1009-00004 · Skybridge Fintech Ltd · Closing

ongoing-compliance-obligations-memo.docx DOCUMENT Finance & Banking

8 / 35 ← → ✕

Contract analysis Extract to table

MEMORANDUM

CALDERWOOD & HARKNESS LLP 1735 Market Street, Suite 2800 Philadelphia, PA 19103

CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED

FROM: Alan Burke, Working Associate, Privacy & Data Security, Calderwood & Harkness LLP

TO: Thomas Elridge, General Counsel / Chief Privacy Officer, Skybridge Fintech Ltd.

DATE: February 12, 2026

RE: Ongoing Compliance Obligations and Key Dates Under Executed DPA/SCC Package — Skybridge Fintech Ltd. / Meridian Federal Savings Bank

MATTER NO.: 1009-00004

This memorandum is protected by the attorney-client privilege and the work product doctrine. It is intended solely for the use of the addressee and authorized recipients identified herein. Distribution, copying, or disclosure of this memorandum or its contents to any unauthorized person is strictly prohibited.

Recommended Distribution:

• Thomas Elridge, General Counsel / Chief Privacy Officer, Skybridge Fintech Ltd.

• Rebecca Muñoz, Chief Information Security Officer, Skybridge Fintech Ltd.

• Sanjay Dhillon, Vice President of Engineering, Skybridge Fintech Ltd.

• Lena Vogt, Managing Director, Skybridge Fintech Europe B.V.

I. Purpose and Scope

This memorandum identifies the ongoing compliance obligations and recurring deadlines arising from the Data Processing Agreement ("DPA") and Standard Contractual Clauses ("SCCs") package negotiated between Skybridge Fintech Ltd. ("Skybridge" or "Processor") and Meridian Federal Savings Bank ("Meridian" or "Controller"). The DPA/SCC package is targeted for execution on February 15, 2026, concurrent with the parties' five-year SaaS subscription agreement pursuant to which Skybridge will provide its SBF Core digital banking and payment processing platform to Meridian (annual contract value: $2.74 million; total contract value: $13.7 million over the initial five-year term).

The purpose of this memorandum is to serve as a practical compliance calendar and reference guide for Skybridge's legal, privacy, information security, and engineering teams. Each section below details a specific category of ongoing obligation, identifies the contractual or regulatory source of that obligation, sets forth the relevant deadlines and recurring periods, and provides concrete action items for the responsible Skybridge personnel. The memorandum is organized to allow each functional group — legal, security, engineering, and European operations — to readily identify those obligations for which it bears primary or supporting responsibility.

It should be noted that this memorandum also applies, with appropriate modifications, to future bank clients onboarded under Skybridge's standardized bank-grade DPA template, which was developed in close consultation with this firm and is substantially based on the Meridian DPA. To the extent that future bank clients negotiate materially different terms — particularly with respect to breach notification windows, audit rights, or sub-processor authorization mechanisms — this memorandum should be supplemented with client-specific addenda.

Copies of this memorandum are recommended for distribution to the following individuals, each of whom holds responsibilities relevant to one or more of the compliance obligations identified herein: Rebecca Muñoz (CISO), Sanjay Dhillon (VP of Engineering), and Lena Vogt (Managing Director, Skybridge Fintech Europe B.V., Amsterdam). Distribution should be made in accordance with Skybridge's internal document classification policy, and recipients should be advised of the privileged and confidential nature of this communication.

II. Summary of Key Compliance Dates and Deadlines

The following table provides a consolidated calendar of all key compliance dates and recurring deadlines arising under the DPA/SCC package and related regulatory requirements. Each item is cross-referenced to the relevant section of this memorandum, the applicable contractual provision, and the responsible Skybridge personnel. This table is intended to serve as a quick-reference resource and should be reviewed at least quarterly by the compliance stakeholders identified in Section XV below.

The sections that follow provide detailed analysis and action items for each obligation summarized above, as well as additional compliance requirements not susceptible to representation in a single calendar entry.

III. Cyber-Insurance Renewal — Bastion Mutual Insurance Company

Contractual Obligation. Section 11.2 of the DPA requires Skybridge to obtain and maintain throughout the term of the agreement (and for a period of twenty-four months following termination) a technology errors and omissions and cyber-liability insurance policy with per-occurrence coverage of no less than ten million dollars ($10,000,000). The DPA further requires Skybridge to provide Meridian with a certificate of insurance upon execution of the DPA and upon each renewal of the policy during the term.

Current Policy. Skybridge's current cyber-liability insurance policy is issued by Bastion Mutual Insurance Company under Policy No. CYB-2025-04821. The policy is a combined Technology Errors & Omissions and Cyber Liability policy, with per-occurrence limits of $10,000,000 and an aggregate limit of $20,000,000. The policy period runs from January 1, 2025, through December 31, 2025.

Status. As of the date of this memorandum, the current policy has expired. The policy period ended on December 31, 2025, and the renewal is currently in progress. Skybridge's insurance broker, Kestrel Risk Advisors LLC, located at 140 Broadway, 18th Floor, New York, NY 10005, is managing the renewal process. We understand from Thomas Elridge that Kestrel Risk Advisors has received preliminary renewal terms from Bastion Mutual and that execution of the renewal policy is expected imminently. However, as of this writing, the renewal has not been formally confirmed.

Action Items. The following steps should be taken promptly to ensure compliance with the DPA's insurance covenant:

1. Confirm Renewal Completion. Thomas Elridge should confirm with Kestrel Risk Advisors LLC that the renewal of Policy No. CYB-2025-04821 (or a successor policy number) has been completed and that the renewed policy is in full force and effect. Coverage limits must remain at or above $10,000,000 per occurrence and $20,000,000 in the aggregate, consistent with the DPA's requirements.

2. Obtain Updated Certificate of Insurance. Upon confirmation of renewal, Skybridge should promptly obtain an updated certificate of insurance naming Meridian Federal Savings Bank as an additional insured (or certificate holder, as applicable under the policy terms) and deliver the certificate to Meridian as a closing deliverable in connection with the DPA execution on February 15, 2026.

3. Ensure Continuous Coverage. Any gap in coverage between the expiration of the prior policy on December 31, 2025, and the effective date of the renewed policy would constitute a breach of Section 11.2 of the DPA. Thomas Elridge should confirm with Kestrel Risk Advisors that the renewal is backdated or otherwise structured to ensure continuous, uninterrupted coverage from January 1, 2026, forward.

4. Calendar Next Renewal. The next anticipated renewal date is December 31, 2026. This date should be calendared with at least ninety (90) days of advance lead time — i.e., no later than October 2, 2026 — to allow sufficient time for broker engagement, market review, and completion of the renewal process before the policy expiration date.

5. Material Changes. If the renewal results in any material changes to the policy — including a change in carrier, a reduction in coverage limits, the addition of exclusions relevant to the processing activities described in the DPA, or a change in deductible or self-insured retention — Thomas Elridge should assess whether notice to Meridian is required under the DPA and, if so, provide such notice promptly.

IV. SOC 2 Type II Audit Cycle — Graystone & Ketchum LLP

Contractual Obligation. DPA Schedule B, Section 3.2, and the audit rights provisions set forth in DPA Section 8 require Skybridge to maintain a current SOC 2 Type II report issued by an independent, nationally recognized auditing firm. The DPA further provides that Skybridge may satisfy Controller audit requests under DPA Section 8.1 by providing its current SOC 2 Type II report, together with supplemental questionnaire responses addressing any specific areas of inquiry raised by the Controller, in lieu of permitting an on-site audit. This mechanism is expressly conditioned on the SOC 2 Type II report being current — meaning that it covers an audit period that ended no more than twelve (12) months prior to the date of the Controller's audit request.

Current Report. Skybridge's most recent SOC 2 Type II report was issued by Graystone & Ketchum LLP, located at 300 Delaware Avenue, Suite 700, Wilmington, DE 19801, with Sandra Clearfield serving as the engagement lead partner. The report is dated September 15, 2025, and covers the audit period from October 1, 2024, through September 15, 2025. The report covers the Trust Services Criteria for Security, Availability, Confidentiality, and Processing Integrity, and includes a description of Skybridge's SBF Core platform and the controls relevant to the processing of financial institution customer data.

Next Audit Cycle. To maintain continuity and avoid any period during which the SOC 2 Type II report could be considered stale, Skybridge should engage Graystone & Ketchum LLP to commence the next audit period beginning no later than October 1, 2025 (or the day immediately following the end of the prior audit period, i.e., September 16, 2025). Based on the typical twelve-month audit cycle, the next report is expected to be issued in approximately September or October 2026.

Action Items. The following steps should be taken to ensure Skybridge maintains a current and credible SOC 2 Type II report:

1. Confirm Engagement. Rebecca Muñoz should confirm that Graystone & Ketchum LLP has been engaged for the new audit period and that the engagement letter reflects the appropriate scope — including, at a minimum, the Security, Availability, Confidentiality, and Processing Integrity criteria — and covers the SBF Core platform, all relevant integrations with Osprey Cloud Infrastructure, and the processing activities described in the DPA.

2. Remediation of Prior Findings. Rebecca Muñoz and Sanjay Dhillon should coordinate to ensure that any control deficiencies, exceptions, or remediation items identified in the September 15, 2025 report have been fully addressed before the commencement of the new audit period. Unresolved findings from the prior report that recur in the new report would significantly undermine the report's value as a substitute for on-site audits.

3. Closing Deliverable. The current SOC 2 Type II report (dated September 15, 2025) should be provided to Meridian upon execution of the DPA on February 15, 2026, as part of the closing deliverables package. The report should be transmitted under a separate non-disclosure acknowledgment consistent with AICPA guidance on restricted-use reports.

4. Proactive Sharing Upon Issuance. Upon issuance of the new SOC 2 Type II report (anticipated September–October 2026), Skybridge should proactively share the report with Meridian and with all other bank clients using the standardized DPA template. Proactive sharing reduces the likelihood that Controllers will exercise their contractual right to conduct on-site audits, which are significantly more disruptive and costly than report-based audit satisfaction.

5. Staleness Risk. Skybridge should carefully track the timing of the audit cycle to ensure that the SOC 2 Type II report does not become stale. If, at any point, the report is more than twelve months old and a Controller requests an audit, Skybridge's ability to rely on the report in lieu of an on-site audit may be compromised. In such a scenario, the Controller would be entitled under DPA Section 8.1 to conduct an on-site audit, subject to the advance notice and scheduling provisions of that section.

V. EU-US Data Privacy Framework Re-Certification

Contractual and Regulatory Context. Skybridge self-certified under the EU-US Data Privacy Framework ("DPF") as of July 1, 2025, and was assigned Certification ID DPF-2025-03912. While the Standard Contractual Clauses — specifically, Modules 2 (Controller-to-Processor) and 3 (Processor-to-Processor), governed by the law of the Netherlands per Clause 17 of the SCCs — serve as the primary lawful transfer mechanism for the personal data of approximately 3,200 Meridian EU-resident accountholders, the DPF certification serves as a supplementary safeguard. The DPF certification was expressly referenced in the Transfer Impact Assessment ("TIA") prepared in connection with the DPA/SCC package, and the TIA relied in part on the DPF as evidence that the legal framework in the United States provides adequate protections for EU personal data transferred under the SCCs.

Re-Certification Requirement. The DPF program requires participating organizations to annually re-certify their compliance with the DPF Principles. Skybridge's initial certification date was July 1, 2025, and accordingly, Skybridge's annual re-certification is due by approximately July 1, 2026, or such other specific deadline as may be established by the International Trade Administration within the U.S. Department of Commerce, which administers the DPF program.

Action Items. The following steps should be taken to ensure timely re-certification and ongoing DPF compliance:

1. Calendar Re-Certification Deadline. The annual re-certification deadline — July 1, 2026, or the specific deadline established by the DPF program — should be calendared with at least sixty (60) days of advance lead time to allow sufficient preparation and review.

2. Joint Review by Elridge and Vogt. Thomas Elridge and Lena Vogt (Managing Director, Skybridge Fintech Europe B.V., Keizersgracht 482, 1017 EG Amsterdam, Netherlands, KvK Registration No. 82104593) should jointly review Skybridge's DPF compliance ahead of the re-certification date. This review should encompass, at a minimum: (a) the adequacy and accuracy of Skybridge's publicly posted privacy policy as it pertains to DPF commitments; (b) the availability and functioning of Skybridge's independent dispute resolution mechanism for DPF-related complaints; (c) Skybridge's commitment to cooperate with and comply with the advice of EU data protection authorities ("DPAs") with respect to human resources data and, to the extent applicable, non-HR data; and (d) Skybridge's compliance with the DPF's onward transfer, data integrity, purpose limitation, access, recourse, and enforcement principles.

3. Monitor Legal Developments. Calderwood & Harkness LLP will continue to monitor developments regarding the legal validity of the EU-US Data Privacy Framework. As Thomas Elridge is aware, the DPF was adopted by the European Commission pursuant to Adequacy Decision C(2023) 4745 on July 10, 2023, and has been the subject of scrutiny by the European Parliament and civil society organizations. Any future legal challenge analogous to the Court of Justice of the European Union's decision in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, "Schrems II") could result in the invalidation of the DPF. In such a scenario, the SCCs would remain in place as the primary transfer mechanism, but the supplementary measures referenced in the TIA should be reassessed to determine whether they remain sufficient in the absence of DPF certification.

4. Recordkeeping. Skybridge should maintain comprehensive records of its DPF compliance, including copies of the initial certification, all re-certifications, the publicly posted privacy policy, and documentation of the dispute resolution mechanism. These records should be readily available for presentation to Meridian or to regulatory authorities — including the Federal Trade Commission, which has enforcement authority over DPF commitments — upon request.

VI. Sub-Processor List Update Obligations

Contractual Obligation. Under DPA Schedule C, Section 2, and SCC Annex III, Skybridge operates under a general written authorization from Meridian for the engagement of sub-processors to assist in the processing of personal data. This general authorization is subject to a critical procedural requirement: Skybridge must provide Meridian with at least thirty (30) days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor. During the thirty-day notice period, Meridian has the right to object to the proposed new or replacement sub-processor on reasonable grounds related to data protection. If Meridian objects and the parties are unable to resolve the objection through the mechanism set forth in DPA Schedule C, Section 3, either party may terminate the DPA with respect to the processing activities that would require the objected-to sub-processor.

Current Approved Sub-Processors. As of the finalization of SCC Annex III on January 15, 2026, Skybridge's approved sub-processor list includes the following two entities:

1. Osprey Cloud Infrastructure, Inc. — Provides Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) hosting for the SBF Core platform. Data center locations: US-East region (Ashburn, Virginia) and EU region (Frankfurt, Germany), with a disaster recovery secondary availability zone in US-East (Ashburn, Virginia). Headquarters: 2200 Campus Drive, San Jose, CA 95131. Chief Executive Officer: Martin Cho. Skybridge and Osprey Cloud are parties to a Data Processing Agreement dated March 1, 2024, which includes Module 3 (Processor-to-Processor) Standard Contractual Clauses and governs Osprey Cloud's processing of personal data on behalf of Skybridge.

2. Skybridge Fintech Europe B.V. — Skybridge's wholly owned European subsidiary, responsible for EU personal data processing activities, including support, development, and compliance functions for EU-resident data subjects. Registered office: Keizersgracht 482, 1017 EG Amsterdam, Netherlands. KvK Registration No. 82104593. Managing Director: Lena Vogt. Current headcount: 14 employees (8 engineers, 4 customer support, 2 compliance/legal). Skybridge Fintech Europe B.V. operates under an intra-group data processing agreement that incorporates Module 3 SCCs.

Action Items. The following steps should be taken to ensure ongoing compliance with the sub-processor authorization and notification requirements:

1. Internal Process for Sub-Processor Changes. Thomas Elridge (or a designee within the legal team) should establish a formal internal process for tracking any planned changes to the sub-processor list. This process should require that any Skybridge business unit or engineering team proposing to engage a new vendor or service provider that will process personal data on behalf of a Controller must submit the proposal to the legal team for review at least sixty (60) days in advance of the planned engagement date — allowing thirty days for internal review and diligence and thirty days for the required prior written notice to Meridian and all other bank clients using the standardized DPA template.

2. Contractual Flow-Down. For any new sub-processor, Skybridge must ensure that the sub-processing agreement contains contractual provisions that are no less protective than those set forth in the DPA, including with respect to data protection obligations, security measures, audit rights, breach notification timelines, and data return/deletion requirements. In addition, consistent with OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance), which requires banking organizations to ensure appropriate oversight of subcontractors of their third-party service providers, the sub-processing agreement should preserve Meridian's (and its regulators') right to access, audit, and examine the sub-processor.

3. Objection Resolution. If Meridian objects to a proposed new or replacement sub-processor during the thirty-day notice period, Skybridge should promptly engage with Meridian to understand the basis for the objection and attempt to resolve the issue through the DPA's objection resolution mechanism (DPA Schedule C, Section 3). This may involve providing additional information about the sub-processor's data protection practices, offering additional contractual protections, or proposing an alternative sub-processor. If the objection cannot be resolved, Skybridge should consult with Calderwood & Harkness LLP regarding the termination provisions that may apply.

4. Maintenance and Distribution. Skybridge should maintain an updated version of SCC Annex III and DPA Schedule C at all times and distribute the updated documents to all Controllers promptly upon any change to the sub-processor list. A master tracking spreadsheet of all Controller DPA versions and sub-processor notifications should be maintained by the legal team.

5. Osprey Cloud DPA Monitoring. The existing Skybridge–Osprey Cloud DPA, dated March 1, 2024, should be monitored for any upcoming renewal, amendment, or expiration. In addition, if Osprey Cloud makes any material changes to its data center locations, processing activities, or security posture, such changes may trigger the sub-processor update notice process and should be communicated to Meridian and all other Controllers.

VII. Data Breach Notification Readiness

Contractual Obligation. DPA Schedule D, Section 1, requires Skybridge to notify Meridian within forty-eight (48) hours of becoming aware of a Personal Data Breach (as defined in the DPA, consistent with Article 4(12) of the GDPR and applicable U.S. state breach notification laws). The notification must include all information reasonably available to Skybridge at the time, including: (a) the nature of the breach; (b) the categories and approximate number of data subjects affected; (c) the categories and approximate number of personal data records affected; (d) the likely consequences of the breach; and (e) the measures taken or proposed to be taken to address the breach, including measures to mitigate its potential adverse effects. The escalation matrix established under DPA Schedule D provides that the initial assessment and internal escalation flow proceeds as follows: CISO Rebecca Muñoz → General Counsel Thomas Elridge → Meridian Chief Compliance Officer Andrea Sokolov and VP Third-Party Risk Management Marcus Tibaldi.

Regulatory Context. The forty-eight-hour notification window in the DPA was negotiated with reference to Meridian's own regulatory obligations. Under the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53, effective April 1, 2022), Meridian is required to notify its primary federal regulator (the OCC) within thirty-six (36) hours of determining that a "notification incident" has occurred — i.e., a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, Meridian's ability to carry out banking operations, business lines, or activities, or that results in a material loss of revenue, profit, or franchise value. Skybridge's forty-eight-hour window is designed to provide Meridian with sufficient lead time to assess the incident and, if it constitutes a notification incident, to meet its own thirty-six-hour obligation to the OCC. In practice, this means that Skybridge's notification to Meridian should be made as promptly as possible within the forty-eight-hour window, and should not be delayed until the forty-eighth hour if the information is available sooner.

Action Items. The following steps should be taken to ensure Skybridge is prepared to meet its breach notification obligations:

1. Incident Response Plan. Skybridge should maintain and regularly update its written incident response plan, which should incorporate the DPA-specific notification procedures and escalation matrix. The plan should be tested at least annually through tabletop exercises and, ideally, through simulated breach scenarios.

2. Tabletop Exercises. Tabletop exercises should be conducted at least annually, with participation from Rebecca Muñoz, Thomas Elridge, and Sanjay Dhillon. These exercises should simulate realistic breach scenarios involving the SBF Core platform and should include practice runs of the notification procedures under DPA Schedule D, including preparation of the notification content and escalation to Meridian's Andrea Sokolov and Marcus Tibaldi.

3. Contact Information Maintenance. The escalation matrix contact information for Meridian personnel — specifically, Chief Compliance Officer Andrea Sokolov and VP Third-Party Risk Management Marcus Tibaldi — should be verified at least quarterly and updated immediately upon any change. Skybridge should request that Meridian provide prompt notice of any changes to these contacts.

4. Breach Notification Template. The breach notification template, which reflects the content requirements of DPA Schedule D, Section 1, should be readily accessible to the incident response team. The template should be stored in a location that will remain accessible even in the event of a system compromise — for example, in a secure offline repository or a separate cloud environment.

5. Insurance Coordination. In the event of a breach, Skybridge should promptly coordinate with Bastion Mutual Insurance Company to activate breach-response coverage under Policy No. CYB-2025-04821 (or its successor policy). The incident response plan should include the relevant Bastion Mutual claims contact information and the policy's notice-of-claim requirements.

6. GDPR Breach Notification. For breaches affecting the personal data of the approximately 3,200 EU-resident Meridian accountholders, Skybridge must ensure that parallel notification procedures are followed under GDPR Article 33 (notification to the supervisory authority) and, where applicable, Article 34 (notification to affected data subjects). The competent supervisory authority for Skybridge Fintech Europe B.V. is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). Notification under Article 33 must be made within seventy-two (72) hours of becoming aware of the breach. Lena Vogt should be the primary point of contact for coordinating with the Autoriteit Persoonsgegevens, in consultation with Thomas Elridge and Calderwood & Harkness LLP.

VIII. New Jersey Data Privacy Act (S3377) Compliance

Effective Date. The New Jersey Data Privacy Act, enacted as S3377, became effective on January 15, 2026. As of the date of this memorandum, the statute is in full force and effect, and compliance is required for all processing of the personal data of New Jersey residents.

Relevance to the Skybridge/Meridian Relationship. Meridian Federal Savings Bank is headquartered in Newark, New Jersey, and operates forty-seven (47) branches across New Jersey, New York, Pennsylvania, and Connecticut. Meridian's total customer base includes approximately 412,000 accountholders, a significant proportion of whom are New Jersey residents. As a processor handling the personal data of New Jersey-resident individuals — including Social Security numbers and behavioral biometric data that is classified as "sensitive data" under S3377 — Skybridge is subject to the processor-specific obligations established by the statute.

Key Processor Obligations Under S3377. The New Jersey Data Privacy Act imposes the following obligations on processors, each of which is relevant to Skybridge's processing activities under the DPA:

(a) Adherence to Controller Instructions. A processor must adhere to the instructions of the controller regarding the processing of personal data. The processor may not process personal data for any purpose other than those set forth in the contract between the processor and the controller. This obligation is consistent with DPA Section 3.1, which restricts Skybridge's processing to the purposes described in Schedule A.

(b) Assistance with Consumer Rights Requests. A processor must assist the controller in responding to consumer rights requests, including requests for access, correction, deletion, and data portability. The DPA addresses this obligation in Section 5, which requires Skybridge to provide reasonable assistance to Meridian in responding to data subject requests within the timeframes established by applicable law.

(c) Data Protection Assessments. The statute requires controllers to conduct data protection assessments for certain high-risk processing activities, including processing that involves sensitive data. Processors must cooperate with controllers in the preparation of such assessments. DPA Section 6 includes a provision requiring Skybridge to cooperate with Meridian in the preparation of data protection impact assessments.

(d) Technical and Organizational Measures. A processor must implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing. DPA Schedule B sets forth the specific security measures that Skybridge is required to maintain, including encryption, access controls, and monitoring.

Action Items. The following steps should be taken to ensure compliance with S3377:

1. Confirm DPA Sufficiency. Thomas Elridge should confirm that the executed DPA's provisions — including those addressing data protection impact assessment cooperation (Section 6), consumer rights request assistance (Section 5), and security measures (Schedule B) — satisfy the processor requirements of S3377. Based on our review, the DPA provisions are substantially aligned with S3377's requirements, but a final confirmation should be made upon execution.

2. Monitor Implementing Regulations. S3377 authorizes the New Jersey Division of Consumer Affairs to issue implementing regulations and guidance. As of the date of this memorandum, no such regulations have been issued. Thomas Elridge should monitor for any rulemaking activity and assess the impact on Skybridge's obligations.

3. Internal Policy Updates. Skybridge's internal privacy policies and procedures should be reviewed and updated to reflect S3377 obligations, including the handling of consumer rights requests from New Jersey residents and the classification of behavioral biometric data as sensitive data.

4. Coordination with Meridian. Thomas Elridge should coordinate with Meridian on any data protection assessment requirements that may be triggered by the processing of New Jersey-resident data through the SBF Core platform, particularly in connection with processing activities involving sensitive data (such as behavioral biometric authentication data used in the anti-fraud analytics module).

IX. Annual Penetration Testing

Contractual Obligation. DPA Schedule B, Section 3.4, requires Skybridge to conduct annual penetration testing of the SBF Core platform by an independent, qualified third-party security firm. The results of the penetration test, including a summary of findings and remediation actions, must be made available to Meridian upon reasonable request, consistent with the audit rights provisions of DPA Section 8.

Current Provider. Skybridge's current penetration testing provider is Ironvault Security Group LLC, located at 11710 Plaza America Drive, Suite 400, Reston, VA 20190. Ironvault is a recognized provider of offensive security testing services with experience in the financial services sector and has performed penetration testing for Skybridge in prior years.

Action Items. The following steps should be taken to ensure ongoing compliance with the penetration testing requirement:

1. Calendar Annual Test. The annual penetration test should be calendared by Rebecca Muñoz, with scheduling coordinated between Skybridge's security team and Ironvault Security Group LLC. The test should be scheduled to align with the SOC 2 Type II audit cycle to the extent practicable, so that the most recent penetration test results can be incorporated into the SOC 2 report.

2. Test Scope. The scope of the penetration test must cover the SBF Core platform in its entirety, including: (a) the payment processing module; (b) the anti-fraud analytics module; (c) the regulatory reporting module; (d) all application programming interfaces (APIs) and integrations with Osprey Cloud Infrastructure (including both the US-East and EU data center regions); (e) administrative access controls, including multi-factor authentication mechanisms; and (f) any customer-facing web and mobile interfaces.

3. Remediation. Any vulnerabilities or findings identified during the penetration test must be remediated within the timelines agreed upon between Skybridge and Ironvault, prioritized by severity level. Critical and high-severity findings should be addressed within thirty (30) days; medium-severity findings within sixty (60) days; and low-severity findings within ninety (90) days or the next scheduled maintenance window.

4. Reporting to Controllers. Penetration test summary reports (redacted to remove specific exploit details that could create security risks if disclosed) should be made available to Meridian and other bank clients upon reasonable request, consistent with the DPA's audit rights provisions. Rebecca Muñoz should maintain a standard redacted summary format suitable for Controller distribution.

5. OCC Bulletin 2023-17 Considerations. Skybridge should consider whether Meridian's Third-Party Risk Management program, which is aligned with OCC Bulletin 2023-17, imposes any specific penetration testing scope, methodology, or reporting requirements beyond those established in the DPA. If Meridian's TPRM program requires specific testing standards (e.g., OWASP, PTES, or NIST SP 800-115), Rebecca Muñoz should coordinate with Ironvault to ensure compliance.

X. Audit Rights Preparedness

Contractual Obligation. Under DPA Section 8, Meridian (as Controller) or its regulators — including the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the Consumer Financial Protection Bureau (CFPB) — may audit Skybridge's processing activities with thirty (30) days' advance written notice. The audit right may be exercised no more than once per twelve-month period, unless triggered by a Personal Data Breach or a specific regulatory inquiry, in which case additional audits may be conducted as reasonably necessary. Audits are conducted at the Controller's expense.

Primary Audit Satisfaction Mechanism. DPA Section 8.2 provides that Skybridge may satisfy a Controller's audit request by providing its current SOC 2 Type II report (issued by Graystone & Ketchum LLP, as described in Section IV above) together with written responses to any supplemental questionnaire submitted by the Controller. This mechanism is intended to minimize the operational disruption associated with on-site audits while still providing the Controller with meaningful assurance regarding Skybridge's compliance with the DPA's security and data protection requirements. However, the Controller retains the right to conduct an on-site audit if the SOC 2 report is not current, if the supplemental questionnaire responses are insufficient, or if the audit is triggered by a breach or regulatory inquiry.

Regulator Access. Consistent with OCC Bulletin 2023-17, which requires that a banking organization's contracts with critical third-party service providers preserve the bank's regulators' rights to examine the third party, DPA Section 8.4 expressly preserves the OCC's, FDIC's, and CFPB's rights to access Skybridge's facilities, systems, records, and personnel as necessary to examine Skybridge's compliance with applicable laws and regulations. This right is not subject to the once-per-twelve-month limitation or the advance notice requirements applicable to Controller audits.

Action Items. The following steps should be taken to ensure Skybridge is prepared for audit requests:

1. Standing Audit Readiness File. Rebecca Muñoz should maintain a standing audit readiness file containing the following documents, updated on a rolling basis: (a) the current SOC 2 Type II report; (b) the most recent penetration test summary report; (c) the current certificate of cyber-liability insurance; (d) the current sub-processor list (SCC Annex III / DPA Schedule C); (e) the data processing description (DPA Schedule A); (f) documentation of the security measures implemented pursuant to DPA Schedule B and SCC Annex II; and (g) the most recent Transfer Impact Assessment.

2. Designated Audit Contacts. Rebecca Muñoz is designated as the primary point of contact for audit requests, with Thomas Elridge serving as the secondary contact. All audit requests should be routed to Rebecca Muñoz upon receipt and acknowledged within five (5) business days.

3. On-Site Audit Coordination. If an on-site audit is requested — for example, following a data breach or in connection with a regulatory examination — Rebecca Muñoz should coordinate the logistics of the audit with Meridian's VP Third-Party Risk Management Marcus Tibaldi. On-site audits should be conducted at mutually agreed times during normal business hours, and Skybridge should designate appropriate personnel to accompany the auditors and respond to information requests.

4. Twelve-Month Audit Window. The twelve-month limitation on routine Controller audits should be tracked to ensure that Skybridge does not inadvertently consent to more than one routine audit per twelve-month period. If Meridian requests an audit within twelve months of a prior audit, Skybridge should confirm whether the request is triggered by a breach or regulatory inquiry (which would be exempt from the limitation) and, if not, politely decline and propose scheduling the audit after the expiration of the twelve-month period.

5. Pooled Audits for Multiple Controllers. As Skybridge onboards additional bank clients under the standardized DPA template, multiple Controllers may request audits during overlapping or closely spaced periods. To reduce operational disruption, Skybridge should consider proposing pooled or consolidated audit arrangements — for example, a single annual audit conducted by an independent third party on behalf of multiple Controllers — consistent with the DPA terms and subject to each Controller's agreement.

XI. Post-Termination Data Retention and Deletion

Contractual Obligation. DPA Section 9.3, in conjunction with SCC Clause 8.5, provides that upon the termination or expiration of the SaaS subscription agreement, Skybridge must retain all personal data processed under the DPA for a period of ninety (90) days solely for the purpose of returning the data to Meridian in a standard, machine-readable format or securely deleting it, at Meridian's election. Following the expiration of the ninety-day period, Skybridge must certify the deletion of all personal data, unless retention is required by applicable law.

Current Contract Term. The SaaS subscription agreement between Skybridge and Meridian has a five-year initial term, with an anticipated execution date of February 15, 2026, and an anticipated expiration date of approximately February 15, 2031. The agreement may be terminated earlier pursuant to its termination provisions, and it may also be renewed for additional terms by mutual agreement.

Action Items. Although the post-termination data handling obligations will not be triggered for several years under the current contract term, Skybridge should take the following preparatory steps now to ensure it will be able to comply when the time comes:

1. Data Return and Deletion Procedures. Sanjay Dhillon should establish — and document — internal procedures and technical capabilities for: (a) the return of all personal data to Meridian in a standard, machine-readable format (e.g., CSV, JSON, or XML, as specified by Meridian at the time of termination); and (b) the certified deletion of all personal data, including data stored in backup systems, logs, and archival storage, using methods consistent with NIST SP 800-88 (Guidelines for Media Sanitization) or equivalent standards.

2. Sub-Processor Coordination. Skybridge must ensure that its sub-processors — Osprey Cloud Infrastructure, Inc. and Skybridge Fintech Europe B.V. — have parallel data return and deletion obligations under their respective data processing agreements and sub-processing agreements. Sanjay Dhillon should confirm that the Skybridge–Osprey Cloud DPA (dated March 1, 2024) and the SBF Europe intra-group DPA both include provisions requiring data return and/or certified deletion within the same ninety-day window or a shorter period.

3. Legal Hold and Regulatory Retention Carve-Outs. Thomas Elridge should identify any legal hold obligations or regulatory data retention requirements — including those arising under the Gramm-Leach-Bliley Act (GLBA), the Bank Secrecy Act / Anti-Money Laundering (BSA/AML) regulations, or other applicable federal or state financial regulations — that may require Skybridge to retain certain categories of personal data beyond the ninety-day post-termination window. Any such retention must be limited to the minimum data necessary to comply with the applicable requirement, and Meridian must be notified of the retention and its legal basis, consistent with DPA Section 9.3(b).

4. Calendar Contract Expiration. The anticipated contract expiration date (February 15, 2031) and the ninety-day post-termination window (expiring approximately May 16, 2031) should be calendared with at least one hundred eighty (180) days of advance notice to allow sufficient time for planning and coordination. This calendar entry should be updated if the contract is terminated early or renewed.

XII. Encryption and Security Standards Maintenance

Contractual Obligation. DPA Schedule B and SCC Annex II set forth the specific technical and organizational security measures that Skybridge is required to implement and maintain throughout the term of the DPA. These measures include, without limitation:

(a) Encryption at Rest: All personal data stored within the SBF Core platform must be encrypted using the Advanced Encryption Standard with 256-bit key length (AES-256) or an equivalent or stronger encryption algorithm.

(b) Encryption in Transit: All personal data transmitted between Skybridge systems, between Skybridge and Meridian, and between Skybridge and its sub-processors must be encrypted using Transport Layer Security version 1.2 or later (TLS 1.2+).

(c) Multi-Factor Authentication (MFA): All administrative and privileged access to the SBF Core platform, including access by Skybridge personnel, must require multi-factor authentication.

Action Items. The following steps should be taken to ensure ongoing compliance with the DPA's encryption and security standards:

1. Ongoing Monitoring and Currency. Rebecca Muñoz and Sanjay Dhillon should continuously monitor industry developments, NIST guidance, and applicable regulatory standards to ensure that the encryption standards specified in the DPA remain current and adequate. Given the five-year term of the SaaS subscription agreement (through approximately February 2031), it is possible that advances in cryptography — including, potentially, the emergence of practical quantum computing capabilities — may necessitate a transition to post-quantum cryptographic algorithms during the contract term. If the National Institute of Standards and Technology (NIST) finalizes post-quantum cryptographic standards and recommends transition timelines that fall within the contract term, Skybridge should develop and implement a transition plan.

2. Notice to Controller. If any changes to encryption protocols, key management practices, or other security standards specified in DPA Schedule B or SCC Annex II are implemented — whether in response to regulatory changes, industry developments, or security incidents — Thomas Elridge should assess whether notice to Meridian is required under the DPA and whether Schedule B and/or SCC Annex II require formal amendment. Any reduction in security posture (e.g., a temporary downgrade of encryption protocols during a migration) should be treated as a material change requiring advance notice and Controller consent.

3. Sub-Processor Security Alignment. Skybridge must ensure that Osprey Cloud Infrastructure, Inc. maintains equivalent or stronger security measures at its US-East data center region (Ashburn, Virginia), its EU data center region (Frankfurt, Germany), and its disaster recovery secondary availability zone (Ashburn, Virginia). Rebecca Muñoz should periodically verify Osprey Cloud's security posture through review of Osprey Cloud's SOC 2 Type II report and direct engagement with Osprey Cloud's security team.

XIII. CCPA/CPRA Obligations

Regulatory Context. The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), applies to the processing of personal information of California residents. Meridian Federal Savings Bank serves accountholders who may be California residents, and Skybridge processes the personal information of those individuals in its capacity as a "service provider" under the CCPA/CPRA.

Contractual Framework. The DPA includes service-provider provisions consistent with CCPA/CPRA requirements, including restrictions on Skybridge's use, retention, and disclosure of personal information processed on behalf of Meridian. Specifically, the DPA restricts Skybridge from "selling" or "sharing" (as those terms are defined under the CCPA/CPRA) any personal information received from Meridian, and requires Skybridge to assist Meridian in responding to consumer rights requests — including requests to know, requests to delete, requests to correct, and requests to opt out of the sale or sharing of personal information.

Action Items. The following steps should be taken to ensure ongoing CCPA/CPRA compliance:

1. DPA Sufficiency. Thomas Elridge should confirm that the DPA's service-provider provisions satisfy the current requirements of the CCPA/CPRA, including the service provider contract requirements set forth in California Civil Code § 1798.100(d) and the implementing regulations promulgated by the California Privacy Protection Agency ("CPPA").

2. Regulatory Monitoring. The CPPA continues to engage in active rulemaking, including with respect to automated decision-making technology, cybersecurity audits, and risk assessments. Thomas Elridge should monitor for any regulatory updates that may impose additional obligations on service providers and assess their impact on Skybridge's compliance posture.

3. Consumer Rights Coordination. Skybridge should coordinate with Meridian on any California-specific consumer rights requests received by either party. The DPA establishes a workflow for the processing of such requests, and Skybridge should ensure that its systems and processes are capable of fulfilling requests within the statutory timelines.

XIV. Ongoing Monitoring of Regulatory Developments

In addition to the specific regulatory obligations addressed in the preceding sections, Skybridge should maintain an ongoing monitoring program to track legislative, regulatory, and judicial developments that may affect its compliance obligations under the DPA/SCC package and related agreements. The following areas warrant particular attention:

1. Federal Banking Regulatory Guidance. Monitor for changes to OCC guidance (including any updates or supplements to OCC Bulletin 2023-17), FDIC rules, and CFPB regulations affecting third-party risk management, data security, and information technology for bank service providers. Changes in federal banking regulatory expectations may necessitate amendments to the DPA or to Skybridge's operational practices.

2. GDPR Enforcement and EU Regulatory Developments. Track developments in GDPR enforcement activity, including decisions by EU supervisory authorities and the Court of Justice of the European Union that may affect the legal framework for EU–US data transfers. In particular, monitor for: (a) any new adequacy decisions or revisions to existing adequacy decisions; (b) any revisions to the Standard Contractual Clauses adopted by the European Commission; and (c) any legal challenges to the EU-US Data Privacy Framework that could affect the validity of the DPF as a supplementary transfer mechanism.

3. State Privacy Legislation. Monitor state privacy legislation in the states where Meridian operates branches — specifically, New Jersey, New York, Pennsylvania, and Connecticut — for any new privacy statutes or amendments to existing statutes that impose processor obligations. As of the date of this memorandum, the New York Privacy Act and comprehensive privacy legislation in Pennsylvania and Connecticut are in various stages of legislative consideration, and any enactment may create additional compliance obligations for Skybridge.

4. Transfer Impact Assessment Reassessment. If there are material changes in U.S. surveillance law (including Section 702 of the Foreign intelligence Surveillance Act, which is currently authorized through April 2026), EU case law, or regulatory guidance affecting the adequacy of protections for EU–US data transfers, Skybridge should reassess the Transfer Impact Assessment prepared in connection with the DPA/SCC package and determine whether supplementary measures should be added or modified.

Calderwood & Harkness LLP will continue to monitor these developments and provide updates to Skybridge as part of its ongoing advisory engagement.

XV. Summary of Responsible Parties

The following table summarizes the primary and secondary responsible persons for each category of compliance obligation identified in this memorandum:

Each responsible person should familiarize themselves with the applicable sections of this memorandum and the underlying DPA provisions, and should ensure that the action items identified in their respective sections are incorporated into their team's operational workflows and compliance calendars.

XVI. Recommendation

Based on the foregoing analysis, we recommend that Skybridge establish a recurring quarterly compliance review meeting involving Thomas Elridge, Rebecca Muñoz, Sanjay Dhillon, and Lena Vogt (the latter participating remotely from Amsterdam as needed). The purpose of these quarterly meetings should be to:

(a) review all obligations identified in this memorandum and confirm that action items are on track;

(b) identify any upcoming deadlines within the next quarter and assign responsibility for timely completion;

(d) discuss any audit requests, breach incidents, or sub-processor changes that have occurred during the prior quarter; and

(e) update this memorandum as necessary to reflect new developments.

Calderwood & Harkness LLP remains available to advise Skybridge on any compliance questions arising under the DPA/SCC package, including interpretation of specific provisions, responses to audit or regulatory inquiries, breach notification procedures, and amendments to the DPA. For questions regarding this memorandum or the underlying engagement, please contact:

Kevin Ostrowski, Partner (Responsible Partner) Calderwood & Harkness LLP 1735 Market Street, Suite 2800 Philadelphia, PA 19103

Priscilla Wynn, Lead Associate Calderwood & Harkness LLP 1735 Market Street, Suite 2800 Philadelphia, PA 19103

This memorandum should be updated upon execution of the DPA on February 15, 2026, to confirm the execution date and incorporate any final changes to the DPA terms. Thereafter, this memorandum should be reviewed and updated on at least an annual basis, or more frequently upon any material change in applicable law, Skybridge's processing activities, sub-processor arrangements, or the DPA terms.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Alan Burke Working Associate, Privacy & Data Security Matter No. 1009-00004

This memorandum is intended to provide general guidance based on the facts and circumstances known to us as of the date hereof. It does not constitute a guarantee of any particular outcome and should not be relied upon as a substitute for specific legal advice with respect to any particular situation. The analysis herein is limited to the matters expressly addressed and does not purport to address every potential compliance obligation that may arise under the DPA/SCC package or applicable law.

Date / Recurring Period	Obligation	Responsible Person(s)	Reference
January 15, 2026	NJ Data Privacy Act (S3377) effective date — compliance required as of this date for all processing of NJ-resident personal data	Thomas Elridge, Rebecca Muñoz	DPA § 4.1(h); NJ S3377 § 14
February 15, 2026	DPA/SCC execution date; commencement of all obligations under the DPA, SCC Modules 2 and 3, and all Schedules and Annexes	Thomas Elridge	DPA § 2.1; SCC Modules 2 & 3
Ongoing (30-day prior written notice)	Sub-processor list updates — prior written notice to Meridian and all Controllers before engaging any new sub-processor or replacing an existing one	Thomas Elridge	DPA Schedule C § 2; SCC Annex III
Ongoing (within 48 hours of awareness)	Personal Data Breach notification to Controller, including all information reasonably available per DPA Schedule D content requirements	Rebecca Muñoz, Thomas Elridge	DPA Schedule D § 1
Ongoing (annually)	Penetration testing of SBF Core platform by Ironvault Security Group LLC, an independent third-party firm	Rebecca Muñoz	DPA Schedule B § 3.4
Ongoing (annually, no more than once per 12-month period)	Audit right — maintain readiness for Controller and/or regulator audits; maintain SOC 2 Type II readiness and standing audit file	Rebecca Muñoz, Thomas Elridge	DPA § 8; SCC Clause 8.9
By renewal date (current policy expired December 31, 2025; renewal in progress)	Bastion Mutual Insurance Company cyber-insurance renewal — Policy No. CYB-2025-04821; minimum $10M per occurrence coverage required	Thomas Elridge; Kestrel Risk Advisors LLC (broker)	DPA § 11.2
Next cycle following September 15, 2025 report	SOC 2 Type II audit cycle — engage Graystone & Ketchum LLP for audit period commencing no later than October 1, 2025; report anticipated September–October 2026	Rebecca Muñoz	DPA Schedule B § 3.2; DPA § 8.2
Annually (initial certification July 1, 2025; next re-certification due approximately July 1, 2026)	EU-US Data Privacy Framework re-certification — Certification ID: DPF-2025-03912	Thomas Elridge, Lena Vogt	SCC supplementary measures § 2; DPF program requirements
90 days post-termination (anticipated contract expiration: approximately February 15, 2031)	Data return and/or certified deletion obligation; data retained only for return/deletion purposes during this window	Sanjay Dhillon, Rebecca Muñoz	DPA § 9.3; SCC Clause 8.5
Obligation Category	Primary Responsible Person	Secondary / Support
Cyber-insurance renewal (Section III)	Thomas Elridge	Kestrel Risk Advisors LLC
SOC 2 Type II audit cycle (Section IV)	Rebecca Muñoz	Graystone & Ketchum LLP (Sandra Clearfield)
DPF re-certification (Section V)	Thomas Elridge	Lena Vogt (SBF Europe)
Sub-processor list updates (Section VI)	Thomas Elridge	Rebecca Muñoz
Breach notification readiness (Section VII)	Rebecca Muñoz	Thomas Elridge; escalation to Meridian (Andrea Sokolov, Marcus Tibaldi)
NJ S3377 compliance (Section VIII)	Thomas Elridge	Rebecca Muñoz
Annual penetration testing (Section IX)	Rebecca Muñoz	Ironvault Security Group LLC
Audit readiness (Section X)	Rebecca Muñoz	Thomas Elridge
Post-termination data handling (Section XI)	Sanjay Dhillon	Rebecca Muñoz
Encryption / security maintenance (Section XII)	Rebecca Muñoz	Sanjay Dhillon
CCPA/CPRA compliance (Section XIII)	Thomas Elridge	Rebecca Muñoz
Regulatory monitoring (Section XIV)	Thomas Elridge	Calderwood & Harkness LLP (ongoing advisory as needed)

MEMORANDUM
CALDERWOOD & HARKNESS LLP 1735 Market Street, Suite 2800 Philadelphia, PA 19103
CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED
FROM: Alan Burke, Working Associate, Privacy & Data Security, Calderwood & Harkness LLP
TO: Thomas Elridge, General Counsel / Chief Privacy Officer, Skybridge Fintech Ltd.
DATE: February 12, 2026
RE: Ongoing Compliance Obligations and Key Dates Under Executed DPA/SCC Package — Skybridge Fintech Ltd. / Meridian Federal Savings Bank
MATTER NO.: 1009-00004
This memorandum is protected by the attorney-client privilege and the work product doctrine. It is intended solely for the use of the addressee and authorized recipients identified herein. Distribution, copying, or disclosure of this memorandum or its contents to any unauthorized person is strictly prohibited.
Recommended Distribution:
• Thomas Elridge, General Counsel / Chief Privacy Officer, Skybridge Fintech Ltd.
• Rebecca Muñoz, Chief Information Security Officer, Skybridge Fintech Ltd.
• Sanjay Dhillon, Vice President of Engineering, Skybridge Fintech Ltd.
• Lena Vogt, Managing Director, Skybridge Fintech Europe B.V.
I. Purpose and Scope
This memorandum identifies the ongoing compliance obligations and recurring deadlines arising from the Data Processing Agreement ("DPA") and Standard Contractual Clauses ("SCCs") package negotiated between Skybridge Fintech Ltd. ("Skybridge" or "Processor") and Meridian Federal Savings Bank ("Meridian" or "Controller"). The DPA/SCC package is targeted for execution on February 15, 2026, concurrent with the parties' five-year SaaS subscription agreement pursuant to which Skybridge will provide its SBF Core digital banking and payment processing platform to Meridian (annual contract value: $2.74 million; total contract value: $13.7 million over the initial five-year term).
The purpose of this memorandum is to serve as a practical compliance calendar and reference guide for Skybridge's legal, privacy, information security, and engineering teams. Each section below details a specific category of ongoing obligation, identifies the contractual or regulatory source of that obligation, sets forth the relevant deadlines and recurring periods, and provides concrete action items for the responsible Skybridge personnel. The memorandum is organized to allow each functional group — legal, security, engineering, and European operations — to readily identify those obligations for which it bears primary or supporting responsibility.
It should be noted that this memorandum also applies, with appropriate modifications, to future bank clients onboarded under Skybridge's standardized bank-grade DPA template, which was developed in close consultation with this firm and is substantially based on the Meridian DPA. To the extent that future bank clients negotiate materially different terms — particularly with respect to breach notification windows, audit rights, or sub-processor authorization mechanisms — this memorandum should be supplemented with client-specific addenda.
Copies of this memorandum are recommended for distribution to the following individuals, each of whom holds responsibilities relevant to one or more of the compliance obligations identified herein: Rebecca Muñoz (CISO), Sanjay Dhillon (VP of Engineering), and Lena Vogt (Managing Director, Skybridge Fintech Europe B.V., Amsterdam). Distribution should be made in accordance with Skybridge's internal document classification policy, and recipients should be advised of the privileged and confidential nature of this communication.
II. Summary of Key Compliance Dates and Deadlines
The following table provides a consolidated calendar of all key compliance dates and recurring deadlines arising under the DPA/SCC package and related regulatory requirements. Each item is cross-referenced to the relevant section of this memorandum, the applicable contractual provision, and the responsible Skybridge personnel. This table is intended to serve as a quick-reference resource and should be reviewed at least quarterly by the compliance stakeholders identified in Section XV below.
The sections that follow provide detailed analysis and action items for each obligation summarized above, as well as additional compliance requirements not susceptible to representation in a single calendar entry.
III. Cyber-Insurance Renewal — Bastion Mutual Insurance Company
Contractual Obligation. Section 11.2 of the DPA requires Skybridge to obtain and maintain throughout the term of the agreement (and for a period of twenty-four months following termination) a technology errors and omissions and cyber-liability insurance policy with per-occurrence coverage of no less than ten million dollars ($10,000,000). The DPA further requires Skybridge to provide Meridian with a certificate of insurance upon execution of the DPA and upon each renewal of the policy during the term.
Current Policy. Skybridge's current cyber-liability insurance policy is issued by Bastion Mutual Insurance Company under Policy No. CYB-2025-04821. The policy is a combined Technology Errors & Omissions and Cyber Liability policy, with per-occurrence limits of $10,000,000 and an aggregate limit of $20,000,000. The policy period runs from January 1, 2025, through December 31, 2025.
Status. As of the date of this memorandum, the current policy has expired. The policy period ended on December 31, 2025, and the renewal is currently in progress. Skybridge's insurance broker, Kestrel Risk Advisors LLC, located at 140 Broadway, 18th Floor, New York, NY 10005, is managing the renewal process. We understand from Thomas Elridge that Kestrel Risk Advisors has received preliminary renewal terms from Bastion Mutual and that execution of the renewal policy is expected imminently. However, as of this writing, the renewal has not been formally confirmed.
Action Items. The following steps should be taken promptly to ensure compliance with the DPA's insurance covenant:
1. Confirm Renewal Completion. Thomas Elridge should confirm with Kestrel Risk Advisors LLC that the renewal of Policy No. CYB-2025-04821 (or a successor policy number) has been completed and that the renewed policy is in full force and effect. Coverage limits must remain at or above $10,000,000 per occurrence and $20,000,000 in the aggregate, consistent with the DPA's requirements.
2. Obtain Updated Certificate of Insurance. Upon confirmation of renewal, Skybridge should promptly obtain an updated certificate of insurance naming Meridian Federal Savings Bank as an additional insured (or certificate holder, as applicable under the policy terms) and deliver the certificate to Meridian as a closing deliverable in connection with the DPA execution on February 15, 2026.
3. Ensure Continuous Coverage. Any gap in coverage between the expiration of the prior policy on December 31, 2025, and the effective date of the renewed policy would constitute a breach of Section 11.2 of the DPA. Thomas Elridge should confirm with Kestrel Risk Advisors that the renewal is backdated or otherwise structured to ensure continuous, uninterrupted coverage from January 1, 2026, forward.
4. Calendar Next Renewal. The next anticipated renewal date is December 31, 2026. This date should be calendared with at least ninety (90) days of advance lead time — i.e., no later than October 2, 2026 — to allow sufficient time for broker engagement, market review, and completion of the renewal process before the policy expiration date.
5. Material Changes. If the renewal results in any material changes to the policy — including a change in carrier, a reduction in coverage limits, the addition of exclusions relevant to the processing activities described in the DPA, or a change in deductible or self-insured retention — Thomas Elridge should assess whether notice to Meridian is required under the DPA and, if so, provide such notice promptly.
IV. SOC 2 Type II Audit Cycle — Graystone & Ketchum LLP
Contractual Obligation. DPA Schedule B, Section 3.2, and the audit rights provisions set forth in DPA Section 8 require Skybridge to maintain a current SOC 2 Type II report issued by an independent, nationally recognized auditing firm. The DPA further provides that Skybridge may satisfy Controller audit requests under DPA Section 8.1 by providing its current SOC 2 Type II report, together with supplemental questionnaire responses addressing any specific areas of inquiry raised by the Controller, in lieu of permitting an on-site audit. This mechanism is expressly conditioned on the SOC 2 Type II report being current — meaning that it covers an audit period that ended no more than twelve (12) months prior to the date of the Controller's audit request.
Current Report. Skybridge's most recent SOC 2 Type II report was issued by Graystone & Ketchum LLP, located at 300 Delaware Avenue, Suite 700, Wilmington, DE 19801, with Sandra Clearfield serving as the engagement lead partner. The report is dated September 15, 2025, and covers the audit period from October 1, 2024, through September 15, 2025. The report covers the Trust Services Criteria for Security, Availability, Confidentiality, and Processing Integrity, and includes a description of Skybridge's SBF Core platform and the controls relevant to the processing of financial institution customer data.
Next Audit Cycle. To maintain continuity and avoid any period during which the SOC 2 Type II report could be considered stale, Skybridge should engage Graystone & Ketchum LLP to commence the next audit period beginning no later than October 1, 2025 (or the day immediately following the end of the prior audit period, i.e., September 16, 2025). Based on the typical twelve-month audit cycle, the next report is expected to be issued in approximately September or October 2026.
Action Items. The following steps should be taken to ensure Skybridge maintains a current and credible SOC 2 Type II report:
1. Confirm Engagement. Rebecca Muñoz should confirm that Graystone & Ketchum LLP has been engaged for the new audit period and that the engagement letter reflects the appropriate scope — including, at a minimum, the Security, Availability, Confidentiality, and Processing Integrity criteria — and covers the SBF Core platform, all relevant integrations with Osprey Cloud Infrastructure, and the processing activities described in the DPA.
2. Remediation of Prior Findings. Rebecca Muñoz and Sanjay Dhillon should coordinate to ensure that any control deficiencies, exceptions, or remediation items identified in the September 15, 2025 report have been fully addressed before the commencement of the new audit period. Unresolved findings from the prior report that recur in the new report would significantly undermine the report's value as a substitute for on-site audits.
3. Closing Deliverable. The current SOC 2 Type II report (dated September 15, 2025) should be provided to Meridian upon execution of the DPA on February 15, 2026, as part of the closing deliverables package. The report should be transmitted under a separate non-disclosure acknowledgment consistent with AICPA guidance on restricted-use reports.
4. Proactive Sharing Upon Issuance. Upon issuance of the new SOC 2 Type II report (anticipated September–October 2026), Skybridge should proactively share the report with Meridian and with all other bank clients using the standardized DPA template. Proactive sharing reduces the likelihood that Controllers will exercise their contractual right to conduct on-site audits, which are significantly more disruptive and costly than report-based audit satisfaction.
5. Staleness Risk. Skybridge should carefully track the timing of the audit cycle to ensure that the SOC 2 Type II report does not become stale. If, at any point, the report is more than twelve months old and a Controller requests an audit, Skybridge's ability to rely on the report in lieu of an on-site audit may be compromised. In such a scenario, the Controller would be entitled under DPA Section 8.1 to conduct an on-site audit, subject to the advance notice and scheduling provisions of that section.
V. EU-US Data Privacy Framework Re-Certification
Contractual and Regulatory Context. Skybridge self-certified under the EU-US Data Privacy Framework ("DPF") as of July 1, 2025, and was assigned Certification ID DPF-2025-03912. While the Standard Contractual Clauses — specifically, Modules 2 (Controller-to-Processor) and 3 (Processor-to-Processor), governed by the law of the Netherlands per Clause 17 of the SCCs — serve as the primary lawful transfer mechanism for the personal data of approximately 3,200 Meridian EU-resident accountholders, the DPF certification serves as a supplementary safeguard. The DPF certification was expressly referenced in the Transfer Impact Assessment ("TIA") prepared in connection with the DPA/SCC package, and the TIA relied in part on the DPF as evidence that the legal framework in the United States provides adequate protections for EU personal data transferred under the SCCs.
Re-Certification Requirement. The DPF program requires participating organizations to annually re-certify their compliance with the DPF Principles. Skybridge's initial certification date was July 1, 2025, and accordingly, Skybridge's annual re-certification is due by approximately July 1, 2026, or such other specific deadline as may be established by the International Trade Administration within the U.S. Department of Commerce, which administers the DPF program.
Action Items. The following steps should be taken to ensure timely re-certification and ongoing DPF compliance:
1. Calendar Re-Certification Deadline. The annual re-certification deadline — July 1, 2026, or the specific deadline established by the DPF program — should be calendared with at least sixty (60) days of advance lead time to allow sufficient preparation and review.
2. Joint Review by Elridge and Vogt. Thomas Elridge and Lena Vogt (Managing Director, Skybridge Fintech Europe B.V., Keizersgracht 482, 1017 EG Amsterdam, Netherlands, KvK Registration No. 82104593) should jointly review Skybridge's DPF compliance ahead of the re-certification date. This review should encompass, at a minimum: (a) the adequacy and accuracy of Skybridge's publicly posted privacy policy as it pertains to DPF commitments; (b) the availability and functioning of Skybridge's independent dispute resolution mechanism for DPF-related complaints; (c) Skybridge's commitment to cooperate with and comply with the advice of EU data protection authorities ("DPAs") with respect to human resources data and, to the extent applicable, non-HR data; and (d) Skybridge's compliance with the DPF's onward transfer, data integrity, purpose limitation, access, recourse, and enforcement principles.
3. Monitor Legal Developments. Calderwood & Harkness LLP will continue to monitor developments regarding the legal validity of the EU-US Data Privacy Framework. As Thomas Elridge is aware, the DPF was adopted by the European Commission pursuant to Adequacy Decision C(2023) 4745 on July 10, 2023, and has been the subject of scrutiny by the European Parliament and civil society organizations. Any future legal challenge analogous to the Court of Justice of the European Union's decision in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, "Schrems II") could result in the invalidation of the DPF. In such a scenario, the SCCs would remain in place as the primary transfer mechanism, but the supplementary measures referenced in the TIA should be reassessed to determine whether they remain sufficient in the absence of DPF certification.
4. Recordkeeping. Skybridge should maintain comprehensive records of its DPF compliance, including copies of the initial certification, all re-certifications, the publicly posted privacy policy, and documentation of the dispute resolution mechanism. These records should be readily available for presentation to Meridian or to regulatory authorities — including the Federal Trade Commission, which has enforcement authority over DPF commitments — upon request.
VI. Sub-Processor List Update Obligations
Contractual Obligation. Under DPA Schedule C, Section 2, and SCC Annex III, Skybridge operates under a general written authorization from Meridian for the engagement of sub-processors to assist in the processing of personal data. This general authorization is subject to a critical procedural requirement: Skybridge must provide Meridian with at least thirty (30) days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor. During the thirty-day notice period, Meridian has the right to object to the proposed new or replacement sub-processor on reasonable grounds related to data protection. If Meridian objects and the parties are unable to resolve the objection through the mechanism set forth in DPA Schedule C, Section 3, either party may terminate the DPA with respect to the processing activities that would require the objected-to sub-processor.
Current Approved Sub-Processors. As of the finalization of SCC Annex III on January 15, 2026, Skybridge's approved sub-processor list includes the following two entities:
1. Osprey Cloud Infrastructure, Inc. — Provides Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) hosting for the SBF Core platform. Data center locations: US-East region (Ashburn, Virginia) and EU region (Frankfurt, Germany), with a disaster recovery secondary availability zone in US-East (Ashburn, Virginia). Headquarters: 2200 Campus Drive, San Jose, CA 95131. Chief Executive Officer: Martin Cho. Skybridge and Osprey Cloud are parties to a Data Processing Agreement dated March 1, 2024, which includes Module 3 (Processor-to-Processor) Standard Contractual Clauses and governs Osprey Cloud's processing of personal data on behalf of Skybridge.
2. Skybridge Fintech Europe B.V. — Skybridge's wholly owned European subsidiary, responsible for EU personal data processing activities, including support, development, and compliance functions for EU-resident data subjects. Registered office: Keizersgracht 482, 1017 EG Amsterdam, Netherlands. KvK Registration No. 82104593. Managing Director: Lena Vogt. Current headcount: 14 employees (8 engineers, 4 customer support, 2 compliance/legal). Skybridge Fintech Europe B.V. operates under an intra-group data processing agreement that incorporates Module 3 SCCs.
Action Items. The following steps should be taken to ensure ongoing compliance with the sub-processor authorization and notification requirements:
1. Internal Process for Sub-Processor Changes. Thomas Elridge (or a designee within the legal team) should establish a formal internal process for tracking any planned changes to the sub-processor list. This process should require that any Skybridge business unit or engineering team proposing to engage a new vendor or service provider that will process personal data on behalf of a Controller must submit the proposal to the legal team for review at least sixty (60) days in advance of the planned engagement date — allowing thirty days for internal review and diligence and thirty days for the required prior written notice to Meridian and all other bank clients using the standardized DPA template.
2. Contractual Flow-Down. For any new sub-processor, Skybridge must ensure that the sub-processing agreement contains contractual provisions that are no less protective than those set forth in the DPA, including with respect to data protection obligations, security measures, audit rights, breach notification timelines, and data return/deletion requirements. In addition, consistent with OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance), which requires banking organizations to ensure appropriate oversight of subcontractors of their third-party service providers, the sub-processing agreement should preserve Meridian's (and its regulators') right to access, audit, and examine the sub-processor.
3. Objection Resolution. If Meridian objects to a proposed new or replacement sub-processor during the thirty-day notice period, Skybridge should promptly engage with Meridian to understand the basis for the objection and attempt to resolve the issue through the DPA's objection resolution mechanism (DPA Schedule C, Section 3). This may involve providing additional information about the sub-processor's data protection practices, offering additional contractual protections, or proposing an alternative sub-processor. If the objection cannot be resolved, Skybridge should consult with Calderwood & Harkness LLP regarding the termination provisions that may apply.
4. Maintenance and Distribution. Skybridge should maintain an updated version of SCC Annex III and DPA Schedule C at all times and distribute the updated documents to all Controllers promptly upon any change to the sub-processor list. A master tracking spreadsheet of all Controller DPA versions and sub-processor notifications should be maintained by the legal team.
5. Osprey Cloud DPA Monitoring. The existing Skybridge–Osprey Cloud DPA, dated March 1, 2024, should be monitored for any upcoming renewal, amendment, or expiration. In addition, if Osprey Cloud makes any material changes to its data center locations, processing activities, or security posture, such changes may trigger the sub-processor update notice process and should be communicated to Meridian and all other Controllers.
VII. Data Breach Notification Readiness
Contractual Obligation. DPA Schedule D, Section 1, requires Skybridge to notify Meridian within forty-eight (48) hours of becoming aware of a Personal Data Breach (as defined in the DPA, consistent with Article 4(12) of the GDPR and applicable U.S. state breach notification laws). The notification must include all information reasonably available to Skybridge at the time, including: (a) the nature of the breach; (b) the categories and approximate number of data subjects affected; (c) the categories and approximate number of personal data records affected; (d) the likely consequences of the breach; and (e) the measures taken or proposed to be taken to address the breach, including measures to mitigate its potential adverse effects. The escalation matrix established under DPA Schedule D provides that the initial assessment and internal escalation flow proceeds as follows: CISO Rebecca Muñoz → General Counsel Thomas Elridge → Meridian Chief Compliance Officer Andrea Sokolov and VP Third-Party Risk Management Marcus Tibaldi.
Regulatory Context. The forty-eight-hour notification window in the DPA was negotiated with reference to Meridian's own regulatory obligations. Under the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53, effective April 1, 2022), Meridian is required to notify its primary federal regulator (the OCC) within thirty-six (36) hours of determining that a "notification incident" has occurred — i.e., a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, Meridian's ability to carry out banking operations, business lines, or activities, or that results in a material loss of revenue, profit, or franchise value. Skybridge's forty-eight-hour window is designed to provide Meridian with sufficient lead time to assess the incident and, if it constitutes a notification incident, to meet its own thirty-six-hour obligation to the OCC. In practice, this means that Skybridge's notification to Meridian should be made as promptly as possible within the forty-eight-hour window, and should not be delayed until the forty-eighth hour if the information is available sooner.
Action Items. The following steps should be taken to ensure Skybridge is prepared to meet its breach notification obligations:
1. Incident Response Plan. Skybridge should maintain and regularly update its written incident response plan, which should incorporate the DPA-specific notification procedures and escalation matrix. The plan should be tested at least annually through tabletop exercises and, ideally, through simulated breach scenarios.
2. Tabletop Exercises. Tabletop exercises should be conducted at least annually, with participation from Rebecca Muñoz, Thomas Elridge, and Sanjay Dhillon. These exercises should simulate realistic breach scenarios involving the SBF Core platform and should include practice runs of the notification procedures under DPA Schedule D, including preparation of the notification content and escalation to Meridian's Andrea Sokolov and Marcus Tibaldi.
3. Contact Information Maintenance. The escalation matrix contact information for Meridian personnel — specifically, Chief Compliance Officer Andrea Sokolov and VP Third-Party Risk Management Marcus Tibaldi — should be verified at least quarterly and updated immediately upon any change. Skybridge should request that Meridian provide prompt notice of any changes to these contacts.
4. Breach Notification Template. The breach notification template, which reflects the content requirements of DPA Schedule D, Section 1, should be readily accessible to the incident response team. The template should be stored in a location that will remain accessible even in the event of a system compromise — for example, in a secure offline repository or a separate cloud environment.
5. Insurance Coordination. In the event of a breach, Skybridge should promptly coordinate with Bastion Mutual Insurance Company to activate breach-response coverage under Policy No. CYB-2025-04821 (or its successor policy). The incident response plan should include the relevant Bastion Mutual claims contact information and the policy's notice-of-claim requirements.
6. GDPR Breach Notification. For breaches affecting the personal data of the approximately 3,200 EU-resident Meridian accountholders, Skybridge must ensure that parallel notification procedures are followed under GDPR Article 33 (notification to the supervisory authority) and, where applicable, Article 34 (notification to affected data subjects). The competent supervisory authority for Skybridge Fintech Europe B.V. is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). Notification under Article 33 must be made within seventy-two (72) hours of becoming aware of the breach. Lena Vogt should be the primary point of contact for coordinating with the Autoriteit Persoonsgegevens, in consultation with Thomas Elridge and Calderwood & Harkness LLP.
VIII. New Jersey Data Privacy Act (S3377) Compliance
Effective Date. The New Jersey Data Privacy Act, enacted as S3377, became effective on January 15, 2026. As of the date of this memorandum, the statute is in full force and effect, and compliance is required for all processing of the personal data of New Jersey residents.
Relevance to the Skybridge/Meridian Relationship. Meridian Federal Savings Bank is headquartered in Newark, New Jersey, and operates forty-seven (47) branches across New Jersey, New York, Pennsylvania, and Connecticut. Meridian's total customer base includes approximately 412,000 accountholders, a significant proportion of whom are New Jersey residents. As a processor handling the personal data of New Jersey-resident individuals — including Social Security numbers and behavioral biometric data that is classified as "sensitive data" under S3377 — Skybridge is subject to the processor-specific obligations established by the statute.
Key Processor Obligations Under S3377. The New Jersey Data Privacy Act imposes the following obligations on processors, each of which is relevant to Skybridge's processing activities under the DPA:
(a) Adherence to Controller Instructions. A processor must adhere to the instructions of the controller regarding the processing of personal data. The processor may not process personal data for any purpose other than those set forth in the contract between the processor and the controller. This obligation is consistent with DPA Section 3.1, which restricts Skybridge's processing to the purposes described in Schedule A.
(b) Assistance with Consumer Rights Requests. A processor must assist the controller in responding to consumer rights requests, including requests for access, correction, deletion, and data portability. The DPA addresses this obligation in Section 5, which requires Skybridge to provide reasonable assistance to Meridian in responding to data subject requests within the timeframes established by applicable law.
(c) Data Protection Assessments. The statute requires controllers to conduct data protection assessments for certain high-risk processing activities, including processing that involves sensitive data. Processors must cooperate with controllers in the preparation of such assessments. DPA Section 6 includes a provision requiring Skybridge to cooperate with Meridian in the preparation of data protection impact assessments.
(d) Technical and Organizational Measures. A processor must implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing. DPA Schedule B sets forth the specific security measures that Skybridge is required to maintain, including encryption, access controls, and monitoring.
Action Items. The following steps should be taken to ensure compliance with S3377:
1. Confirm DPA Sufficiency. Thomas Elridge should confirm that the executed DPA's provisions — including those addressing data protection impact assessment cooperation (Section 6), consumer rights request assistance (Section 5), and security measures (Schedule B) — satisfy the processor requirements of S3377. Based on our review, the DPA provisions are substantially aligned with S3377's requirements, but a final confirmation should be made upon execution.
2. Monitor Implementing Regulations. S3377 authorizes the New Jersey Division of Consumer Affairs to issue implementing regulations and guidance. As of the date of this memorandum, no such regulations have been issued. Thomas Elridge should monitor for any rulemaking activity and assess the impact on Skybridge's obligations.
3. Internal Policy Updates. Skybridge's internal privacy policies and procedures should be reviewed and updated to reflect S3377 obligations, including the handling of consumer rights requests from New Jersey residents and the classification of behavioral biometric data as sensitive data.
4. Coordination with Meridian. Thomas Elridge should coordinate with Meridian on any data protection assessment requirements that may be triggered by the processing of New Jersey-resident data through the SBF Core platform, particularly in connection with processing activities involving sensitive data (such as behavioral biometric authentication data used in the anti-fraud analytics module).
IX. Annual Penetration Testing
Contractual Obligation. DPA Schedule B, Section 3.4, requires Skybridge to conduct annual penetration testing of the SBF Core platform by an independent, qualified third-party security firm. The results of the penetration test, including a summary of findings and remediation actions, must be made available to Meridian upon reasonable request, consistent with the audit rights provisions of DPA Section 8.
Current Provider. Skybridge's current penetration testing provider is Ironvault Security Group LLC, located at 11710 Plaza America Drive, Suite 400, Reston, VA 20190. Ironvault is a recognized provider of offensive security testing services with experience in the financial services sector and has performed penetration testing for Skybridge in prior years.
Action Items. The following steps should be taken to ensure ongoing compliance with the penetration testing requirement:
1. Calendar Annual Test. The annual penetration test should be calendared by Rebecca Muñoz, with scheduling coordinated between Skybridge's security team and Ironvault Security Group LLC. The test should be scheduled to align with the SOC 2 Type II audit cycle to the extent practicable, so that the most recent penetration test results can be incorporated into the SOC 2 report.
2. Test Scope. The scope of the penetration test must cover the SBF Core platform in its entirety, including: (a) the payment processing module; (b) the anti-fraud analytics module; (c) the regulatory reporting module; (d) all application programming interfaces (APIs) and integrations with Osprey Cloud Infrastructure (including both the US-East and EU data center regions); (e) administrative access controls, including multi-factor authentication mechanisms; and (f) any customer-facing web and mobile interfaces.
3. Remediation. Any vulnerabilities or findings identified during the penetration test must be remediated within the timelines agreed upon between Skybridge and Ironvault, prioritized by severity level. Critical and high-severity findings should be addressed within thirty (30) days; medium-severity findings within sixty (60) days; and low-severity findings within ninety (90) days or the next scheduled maintenance window.
4. Reporting to Controllers. Penetration test summary reports (redacted to remove specific exploit details that could create security risks if disclosed) should be made available to Meridian and other bank clients upon reasonable request, consistent with the DPA's audit rights provisions. Rebecca Muñoz should maintain a standard redacted summary format suitable for Controller distribution.
5. OCC Bulletin 2023-17 Considerations. Skybridge should consider whether Meridian's Third-Party Risk Management program, which is aligned with OCC Bulletin 2023-17, imposes any specific penetration testing scope, methodology, or reporting requirements beyond those established in the DPA. If Meridian's TPRM program requires specific testing standards (e.g., OWASP, PTES, or NIST SP 800-115), Rebecca Muñoz should coordinate with Ironvault to ensure compliance.
X. Audit Rights Preparedness
Contractual Obligation. Under DPA Section 8, Meridian (as Controller) or its regulators — including the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the Consumer Financial Protection Bureau (CFPB) — may audit Skybridge's processing activities with thirty (30) days' advance written notice. The audit right may be exercised no more than once per twelve-month period, unless triggered by a Personal Data Breach or a specific regulatory inquiry, in which case additional audits may be conducted as reasonably necessary. Audits are conducted at the Controller's expense.
Primary Audit Satisfaction Mechanism. DPA Section 8.2 provides that Skybridge may satisfy a Controller's audit request by providing its current SOC 2 Type II report (issued by Graystone & Ketchum LLP, as described in Section IV above) together with written responses to any supplemental questionnaire submitted by the Controller. This mechanism is intended to minimize the operational disruption associated with on-site audits while still providing the Controller with meaningful assurance regarding Skybridge's compliance with the DPA's security and data protection requirements. However, the Controller retains the right to conduct an on-site audit if the SOC 2 report is not current, if the supplemental questionnaire responses are insufficient, or if the audit is triggered by a breach or regulatory inquiry.
Regulator Access. Consistent with OCC Bulletin 2023-17, which requires that a banking organization's contracts with critical third-party service providers preserve the bank's regulators' rights to examine the third party, DPA Section 8.4 expressly preserves the OCC's, FDIC's, and CFPB's rights to access Skybridge's facilities, systems, records, and personnel as necessary to examine Skybridge's compliance with applicable laws and regulations. This right is not subject to the once-per-twelve-month limitation or the advance notice requirements applicable to Controller audits.
Action Items. The following steps should be taken to ensure Skybridge is prepared for audit requests:
1. Standing Audit Readiness File. Rebecca Muñoz should maintain a standing audit readiness file containing the following documents, updated on a rolling basis: (a) the current SOC 2 Type II report; (b) the most recent penetration test summary report; (c) the current certificate of cyber-liability insurance; (d) the current sub-processor list (SCC Annex III / DPA Schedule C); (e) the data processing description (DPA Schedule A); (f) documentation of the security measures implemented pursuant to DPA Schedule B and SCC Annex II; and (g) the most recent Transfer Impact Assessment.
2. Designated Audit Contacts. Rebecca Muñoz is designated as the primary point of contact for audit requests, with Thomas Elridge serving as the secondary contact. All audit requests should be routed to Rebecca Muñoz upon receipt and acknowledged within five (5) business days.
3. On-Site Audit Coordination. If an on-site audit is requested — for example, following a data breach or in connection with a regulatory examination — Rebecca Muñoz should coordinate the logistics of the audit with Meridian's VP Third-Party Risk Management Marcus Tibaldi. On-site audits should be conducted at mutually agreed times during normal business hours, and Skybridge should designate appropriate personnel to accompany the auditors and respond to information requests.
4. Twelve-Month Audit Window. The twelve-month limitation on routine Controller audits should be tracked to ensure that Skybridge does not inadvertently consent to more than one routine audit per twelve-month period. If Meridian requests an audit within twelve months of a prior audit, Skybridge should confirm whether the request is triggered by a breach or regulatory inquiry (which would be exempt from the limitation) and, if not, politely decline and propose scheduling the audit after the expiration of the twelve-month period.
5. Pooled Audits for Multiple Controllers. As Skybridge onboards additional bank clients under the standardized DPA template, multiple Controllers may request audits during overlapping or closely spaced periods. To reduce operational disruption, Skybridge should consider proposing pooled or consolidated audit arrangements — for example, a single annual audit conducted by an independent third party on behalf of multiple Controllers — consistent with the DPA terms and subject to each Controller's agreement.
XI. Post-Termination Data Retention and Deletion
Contractual Obligation. DPA Section 9.3, in conjunction with SCC Clause 8.5, provides that upon the termination or expiration of the SaaS subscription agreement, Skybridge must retain all personal data processed under the DPA for a period of ninety (90) days solely for the purpose of returning the data to Meridian in a standard, machine-readable format or securely deleting it, at Meridian's election. Following the expiration of the ninety-day period, Skybridge must certify the deletion of all personal data, unless retention is required by applicable law.
Current Contract Term. The SaaS subscription agreement between Skybridge and Meridian has a five-year initial term, with an anticipated execution date of February 15, 2026, and an anticipated expiration date of approximately February 15, 2031. The agreement may be terminated earlier pursuant to its termination provisions, and it may also be renewed for additional terms by mutual agreement.
Action Items. Although the post-termination data handling obligations will not be triggered for several years under the current contract term, Skybridge should take the following preparatory steps now to ensure it will be able to comply when the time comes:
1. Data Return and Deletion Procedures. Sanjay Dhillon should establish — and document — internal procedures and technical capabilities for: (a) the return of all personal data to Meridian in a standard, machine-readable format (e.g., CSV, JSON, or XML, as specified by Meridian at the time of termination); and (b) the certified deletion of all personal data, including data stored in backup systems, logs, and archival storage, using methods consistent with NIST SP 800-88 (Guidelines for Media Sanitization) or equivalent standards.
2. Sub-Processor Coordination. Skybridge must ensure that its sub-processors — Osprey Cloud Infrastructure, Inc. and Skybridge Fintech Europe B.V. — have parallel data return and deletion obligations under their respective data processing agreements and sub-processing agreements. Sanjay Dhillon should confirm that the Skybridge–Osprey Cloud DPA (dated March 1, 2024) and the SBF Europe intra-group DPA both include provisions requiring data return and/or certified deletion within the same ninety-day window or a shorter period.
3. Legal Hold and Regulatory Retention Carve-Outs. Thomas Elridge should identify any legal hold obligations or regulatory data retention requirements — including those arising under the Gramm-Leach-Bliley Act (GLBA), the Bank Secrecy Act / Anti-Money Laundering (BSA/AML) regulations, or other applicable federal or state financial regulations — that may require Skybridge to retain certain categories of personal data beyond the ninety-day post-termination window. Any such retention must be limited to the minimum data necessary to comply with the applicable requirement, and Meridian must be notified of the retention and its legal basis, consistent with DPA Section 9.3(b).
4. Calendar Contract Expiration. The anticipated contract expiration date (February 15, 2031) and the ninety-day post-termination window (expiring approximately May 16, 2031) should be calendared with at least one hundred eighty (180) days of advance notice to allow sufficient time for planning and coordination. This calendar entry should be updated if the contract is terminated early or renewed.
XII. Encryption and Security Standards Maintenance
Contractual Obligation. DPA Schedule B and SCC Annex II set forth the specific technical and organizational security measures that Skybridge is required to implement and maintain throughout the term of the DPA. These measures include, without limitation:
(a) Encryption at Rest: All personal data stored within the SBF Core platform must be encrypted using the Advanced Encryption Standard with 256-bit key length (AES-256) or an equivalent or stronger encryption algorithm.
(b) Encryption in Transit: All personal data transmitted between Skybridge systems, between Skybridge and Meridian, and between Skybridge and its sub-processors must be encrypted using Transport Layer Security version 1.2 or later (TLS 1.2+).
(c) Multi-Factor Authentication (MFA): All administrative and privileged access to the SBF Core platform, including access by Skybridge personnel, must require multi-factor authentication.
Action Items. The following steps should be taken to ensure ongoing compliance with the DPA's encryption and security standards:
1. Ongoing Monitoring and Currency. Rebecca Muñoz and Sanjay Dhillon should continuously monitor industry developments, NIST guidance, and applicable regulatory standards to ensure that the encryption standards specified in the DPA remain current and adequate. Given the five-year term of the SaaS subscription agreement (through approximately February 2031), it is possible that advances in cryptography — including, potentially, the emergence of practical quantum computing capabilities — may necessitate a transition to post-quantum cryptographic algorithms during the contract term. If the National Institute of Standards and Technology (NIST) finalizes post-quantum cryptographic standards and recommends transition timelines that fall within the contract term, Skybridge should develop and implement a transition plan.
2. Notice to Controller. If any changes to encryption protocols, key management practices, or other security standards specified in DPA Schedule B or SCC Annex II are implemented — whether in response to regulatory changes, industry developments, or security incidents — Thomas Elridge should assess whether notice to Meridian is required under the DPA and whether Schedule B and/or SCC Annex II require formal amendment. Any reduction in security posture (e.g., a temporary downgrade of encryption protocols during a migration) should be treated as a material change requiring advance notice and Controller consent.
3. Sub-Processor Security Alignment. Skybridge must ensure that Osprey Cloud Infrastructure, Inc. maintains equivalent or stronger security measures at its US-East data center region (Ashburn, Virginia), its EU data center region (Frankfurt, Germany), and its disaster recovery secondary availability zone (Ashburn, Virginia). Rebecca Muñoz should periodically verify Osprey Cloud's security posture through review of Osprey Cloud's SOC 2 Type II report and direct engagement with Osprey Cloud's security team.
XIII. CCPA/CPRA Obligations
Regulatory Context. The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), applies to the processing of personal information of California residents. Meridian Federal Savings Bank serves accountholders who may be California residents, and Skybridge processes the personal information of those individuals in its capacity as a "service provider" under the CCPA/CPRA.
Contractual Framework. The DPA includes service-provider provisions consistent with CCPA/CPRA requirements, including restrictions on Skybridge's use, retention, and disclosure of personal information processed on behalf of Meridian. Specifically, the DPA restricts Skybridge from "selling" or "sharing" (as those terms are defined under the CCPA/CPRA) any personal information received from Meridian, and requires Skybridge to assist Meridian in responding to consumer rights requests — including requests to know, requests to delete, requests to correct, and requests to opt out of the sale or sharing of personal information.
Action Items. The following steps should be taken to ensure ongoing CCPA/CPRA compliance:
1. DPA Sufficiency. Thomas Elridge should confirm that the DPA's service-provider provisions satisfy the current requirements of the CCPA/CPRA, including the service provider contract requirements set forth in California Civil Code § 1798.100(d) and the implementing regulations promulgated by the California Privacy Protection Agency ("CPPA").
2. Regulatory Monitoring. The CPPA continues to engage in active rulemaking, including with respect to automated decision-making technology, cybersecurity audits, and risk assessments. Thomas Elridge should monitor for any regulatory updates that may impose additional obligations on service providers and assess their impact on Skybridge's compliance posture.
3. Consumer Rights Coordination. Skybridge should coordinate with Meridian on any California-specific consumer rights requests received by either party. The DPA establishes a workflow for the processing of such requests, and Skybridge should ensure that its systems and processes are capable of fulfilling requests within the statutory timelines.
XIV. Ongoing Monitoring of Regulatory Developments
In addition to the specific regulatory obligations addressed in the preceding sections, Skybridge should maintain an ongoing monitoring program to track legislative, regulatory, and judicial developments that may affect its compliance obligations under the DPA/SCC package and related agreements. The following areas warrant particular attention:
1. Federal Banking Regulatory Guidance. Monitor for changes to OCC guidance (including any updates or supplements to OCC Bulletin 2023-17), FDIC rules, and CFPB regulations affecting third-party risk management, data security, and information technology for bank service providers. Changes in federal banking regulatory expectations may necessitate amendments to the DPA or to Skybridge's operational practices.
2. GDPR Enforcement and EU Regulatory Developments. Track developments in GDPR enforcement activity, including decisions by EU supervisory authorities and the Court of Justice of the European Union that may affect the legal framework for EU–US data transfers. In particular, monitor for: (a) any new adequacy decisions or revisions to existing adequacy decisions; (b) any revisions to the Standard Contractual Clauses adopted by the European Commission; and (c) any legal challenges to the EU-US Data Privacy Framework that could affect the validity of the DPF as a supplementary transfer mechanism.
3. State Privacy Legislation. Monitor state privacy legislation in the states where Meridian operates branches — specifically, New Jersey, New York, Pennsylvania, and Connecticut — for any new privacy statutes or amendments to existing statutes that impose processor obligations. As of the date of this memorandum, the New York Privacy Act and comprehensive privacy legislation in Pennsylvania and Connecticut are in various stages of legislative consideration, and any enactment may create additional compliance obligations for Skybridge.
4. Transfer Impact Assessment Reassessment. If there are material changes in U.S. surveillance law (including Section 702 of the Foreign intelligence Surveillance Act, which is currently authorized through April 2026), EU case law, or regulatory guidance affecting the adequacy of protections for EU–US data transfers, Skybridge should reassess the Transfer Impact Assessment prepared in connection with the DPA/SCC package and determine whether supplementary measures should be added or modified.
Calderwood & Harkness LLP will continue to monitor these developments and provide updates to Skybridge as part of its ongoing advisory engagement.
XV. Summary of Responsible Parties
The following table summarizes the primary and secondary responsible persons for each category of compliance obligation identified in this memorandum:
Each responsible person should familiarize themselves with the applicable sections of this memorandum and the underlying DPA provisions, and should ensure that the action items identified in their respective sections are incorporated into their team's operational workflows and compliance calendars.
XVI. Recommendation
Based on the foregoing analysis, we recommend that Skybridge establish a recurring quarterly compliance review meeting involving Thomas Elridge, Rebecca Muñoz, Sanjay Dhillon, and Lena Vogt (the latter participating remotely from Amsterdam as needed). The purpose of these quarterly meetings should be to:
(a) review all obligations identified in this memorandum and confirm that action items are on track;
(b) identify any upcoming deadlines within the next quarter and assign responsibility for timely completion;
(c) review any regulatory developments or changes in law that may affect Skybridge's compliance posture;
(d) discuss any audit requests, breach incidents, or sub-processor changes that have occurred during the prior quarter; and
(e) update this memorandum as necessary to reflect new developments.
Calderwood & Harkness LLP remains available to advise Skybridge on any compliance questions arising under the DPA/SCC package, including interpretation of specific provisions, responses to audit or regulatory inquiries, breach notification procedures, and amendments to the DPA. For questions regarding this memorandum or the underlying engagement, please contact:
Kevin Ostrowski, Partner (Responsible Partner) Calderwood & Harkness LLP 1735 Market Street, Suite 2800 Philadelphia, PA 19103
Priscilla Wynn, Lead Associate Calderwood & Harkness LLP 1735 Market Street, Suite 2800 Philadelphia, PA 19103
This memorandum should be updated upon execution of the DPA on February 15, 2026, to confirm the execution date and incorporate any final changes to the DPA terms. Thereafter, this memorandum should be reviewed and updated on at least an annual basis, or more frequently upon any material change in applicable law, Skybridge's processing activities, sub-processor arrangements, or the DPA terms.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Alan Burke Working Associate, Privacy & Data Security Matter No. 1009-00004
This memorandum is intended to provide general guidance based on the facts and circumstances known to us as of the date hereof. It does not constitute a guarantee of any particular outcome and should not be relied upon as a substitute for specific legal advice with respect to any particular situation. The analysis herein is limited to the matters expressly addressed and does not purport to address every potential compliance obligation that may arise under the DPA/SCC package or applicable law.
Date / Recurring Period | Obligation | Responsible Person(s) | Reference
January 15, 2026 | NJ Data Privacy Act (S3377) effective date — compliance required as of this date for all processing of NJ-resident personal data | Thomas Elridge, Rebecca Muñoz | DPA § 4.1(h); NJ S3377 § 14
February 15, 2026 | DPA/SCC execution date; commencement of all obligations under the DPA, SCC Modules 2 and 3, and all Schedules and Annexes | Thomas Elridge | DPA § 2.1; SCC Modules 2 & 3
Ongoing (30-day prior written notice) | Sub-processor list updates — prior written notice to Meridian and all Controllers before engaging any new sub-processor or replacing an existing one | Thomas Elridge | DPA Schedule C § 2; SCC Annex III
Ongoing (within 48 hours of awareness) | Personal Data Breach notification to Controller, including all information reasonably available per DPA Schedule D content requirements | Rebecca Muñoz, Thomas Elridge | DPA Schedule D § 1
Ongoing (annually) | Penetration testing of SBF Core platform by Ironvault Security Group LLC, an independent third-party firm | Rebecca Muñoz | DPA Schedule B § 3.4
Ongoing (annually, no more than once per 12-month period) | Audit right — maintain readiness for Controller and/or regulator audits; maintain SOC 2 Type II readiness and standing audit file | Rebecca Muñoz, Thomas Elridge | DPA § 8; SCC Clause 8.9
By renewal date (current policy expired December 31, 2025; renewal in progress) | Bastion Mutual Insurance Company cyber-insurance renewal — Policy No. CYB-2025-04821; minimum $10M per occurrence coverage required | Thomas Elridge; Kestrel Risk Advisors LLC (broker) | DPA § 11.2
Next cycle following September 15, 2025 report | SOC 2 Type II audit cycle — engage Graystone & Ketchum LLP for audit period commencing no later than October 1, 2025; report anticipated September–October 2026 | Rebecca Muñoz | DPA Schedule B § 3.2; DPA § 8.2
Annually (initial certification July 1, 2025; next re-certification due approximately July 1, 2026) | EU-US Data Privacy Framework re-certification — Certification ID: DPF-2025-03912 | Thomas Elridge, Lena Vogt | SCC supplementary measures § 2; DPF program requirements
90 days post-termination (anticipated contract expiration: approximately February 15, 2031) | Data return and/or certified deletion obligation; data retained only for return/deletion purposes during this window | Sanjay Dhillon, Rebecca Muñoz | DPA § 9.3; SCC Clause 8.5
Obligation Category | Primary Responsible Person | Secondary / Support
Cyber-insurance renewal (Section III) | Thomas Elridge | Kestrel Risk Advisors LLC
SOC 2 Type II audit cycle (Section IV) | Rebecca Muñoz | Graystone & Ketchum LLP (Sandra Clearfield)
DPF re-certification (Section V) | Thomas Elridge | Lena Vogt (SBF Europe)
Sub-processor list updates (Section VI) | Thomas Elridge | Rebecca Muñoz
Breach notification readiness (Section VII) | Rebecca Muñoz | Thomas Elridge; escalation to Meridian (Andrea Sokolov, Marcus Tibaldi)
NJ S3377 compliance (Section VIII) | Thomas Elridge | Rebecca Muñoz
Annual penetration testing (Section IX) | Rebecca Muñoz | Ironvault Security Group LLC
Audit readiness (Section X) | Rebecca Muñoz | Thomas Elridge
Post-termination data handling (Section XI) | Sanjay Dhillon | Rebecca Muñoz
Encryption / security maintenance (Section XII) | Rebecca Muñoz | Sanjay Dhillon
CCPA/CPRA compliance (Section XIII) | Thomas Elridge | Rebecca Muñoz
Regulatory monitoring (Section XIV) | Thomas Elridge | Calderwood & Harkness LLP (ongoing advisory as needed)

MEMORANDUM

MATTER NO.: 1009-00004

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts