.
(b) Appropriate Safeguards (Article 46): In the absence of an adequacy decision, a controller or processor may transfer personal data to a third country only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. Article 46(2) enumerates the safeguards that may be used without requiring specific authorization from a supervisory authority, including, at subsection (c), standard data protection clauses adopted by the Commission — i.e., Standard Contractual Clauses. SCCs are the most widely used transfer mechanism globally and are the primary mechanism under consideration in this assessment.
(c) Derogations (Article 49): In the absence of both an adequacy decision and appropriate safeguards, a transfer may proceed under the derogations enumerated in Article 49, which include, inter alia, explicit consent of the data subject, necessity for the performance of a contract, and compelling legitimate interests. These derogations are narrowly construed and intended for occasional, non-repetitive transfers. Given the systematic, recurring nature of the transfers at issue — involving approximately 18.6 million transactions per month — reliance on Article 49 derogations is neither appropriate nor feasible.
No blanket adequacy decision for the United States exists under Article 45 of the GDPR for entities that have not self-certified under the EU-US Data Privacy Framework. Accordingly, the transfers at issue in this assessment require either the DPF adequacy pathway (for transfers to DPF-certified entities) or appropriate safeguards in the form of SCCs, or both.
B. *Schrems II* (CJEU Case C-311/18) — Key Holdings
The CJEU's landmark judgment in Data Protection Commissioner v. Kestrel Services Inc. Ireland Ltd. and Maximillian Schrems (Case C-311/18), decided on July 16, 2020, fundamentally reshaped the legal landscape for EU–US personal data transfers. The key holdings relevant to this assessment are as follows:
Invalidation of Privacy Shield. The Court invalidated Commission Implementing Decision (EU) 2016/1250, which had established the EU-US Privacy Shield as an adequacy framework for transatlantic data transfers. The Court found that the US surveillance regime, particularly as conducted under FISA Section 702 and Executive Order 12333, did not satisfy the requirements of proportionality and necessity under EU law, and that the Ombudsperson mechanism established under the Privacy Shield did not provide data subjects with an effective remedy before an independent body.
Validity of SCCs — with conditions. The Court upheld the validity of SCCs adopted pursuant to Article 46(2)(c) of the GDPR as a mechanism for international data transfers. However, the Court emphasized that the contractual nature of SCCs means that they cannot, standing alone, bind the authorities of the third country, who are not parties to the contract. Accordingly, the Court held that data exporters and, where relevant, data importers are obligated to assess, on a case-by-case basis, whether the law and practices of the destination country ensure an essentially equivalent level of protection to that guaranteed within the European Union by the GDPR, read in light of the Charter of Fundamental Rights of the European Union — particularly Articles 7 (respect for private and family life), 8 (protection of personal data), and 47 (right to an effective remedy).
Identification of problematic US surveillance laws. The Court specifically identified US surveillance authorities — particularly Section 702 of the Foreign intelligence Surveillance Act ("FISA 702"), codified at 50 U.S.C. § 1881a, and Executive Order 12333 — as laws and practices that potentially undermine the level of protection afforded to personal data transferred from the EU to the US. The Court found that FISA 702 surveillance was not limited to what is "strictly necessary" and did not meet the EU standard of proportionality, and that EO 12333-based collection did not provide adequate safeguards for non-US persons.
Obligation to implement supplementary measures. Where the assessment reveals that the laws of the third country impinge on the effectiveness of the SCCs, the Court required data exporters to implement supplementary measures — technical, organizational, or contractual in nature — sufficient to ensure that the personal data transferred receives a level of protection essentially equivalent to that in the EU. If no supplementary measures can be identified that would provide such protection, the transfer must be suspended or terminated.
C. EDPB Recommendations 01/2020 on Supplementary Measures
Following the Schrems II judgment, the EDPB adopted Recommendations 01/2020 on Measures that Supplement Transfer Tools to Ensure Compliance with the EU Level of Protection of Personal Data, initially adopted on November 10, 2020, and revised and finalized on June 18, 2021. These Recommendations establish a structured, six-step methodology for conducting the assessment required by Schrems II:
1. Know your transfers: Map and document all transfers of personal data to third countries, including the identification of the personal data transferred, the transfer tool relied upon, and the entities involved.
2. Identify the transfer tool: Determine which Article 46 transfer tool (or other lawful basis under Chapter V) is being relied upon for each transfer.
3. Assess the law and practices of the third country: Evaluate whether anything in the law or practice of the third country impinges on the effectiveness of the appropriate safeguards of the transfer tool being relied upon, in the context of the specific transfer.
4. Identify and adopt supplementary measures: Where the assessment in Step 3 reveals that the third country's law or practices impinge on the effectiveness of the transfer tool, identify and adopt supplementary measures that, when combined with the transfer tool, ensure that transferred data is afforded an essentially equivalent level of protection.
5. Take procedural steps: Implement any formal procedural steps required by the specific transfer tool or supplementary measures adopted — for example, including supplementary measures as additional contractual provisions or implementing specific technical configurations.
6. Re-evaluate at appropriate intervals: Continuously monitor developments in the third country that may affect the initial assessment, and re-evaluate the transfer at appropriate intervals.
This memorandum follows the EDPB's six-step methodology in its analysis and recommendations. Steps 1 and 2 are addressed in Section II (Scope of the Assessment) and Section VI (Transfer Mapping); Step 3 is addressed in Section IV (Assessment of US Law and Practices); Step 4 is addressed in Section V (Supplementary Measures); Steps 5 and 6 are addressed in Sections VI, VIII, and X (Recommendations).
D. EU-US Data Privacy Framework ("DPF")
On July 10, 2023, the European Commission adopted Implementing Decision (EU) 2023/1795, establishing that the United States ensures an adequate level of protection for personal data transferred from the European Union to organizations in the United States that have self-certified under the EU-US Data Privacy Framework. The DPF was developed in response to the Schrems II judgment and reflects reforms to the US signals intelligence framework implemented through Executive Order 14086 (signed October 7, 2022) and accompanying Department of Justice regulations establishing the Data Protection Review Court ("DPRC").
Skybridge self-certified under the DPF as of July 1, 2025 (Certification ID: DPF-2025-03912). As a DPF-certified organization, Skybridge has committed to comply with the DPF Principles, including Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse/Enforcement/Liability. Skybridge's DPF certification subjects it to enforcement by the FTC under Section 5 of the FTC Act, and provides EU data subjects with the right to invoke binding arbitration before a DPF arbitration panel as a last-resort mechanism for resolving complaints.
The DPF adequacy decision provides a lawful basis under Article 45 of the GDPR for transfers of personal data to Skybridge as a DPF-certified entity. However, several important limitations must be noted:
First, the DPF adequacy does not extend to Osprey Cloud Infrastructure, Inc. unless Osprey Cloud has independently self-certified under the DPF. At present, the existing Skybridge–Osprey Cloud DPA dated March 1, 2024 relies on Module 3 SCCs rather than the DPF as the transfer mechanism for the Skybridge → Osprey Cloud transfer. Osprey Cloud's DPF certification status should be independently verified as part of the DPA/SCC finalization process.
Second, the DPF adequacy decision may itself be subject to future legal challenge. Maximillian Schrems and the advocacy organization NOYB (None of Your Business) have publicly indicated their intention to challenge the DPF before the CJEU, and commentators have speculated about the possibility of a "Schrems III" proceeding. While the DPF adequacy decision remains valid and in force at the time of this assessment, the prospect of a future challenge introduces a degree of legal uncertainty. Accordingly, reliance on the DPF alone is not recommended as a matter of prudent risk management. SCCs should be maintained as the primary transfer mechanism, with the DPF serving as a supplementary and redundant layer of protection that provides additional legal certainty while the DPF adequacy decision remains in effect.
E. EU Commission Standard Contractual Clauses (Implementing Decision 2021/914)
The current set of Standard Contractual Clauses was adopted by the European Commission pursuant to Implementing Decision 2021/914 of June 4, 2021, and replaced all prior SCC sets effective December 27, 2022. The new SCCs were designed to address the requirements of the Schrems II judgment and to reflect the provisions of the GDPR, including the concepts of controller and processor as defined in the Regulation.
The 2021 SCCs employ a modular structure consisting of four modules, each tailored to a different configuration of data transfer relationships:
• Module 1: Controller-to-Controller
• Module 2: Controller-to-Processor
• Module 3: Processor-to-Sub-processor (or Processor-to-Processor)
• Module 4: Processor-to-Controller
The applicable modules for the transfers at issue in this matter are:
Module 2 (Controller-to-Processor): This module governs transfers from a data controller (or an entity acting on behalf of a controller) to a data processor in a third country. In the context of the Meridian engagement, Module 2 applies to the transfer of EU personal data from Meridian (Controller, acting through SBF Europe as the entity established in the EU that exports data on behalf of the Controller's processing chain) to Skybridge (Processor, located in the United States). Module 2 requires the data importer (Skybridge) to process data only on documented instructions from the controller, to implement appropriate technical and organizational measures, to assist the controller in responding to data subject requests, and to comply with notification obligations in respect of government access requests.
Module 3 (Processor-to-Sub-processor): This module governs transfers from a data processor to a sub-processor in a third country. Module 3 applies to two transfers in this matter: (i) the transfer from Skybridge (Processor) to Osprey Cloud (Sub-processor, located in the United States), which governs the hosting of SBF Core on Osprey Cloud's US-East and EU infrastructure; and (ii) on a belt-and-suspenders basis, the transfer from Skybridge (Processor, US) to SBF Europe (Sub-processor, Netherlands). The latter transfer does not in itself require SCCs because SBF Europe is located within the EU; however, Module 3 SCCs are included to provide contractual coverage for any reverse-flow or round-trip scenarios in which data may be re-transferred from SBF Europe back to the United States, and to ensure comprehensive contractual protection throughout the processing chain.
Consistent with the territorial nexus of SBF Europe as the EU-established entity in the processing chain, the SCCs will be governed by the law of the Netherlands pursuant to Clause 17 of the SCCs. Clause 17 requires the parties to specify the law of an EU Member State as the governing law of the SCCs; the selection of Netherlands law reflects the jurisdiction in which SBF Europe is established and registered, and is consistent with the supervisory competence of the Autoriteit Persoonsgegevens over SBF Europe's processing activities.
IV. Assessment of US Law and Practices (Step 3 of EDPB Methodology)
A. US Government Surveillance Framework
Consistent with the EDPB's six-step methodology and the Schrems II requirements, this section assesses the laws and practices of the United States that could potentially impinge on the effectiveness of the SCCs as the chosen transfer tool. The analysis focuses on the four principal legal authorities that govern US government access to personal data held by private entities: FISA Section 702, Executive Order 12333, the CLOUD Act, and National Security Letters.
1. FISA Section 702. Section 702 of the Foreign intelligence Surveillance Act, codified at 50 U.S.C. § 1881a, authorizes the US government — specifically, the National Security Agency ("NSA"), with oversight from the Foreign intelligence Surveillance Court ("FISC") — to target non-US persons reasonably believed to be located outside the United States for the purpose of acquiring foreign intelligence information. Under FISA 702, the government may compel "electronic communication service providers" (as defined in 50 U.S.C. § 1881(b)(4)) to provide assistance in facilitating the acquisition of communications and other data of targeted individuals. The collection programs authorized under FISA 702 — including the PRISM program (which compels service providers to produce stored communications and data of targeted users) and the upstream program (which acquires communications in transit on telecommunications backbone infrastructure) — were central to the CJEU's concerns in Schrems II.
A threshold question is whether Skybridge and/or Osprey Cloud qualify as "electronic communication service providers" under 50 U.S.C. § 1881(b)(4). The statutory definition is broad and encompasses any provider of "electronic communication service" (as defined in 18 U.S.C. § 2510(15)), "remote computing service" (as defined in 18 U.S.C. § 2711(2)), or any other communication service that has access to wire or electronic communications. Skybridge is a SaaS fintech platform rather than a traditional telecommunications carrier, internet service provider, or webmail service. However, SBF Core processes and stores electronic communications and data on behalf of its users, and the "remote computing service" definition is broad enough to encompass providers of cloud-based processing and storage services. Similarly, Osprey Cloud, as an IaaS/PaaS provider, could fall within the definition as a provider of "remote computing services." On a conservative basis, we assume for purposes of this assessment that both Skybridge and Osprey Cloud could potentially fall within the scope of FISA 702 and could be subject to directives issued under that authority.
Critically, however, the legal landscape has evolved significantly since the Schrems II judgment. On October 7, 2022, President Biden signed Executive Order 14086, titled "Enhancing Safeguards for United States signals intelligence Activities." EO 14086 introduced binding requirements of proportionality and necessity for US signals intelligence activities directed at foreign persons' data, explicitly providing that signals intelligence shall be conducted only to the extent necessary and proportionate to a validated intelligence priority. EO 14086 also established, through accompanying Department of Justice regulations (28 CFR Part 201), the Data Protection Review Court ("DPRC") as a two-tier redress mechanism for qualifying states' data subjects (including EU data subjects). The DPRC is empowered to receive and adjudicate complaints from EU data subjects (channeled through EU data protection authorities and the Office of the Director of National intelligence's Civil Liberties Protection Officer), to issue binding remedial orders, and to require the deletion of unlawfully collected data. These reforms were the cornerstone of the European Commission's determination that the DPF provides an adequate level of protection.
The introduction of proportionality and necessity standards, combined with the DPRC redress mechanism, significantly reduces the risk that FISA 702 collection would impinge on the effectiveness of SCCs in the context of the transfers at issue. While FISA 702 remains in effect and the government retains the legal authority to compel production of data from covered service providers, the reformed framework imposes meaningful constraints on the exercise of that authority and provides EU data subjects with an independent judicial remedy.
2. Executive Order 12333. Executive Order 12333, originally issued in 1981 and subsequently amended, governs intelligence activities conducted by the US intelligence community outside of the FISA statutory framework. Unlike FISA 702, EO 12333 does not authorize the government to compel private companies to provide access to data or to assist in surveillance activities. Instead, EO 12333 collection typically involves the interception of data in transit — for example, communications traversing international telecommunications cables — by intelligence agencies using their own technical capabilities.
The risk that EO 12333 collection poses to the personal data at issue in this assessment is assessed as comparatively lower than the risk posed by FISA 702. This conclusion rests on two principal grounds. First, EO 12333 does not involve compulsory assistance from private companies; neither Skybridge nor Osprey Cloud would be compelled to produce data to the government under EO 12333 authority. The risk is therefore limited to the possibility that intelligence agencies might intercept data in transit between EU and US processing locations. Second, the supplementary technical measures deployed by Skybridge — particularly TLS 1.2+ encryption for all data in transit — significantly mitigate the risk of successful interception of data traversing international networks.
Furthermore, EO 14086's proportionality and necessity requirements apply to all signals intelligence activities conducted by the US intelligence community, including activities conducted under EO 12333 authority. This represents an important post-Schrems II development that further reduces the risk profile.
3. CLOUD Act (Clarifying Lawful Overseas Use of Data Act, 2018). The Clarifying Lawful Overseas Use of Data Act ("CLOUD Act"), enacted on March 23, 2018, as part of the Consolidated Appropriations Act of 2018, amended the Stored Communications Act (18 U.S.C. § 2713) to clarify that a provider of electronic communication services or remote computing services that is subject to US jurisdiction shall comply with obligations to preserve, back up, or disclose the contents of wire or electronic communications and any record or other information relating to a customer or subscriber, regardless of whether such communication, record, or other information is located within or outside the United States.
The CLOUD Act is directly relevant to this assessment because Osprey Cloud Infrastructure, Inc., a US corporation subject to US jurisdiction, operates a data center in Frankfurt, Germany where certain EU personal data is processed and stored. Under the CLOUD Act, the US government could potentially compel Osprey Cloud to produce data stored at the Frankfurt facility through a valid warrant, subpoena, or court order issued under US law, notwithstanding the fact that the data is physically located within the EU. This creates a tension between US compulsory process and EU data protection law, including Article 48 of the GDPR, which provides that any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may be recognized or enforceable only if based on an international agreement such as a mutual legal assistance treaty.
The SCCs address this risk in part through Clause 15 (Obligations of the data importer in case of access by public authorities), which requires the data importer to promptly notify the data exporter of any legally binding request by a public authority for disclosure of personal data (unless prohibited), to challenge the request if there are reasonable grounds to consider it unlawful, and to provide the minimum amount of information permissible. The supplementary technical measures — particularly encryption at rest with Skybridge-held keys, discussed in Section V.A below — provide an additional layer of protection by ensuring that even if Osprey Cloud were compelled to produce data stored at Frankfurt, the data would be encrypted and Osprey Cloud would not possess the keys necessary to decrypt it without Skybridge's involvement.
4. National Security Letters (NSLs). National Security Letters are administrative subpoenas issued by the Federal Bureau of Investigation ("FBI") under several statutory authorities (principally 18 U.S.C. § 2709 and 12 U.S.C. § 3414) to obtain certain categories of records in connection with national security investigations. NSLs are limited in scope to subscriber information and transactional records — they do not authorize the acquisition of content — and may be issued only where the FBI certifies that the records sought are relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities.
NSLs carry mandatory nondisclosure (gag) orders that prohibit the recipient from disclosing the existence or content of the NSL, although these nondisclosure orders are subject to judicial review and termination. The gag order provisions are relevant because they could limit the data importer's ability to notify the data exporter of a government access request, potentially undermining the transparency commitments in the SCCs. However, NSLs are limited to metadata and subscriber information, do not authorize access to content, and have been subject to increased judicial oversight following amendments in the USA FREEDOM Act of 2015. The risk to the personal data at issue from NSLs is assessed as limited.
B. Assessment of Risk to Data Subjects
Having surveyed the US legal authorities that could potentially be invoked to compel access to the personal data at issue, we now assess the actual risk to the rights and freedoms of the affected data subjects in light of the specific circumstances of the transfers.
Nature and sensitivity of the data. The personal data transferred includes financial transaction data, Social Security numbers, taxpayer identification numbers, account numbers, and behavioral biometric data. This data is highly sensitive by any measure — it could enable identity theft, financial fraud, or detailed profiling of individuals' financial activities if accessed by unauthorized parties. The sensitivity of the data weighs in favor of heightened protective measures, which are addressed in Section V below.
Volume and scope of the data. The EU-resident data subject population is approximately 3,200 individuals, representing less than one percent of Meridian's total accountholder base. The volume of EU-related transaction data — estimated at approximately 144,000 transactions per month — is modest in absolute terms. The relatively small scale of the EU personal data within the overall data set reduces the likelihood that the data would be of interest to US intelligence agencies in the context of foreign intelligence collection activities, which typically focus on communications and activities of known or suspected intelligence targets rather than on the financial records of a relatively small number of bank customers.
Skybridge's prior experience with government access requests. To date, Skybridge has represented that it has not received any government access requests — whether under FISA 702, NSLs, CLOUD Act warrants, or otherwise — directed at personal data processed through SBF Core. This representation should be formally confirmed with Thomas Elridge (General Counsel, Skybridge) and Rebecca Muñoz (Chief Information Security Officer, Skybridge) as part of the DPA/SCC finalization process. A clean history of no prior government access requests supports the assessment that the risk to the specific data at issue is low.
Industry sector. Skybridge operates in the fintech and banking technology sector. While financial data is of general interest to law enforcement and regulatory authorities, the fintech/banking sector is not a primary target for foreign intelligence surveillance activities under FISA 702. FISA 702 collection has historically focused on counterterrorism, counterintelligence, and cybersecurity intelligence — areas in which the communications and activities of technology companies, telecommunications providers, and social media platforms have been the primary targets. A SaaS payment processing platform serving a federally chartered savings bank is unlikely to be a priority intelligence target. This sector-specific consideration supports a lower risk assessment.
Post-EO 14086 reforms. As discussed in Section IV.A.1 above, the reforms introduced by EO 14086 — including the binding proportionality and necessity requirements for signals intelligence activities and the establishment of the DPRC as an independent redress mechanism — significantly improve the legal landscape compared to the pre-Schrems II environment in which the CJEU identified deficiencies in US law. While EO 14086 is an executive order rather than a statute and could theoretically be revoked or amended by a future administration, the European Commission's DPF adequacy decision was predicated on these reforms, and the reforms remain in effect at the time of this assessment.
C. Overall Assessment
Based on the foregoing analysis, it is our assessment that the legal framework in the United States, as reformed by Executive Order 14086 and the establishment of the Data Protection Review Court, combined with the specific nature and volume of the personal data at issue, the fintech/banking industry sector, and Skybridge's absence of any prior government access requests, results in a risk level that is manageable through the deployment of SCCs with supplementary measures.
The risk of US government access to the personal data of the approximately 3,200 EU-resident Meridian accountholders in a manner that would undermine the essential equivalence standard required by the CJEU in Schrems II is assessed as low, though not negligible. The residual risk arises from the inherent legal authorities that the US government retains — particularly FISA 702 and the CLOUD Act — which, while constrained by EO 14086 reforms, remain available in principle. The supplementary measures described in Section V below are designed to further reduce this residual risk to an acceptable level.
V. Supplementary Measures (Step 4 of EDPB Methodology)
In accordance with Step 4 of the EDPB's six-step methodology, this section identifies and describes the supplementary technical, organizational, and contractual measures that Skybridge has implemented or will implement to ensure that the personal data transferred from the EU to the US receives an essentially equivalent level of protection, notwithstanding the US legal authorities identified in Section IV above. These measures are designed to supplement the protections afforded by the SCCs and the DPF and to address the specific risks identified in the preceding analysis.
A. Technical Measures
The following technical measures are implemented across Skybridge's processing infrastructure, including SBF Core and the underlying Osprey Cloud hosting environment:
1. Encryption at rest (AES-256). All personal data stored by Skybridge and Osprey Cloud is encrypted at rest using the Advanced Encryption Standard with 256-bit keys ("AES-256"), which is recognized by the National Institute of Standards and Technology ("NIST") as providing a high level of cryptographic security and is widely considered to be computationally infeasible to break with current technology. This encryption applies to all personal data at both the US-East (Ashburn, Virginia) and EU (Frankfurt, Germany) data center locations. Critically, the encryption key management architecture is designed such that encryption keys are generated, stored, and managed by Skybridge using a dedicated key management service; encryption keys are not accessible to Osprey Cloud or to third parties, including the US government, without Skybridge's active involvement and authorization. This key management architecture is directly relevant to the CLOUD Act and FISA 702 risk: even if a US government authority were to compel Osprey Cloud to produce data from its data centers, the data would be encrypted at rest, and Osprey Cloud would not possess the decryption keys necessary to render the data intelligible. Production of encrypted data without the corresponding decryption keys would not expose the personal data to the requesting authority in a meaningful way.
2. Encryption in transit (TLS 1.2+). All personal data transmitted between SBF Europe (Amsterdam), Skybridge (Wilmington), and Osprey Cloud infrastructure (Ashburn and Frankfurt) is encrypted in transit using Transport Layer Security ("TLS") protocol version 1.2 or higher. TLS encryption protects data against interception during transmission across public and private networks, directly mitigating the risk of data capture through EO 12333-type collection activities that target data in transit on international telecommunications infrastructure. Skybridge's TLS implementation uses forward secrecy cipher suites, ensuring that the compromise of a long-term key does not compromise past session keys.
3. Multi-factor authentication (MFA). Multi-factor authentication is required for all administrative access to SBF Core and to the underlying Osprey Cloud infrastructure that hosts SBF Core. MFA requires users to present at least two independent authentication factors — typically a password (something the user knows) and a time-based one-time password generated by a hardware token or authenticator application (something the user has) — before access is granted. MFA reduces the risk of unauthorized access to personal data by compromised credentials, whether through phishing, credential stuffing, or other attack vectors.
4. Pseudonymization and access controls. Skybridge has implemented role-based access controls ("RBAC") across SBF Core that limit personnel access to personal data on a strict need-to-know basis. Access permissions are configured at a granular level, such that individual employees are granted access only to the specific categories of personal data and processing functions required for their designated roles. All access to personal data is logged in detail, including the identity of the accessing user, the timestamp of access, the categories of data accessed, and the nature of the processing operation performed. Access logs are monitored by automated security information and event management ("SIEM") systems, and anomalous access patterns are flagged for investigation by Skybridge's security operations team under the oversight of the CISO.
5. Annual penetration testing. Skybridge engages Ironvault Security Group LLC, an independent third-party information security firm located at 11710 Plaza America Drive, Suite 400, Reston, Virginia 20190, to conduct annual penetration testing of SBF Core and associated infrastructure. Penetration testing is designed to identify vulnerabilities in the application, network, and infrastructure layers that could be exploited by attackers to gain unauthorized access to personal data. The most recent penetration test was completed in September 2025, and the resulting report and remediation plan are maintained in Skybridge's security documentation. Any critical or high-severity findings are remediated within 30 days of identification, with verification testing conducted upon completion of remediation.
B. Organizational Measures
1. SOC 2 Type II certification. Skybridge has obtained a Service Organization Control 2 Type II ("SOC 2 Type II") report, issued by the independent accounting and audit firm Graystone & Ketchum LLP, located at 300 Delaware Avenue, Suite 700, Wilmington, Delaware 19801 (Lead Audit Partner: Sandra Clearfield). The current SOC 2 Type II report covers the audit period from October 1, 2024 through September 15, 2025, and evaluates Skybridge's controls related to the Trust Services Criteria of Security, Availability, Processing Integrity, Confidentiality, and Privacy. The SOC 2 Type II report provides independent assurance that Skybridge's controls are suitably designed and operating effectively over the audit period, and is made available to Meridian (and other customers) under nondisclosure agreement as a mechanism for satisfying audit and oversight obligations under the DPA.
2. Cyber-liability insurance. Skybridge maintains a cyber-liability insurance policy issued by Bastion Mutual Insurance Company, Policy No. CYB-2025-04821, providing coverage of $10 million per occurrence and $20 million in aggregate. The policy period runs from January 1, 2025 through December 31, 2025, and renewal for the 2026 policy year is currently in progress. The policy is brokered by Kestrel Risk Advisors LLC. The cyber-liability insurance provides financial protection in the event of a data breach, unauthorized access, or other security incident affecting personal data processed through SBF Core, and supports Skybridge's ability to compensate affected data subjects for harm resulting from a privacy or security incident.
3. CISO oversight. Rebecca Muñoz serves as Chief Information Security Officer ("CISO") of Skybridge Fintech Ltd. and is responsible for maintaining Skybridge's overall information security posture, including incident response procedures, vulnerability management, security architecture review, and compliance with applicable security standards and regulatory requirements. Ms. Muñoz reports directly to Skybridge's Chief Executive Officer and maintains a direct escalation pathway to the Board of Directors for significant security matters. Skybridge's incident response plan, maintained under Ms. Muñoz's oversight, provides for detection, containment, investigation, notification, and remediation of security incidents within defined timeframes, consistent with the DPA's breach notification requirements and applicable regulatory obligations.
4. Employee training and confidentiality obligations. All Skybridge personnel — currently 187 employees — and all SBF Europe personnel — currently 14 employees — are subject to binding confidentiality agreements that prohibit the unauthorized disclosure of personal data and other confidential information. All personnel are required to complete annual data protection training covering the GDPR, the CCPA/CPRA, applicable US financial regulatory requirements (including GLBA), Skybridge's internal data protection policies and procedures, and incident response protocols. New employees receive data protection training as part of their onboarding process before being granted access to systems containing personal data. Training completion is tracked and documented by Skybridge's compliance function.
5. Sub-processor management. Skybridge operates a general written authorization model for the engagement of sub-processors, consistent with Article 28(2) of the GDPR and Clause 9 of the SCCs. Under this model, the Controller (Meridian) provides general written authorization for Skybridge to engage sub-processors, subject to the following conditions: Skybridge must provide the Controller with at least 30 days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor; the notice must identify the sub-processor, the nature of the processing to be performed, and the location of processing; the Controller has the right to object to the engagement of a proposed sub-processor on reasonable data-protection grounds within the 30-day notice period; and Skybridge is required to flow down equivalent data protection obligations to all sub-processors through written contracts. The existing Skybridge–Osprey Cloud DPA dated March 1, 2024 imposes comprehensive security, confidentiality, and compliance obligations on Osprey Cloud consistent with these requirements.
C. Contractual Measures
1. Standard Contractual Clauses (Implementing Decision 2021/914). As described throughout this memorandum, the SCCs serve as the primary contractual mechanism for the EU–US data transfers. Module 2 (Controller-to-Processor) governs the Meridian → Skybridge transfer, and Module 3 (Processor-to-Sub-processor) governs the Skybridge → Osprey Cloud and Skybridge → SBF Europe transfers. The SCCs are governed by the law of the Netherlands pursuant to Clause 17. The SCCs incorporate a comprehensive set of data protection obligations, including obligations relating to processing instructions, data security, data subject rights, government access requests, and auditing.
2. Transparency commitments. The SCCs include robust transparency commitments on the part of Skybridge as the data importer. Specifically, pursuant to Clause 15 of the SCCs, Skybridge commits to: (a) promptly notify the data exporter (to the extent legally permitted under applicable law, including any applicable non-disclosure obligations) of any legally binding request by a public authority or law enforcement agency for the disclosure or production of personal data transferred under the SCCs; (b) provide, along with such notification, information about the data requested, the requesting authority, the legal basis for the request, and the response provided; (c) challenge any government access request that Skybridge reasonably considers to be overbroad, disproportionate, or unlawful under the laws of the requesting jurisdiction, using available legal mechanisms including administrative appeals and judicial review; and (d) provide the minimum amount of information permissible when complying with a government access request, based on a reasonable interpretation of the request.
3. Data minimization. The DPA includes express data minimization provisions requiring that the processing of personal data be limited to what is strictly necessary for the specified purposes of payment processing, fraud detection, and regulatory reporting. Skybridge is contractually prohibited from processing personal data for any purpose beyond those documented in th