Thomas,
Thank you for joining the first portion of this afternoon's call — your input on the audit rights framework and breach escalation procedures was very helpful in moving those items forward. This email provides a full summary of the key issues call held today, January 8, 2026, between Calderwood & Harkness and Blackwell, Raines & Stoddard LLP ("BRS") regarding the customer-facing Data Processing Agreement between Skybridge Fintech Ltd. (as Processor) and Meridian Federal Savings Bank (as Controller). As you know, today's call followed BRS's December 20, 2025 markup of our counter-proposal DPA. Please also note that Kevin is transmitting the second redline of the DPA to BRS concurrently under separate cover via formal letter to Constance Liu.
**Call Participants**
- **Calderwood & Harkness LLP:** Kevin Ostrowski (Partner), Priscilla Wynn (Associate), Alan Burke (Associate) - **Blackwell, Raines & Stoddard LLP:** Constance Liu (Partner), Derek Faulkner (Associate) - **Skybridge Fintech Ltd.:** Thomas Elridge (General Counsel / Chief Privacy Officer) — joined for the first 30 minutes
Meridian's VP of Third-Party Risk Management, Marcus Tibaldi, and Chief Compliance Officer, Andrea Sokolov, did not participate, though Constance Liu indicated she would be briefing both of them following the call.
---
**ISSUES WHERE SUBSTANTIAL PROGRESS WAS MADE**
**1. Liability Cap**
BRS's December 20 markup proposed an uncapped liability structure for data breaches attributable to the Processor. On the call, we walked through our position in detail: a liability cap equal to the greater of (a) $5.0 million or (b) 2× the fees paid by Controller in the 12-month period preceding the claim. For Meridian specifically, based on the $2.74M annual contract value, this formula yields a cap of $5.48M (2 × $2.74M = $5.48M, which exceeds the $5.0M floor).
Constance Liu acknowledged that this is within the range of what Meridian's TPRM program has accepted from other critical vendors and indicated she believes Meridian will accept the formula structure, though she reserved on the specific dollar floor pending internal discussion with Marcus Tibaldi. We also emphasized that Skybridge maintains cyber-liability insurance through Bastion Mutual Insurance Company with $10M per-occurrence / $20M aggregate coverage (Policy No. CYB-2025-04821), which provides a meaningful backstop above the contractual cap.
*Status: Substantially resolved; awaiting Meridian internal confirmation on the $5.0M floor.*
**2. Indemnification Scope — Regulatory Fines Carve-Out**
This was a key area of discussion. The central question is whether Skybridge's indemnification obligation extends to regulatory fines and penalties imposed on Meridian arising from Skybridge's breach of the DPA. BRS's markup included broad indemnification covering all regulatory fines without qualification.
We proposed limiting indemnification for regulatory fines to those that are: (i) directly resulting from Skybridge's material breach of the DPA; (ii) permissible to be indemnified under applicable law (noting that some jurisdictions prohibit indemnification of penalties); and (iii) subject to the overall liability cap.
Constance Liu pushed back on application of the liability cap to regulatory fines, arguing that OCC and FDIC enforcement actions could far exceed the cap. We maintained that the cap must apply to all claims, including regulatory fines, in order to keep the DPA commercially viable as a template across Skybridge's bank client base. We also discussed that Meridian's regulatory supervisors include the OCC, FDIC, and CFPB, and that the DPA must satisfy OCC Bulletin 2023-17 requirements for third-party risk management.
*Status: Partially resolved on the "permissible under applicable law" qualifier; the question of whether regulatory fines are subject to or carved out from the liability cap remains open (see Open Item #1 below).*
**3. Audit Rights**
BRS's December 20 markup requested unlimited on-site audit rights with 15 days' notice. We proposed and discussed the following framework, to which BRS appeared receptive:
- Controller (or its designated third-party auditor) may conduct an audit no more than once per 12-month period, with 30 days' advance written notice, at Controller's expense. - Skybridge may satisfy audit requests by providing its current SOC 2 Type II report (issued by Graystone & Ketchum LLP; current report covers the period October 1, 2024 through September 15, 2025) and written responses to a reasonable supplemental questionnaire. - On-site audit is available if the SOC 2 report and questionnaire responses are insufficient to address Controller's specific concerns, or if triggered by a data breach or regulatory inquiry. - Regulatory access is expressly preserved: the OCC, FDIC, CFPB, and any other applicable regulator retain the right to examine, audit, and obtain information from Skybridge in connection with services provided to Meridian, consistent with OCC Bulletin 2023-17 and applicable federal banking regulations. This right is not subject to the frequency limitation or advance notice requirement.
Constance Liu confirmed this framework is consistent with Meridian's TPRM program requirements.
*Status: Substantially resolved; language reflected in the second redline.*
**4. Sub-Processor Approval Mechanics**
We reached agreement on a general written authorization model with 30-day prior written notice before engaging any new sub-processor. Controller has the right to object to a new sub-processor within the 30-day notice period on reasonable grounds related to data protection. If Controller objects and the parties cannot resolve the objection within 15 days, Controller may terminate the affected processing (not the entire DPA) without penalty.
Current approved sub-processors are:
- **Osprey Cloud Infrastructure, Inc.** — IaaS/PaaS hosting; US-East data center region in Ashburn, VA, and EU data center region in Frankfurt, Germany - **Skybridge Fintech Europe B.V.** — EU personal data processing; Amsterdam, Netherlands (KvK 82104593)
We also noted the existing Skybridge–Osprey Cloud DPA dated March 1, 2024, which includes Module 3 SCCs (processor-to-sub-processor), and confirmed that flow-down obligations will mirror the customer-facing DPA.
*Status: Resolved; to be reflected in Schedule C and the second redline.*
**5. Breach Notification Timeline**
We confirmed mutual agreement on a 48-hour notification timeline from the point at which Skybridge becomes aware of a Personal Data Breach. This aligns with Meridian's TPRM requirements. We noted that the separate bank-to-regulator notification obligation under the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53) is 36 hours for "notification incidents," but that is Meridian's obligation, not Skybridge's. The 48-hour timeline provides Meridian with a reasonable window to assess and comply with its own regulatory notification obligations.
The escalation matrix, to be set forth in Schedule D, is as follows:
Skybridge CISO (Rebecca Muñoz) → Skybridge GC (Thomas Elridge) → Meridian CCO (Andrea Sokolov) and VP TPRM (Marcus Tibaldi)
*Status: Resolved.*
---
**FOUR REMAINING OPEN ITEMS**
1. **Regulatory Fines and the Liability Cap.** Whether indemnification for regulatory fines imposed on Meridian arising from Skybridge's breach is subject to the overall liability cap or carved out. BRS's position is that regulatory fines should be carved out from the cap; our position is that the cap must apply to all claims. This is the most commercially significant open item in the negotiation.
2. **DPIA Cooperation — Scope and Cost Allocation.** BRS's markup requires Skybridge to provide "all assistance reasonably requested" by Meridian for Data Protection Impact Assessments under GDPR Article 35 and under the anticipated NJ Data Privacy Act (S3377, expected effective January 15, 2026). We agreed to the cooperation obligation in principle but proposed that DPIA assistance beyond a reasonable baseline (to be defined) be provided at Skybridge's then-current professional services rates. BRS has not yet agreed to cost-shifting for DPIA cooperation.
3. **SCC Clause 17 Governing Law.** BRS initially proposed that the Standard Contractual Clauses be governed by Irish law. We proposed the law of the Netherlands, reflecting that Skybridge Fintech Europe B.V. is the EU establishment and EU data processing activities occur in the Netherlands. Constance Liu indicated she would consult with Meridian's compliance team and revert. For the avoidance of doubt, the DPA itself remains governed by Delaware law, which is agreed.
4. **Definition of "Personal Data Breach" — Inclusion of Unsuccessful Attempts.** BRS's markup defines "Personal Data Breach" to include unsuccessful security incidents (e.g., unsuccessful login attempts, port scans) that do not result in unauthorized access to personal data. Our position is that the definition should be limited to incidents that result in actual unauthorized access, disclosure, alteration, or destruction of personal data, consistent with GDPR Article 4(12). We agreed on the call to address reporting on material unsuccessful attempts through periodic security summary reports rather than through the breach notification procedure.
---
**NEXT STEPS AND TIMELINE**
- **January 8, 2026:** Calderwood & Harkness transmits the second redline to BRS (being sent today), reflecting the resolutions described above. - **January 8–13:** Thomas and Rebecca — we would appreciate your review of the second redline, with particular attention to the updated audit rights framework (Section 8) and the breach notification procedures (Schedule D). - **~January 13–14:** Anticipated BRS response to the second redline. - **January 15, 2026:** Target date for circulation of a third redline with finalized SCC Annexes I–III. Please also note that the NJ Data Privacy Act (S3377) is expected to take effect on this date; the DPA has been drafted to account for its controller/processor obligations and data protection assessment requirements. - **January 22, 2026:** Target for circulating a near-final DPA to Meridian's CCO Andrea Sokolov and VP TPRM Marcus Tibaldi for internal review. - **January 30, 2026:** Final issues resolution call. - **February 5, 2026:** Execution-ready package. - **February 15, 2026:** Target signing, concurrent with the SaaS subscription agreement.
---
**ATTACHMENTS / REFERENCE DOCUMENTS**
As noted, the second redline of the DPA is being transmitted separately via Kevin's formal letter to Constance Liu. For your internal use, I am attaching the updated key terms comparison matrix (spreadsheet format) prepared by Alan, which tracks our positions, BRS's positions, and current status for each negotiated provision.
---
Thomas, please let me know if it would be helpful to schedule a call — with Rebecca and/or Sanjay Dhillon — to walk through the second redline in detail before BRS responds. I expect we can find time early next week. I would also note that Kevin is available to discuss the regulatory fines / liability cap issue specifically, as it will likely require a commercial decision from Skybridge's leadership — potentially Nadia — on how far to push on this point.
Please don't hesitate to reach out with any questions in the meantime.
Best regards,
**Priscilla Wynn** Associate, Privacy & Data Security Calderwood & Harkness LLP 1735 Market Street, Suite 2800 Philadelphia, PA 19103 T: (215) 554-3192 E: pwynn@calderwoodharkness.com
---
*CONFIDENTIALITY NOTICE: This email and any attachments are privileged and confidential, and are intended solely for the use of the individual or entity to whom they are addressed. This communication may contain information protected by the attorney-client privilege, the work product doctrine, or other applicable protections. If you are not the intended recipient, please notify the sender immediately, delete this message, and do not read, copy, disclose, or use its contents. Any unauthorized review, use, disclosure, or distribution is prohibited and may be unlawful.*