| Item No. | Category | Document Name | Description | Responsible Party | Reviewing / Approving Party | Due Date | Status | Date Completed | Notes / Comments |
| 1 | Core Agreement | Data Processing Agreement — Execution Version | Final execution-ready DPA between Meridian Federal Savings Bank (Controller) and Skybridge Fintech Ltd. (Processor), dated February 5, 2026. Governed by Delaware law. Includes operative provisions on indemnification, liability cap (greater of $5.0M or 2× trailing-12-month fees; $5.48M for Meridian based on $2.74M ACV), 48-hour breach notification, sub-processor general authorization with 30-day notice and objection right, audit rights (1× per 12 months, SOC 2 Type II as primary mechanism, regulator access preserved), 90-day post-termination data retention, insurance requirement ($10M per occurrence cyber-liability), and DPIA cooperation. | Calderwood & Harkness LLP (Priscilla Wynn / Alan Burke) | Kevin Ostrowski (C&H); Thomas Elridge (Skybridge); Constance Liu (BRS); Vanessa Hartwell / Marcus Tibaldi (Meridian) | 2026-02-05 | Final | 2026-02-05 | Circulated to BRS on 02/05. Execution target 02/15/2026 concurrent with SaaS subscription agreement ($2.74M/yr ACV, 5-year term, $13.7M TCV). |
| 2 | SCC Package | Standard Contractual Clauses — Module 2 (Controller-to-Processor): Meridian → Skybridge | EU Commission SCCs (Implementing Decision 2021/914), Module 2 for data transfers from Meridian Federal Savings Bank (data exporter/Controller) to Skybridge Fintech Ltd. (data importer/Processor). Governed by the law of the Netherlands per Clause 17. Covers ~3,200 EU-resident Meridian accountholders. | Calderwood & Harkness LLP (Alan Burke) | Kevin Ostrowski (C&H); Thomas Elridge (Skybridge); Constance Liu (BRS) | 2026-02-05 | Final | 2026-02-05 | Included in combined SCC execution-ready package. Initial draft dated 12/12/2025. |
| 3 | SCC Package | Standard Contractual Clauses — Module 3 (Processor-to-Sub-processor): Skybridge → Osprey Cloud Infrastructure, Inc. | EU Commission SCCs Module 3 for data transfers from Skybridge Fintech Ltd. (data exporter/Processor) to Osprey Cloud Infrastructure, Inc. (data importer/Sub-processor), 2200 Campus Drive, San Jose, CA 95131. US-East data center (Ashburn, VA) and EU data center (Frankfurt, Germany). Governed by the law of the Netherlands per Clause 17. Supplements existing Skybridge–Osprey DPA dated March 1, 2024. | Calderwood & Harkness LLP (Alan Burke) | Kevin Ostrowski (C&H); Thomas Elridge (Skybridge); Constance Liu (BRS) | 2026-02-05 | Final | 2026-02-05 | Initial draft dated 12/12/2025. |
| 4 | SCC Package | Standard Contractual Clauses — Module 3 (Processor-to-Sub-processor): Skybridge → Skybridge Fintech Europe B.V. | EU Commission SCCs Module 3 for data transfers from Skybridge Fintech Ltd. (data exporter/Processor) to Skybridge Fintech Europe B.V. (data importer/Sub-processor), Keizersgracht 482, 1017 EG Amsterdam, Netherlands (KvK 82104593). Managing Director: Lena Vogt. 14 employees. Governed by the law of the Netherlands per Clause 17. | Calderwood & Harkness LLP (Alan Burke) | Kevin Ostrowski (C&H); Thomas Elridge (Skybridge); Lena Vogt (SBF Europe) | 2026-02-05 | Final | 2026-02-05 | Initial draft dated 12/12/2025. SBF Europe registered with Autoriteit Persoonsgegevens. |
| 5 | SCC Package | Standard Contractual Clauses — Full Execution-Ready Package (All Modules Combined) | Combined SCC package dated February 5, 2026, incorporating Module 2 (Meridian → Skybridge) and Module 3 (Skybridge → Osprey Cloud; Skybridge → SBF Europe) together with Annexes I, II, and III. Appended to and forming part of the DPA execution version. | Calderwood & Harkness LLP (Alan Burke / Priscilla Wynn) | Kevin Ostrowski (C&H); Thomas Elridge (Skybridge); Constance Liu (BRS) | 2026-02-05 | Final | 2026-02-05 | Governed by the law of the Netherlands per Clause 17; DPA governed by Delaware law. |
| 6 | DPA Schedule | Schedule A: Description of Processing | Data subjects (~412,000 Meridian accountholders, authorized signers, beneficial owners, employees; ~3,200 EU-resident); categories of personal data (full name, DOB, SSN, TIN, account numbers, routing numbers, transaction data, IP addresses, device identifiers, geolocation, email, phone, behavioral biometric data); purposes (payment processing, anti-fraud analytics, regulatory reporting via SBF Core); duration (SaaS subscription term + 90 days post-termination); volume (~18.6M transactions/month). | Calderwood & Harkness LLP (Alan Burke) | Priscilla Wynn (C&H); Thomas Elridge / Rebecca Muñoz (Skybridge); Marcus Tibaldi (Meridian) | 2026-02-05 | Final | 2026-02-05 | SSNs and behavioral biometric data classified as sensitive under CCPA/CPRA and NJ S3377. |
| 7 | DPA Schedule | Schedule B: Security Measures | SOC 2 Type II certification (Graystone & Ketchum LLP, audit period October 1, 2024 – September 15, 2025, lead partner Sandra Clearfield); AES-256 encryption at rest; TLS 1.2+ encryption in transit; MFA for administrative access; annual penetration testing by Ironvault Security Group LLC (Reston, VA); incident response plan; employee security training; physical security at Osprey Cloud data centers. | Calderwood & Harkness LLP (Alan Burke) | Rebecca Muñoz (Skybridge CISO); Sanjay Dhillon (Skybridge VP Engineering); Marcus Tibaldi (Meridian) | 2026-02-05 | Final | 2026-02-05 | References Graystone & Ketchum LLP SOC 2 report and Ironvault annual pen test. |
| 8 | DPA Schedule | Schedule C: Approved Sub-Processor List | Lists approved sub-processors: (1) Osprey Cloud Infrastructure, Inc., 2200 Campus Drive, San Jose, CA 95131 — IaaS/PaaS hosting, US-East (Ashburn, VA) and EU (Frankfurt, Germany); (2) Skybridge Fintech Europe B.V., Keizersgracht 482, 1017 EG Amsterdam, Netherlands — EU personal data processing. General written authorization with 30-day prior notice for new sub-processors; Controller right to object. | Calderwood & Harkness LLP (Alan Burke) | Thomas Elridge (Skybridge); Marcus Tibaldi / Andrea Sokolov (Meridian) | 2026-02-05 | Final | 2026-02-05 | Aligned with OCC Bulletin 2023-17 sub-contractor oversight requirements. |
| 9 | DPA Schedule | Schedule D: Data Breach Notification Procedures | 48-hour notification timeline from Skybridge awareness of Personal Data Breach to Meridian. Escalation matrix: CISO Rebecca Muñoz → GC Thomas Elridge → Meridian CCO Andrea Sokolov and VP TPRM Marcus Tibaldi. Content requirements for breach notice; cooperation obligations. Reference to FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53, 36-hour bank-to-regulator timeline). | Calderwood & Harkness LLP (Priscilla Wynn) | Rebecca Muñoz (Skybridge); Andrea Sokolov / Marcus Tibaldi (Meridian); Constance Liu (BRS) | 2026-02-05 | Final | 2026-02-05 | Meridian TPRM program requires ≤48 hours; federal banking regulator guidance requires 36 hours for bank-to-regulator notification. |
| 10 | SCC Annex | SCC Annex I: Description of Transfer (All Modules) | Data exporter/importer identities; categories of data subjects (~412,000 accountholders, ~3,200 EU-resident); categories of personal data (names, SSNs, account numbers, transaction data, IP addresses, device identifiers, geolocation, behavioral biometric data); processing purposes (payment processing, fraud detection, regulatory reporting via SBF Core); frequency (~18.6M transactions/month); retention (duration of subscription + 90 days). | Calderwood & Harkness LLP (Alan Burke) | Thomas Elridge (Skybridge); Constance Liu (BRS) | 2026-01-15 | Final | 2026-01-15 | Finalized with third redline dated January 15, 2026. |
| 11 | SCC Annex | SCC Annex II: Technical and Organizational Measures | AES-256 encryption at rest; TLS 1.2+ encryption in transit; MFA for administrative access; annual penetration testing by Ironvault Security Group LLC; SOC 2 Type II audit by Graystone & Ketchum LLP; incident response procedures; access controls; backup/disaster recovery at Osprey Cloud US-East secondary availability zone (Ashburn, VA). | Calderwood & Harkness LLP (Alan Burke) | Rebecca Muñoz (Skybridge); Marcus Tibaldi (Meridian) | 2026-01-15 | Final | 2026-01-15 | Finalized with third redline dated January 15, 2026. |
| 12 | SCC Annex | SCC Annex III: List of Sub-processors | Lists: (1) Osprey Cloud Infrastructure, Inc., 2200 Campus Drive, San Jose, CA 95131 — IaaS/PaaS, US-East (Ashburn, VA) and EU (Frankfurt, Germany); (2) Skybridge Fintech Europe B.V., Keizersgracht 482, 1017 EG Amsterdam, Netherlands — EU personal data processing. | Calderwood & Harkness LLP (Alan Burke) | Thomas Elridge (Skybridge); Constance Liu (BRS) | 2026-01-15 | Final | 2026-01-15 | Finalized with third redline dated January 15, 2026. |
| 13 | Certificate | Officer's Certificate — Skybridge Fintech Ltd. | Certificate executed by Thomas Elridge, General Counsel of Skybridge Fintech Ltd. (4100 Silverside Road, Suite 310, Wilmington, DE 19810), certifying that Skybridge is duly organized under Delaware law, execution of DPA/SCC package duly authorized, and signatory Nadia Karimova (CEO) has authority to bind Skybridge. | Skybridge Fintech Ltd. (Thomas Elridge, General Counsel) | Kevin Ostrowski (C&H) | 2026-02-15 | Pending | To be dated February 15, 2026 upon execution. |
| 14 | Certificate | Officer's Certificate — Meridian Federal Savings Bank | Certificate from authorized officer of Meridian Federal Savings Bank (900 Broad Street, Suite 1200, Newark, NJ 07102, OCC Charter No. 14-2238) certifying authority to execute DPA/SCC package and that signatory Lawrence C. Driscoll (CEO) has authority to bind Meridian. | Meridian Federal Savings Bank (Vanessa Hartwell, General Counsel) | Constance Liu (BRS) | 2026-02-15 | Pending | To be obtained from BRS / Meridian. |
| 15 | Signature Pages | Signature Pages — DPA and SCC Package | Signature blocks for: Meridian Federal Savings Bank (by Lawrence C. Driscoll, CEO); Skybridge Fintech Ltd. (by Nadia Karimova, CEO). SCC-specific signature blocks for Module 2 (Meridian and Skybridge), Module 3 (Skybridge and Osprey Cloud Infrastructure, Inc.), and Module 3 (Skybridge and Skybridge Fintech Europe B.V.). | Calderwood & Harkness LLP (Priscilla Wynn) / Blackwell, Raines & Stoddard LLP (Derek Faulkner) | Kevin Ostrowski (C&H); Constance Liu (BRS) | 2026-02-15 | Pending | Target execution date February 15, 2026, concurrent with SaaS subscription agreement. |
| 16 | Third-Party Report | SOC 2 Type II Report — Skybridge Fintech Ltd. | SOC 2 Type II report issued by Graystone & Ketchum LLP (300 Delaware Avenue, Suite 700, Wilmington, DE 19801), lead partner Sandra Clearfield. Report dated September 15, 2025; audit period October 1, 2024 – September 15, 2025. To be delivered to Meridian as part of DPA execution deliverables. | Skybridge Fintech Ltd. (Rebecca Muñoz, CISO) | Marcus Tibaldi (Meridian VP TPRM); Andrea Sokolov (Meridian CCO) | 2026-02-10 | Received | 2025-09-15 | Current report already in hand. Delivery to Meridian required prior to or at execution. |
| 17 | Insurance | Certificate of Cyber-Liability Insurance — Bastion Mutual Insurance Company | Certificate evidencing Technology E&O and Cyber Liability coverage: $10M per occurrence / $20M aggregate, Policy No. CYB-2025-04821. Carrier: Bastion Mutual Insurance Company, 55 Farmington Avenue, Hartford, CT 06105. Broker: Kestrel Risk Advisors LLC, 140 Broadway, 18th Floor, New York, NY 10005. Current policy period January 1, 2025 – December 31, 2025; renewal in progress for 2026. | Skybridge Fintech Ltd. (Thomas Elridge) via Kestrel Risk Advisors LLC | Marcus Tibaldi (Meridian VP TPRM) | 2026-02-10 | Pending | DPA requires $10M per occurrence minimum. Current policy expires 12/31/2025; 2026 renewal must be confirmed. Certificate must name Meridian as additional insured or certificate holder per DPA requirements. |
| 18 | Sign-Off | Board / Management Sign-Off — Skybridge Fintech Ltd. | Internal management approval from Skybridge CEO Nadia Karimova and General Counsel Thomas Elridge authorizing execution of DPA/SCC package. PE sponsor Halcyon Ridge Capital Partners, LP (34.2% equity, board observer Catherine Shin) to be notified. | Skybridge Fintech Ltd. (Nadia Karimova, CEO; Thomas Elridge, GC) | Kevin Ostrowski (C&H) | 2026-02-10 | Pending | Target sign-off by February 10, 2026. |
| 19 | Sign-Off | Board / Management Sign-Off — Meridian Federal Savings Bank | Internal management approval from Meridian CEO Lawrence C. Driscoll, General Counsel Vanessa Hartwell, CCO Andrea Sokolov, and VP TPRM Marcus Tibaldi, confirming completion of TPRM due diligence (per OCC Bulletin 2023-17 and FFIEC guidance) and authorizing execution of DPA/SCC package concurrent with SaaS subscription agreement. | Meridian Federal Savings Bank (Lawrence C. Driscoll, CEO) | Constance Liu (BRS) | 2026-02-10 | Pending | Target sign-off by February 10, 2026. Near-final DPA circulated for Meridian internal review on January 22, 2026. |
| 20 | Supplemental | EU-US Data Privacy Framework Self-Certification Confirmation | Confirmation of Skybridge Fintech Ltd.'s active EU-US Data Privacy Framework self-certification, Certification ID: DPF-2025-03912, effective July 1, 2025. Supplements SCCs but does not replace them per Schrems II / CJEU C-311/18. | Skybridge Fintech Ltd. (Thomas Elridge) | Priscilla Wynn (C&H); Constance Liu (BRS) | 2026-02-10 | Received | 2025-07-01 | Self-certification active since July 2025. Annual re-certification required. |
| 21 | Supplemental | Transfer Impact Assessment Memorandum | TIA for EU–US personal data transfers under SCCs, prepared by Alan Burke dated December 8, 2025. Addresses Schrems II requirements, DPF self-certification, and supplementary measures (AES-256, TLS 1.2+). Supports SCC Modules 2 and 3. | Calderwood & Harkness LLP (Alan Burke) | Kevin Ostrowski (C&H); Thomas Elridge (Skybridge) | 2026-02-05 | Final | 2025-12-08 | To be retained in Skybridge's GDPR compliance file; may be requested by Meridian or regulators. |
| 22 | Supplemental | Existing Skybridge–Osprey Cloud DPA (March 1, 2024) | Copy of the existing Data Processing Agreement between Skybridge Fintech Ltd. and Osprey Cloud Infrastructure, Inc. dated March 1, 2024 (includes Module 3 SCCs: processor-to-sub-processor). To be provided to Meridian for sub-processor due diligence. | Skybridge Fintech Ltd. (Thomas Elridge) | Marcus Tibaldi (Meridian VP TPRM) | 2026-02-10 | Received | 2024-03-01 | Executed March 1, 2024. Confirm no amendments since execution. |
| Prepared by: Priscilla Wynn, Calderwood & Harkness LLP | Matter No. 1009-00004 | Date: February 5, 2026 | Target Execution Date: February 15, 2026 |
| Organization | Full Legal Name | Role in Transaction | Contact Person | Title | Address |
| Skybridge Fintech Ltd. | Skybridge Fintech Ltd. | Processor (Client) | Nadia Karimova | CEO | 4100 Silverside Road, Suite 310, Wilmington, DE 19810 |
| Skybridge Fintech Ltd. | Skybridge Fintech Ltd. | Processor (Client) | Thomas Elridge | General Counsel / Chief Privacy Officer | 4100 Silverside Road, Suite 310, Wilmington, DE 19810 |
| Skybridge Fintech Ltd. | Skybridge Fintech Ltd. | Processor (Client) | Rebecca Muñoz | CISO | 4100 Silverside Road, Suite 310, Wilmington, DE 19810 |
| Skybridge Fintech Ltd. | Skybridge Fintech Ltd. | Processor (Client) | Sanjay Dhillon | VP of Engineering | 4100 Silverside Road, Suite 310, Wilmington, DE 19810 |
| Meridian Federal Savings Bank | Meridian Federal Savings Bank | Controller (Counterparty) | Lawrence C. Driscoll | CEO | 900 Broad Street, Suite 1200, Newark, NJ 07102 |
| Meridian Federal Savings Bank | Meridian Federal Savings Bank | Controller (Counterparty) | Vanessa Hartwell | General Counsel | 900 Broad Street, Suite 1200, Newark, NJ 07102 |
| Meridian Federal Savings Bank | Meridian Federal Savings Bank | Controller (Counterparty) | Andrea Sokolov | Chief Compliance Officer | 900 Broad Street, Suite 1200, Newark, NJ 07102 |
| Meridian Federal Savings Bank | Meridian Federal Savings Bank | Controller (Counterparty) | Marcus Tibaldi | VP, Third-Party Risk Management | 900 Broad Street, Suite 1200, Newark, NJ 07102 |
| Calderwood & Harkness LLP | Calderwood & Harkness LLP | Outside Counsel to Skybridge | Kevin Ostrowski | Responsible Partner, Privacy & Data Security | 1735 Market Street, Suite 2800, Philadelphia, PA 19103 |
| Calderwood & Harkness LLP | Calderwood & Harkness LLP | Outside Counsel to Skybridge | Priscilla Wynn | Lead Associate, Privacy & Data Security | 1735 Market Street, Suite 2800, Philadelphia, PA 19103 |
| Calderwood & Harkness LLP | Calderwood & Harkness LLP | Outside Counsel to Skybridge | Alan Burke | Working Associate, Privacy & Data Security | 1735 Market Street, Suite 2800, Philadelphia, PA 19103 |
| Blackwell, Raines & Stoddard LLP | Blackwell, Raines & Stoddard LLP | Outside Counsel to Meridian | Constance Liu | Partner, Financial Services / Data Privacy | 200 Park Avenue, 31st Floor, New York, NY 10166 |
| Blackwell, Raines & Stoddard LLP | Blackwell, Raines & Stoddard LLP | Outside Counsel to Meridian | Derek Faulkner | Associate | 200 Park Avenue, 31st Floor, New York, NY 10166 |
| Osprey Cloud Infrastructure, Inc. | Osprey Cloud Infrastructure, Inc. | Sub-processor (IaaS/PaaS) | Martin Cho | CEO | 2200 Campus Drive, San Jose, CA 95131 |
| Skybridge Fintech Europe B.V. | Skybridge Fintech Europe B.V. | EU Sub-processor (Affiliate) | Lena Vogt | Managing Director | Keizersgracht 482, 1017 EG Amsterdam, Netherlands |
| Bastion Mutual Insurance Company | Bastion Mutual Insurance Company | Cyber-Liability Insurance Carrier | — | — | 55 Farmington Avenue, Hartford, CT 06105 |
| Kestrel Risk Advisors LLC | Kestrel Risk Advisors LLC | Insurance Broker | — | — | 140 Broadway, 18th Floor, New York, NY 10005 |
| Graystone & Ketchum LLP | Graystone & Ketchum LLP | Independent Auditor (SOC 2 Type II) | Sandra Clearfield | Lead Partner, IT Audit | 300 Delaware Avenue, Suite 700, Wilmington, DE 19801 |
| Date | Milestone / Event | Status | Notes |
| 2025-11-20 | Calderwood & Harkness engagement opened; kickoff call with Thomas Elridge and Rebecca Muñoz | Completed | Matter No. 1009-00004 |
| 2025-11-25 | Receipt of Meridian's TPRM due-diligence questionnaire and BRS form DPA | Completed | Received from Blackwell, Raines & Stoddard LLP (Constance Liu) |
| 2025-12-05 | C&H first-draft redline of BRS form DPA and gap analysis memorandum delivered | Completed | Prepared by Priscilla Wynn and Alan Burke |
| 2025-12-12 | Skybridge counter-proposal DPA (clean draft) transmitted to BRS | Completed | Transmittal letter from Kevin Ostrowski to Constance Liu |
| 2025-12-20 | BRS returns markup of Skybridge counter-proposal | Completed |
| 2026-01-08 | Second redline exchange; key issues call (liability cap, indemnification, audit scope, sub-processor approval) | Completed | Call summary emailed by Priscilla Wynn to Thomas Elridge |
| 2026-01-15 | Third redline (near-final); SCC Annexes I–III finalized | Completed | NJ Data Privacy Act (S3377) expected effective date also January 15, 2026 |
| 2026-01-22 | Near-final DPA circulated for Meridian CCO and VP TPRM review | Completed | Circulated to Andrea Sokolov and Marcus Tibaldi |
| 2026-01-30 | Final issues list (4 open items); resolution call | Completed | Status update email from Kevin Ostrowski to Thomas Elridge and Nadia Karimova |
| 2026-02-05 | Execution-ready DPA/SCC package circulated | Completed | Transmittal letter from Kevin Ostrowski to Constance Liu |
| 2026-02-10 | Board / management sign-off (both Skybridge and Meridian) | Pending | Halcyon Ridge Capital Partners LP (Catherine Shin, board observer) to be notified |
| 2026-02-15 | Target signing date — DPA and SCC package executed concurrent with SaaS subscription agreement | Upcoming | ACV: $2.74M/yr; TCV: $13.7M (5-year term) |