1009-00004 · Skybridge Fintech Ltd · Correspondence

transmittal-letter-counter-proposal-121225.docx DOCUMENT Finance & Banking

13 / 35 ← → ✕

Contract analysis Extract to table

CALDERWOOD & HARKNESS LLP Attorneys at Law

1735 Market Street, Suite 2800 Philadelphia, PA 19103

Telephone: (215) 555-7400 Facsimile: (215) 555-7401 www.calderwoodharkness.com

Kevin Ostrowski Partner, Privacy & Data Security Direct: (215) 555-7438

Email: kostrowski@calderwoodharkness.com

December 12, 2025

VIA EMAIL AND ELECTRONIC DOCUMENT TRANSFER

Constance Liu, Esq. Partner, Financial Services / Data Privacy Blackwell, Raines & Stoddard LLP 200 Park Avenue, 31st Floor New York, NY 10166

Re: Data Processing Agreement — Skybridge Fintech Ltd. (Processor) and Meridian Federal Savings Bank (Controller) Calderwood & Harkness Matter No. 1009-00004

Dear Ms. Liu:

On behalf of our client, Skybridge Fintech Ltd. ("Skybridge"), please find enclosed Skybridge's clean counter-proposal Data Processing Agreement (the "Counter-Proposal DPA" or the "Skybridge DPA") for the data processing relationship between Meridian Federal Savings Bank ("Meridian," as Controller) and Skybridge (as Processor). The Counter-Proposal DPA is transmitted as a clean document intended to serve as the basis for further negotiation between the parties, replacing in its entirety the form Data Processing Agreement received from your firm on November 25, 2025 (the "Meridian Form DPA").

As a preliminary matter, we wish to note that the Counter-Proposal DPA is structured on the basis of Skybridge's standard bank-grade template, which has been specifically designed to be consistent with the third-party risk management requirements applicable to Skybridge's regulated financial institution clients, including alignment with the Office of the Comptroller of the Currency's Bulletin 2023-17 (Third-Party Relationships: Risk Management) and the Federal Financial Institutions Examination Council ("FFIEC") guidance on technology service providers. At the same time, the Counter-Proposal DPA reflects balanced risk allocation appropriate for a SaaS vendor–bank relationship, taking into account the respective roles and obligations of each party and the commercial realities of Skybridge's multi-tenant platform architecture. We believe this approach provides Meridian with the substantive protections and regulatory compliance assurances it requires while establishing a framework that is operationally sustainable for Skybridge.

The enclosed package comprises the following documents: (i) the main body of the Counter-Proposal DPA; (ii) draft Schedules A through D (Schedule A — Description of Processing Activities; Schedule B — Technical and Organizational Security Measures; Schedule C — Approved Sub-Processor List; and Schedule D — Data Breach Notification Procedures); and (iii) placeholder Standard Contractual Clauses pursuant to European Commission Implementing Decision (EU) 2021/914 (Modules 2 and 3) with draft Annexes I through III, which will be finalized as negotiations progress and the parties confirm the specific categories of data subjects, personal data, and technical and organizational measures applicable to the Meridian engagement.

Summary of Key Departures from the Meridian Form DPA

While many of the provisions in the Meridian Form DPA have been incorporated into or adapted within the Counter-Proposal DPA, Skybridge's Counter-Proposal DPA departs from the Meridian Form DPA in several material respects. These departures are summarized below for your convenience and to facilitate efficient review by your client's team, including Ms. Hartwell, Ms. Sokolov, and Mr. Tibaldi. We would welcome the opportunity to discuss each of these items in greater detail at the parties' mutual convenience.

1. Liability Cap Structure

The Counter-Proposal DPA establishes a liability cap equal to the greater of (a) Five Million Dollars ($5,000,000) or (b) two times (2×) the aggregate fees actually paid by Controller to Processor in the twelve (12)-month period immediately preceding the event or series of related events giving rise to the claim (the "Liability Cap"). For the Meridian engagement specifically, based on the annual contract value of Two Million Seven Hundred Forty Thousand Dollars ($2,740,000) under the SaaS subscription agreement currently under negotiation between the parties, this formula yields a Liability Cap of Five Million Four Hundred Eighty Thousand Dollars ($5,480,000) (i.e., 2 × $2,740,000), which exceeds the $5,000,000 floor.

This Liability Cap structure replaces the uncapped liability framework set forth in the Meridian Form DPA. Skybridge's position is that its proposed approach reflects market-standard practice in bank-vendor data processing agreements and is consistent with liability frameworks that have been accepted by other similarly situated federally regulated financial institutions in Skybridge's client portfolio. The proposed structure provides a meaningful minimum floor of $5,000,000, ensuring that Meridian has access to substantive recovery in all circumstances, while scaling the cap to the commercial value of the relationship between the parties as measured by fees paid. We believe this approach appropriately aligns the risk assumed by Skybridge under the DPA with the economic value of the services provided and the fees received.

The Liability Cap applies to all claims arising under or in connection with the DPA, whether in contract, tort (including negligence), strict liability, or otherwise, subject to the limited carve-outs discussed below in connection with the indemnification provisions. Skybridge is prepared to discuss the scope and application of the Liability Cap in greater detail with your team, including potential carve-outs for specific categories of loss such as willful misconduct or fraud, which are addressed separately in the Counter-Proposal DPA.

2. Indemnification Provisions

Skybridge has revised the indemnification provisions from those set forth in the Meridian Form DPA. Under the Counter-Proposal DPA, Skybridge shall indemnify, defend, and hold harmless Controller and its directors, officers, employees, and agents from and against any third-party claims, demands, suits, or proceedings arising from Skybridge's material breach of the DPA, including regulatory fines and penalties to the extent that such fines and penalties are permissible of indemnification under applicable law and are directly attributable to Skybridge's breach. The indemnification obligations of Skybridge are subject to the Liability Cap described in Section 1 above.

The Counter-Proposal DPA narrows the scope of indemnification relative to the Meridian Form DPA in several important respects. The Meridian Form DPA contained indemnification language that extended to first-party losses suffered by Meridian, consequential and incidental damages, and loss of profits, in each case without adequate limitation or any nexus requirement to Skybridge's breach. Skybridge's position is that indemnification provisions in a data processing agreement should be tied to demonstrable third-party claims and regulatory actions that are directly caused by Skybridge's breach of its obligations as Processor, rather than serving as an uncapped guarantee of all downstream losses, business interruption costs, or diminution in value that Meridian may experience in connection with a data security event.

The indemnification framework in the Counter-Proposal DPA is designed to work in conjunction with the cyber-liability insurance coverage that Skybridge maintains with Bastion Mutual Insurance Company under Policy No. CYB-2025-04821, which provides coverage of Ten Million Dollars ($10,000,000) per occurrence and Twenty Million Dollars ($20,000,000) in the aggregate. The availability of this insurance backstop provides Meridian with additional assurance that Skybridge's indemnification obligations will be adequately supported. We note that a certificate of insurance can be provided to Meridian upon execution of the DPA, and Skybridge has agreed in the Counter-Proposal DPA to name Meridian as an additional insured on the cyber-liability policy upon Meridian's request.

3. Breach Notification Timeline

The Counter-Proposal DPA provides that Skybridge shall notify Meridian of a Personal Data Breach without undue delay and in any event within forty-eight (48) hours of Skybridge becoming aware of such breach (with "awareness" defined as the point at which a senior officer of Skybridge's information security team has confirmed that a security incident constitutes a Personal Data Breach within the meaning of the DPA). The forty-eight (48)-hour notification timeline is consistent with the requirements communicated by Meridian's Third-Party Risk Management program as set forth in the vendor due-diligence questionnaire received from your firm on November 25, 2025, and Skybridge is comfortable committing to this timeline.

We note that this notification timeline pertains solely to Skybridge's obligation to notify Meridian as its customer and as the Controller with respect to the personal data at issue. Meridian's separate and independent obligation to notify its primary federal regulators — specifically, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation — within thirty-six (36) hours under the Computer-Security Incident Notification Rule (12 C.F.R. Part 53, applicable to national banks and federal savings associations; 12 C.F.R. Part 304, applicable to FDIC-supervised institutions) for qualifying "notification incidents" is expressly preserved and referenced in Schedule D (Data Breach Notification Procedures) of the Counter-Proposal DPA. The forty-eight (48)-hour Skybridge-to-Meridian notification window is designed to provide Meridian with sufficient lead time to evaluate whether a particular breach triggers its own regulatory notification obligations and to prepare any required filings.

Schedule D of the Counter-Proposal DPA includes a detailed escalation matrix identifying the contact persons and communication channels for breach notification, as well as content requirements for the initial breach notice that Skybridge will provide to Meridian. These content requirements are designed to ensure that Meridian receives sufficient information in Skybridge's initial notification to assess the nature and scope of the breach, the categories and approximate number of data subjects affected, the categories of personal data compromised, and the measures taken or proposed to be taken by Skybridge to address the breach and mitigate its effects. This information is intended to facilitate Meridian's own regulatory notification obligations, internal incident response procedures, and any communications that Meridian may be required to make to affected data subjects.

4. Sub-Processor Approval Mechanics

The Counter-Proposal DPA adopts a general written authorization model for sub-processor engagement, pursuant to which Meridian authorizes Skybridge to engage sub-processors for the purpose of performing specific processing activities on behalf of Meridian, subject to a requirement that Skybridge provide Meridian with thirty (30) days' prior written notice before engaging any new sub-processor or making material changes to existing sub-processor arrangements. The written notice shall identify the proposed sub-processor, describe the processing activities to be performed by such sub-processor, specify the location(s) of processing, and confirm that appropriate data protection agreements are in place. Meridian retains the right to object to any proposed new sub-processor during the thirty (30)-day notice period on reasonable grounds relating to data protection, and the Counter-Proposal DPA sets forth a resolution mechanism in the event of such objection.

This general authorization model replaces the specific prior written consent model set forth in the Meridian Form DPA, under which Skybridge would have been required to obtain Meridian's affirmative written consent before engaging or changing any sub-processor. While Skybridge understands Meridian's interest in maintaining visibility and control over the sub-processing chain, the specific prior consent model would be operationally impractical for Skybridge given that the Counter-Proposal DPA is structured to serve as Skybridge's template for all bank clients and the sub-processor infrastructure supporting the platform is shared across Skybridge's entire client base. The general authorization model with a thirty (30)-day notice and objection right is consistent with the approach contemplated by Article 28(2) of the General Data Protection Regulation ("GDPR") and is the prevailing market approach among enterprise SaaS providers serving the financial services sector.

Schedule C (Approved Sub-Processor List) of the Counter-Proposal DPA identifies Skybridge's current sub-processors as of the date of the Counter-Proposal DPA:

(i) Osprey Cloud Infrastructure, Inc. — providing infrastructure-as-a-service ("IaaS") and platform-as-a-service ("PaaS") hosting services, with data processing occurring at Osprey Cloud's US-East data center located in Ashburn, Virginia and, for personal data relating to EU-resident data subjects, at Osprey Cloud's EU data center located in Frankfurt, Germany; and

(ii) Skybridge Fintech Europe B.V. — a wholly owned subsidiary of Skybridge Fintech Ltd., incorporated and domiciled in Amsterdam, the Netherlands, performing EU personal data processing activities on behalf of Skybridge in connection with the provision of the SaaS platform to Controller.

With respect to flow-down obligations, the Counter-Proposal DPA provides that Skybridge shall impose on each sub-processor, by way of a written agreement, data protection obligations that are materially consistent with those imposed on Skybridge under the DPA. This requirement is designed to ensure continuity of data protection obligations throughout the sub-processing chain and to comply with the sub-contractor oversight requirements set forth in OCC Bulletin 2023-17, which provides that banking organizations should ensure that contracts with third parties include provisions addressing the use of subcontractors and the imposition of appropriate risk management requirements on such subcontractors. Skybridge has an existing data processing agreement with Osprey Cloud Infrastructure, Inc. dated March 1, 2024, which includes Module 3 Standard Contractual Clauses (processor-to-sub-processor) addressing the transfer of personal data from Skybridge to Osprey Cloud. A copy of the Skybridge–Osprey Cloud DPA (with commercially sensitive pricing terms redacted) can be made available for Meridian's review upon request.

5. Audit Rights Framework

The Counter-Proposal DPA provides that Meridian, or its authorized representatives, or its federal banking regulators (including the OCC, the FDIC, and the Consumer Financial Protection Bureau ("CFPB")) may audit Skybridge's data processing activities and facilities upon thirty (30) days' advance written notice to Skybridge, subject to the terms and conditions set forth below. Audits conducted by or on behalf of Meridian (as distinct from regulatory examinations) are limited to no more than one (1) audit per twelve (12)-month period during the term of the DPA, unless an additional audit is triggered by (a) a Personal Data Breach affecting Meridian's personal data, (b) a regulatory inquiry or examination directed at Meridian that requires additional information from Skybridge, or (c) a material change in applicable law or regulation imposing new audit or oversight requirements on Meridian with respect to its technology service providers. Audits conducted by or on behalf of Meridian shall be conducted at Controller's sole expense, including any fees, costs, and out-of-pocket expenses incurred by Skybridge in connection with facilitating such audit.

In lieu of or in addition to an on-site audit, Skybridge may, at its election, satisfy Meridian's audit requests by providing Meridian with: (a) Skybridge's current SOC 2 Type II report (the most recent report having been issued by Graystone & Ketchum LLP, Certified Public Accountants, dated September 15, 2025, covering the audit period from October 1, 2024 through September 15, 2025); (b) supplemental written responses to Meridian's audit questionnaire or information requests; and (c) such additional documentation as may be reasonably required by Meridian to assess Skybridge's compliance with its obligations under the DPA. Skybridge believes that the availability of its independently audited SOC 2 Type II report, combined with the detailed security and compliance information set forth in Schedule B and Skybridge's responsiveness to supplemental information requests, will in most cases satisfy Meridian's audit and oversight objectives without the operational disruption and confidentiality concerns associated with on-site inspections.

The Meridian Form DPA's unlimited audit rights — including the right to conduct unannounced on-site inspections of Skybridge's facilities and systems at any time during business hours — have been replaced with the structured framework described above. Skybridge's position is that unlimited and unannounced audit rights are inconsistent with the operational realities of a multi-tenant SaaS platform on which Skybridge hosts multiple bank clients, each of which has its own confidentiality requirements and regulatory oversight obligations. Permitting unannounced on-site access by one client or its representatives could compromise the confidentiality of other clients' data and disrupt Skybridge's operations. The structured framework in the Counter-Proposal DPA is designed to balance Meridian's legitimate regulatory oversight obligations with Skybridge's operational integrity and confidentiality concerns.

Importantly, the Counter-Proposal DPA expressly preserves and in no way limits the rights of Meridian's federal banking regulators — including the OCC, the FDIC, and the CFPB — to examine, audit, or inspect Skybridge as a technology service provider under applicable law and regulation, including without limitation the Bank Service Company Act (12 U.S.C. § 1867(c)), OCC Bulletin 2023-17, and any successor guidance or regulation. The annual frequency limitation and advance notice requirements applicable to Meridian-initiated audits do not apply to regulatory examinations. Skybridge is committed to full cooperation with Meridian's regulators and understands the importance of maintaining robust regulatory access rights in the context of a bank-vendor relationship.

Additional Provisions of Note

In addition to the key departures summarized above, we wish to draw your attention to the following provisions of the Counter-Proposal DPA:

Governing Law. The Counter-Proposal DPA is governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles. This governing law provision is consistent with Skybridge's state of incorporation and, we understand, with the governing law provision of the underlying SaaS subscription agreement currently under negotiation between the parties. The Standard Contractual Clauses incorporated into the DPA are governed by the law of the Netherlands pursuant to Clause 17 of the SCCs, reflecting the EU Member State in which Skybridge Fintech Europe B.V. is established. Any disputes arising under the SCCs shall be resolved before the courts of Amsterdam, the Netherlands, in accordance with Clause 18 of the SCCs.

Data Retention. The Counter-Proposal DPA provides that Skybridge shall process and retain personal data only for the duration of the SaaS subscription agreement and for a period of ninety (90) days following the effective date of termination or expiration of the subscription agreement. During the ninety (90)-day post-termination period, Skybridge shall, at Meridian's election and written instruction, either (a) return all personal data to Meridian in a commonly used, machine-readable format, or (b) securely delete and destroy all copies of personal data in Skybridge's possession or control, and provide written certification of such deletion. Notwithstanding the foregoing, Skybridge may retain personal data beyond the ninety (90)-day post-termination period to the extent required by applicable law, regulation, or legal hold obligation, provided that any such retained data remains subject to the confidentiality and security obligations of the DPA.

Insurance. The Counter-Proposal DPA includes a covenant by Skybridge to maintain cyber-liability insurance coverage with per-occurrence coverage of no less than Ten Million Dollars ($10,000,000) and aggregate coverage of no less than Twenty Million Dollars ($20,000,000) throughout the term of the DPA, with an obligation to provide Meridian with a certificate of insurance upon request and to provide thirty (30) days' advance written notice of any material change in, cancellation of, or failure to renew such coverage.

Security Standards. The Counter-Proposal DPA requires Skybridge to implement and maintain throughout the term of the DPA, at a minimum, the following technical and organizational security measures, as further described in Schedule B: (i) current SOC 2 Type II certification; (ii) AES-256 encryption for personal data at rest; (iii) TLS 1.2 or higher encryption for personal data in transit; (iv) multi-factor authentication for all administrative and privileged access to systems processing personal data; and (v) annual penetration testing conducted by a qualified independent third-party security firm (Skybridge currently engages Ironvault Security Group LLC for this purpose). These measures are designed to meet or exceed the technical safeguard requirements applicable to Skybridge's financial institution clients and are consistent with the security standards referenced in the FFIEC's Information Technology Examination Handbook and NIST Cybersecurity Framework.

DPIA Cooperation. Skybridge agrees to provide reasonable assistance to Meridian in connection with Data Protection Impact Assessments ("DPIAs") to the extent that such assessments are required under applicable data protection law (including Article 35 of the GDPR) and relate to the processing activities performed by Skybridge on behalf of Meridian. Skybridge shall provide such assistance at Meridian's reasonable request and at Meridian's expense, taking into account the nature of the processing and the information available to Skybridge.

Standard Contractual Clauses. The Counter-Proposal DPA incorporates the Standard Contractual Clauses adopted pursuant to European Commission Implementing Decision (EU) 2021/914 of June 4, 2021, as follows: Module 2 (Controller-to-Processor) governs the transfer of personal data from Meridian (as Controller, established in the United States) to Skybridge (as Processor, established in the United States and processing on behalf of Controller using infrastructure located in part outside the European Economic Area); Module 3 (Processor-to-Sub-processor) governs the onward transfer of personal data from Skybridge to its sub-processors, including Osprey Cloud Infrastructure, Inc. and Skybridge Fintech Europe B.V. The SCCs are intended to provide an adequate safeguard under Chapter V of the GDPR for the transfer of personal data relating to Meridian's approximately 3,200 EU-resident accountholders whose personal data is processed through the Skybridge platform. Draft Annexes I (List of Parties and Description of Transfer), II (Technical and Organizational Measures), and III (List of Sub-processors) are included in the enclosed package but will require further refinement and finalization as the parties confirm the specific parameters of the data processing relationship during the course of negotiations.

Proposed Next Steps

We respectfully request that Blackwell, Raines & Stoddard and Meridian's internal team review the Counter-Proposal DPA and provide a markup or written comments at their earliest convenience. We recognize that your client's team will need adequate time for a thorough review, particularly given the technical and regulatory complexity of several of the provisions addressed above.

To that end, we propose scheduling a call during the week of January 6, 2026, to discuss any substantive issues identified during your review, with the aim of resolving the key commercial and legal points as efficiently as possible. We are flexible with respect to timing and participants and would suggest that the call include representatives from both outside counsel teams as well as the relevant client-side stakeholders.

As you are aware, the parties share a target of executing the DPA and the complete SCC package by February 15, 2026, concurrent with the execution of the SaaS subscription agreement. We believe that adherence to the review and discussion timeline proposed above will position the parties well to meet this target, and we are committed to working collaboratively with your team to do so.

In the interim, please do not hesitate to contact me directly at (215) 555-7438 or at kostrowski@calderwoodharkness.com with any questions regarding the enclosed Counter-Proposal DPA or any aspect of this transmittal letter. My colleagues Priscilla Wynn and Alan Burke are also available to assist and can be reached through our main office line.

Closing

Skybridge values the prospective relationship with Meridian and is committed to establishing a robust, comprehensive, and commercially balanced data processing framework that satisfies Meridian's regulatory requirements, risk management objectives, and operational needs. We welcome the opportunity to discuss the Counter-Proposal DPA with you and your client at Blackwell, Raines & Stoddard's and Meridian's convenience and look forward to a productive negotiation process.

Nothing in this letter or in the enclosed Counter-Proposal DPA constitutes a waiver of any rights, claims, or defenses of Skybridge Fintech Ltd., all of which are expressly reserved. The enclosed Counter-Proposal DPA is transmitted for purposes of negotiation only and does not constitute a binding offer or acceptance.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security

Enclosure: Skybridge Fintech Ltd. — Customer-Facing Data Processing Agreement (Counter-Proposal Clean Draft), including Schedule A (Description of Processing Activities), Schedule B (Technical and Organizational Security Measures), Schedule C (Approved Sub-Processor List), Schedule D (Data Breach Notification Procedures), and Draft Standard Contractual Clauses (Modules 2 and 3) with Annexes I–III

cc: (via email)

Thomas Elridge, General Counsel & Chief Privacy Officer, Skybridge Fintech Ltd. Rebecca Muñoz, Chief Information Security Officer, Skybridge Fintech Ltd. Priscilla Wynn, Esq., Calderwood & Harkness LLP Alan Burke, Esq., Calderwood & Harkness LLP Derek Faulkner, Esq., Blackwell, Raines & Stoddard LLP

This communication, including all enclosures, is intended solely for the use of the addressee(s) and may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately and destroy all copies.

CALDERWOOD & HARKNESS LLP Attorneys at Law
1735 Market Street, Suite 2800 Philadelphia, PA 19103
Telephone: (215) 555-7400 Facsimile: (215) 555-7401 www.calderwoodharkness.com
Kevin Ostrowski Partner, Privacy & Data Security Direct: (215) 555-7438
Email: kostrowski@calderwoodharkness.com
December 12, 2025
VIA EMAIL AND ELECTRONIC DOCUMENT TRANSFER
Constance Liu, Esq. Partner, Financial Services / Data Privacy Blackwell, Raines & Stoddard LLP 200 Park Avenue, 31st Floor New York, NY 10166
Re: Data Processing Agreement — Skybridge Fintech Ltd. (Processor) and Meridian Federal Savings Bank (Controller) Calderwood & Harkness Matter No. 1009-00004
Dear Ms. Liu:
On behalf of our client, Skybridge Fintech Ltd. ("Skybridge"), please find enclosed Skybridge's clean counter-proposal Data Processing Agreement (the "Counter-Proposal DPA" or the "Skybridge DPA") for the data processing relationship between Meridian Federal Savings Bank ("Meridian," as Controller) and Skybridge (as Processor). The Counter-Proposal DPA is transmitted as a clean document intended to serve as the basis for further negotiation between the parties, replacing in its entirety the form Data Processing Agreement received from your firm on November 25, 2025 (the "Meridian Form DPA").
As a preliminary matter, we wish to note that the Counter-Proposal DPA is structured on the basis of Skybridge's standard bank-grade template, which has been specifically designed to be consistent with the third-party risk management requirements applicable to Skybridge's regulated financial institution clients, including alignment with the Office of the Comptroller of the Currency's Bulletin 2023-17 (Third-Party Relationships: Risk Management) and the Federal Financial Institutions Examination Council ("FFIEC") guidance on technology service providers. At the same time, the Counter-Proposal DPA reflects balanced risk allocation appropriate for a SaaS vendor–bank relationship, taking into account the respective roles and obligations of each party and the commercial realities of Skybridge's multi-tenant platform architecture. We believe this approach provides Meridian with the substantive protections and regulatory compliance assurances it requires while establishing a framework that is operationally sustainable for Skybridge.
The enclosed package comprises the following documents: (i) the main body of the Counter-Proposal DPA; (ii) draft Schedules A through D (Schedule A — Description of Processing Activities; Schedule B — Technical and Organizational Security Measures; Schedule C — Approved Sub-Processor List; and Schedule D — Data Breach Notification Procedures); and (iii) placeholder Standard Contractual Clauses pursuant to European Commission Implementing Decision (EU) 2021/914 (Modules 2 and 3) with draft Annexes I through III, which will be finalized as negotiations progress and the parties confirm the specific categories of data subjects, personal data, and technical and organizational measures applicable to the Meridian engagement.
Summary of Key Departures from the Meridian Form DPA
While many of the provisions in the Meridian Form DPA have been incorporated into or adapted within the Counter-Proposal DPA, Skybridge's Counter-Proposal DPA departs from the Meridian Form DPA in several material respects. These departures are summarized below for your convenience and to facilitate efficient review by your client's team, including Ms. Hartwell, Ms. Sokolov, and Mr. Tibaldi. We would welcome the opportunity to discuss each of these items in greater detail at the parties' mutual convenience.
1. Liability Cap Structure
The Counter-Proposal DPA establishes a liability cap equal to the greater of (a) Five Million Dollars ($5,000,000) or (b) two times (2×) the aggregate fees actually paid by Controller to Processor in the twelve (12)-month period immediately preceding the event or series of related events giving rise to the claim (the "Liability Cap"). For the Meridian engagement specifically, based on the annual contract value of Two Million Seven Hundred Forty Thousand Dollars ($2,740,000) under the SaaS subscription agreement currently under negotiation between the parties, this formula yields a Liability Cap of Five Million Four Hundred Eighty Thousand Dollars ($5,480,000) (i.e., 2 × $2,740,000), which exceeds the $5,000,000 floor.
This Liability Cap structure replaces the uncapped liability framework set forth in the Meridian Form DPA. Skybridge's position is that its proposed approach reflects market-standard practice in bank-vendor data processing agreements and is consistent with liability frameworks that have been accepted by other similarly situated federally regulated financial institutions in Skybridge's client portfolio. The proposed structure provides a meaningful minimum floor of $5,000,000, ensuring that Meridian has access to substantive recovery in all circumstances, while scaling the cap to the commercial value of the relationship between the parties as measured by fees paid. We believe this approach appropriately aligns the risk assumed by Skybridge under the DPA with the economic value of the services provided and the fees received.
The Liability Cap applies to all claims arising under or in connection with the DPA, whether in contract, tort (including negligence), strict liability, or otherwise, subject to the limited carve-outs discussed below in connection with the indemnification provisions. Skybridge is prepared to discuss the scope and application of the Liability Cap in greater detail with your team, including potential carve-outs for specific categories of loss such as willful misconduct or fraud, which are addressed separately in the Counter-Proposal DPA.
2. Indemnification Provisions
Skybridge has revised the indemnification provisions from those set forth in the Meridian Form DPA. Under the Counter-Proposal DPA, Skybridge shall indemnify, defend, and hold harmless Controller and its directors, officers, employees, and agents from and against any third-party claims, demands, suits, or proceedings arising from Skybridge's material breach of the DPA, including regulatory fines and penalties to the extent that such fines and penalties are permissible of indemnification under applicable law and are directly attributable to Skybridge's breach. The indemnification obligations of Skybridge are subject to the Liability Cap described in Section 1 above.
The Counter-Proposal DPA narrows the scope of indemnification relative to the Meridian Form DPA in several important respects. The Meridian Form DPA contained indemnification language that extended to first-party losses suffered by Meridian, consequential and incidental damages, and loss of profits, in each case without adequate limitation or any nexus requirement to Skybridge's breach. Skybridge's position is that indemnification provisions in a data processing agreement should be tied to demonstrable third-party claims and regulatory actions that are directly caused by Skybridge's breach of its obligations as Processor, rather than serving as an uncapped guarantee of all downstream losses, business interruption costs, or diminution in value that Meridian may experience in connection with a data security event.
The indemnification framework in the Counter-Proposal DPA is designed to work in conjunction with the cyber-liability insurance coverage that Skybridge maintains with Bastion Mutual Insurance Company under Policy No. CYB-2025-04821, which provides coverage of Ten Million Dollars ($10,000,000) per occurrence and Twenty Million Dollars ($20,000,000) in the aggregate. The availability of this insurance backstop provides Meridian with additional assurance that Skybridge's indemnification obligations will be adequately supported. We note that a certificate of insurance can be provided to Meridian upon execution of the DPA, and Skybridge has agreed in the Counter-Proposal DPA to name Meridian as an additional insured on the cyber-liability policy upon Meridian's request.
3. Breach Notification Timeline
The Counter-Proposal DPA provides that Skybridge shall notify Meridian of a Personal Data Breach without undue delay and in any event within forty-eight (48) hours of Skybridge becoming aware of such breach (with "awareness" defined as the point at which a senior officer of Skybridge's information security team has confirmed that a security incident constitutes a Personal Data Breach within the meaning of the DPA). The forty-eight (48)-hour notification timeline is consistent with the requirements communicated by Meridian's Third-Party Risk Management program as set forth in the vendor due-diligence questionnaire received from your firm on November 25, 2025, and Skybridge is comfortable committing to this timeline.
We note that this notification timeline pertains solely to Skybridge's obligation to notify Meridian as its customer and as the Controller with respect to the personal data at issue. Meridian's separate and independent obligation to notify its primary federal regulators — specifically, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation — within thirty-six (36) hours under the Computer-Security Incident Notification Rule (12 C.F.R. Part 53, applicable to national banks and federal savings associations; 12 C.F.R. Part 304, applicable to FDIC-supervised institutions) for qualifying "notification incidents" is expressly preserved and referenced in Schedule D (Data Breach Notification Procedures) of the Counter-Proposal DPA. The forty-eight (48)-hour Skybridge-to-Meridian notification window is designed to provide Meridian with sufficient lead time to evaluate whether a particular breach triggers its own regulatory notification obligations and to prepare any required filings.
Schedule D of the Counter-Proposal DPA includes a detailed escalation matrix identifying the contact persons and communication channels for breach notification, as well as content requirements for the initial breach notice that Skybridge will provide to Meridian. These content requirements are designed to ensure that Meridian receives sufficient information in Skybridge's initial notification to assess the nature and scope of the breach, the categories and approximate number of data subjects affected, the categories of personal data compromised, and the measures taken or proposed to be taken by Skybridge to address the breach and mitigate its effects. This information is intended to facilitate Meridian's own regulatory notification obligations, internal incident response procedures, and any communications that Meridian may be required to make to affected data subjects.
4. Sub-Processor Approval Mechanics
The Counter-Proposal DPA adopts a general written authorization model for sub-processor engagement, pursuant to which Meridian authorizes Skybridge to engage sub-processors for the purpose of performing specific processing activities on behalf of Meridian, subject to a requirement that Skybridge provide Meridian with thirty (30) days' prior written notice before engaging any new sub-processor or making material changes to existing sub-processor arrangements. The written notice shall identify the proposed sub-processor, describe the processing activities to be performed by such sub-processor, specify the location(s) of processing, and confirm that appropriate data protection agreements are in place. Meridian retains the right to object to any proposed new sub-processor during the thirty (30)-day notice period on reasonable grounds relating to data protection, and the Counter-Proposal DPA sets forth a resolution mechanism in the event of such objection.
This general authorization model replaces the specific prior written consent model set forth in the Meridian Form DPA, under which Skybridge would have been required to obtain Meridian's affirmative written consent before engaging or changing any sub-processor. While Skybridge understands Meridian's interest in maintaining visibility and control over the sub-processing chain, the specific prior consent model would be operationally impractical for Skybridge given that the Counter-Proposal DPA is structured to serve as Skybridge's template for all bank clients and the sub-processor infrastructure supporting the platform is shared across Skybridge's entire client base. The general authorization model with a thirty (30)-day notice and objection right is consistent with the approach contemplated by Article 28(2) of the General Data Protection Regulation ("GDPR") and is the prevailing market approach among enterprise SaaS providers serving the financial services sector.
Schedule C (Approved Sub-Processor List) of the Counter-Proposal DPA identifies Skybridge's current sub-processors as of the date of the Counter-Proposal DPA:
(i) Osprey Cloud Infrastructure, Inc. — providing infrastructure-as-a-service ("IaaS") and platform-as-a-service ("PaaS") hosting services, with data processing occurring at Osprey Cloud's US-East data center located in Ashburn, Virginia and, for personal data relating to EU-resident data subjects, at Osprey Cloud's EU data center located in Frankfurt, Germany; and
(ii) Skybridge Fintech Europe B.V. — a wholly owned subsidiary of Skybridge Fintech Ltd., incorporated and domiciled in Amsterdam, the Netherlands, performing EU personal data processing activities on behalf of Skybridge in connection with the provision of the SaaS platform to Controller.
With respect to flow-down obligations, the Counter-Proposal DPA provides that Skybridge shall impose on each sub-processor, by way of a written agreement, data protection obligations that are materially consistent with those imposed on Skybridge under the DPA. This requirement is designed to ensure continuity of data protection obligations throughout the sub-processing chain and to comply with the sub-contractor oversight requirements set forth in OCC Bulletin 2023-17, which provides that banking organizations should ensure that contracts with third parties include provisions addressing the use of subcontractors and the imposition of appropriate risk management requirements on such subcontractors. Skybridge has an existing data processing agreement with Osprey Cloud Infrastructure, Inc. dated March 1, 2024, which includes Module 3 Standard Contractual Clauses (processor-to-sub-processor) addressing the transfer of personal data from Skybridge to Osprey Cloud. A copy of the Skybridge–Osprey Cloud DPA (with commercially sensitive pricing terms redacted) can be made available for Meridian's review upon request.
5. Audit Rights Framework
The Counter-Proposal DPA provides that Meridian, or its authorized representatives, or its federal banking regulators (including the OCC, the FDIC, and the Consumer Financial Protection Bureau ("CFPB")) may audit Skybridge's data processing activities and facilities upon thirty (30) days' advance written notice to Skybridge, subject to the terms and conditions set forth below. Audits conducted by or on behalf of Meridian (as distinct from regulatory examinations) are limited to no more than one (1) audit per twelve (12)-month period during the term of the DPA, unless an additional audit is triggered by (a) a Personal Data Breach affecting Meridian's personal data, (b) a regulatory inquiry or examination directed at Meridian that requires additional information from Skybridge, or (c) a material change in applicable law or regulation imposing new audit or oversight requirements on Meridian with respect to its technology service providers. Audits conducted by or on behalf of Meridian shall be conducted at Controller's sole expense, including any fees, costs, and out-of-pocket expenses incurred by Skybridge in connection with facilitating such audit.
In lieu of or in addition to an on-site audit, Skybridge may, at its election, satisfy Meridian's audit requests by providing Meridian with: (a) Skybridge's current SOC 2 Type II report (the most recent report having been issued by Graystone & Ketchum LLP, Certified Public Accountants, dated September 15, 2025, covering the audit period from October 1, 2024 through September 15, 2025); (b) supplemental written responses to Meridian's audit questionnaire or information requests; and (c) such additional documentation as may be reasonably required by Meridian to assess Skybridge's compliance with its obligations under the DPA. Skybridge believes that the availability of its independently audited SOC 2 Type II report, combined with the detailed security and compliance information set forth in Schedule B and Skybridge's responsiveness to supplemental information requests, will in most cases satisfy Meridian's audit and oversight objectives without the operational disruption and confidentiality concerns associated with on-site inspections.
The Meridian Form DPA's unlimited audit rights — including the right to conduct unannounced on-site inspections of Skybridge's facilities and systems at any time during business hours — have been replaced with the structured framework described above. Skybridge's position is that unlimited and unannounced audit rights are inconsistent with the operational realities of a multi-tenant SaaS platform on which Skybridge hosts multiple bank clients, each of which has its own confidentiality requirements and regulatory oversight obligations. Permitting unannounced on-site access by one client or its representatives could compromise the confidentiality of other clients' data and disrupt Skybridge's operations. The structured framework in the Counter-Proposal DPA is designed to balance Meridian's legitimate regulatory oversight obligations with Skybridge's operational integrity and confidentiality concerns.
Importantly, the Counter-Proposal DPA expressly preserves and in no way limits the rights of Meridian's federal banking regulators — including the OCC, the FDIC, and the CFPB — to examine, audit, or inspect Skybridge as a technology service provider under applicable law and regulation, including without limitation the Bank Service Company Act (12 U.S.C. § 1867(c)), OCC Bulletin 2023-17, and any successor guidance or regulation. The annual frequency limitation and advance notice requirements applicable to Meridian-initiated audits do not apply to regulatory examinations. Skybridge is committed to full cooperation with Meridian's regulators and understands the importance of maintaining robust regulatory access rights in the context of a bank-vendor relationship.
Additional Provisions of Note
In addition to the key departures summarized above, we wish to draw your attention to the following provisions of the Counter-Proposal DPA:
Governing Law. The Counter-Proposal DPA is governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles. This governing law provision is consistent with Skybridge's state of incorporation and, we understand, with the governing law provision of the underlying SaaS subscription agreement currently under negotiation between the parties. The Standard Contractual Clauses incorporated into the DPA are governed by the law of the Netherlands pursuant to Clause 17 of the SCCs, reflecting the EU Member State in which Skybridge Fintech Europe B.V. is established. Any disputes arising under the SCCs shall be resolved before the courts of Amsterdam, the Netherlands, in accordance with Clause 18 of the SCCs.
Data Retention. The Counter-Proposal DPA provides that Skybridge shall process and retain personal data only for the duration of the SaaS subscription agreement and for a period of ninety (90) days following the effective date of termination or expiration of the subscription agreement. During the ninety (90)-day post-termination period, Skybridge shall, at Meridian's election and written instruction, either (a) return all personal data to Meridian in a commonly used, machine-readable format, or (b) securely delete and destroy all copies of personal data in Skybridge's possession or control, and provide written certification of such deletion. Notwithstanding the foregoing, Skybridge may retain personal data beyond the ninety (90)-day post-termination period to the extent required by applicable law, regulation, or legal hold obligation, provided that any such retained data remains subject to the confidentiality and security obligations of the DPA.
Insurance. The Counter-Proposal DPA includes a covenant by Skybridge to maintain cyber-liability insurance coverage with per-occurrence coverage of no less than Ten Million Dollars ($10,000,000) and aggregate coverage of no less than Twenty Million Dollars ($20,000,000) throughout the term of the DPA, with an obligation to provide Meridian with a certificate of insurance upon request and to provide thirty (30) days' advance written notice of any material change in, cancellation of, or failure to renew such coverage.
Security Standards. The Counter-Proposal DPA requires Skybridge to implement and maintain throughout the term of the DPA, at a minimum, the following technical and organizational security measures, as further described in Schedule B: (i) current SOC 2 Type II certification; (ii) AES-256 encryption for personal data at rest; (iii) TLS 1.2 or higher encryption for personal data in transit; (iv) multi-factor authentication for all administrative and privileged access to systems processing personal data; and (v) annual penetration testing conducted by a qualified independent third-party security firm (Skybridge currently engages Ironvault Security Group LLC for this purpose). These measures are designed to meet or exceed the technical safeguard requirements applicable to Skybridge's financial institution clients and are consistent with the security standards referenced in the FFIEC's Information Technology Examination Handbook and NIST Cybersecurity Framework.
DPIA Cooperation. Skybridge agrees to provide reasonable assistance to Meridian in connection with Data Protection Impact Assessments ("DPIAs") to the extent that such assessments are required under applicable data protection law (including Article 35 of the GDPR) and relate to the processing activities performed by Skybridge on behalf of Meridian. Skybridge shall provide such assistance at Meridian's reasonable request and at Meridian's expense, taking into account the nature of the processing and the information available to Skybridge.
Standard Contractual Clauses. The Counter-Proposal DPA incorporates the Standard Contractual Clauses adopted pursuant to European Commission Implementing Decision (EU) 2021/914 of June 4, 2021, as follows: Module 2 (Controller-to-Processor) governs the transfer of personal data from Meridian (as Controller, established in the United States) to Skybridge (as Processor, established in the United States and processing on behalf of Controller using infrastructure located in part outside the European Economic Area); Module 3 (Processor-to-Sub-processor) governs the onward transfer of personal data from Skybridge to its sub-processors, including Osprey Cloud Infrastructure, Inc. and Skybridge Fintech Europe B.V. The SCCs are intended to provide an adequate safeguard under Chapter V of the GDPR for the transfer of personal data relating to Meridian's approximately 3,200 EU-resident accountholders whose personal data is processed through the Skybridge platform. Draft Annexes I (List of Parties and Description of Transfer), II (Technical and Organizational Measures), and III (List of Sub-processors) are included in the enclosed package but will require further refinement and finalization as the parties confirm the specific parameters of the data processing relationship during the course of negotiations.
Proposed Next Steps
We respectfully request that Blackwell, Raines & Stoddard and Meridian's internal team review the Counter-Proposal DPA and provide a markup or written comments at their earliest convenience. We recognize that your client's team will need adequate time for a thorough review, particularly given the technical and regulatory complexity of several of the provisions addressed above.
To that end, we propose scheduling a call during the week of January 6, 2026, to discuss any substantive issues identified during your review, with the aim of resolving the key commercial and legal points as efficiently as possible. We are flexible with respect to timing and participants and would suggest that the call include representatives from both outside counsel teams as well as the relevant client-side stakeholders.
As you are aware, the parties share a target of executing the DPA and the complete SCC package by February 15, 2026, concurrent with the execution of the SaaS subscription agreement. We believe that adherence to the review and discussion timeline proposed above will position the parties well to meet this target, and we are committed to working collaboratively with your team to do so.
In the interim, please do not hesitate to contact me directly at (215) 555-7438 or at kostrowski@calderwoodharkness.com with any questions regarding the enclosed Counter-Proposal DPA or any aspect of this transmittal letter. My colleagues Priscilla Wynn and Alan Burke are also available to assist and can be reached through our main office line.
Closing
Skybridge values the prospective relationship with Meridian and is committed to establishing a robust, comprehensive, and commercially balanced data processing framework that satisfies Meridian's regulatory requirements, risk management objectives, and operational needs. We welcome the opportunity to discuss the Counter-Proposal DPA with you and your client at Blackwell, Raines & Stoddard's and Meridian's convenience and look forward to a productive negotiation process.
Nothing in this letter or in the enclosed Counter-Proposal DPA constitutes a waiver of any rights, claims, or defenses of Skybridge Fintech Ltd., all of which are expressly reserved. The enclosed Counter-Proposal DPA is transmitted for purposes of negotiation only and does not constitute a binding offer or acceptance.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security
Enclosure: Skybridge Fintech Ltd. — Customer-Facing Data Processing Agreement (Counter-Proposal Clean Draft), including Schedule A (Description of Processing Activities), Schedule B (Technical and Organizational Security Measures), Schedule C (Approved Sub-Processor List), Schedule D (Data Breach Notification Procedures), and Draft Standard Contractual Clauses (Modules 2 and 3) with Annexes I–III
cc: (via email)
Thomas Elridge, General Counsel & Chief Privacy Officer, Skybridge Fintech Ltd. Rebecca Muñoz, Chief Information Security Officer, Skybridge Fintech Ltd. Priscilla Wynn, Esq., Calderwood & Harkness LLP Alan Burke, Esq., Calderwood & Harkness LLP Derek Faulkner, Esq., Blackwell, Raines & Stoddard LLP
This communication, including all enclosures, is intended solely for the use of the addressee(s) and may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately and destroy all copies.

CALDERWOOD & HARKNESS LLP Attorneys at Law

VIA EMAIL AND ELECTRONIC DOCUMENT TRANSFER

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts