1009-00004 · Skybridge Fintech Ltd · Correspondence

transmittal-letter-execution-package-020526.docx DOCUMENT Finance & Banking

14 / 35 ← → ✕

Contract analysis Extract to table

CALDERWOOD & HARKNESS LLP Attorneys at Law

1735 Market Street, Suite 2800 Philadelphia, PA 19103

Telephone: (215) 864-7200 Facsimile: (215) 864-7201 www.calderwoodharkness.com

Kevin Ostrowski Partner, Privacy & Data Security Direct: (215) 864-7238 kostrowski@calderwoodharkness.com

February 5, 2026

Via Email (cliu@blackwellraines.com) and Sundial Data Systems

Constance Liu, Esq. Partner Blackwell, Raines & Stoddard LLP 200 Park Avenue, 31st Floor New York, NY 10166

Re: Execution-Ready Data Processing Agreement and Standard Contractual Clauses Package — Skybridge Fintech Ltd. / Meridian Federal Savings Bank Matter No.: 1009-00004

Dear Ms. Liu:

On behalf of our client, Skybridge Fintech Ltd. ("Skybridge" or "Processor"), we are pleased to transmit herewith the enclosed execution-ready Data Processing Agreement ("DPA") and Standard Contractual Clauses ("SCC") package for execution by Meridian Federal Savings Bank ("Meridian" or "Controller") and Skybridge. As you are aware, this package is the culmination of extensive and productive negotiations between our respective clients and their counsel, which commenced upon Skybridge's receipt of Meridian's form DPA from your office on November 25, 2025 and continued through multiple rounds of redlining, supplemental diligence, and the final resolution call held on January 30, 2026. The enclosed execution-ready documents reflect the agreed-upon terms on all material points, and we believe the package is now in final form suitable for execution by authorized representatives of both parties. Consistent with the timeline discussed between our firms and the parties' respective business teams, the DPA and SCC package is intended for concurrent execution with the five-year SaaS subscription agreement between Meridian and Skybridge (the "Subscription Agreement"), with a target execution date of February 15, 2026.

We set forth below a summary description of each enclosed document and its material terms, followed by certain requests regarding Meridian's review, approval, and execution logistics.

I. Data Processing Agreement — Execution Version

Enclosed is the execution-ready Data Processing Agreement, dated February 5, 2026, between Meridian Federal Savings Bank, in its capacity as Controller, and Skybridge Fintech Ltd., in its capacity as Processor, governing the processing of personal data by Skybridge in connection with the services provided under the Subscription Agreement. The DPA is governed by the laws of the State of Delaware, without regard to conflicts-of-law principles, consistent with the governing-law provision of the Subscription Agreement.

The DPA reflects the final resolution of all open items that were the subject of discussion during the January 30, 2026 resolution call among counsel and the parties' respective privacy and compliance teams. For your convenience, we summarize below the agreed positions on the principal negotiated terms:

Liability Cap (Section 8.2). The aggregate liability of Processor under the DPA is capped at the greater of (a) five million dollars ($5,000,000) or (b) two times (2×) the fees actually paid by Controller to Processor in the twelve (12) month period immediately preceding the event giving rise to the claim. Based on Meridian's annual contract value of $2,740,000 under the Subscription Agreement, the effective liability cap at initial execution is $5,480,000. This cap is subject to recalculation on a rolling twelve-month basis as fees are paid during the term, as agreed on the January 30 call.

Indemnification (Section 8.3). Skybridge has agreed to indemnify, defend, and hold harmless Meridian and its officers, directors, employees, and agents from and against any third-party claims, demands, suits, actions, or proceedings arising out of or relating to Skybridge's breach of the DPA, including, to the extent permissible under applicable law, regulatory fines and penalties imposed by competent supervisory authorities. This indemnification obligation is subject to the aggregate liability cap set forth in Section 8.2. Controller's corresponding indemnification obligations under Section 8.4 are reciprocal in scope, subject to the same cap structure.

Breach Notification (Section 5.1). Processor is obligated to notify Controller of any Personal Data Breach (as defined in the DPA, incorporating the definition under Article 4(12) of the GDPR and analogous state-law definitions) without undue delay, and in any event within forty-eight (48) hours of Processor's becoming aware of such breach. The notification must include, to the extent then reasonably available, the categories and approximate number of data subjects affected, the nature and likely consequences of the breach, and the measures taken or proposed to be taken to address the breach and mitigate its effects. Detailed breach notification procedures, including escalation contacts and communication protocols, are set forth in Schedule D to the DPA.

Sub-Processor Approval (Section 6). Processor has been granted a general written authorization from Controller to engage sub-processors for the processing of personal data, subject to the following conditions: (i) Processor shall provide Controller with at least thirty (30) days' prior written notice of any intended addition or replacement of a sub-processor; (ii) Controller shall have the right to object to such addition or replacement on reasonable grounds relating to the protection of personal data; and (iii) in the event of an unresolved objection, the parties shall engage in good-faith discussions to resolve the matter, with Controller retaining the right to terminate the DPA for convenience if no resolution is reached within fifteen (15) days of Controller's objection. Processor shall remain fully liable for the acts and omissions of its sub-processors as though such acts and omissions were those of Processor itself. The list of currently approved sub-processors is set forth in Schedule C.

Audit Rights (Section 7). Controller is entitled to conduct or commission audits of Processor's processing activities and security measures no more than once per twelve (12) month period, at Controller's sole cost and expense. This limitation does not apply in the event of a Personal Data Breach or a regulatory inquiry, investigation, or examination directed at Controller or Processor that necessitates additional audit activity. As the primary audit mechanism, Processor shall make available to Controller, upon request, its most recent SOC 2 Type II report. As discussed and agreed on the January 30 call, the DPA expressly preserves the right of Controller's federal banking regulators — including the Office of the Comptroller of the Currency ("OCC"), the Federal Deposit Insurance Corporation ("FDIC"), and the Consumer Financial Protection Bureau ("CFPB") — to examine and access Processor's facilities, systems, and records in accordance with applicable banking regulations, including OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance) and related interagency guidance. Nothing in the DPA shall be construed to limit or restrict such regulatory access rights.

Post-Termination Data Retention (Section 9.3). Following expiration or termination of the DPA or the Subscription Agreement (whichever occurs later), Processor shall, at Controller's election, return or securely delete all personal data processed on behalf of Controller within ninety (90) calendar days of receipt of Controller's written instructions. Processor shall certify in writing to Controller upon completion of the return or deletion, as applicable, and shall retain no copies of such personal data except to the extent required by applicable law, in which case Processor shall continue to maintain the confidentiality and security of such retained data.

Cyber-Liability Insurance (Section 10.4). Processor shall maintain in full force and effect throughout the term of the DPA a cyber-liability insurance policy providing coverage of not less than ten million dollars ($10,000,000) per occurrence, issued by a carrier with an A.M. Best rating of "A-" or better. Evidence of such coverage shall be provided to Controller upon execution and annually thereafter, and Processor shall provide Controller with not less than thirty (30) days' advance written notice of any material change to, cancellation of, or failure to renew such policy.

II. DPA Schedules

The following Schedules are appended to and form an integral part of the DPA:

Schedule A: Description of Processing. Schedule A sets forth a detailed description of the processing activities to be carried out by Processor on behalf of Controller, including: (i) the categories of data subjects, encompassing approximately 412,000 Meridian accountholders, authorized signers on deposit and lending accounts, beneficial owners identified pursuant to Meridian's Customer Identification Program and beneficial-ownership requirements, and Meridian employees whose data is processed through the SBF Core platform; (ii) the categories of personal data processed, including full legal name, Social Security number, date of birth, residential and mailing address, email address, telephone number, deposit and loan account numbers, transaction data (including payment amounts, dates, payees, and merchant category codes), IP addresses, device identifiers, behavioral biometric data (including keystroke dynamics, mouse movement patterns, and touchscreen interactions collected for anti-fraud and authentication purposes), and such other categories as may be specified in the Subscription Agreement; (iii) the purposes of processing, including payment processing, anti-fraud analytics and monitoring, regulatory reporting via the SBF Core platform, customer authentication, and such other purposes as are necessary for the provision of services under the Subscription Agreement; and (iv) the duration of processing, which shall be co-terminus with the term of the Subscription Agreement unless otherwise instructed in writing by Controller.

Schedule B: Security Measures. Schedule B describes the technical and organizational security measures implemented and maintained by Processor to protect personal data against unauthorized access, use, alteration, disclosure, or destruction. Key measures referenced in Schedule B include, without limitation: Processor's SOC 2 Type II certification, as most recently audited by Graystone & Ketchum LLP for the audit period of October 1, 2024 through September 15, 2025; AES-256 encryption for all personal data at rest; TLS 1.2 or higher encryption for all personal data in transit; multi-factor authentication ("MFA") for all administrative and privileged access to systems that process personal data; role-based access controls with least-privilege principles; network segmentation and intrusion detection systems; annual penetration testing conducted by an independent third-party security firm (currently Ironvault Security Group LLC); vulnerability management and patch management programs; and employee security awareness training. Processor's security measures are subject to continuous review and improvement, and any material reduction in the level of security shall require prior written notice to Controller.

Schedule C: Approved Sub-Processor List. Schedule C identifies the sub-processors currently approved for the processing of personal data on behalf of Controller, together with a description of each sub-processor's processing activities and location. The approved sub-processors are: (i) Osprey Cloud Infrastructure, Inc., providing infrastructure-as-a-service ("IaaS") and platform-as-a-service ("PaaS") hosting for the SBF Core platform, with data center regions located in the United States (US-East, Northern Virginia) and the European Union (Frankfurt, Germany); and (ii) Skybridge Fintech Europe B.V., Processor's wholly owned EU subsidiary, which processes personal data of EU-resident data subjects in Amsterdam, the Netherlands. Schedule C also incorporates the general authorization, thirty-day notice, and Controller objection mechanics described in Section 6 of the DPA.

Schedule D: Data Breach Notification Procedures. Schedule D sets forth the specific procedures, contacts, and escalation matrix applicable to Processor's notification obligations in the event of a Personal Data Breach, as described in Section 5.1 of the DPA. Schedule D provides for an initial notification within forty-eight (48) hours, supplemental written reports at twenty-four (24) hour intervals until the incident is resolved, and designated escalation contacts within both Processor's and Controller's security and privacy teams.

III. Standard Contractual Clauses — Full Execution-Ready Package

Enclosed is the execution-ready Standard Contractual Clauses package, prepared pursuant to the European Commission Implementing Decision (EU) 2021/914 of June 4, 2021, as published in the Official Journal of the European Union (OJ L 199, 7.6.2021, pp. 31–61). The SCC package is appended to and forms part of the DPA. The package incorporates the following modules:

Module 2 (Controller-to-Processor). This module governs the transfer of personal data from Meridian Federal Savings Bank, acting as data exporter and Controller, to Skybridge Fintech Ltd., acting as data importer and Processor. Module 2 addresses, among other things, the instructions of the Controller, the obligations of the Processor with respect to data security, sub-processing, international onward transfers, data subject rights, and supervisory authority cooperation.

Module 3 (Processor-to-Sub-processor) — Osprey Cloud Infrastructure, Inc. This module governs the onward transfer of personal data from Skybridge Fintech Ltd., acting as data exporter and Processor, to Osprey Cloud Infrastructure, Inc., acting as data importer and Sub-processor, in connection with the IaaS and PaaS hosting services provided by Osprey for the SBF Core platform.

Module 3 (Processor-to-Sub-processor) — Skybridge Fintech Europe B.V. This module governs the transfer of personal data from Skybridge Fintech Ltd. to its wholly owned EU subsidiary, Skybridge Fintech Europe B.V. (registered address: Keizersgracht 482, 1017 EG Amsterdam, the Netherlands; Kamer van Koophandel No. 82104593), in connection with the processing of personal data of EU-resident data subjects.

Pursuant to Clause 17 of the SCCs (Governing Law), the parties have selected the law of the Netherlands as the governing law for the SCCs, consistent with Skybridge Fintech Europe B.V.'s establishment as the EU entity and Processor's principal EU data-processing operations being located in the Netherlands. This selection ensures alignment with the supervisory authority competent for Processor's EU establishment.

The SCC package includes the following completed Annexes:

Annex I (Description of Transfer). Annex I was finalized by the parties on January 15, 2026, and describes the international data transfers covered by the SCCs. The transfer involves the personal data of approximately 3,200 EU-resident Meridian accountholders and encompasses approximately 18.6 million transactions per month processed through the SBF Core platform. Annex I further specifies the data exporter, data importer, categories of data subjects, categories of personal data, sensitive data (if any), the frequency of the transfer, the nature and purpose of the processing, and the period for which the data will be retained.

Annex II (Technical and Organizational Measures). Annex II was finalized by the parties on January 15, 2026, and sets forth a description of the technical and organizational measures implemented by the data importer(s) to ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the processing and the risks for the rights and freedoms of data subjects. The measures described in Annex II are consistent with and cross-reference the security measures detailed in Schedule B to the DPA.

Annex III (List of Sub-processors). Annex III was finalized by the parties on January 15, 2026, and identifies the sub-processors authorized to process personal data on behalf of the data importer, specifically Osprey Cloud Infrastructure, Inc. and Skybridge Fintech Europe B.V., together with a description of each sub-processor's processing activities, location, and contact details.

IV. Additional Enclosed and Supplementary Materials

For your reference and records, we note the following supplementary materials:

Skybridge maintains a current self-certification under the EU-U.S. Data Privacy Framework ("DPF"), Certification ID: DPF-2025-03912, effective as of July 1, 2025. Skybridge's DPF self-certification is listed on the Data Privacy Framework Program website maintained by the International Trade Administration of the U.S. Department of Commerce. While Skybridge's DPF certification supplements the transfer mechanism established by the SCCs and provides an additional legal basis for certain EU-to-U.S. personal data transfers, it does not replace or supersede the SCCs, which remain the primary transfer mechanism under the DPA.

In addition, Skybridge's current SOC 2 Type II report, issued on September 15, 2025 by Graystone & Ketchum LLP, and Skybridge's certificate of cyber-liability insurance issued by Bastion Mutual Insurance Company (Policy No. CYB-2025-04821, providing coverage of $10,000,000 per occurrence and $20,000,000 in the aggregate) will be delivered separately to Meridian as closing deliverables in advance of the February 15, 2026 execution date. We will coordinate delivery of these items with your office and Meridian's third-party risk management team.

V. Requested Actions by Meridian

In order to maintain the parties' agreed-upon timeline for execution on February 15, 2026, we respectfully request the following actions by Meridian and its counsel:

1. Review and Approval. We request confirmation that Meridian's management team — including Chief Executive Officer Lawrence C. Driscoll, General Counsel Vanessa Hartwell, Chief Compliance Officer Andrea Sokolov, and Vice President, Third-Party Risk Management, Marcus Tibaldi — has completed its review of the execution-ready DPA and SCC package enclosed herewith, and that Meridian has approved the package in all material respects and is prepared to proceed to execution.

2. Board or Management Sign-Off. We request confirmation that any required board-level or senior management sign-off on Meridian's part can be obtained no later than February 10, 2026, consistent with the execution timeline agreed upon by the parties. If any additional internal governance approvals are required at Meridian (e.g., approval by the board's technology or risk committee), we would appreciate prompt notice so that we may adjust the timeline accordingly, if necessary.

3. Officer's Certificate. We request that Meridian deliver, in advance of the February 15, 2026 signing date, an officer's certificate confirming the authority of the designated signatory (CEO Lawrence C. Driscoll) to execute the DPA and SCC package on behalf of Meridian Federal Savings Bank, and confirming that all requisite corporate authorizations and approvals have been duly obtained. We note for your reference that Skybridge's corresponding officer's certificate, to be executed by Thomas Elridge in his capacity as General Counsel of Skybridge Fintech Ltd., will be provided concurrent with execution on February 15, 2026.

VI. Execution Logistics

We propose that the DPA and SCC package be executed by counterpart signature pages on February 15, 2026. Enclosed herewith are the pre-prepared signature pages for each party's execution. The signature pages include execution blocks for the following parties and documents:

• Data Processing Agreement: Meridian Federal Savings Bank (to be executed by Lawrence C. Driscoll, Chief Executive Officer) and Skybridge Fintech Ltd. (to be executed by Nadia Karimova, Chief Executive Officer);

• Standard Contractual Clauses — Module 2 (Controller-to-Processor): Meridian Federal Savings Bank (data exporter) and Skybridge Fintech Ltd. (data importer);

• Standard Contractual Clauses — Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (data exporter) and Osprey Cloud Infrastructure, Inc. (data importer); and

• Standard Contractual Clauses — Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (data exporter) and Skybridge Fintech Europe B.V. (data importer).

We note that the DPA and SCC package is to be executed concurrently with the Subscription Agreement. We understand from discussions with your office that the Subscription Agreement signature pages are being coordinated separately, and we would appreciate confirmation that both sets of documents will be available for simultaneous execution on the target date.

VII. Closing Remarks

We wish to express our sincere appreciation for the collaborative and professional manner in which Blackwell, Raines & Stoddard LLP has engaged throughout this negotiation process. In particular, the contributions of you and your colleague Derek Faulkner have been instrumental in facilitating the efficient resolution of complex data protection, regulatory, and commercial issues, and we are pleased that the parties have been able to reach agreement on a comprehensive and balanced DPA and SCC package.

Should you or your client have any final questions, comments, or requests for clarification regarding the enclosed package prior to execution, please do not hesitate to contact me directly at (215) 864-7238 or kostrowski@calderwoodharkness.com. In addition, my colleagues Priscilla Wynn (pwynn@calderwoodharkness.com, (215) 864-7245) and Alan Burke (aburke@calderwoodharkness.com, (215) 864-7252) are available for coordination on execution logistics and any remaining administrative matters.

We look forward to bringing this matter to a successful close on February 15, 2026.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security 1735 Market Street, Suite 2800 Philadelphia, PA 19103

Enclosures:

1. Data Processing Agreement — Execution Version (dated February 5, 2026)

2. Schedule A: Description of Processing

3. Schedule B: Security Measures

4. Schedule C: Approved Sub-Processor List

5. Schedule D: Data Breach Notification Procedures

6. Standard Contractual Clauses — Full Execution-Ready Package (Modules 2 and 3, with Annexes I, II, and III)

7. Signature Pages — DPA and SCC Package

cc:

Thomas Elridge, General Counsel / Chief Privacy Officer, Skybridge Fintech Ltd. Derek Faulkner, Esq., Blackwell, Raines & Stoddard LLP Priscilla Wynn, Esq., Calderwood & Harkness LLP Alan Burke, Esq., Calderwood & Harkness LLP

CALDERWOOD & HARKNESS LLP Attorneys at Law
1735 Market Street, Suite 2800 Philadelphia, PA 19103
Telephone: (215) 864-7200 Facsimile: (215) 864-7201 www.calderwoodharkness.com
Kevin Ostrowski Partner, Privacy & Data Security Direct: (215) 864-7238 kostrowski@calderwoodharkness.com
February 5, 2026
Via Email (cliu@blackwellraines.com) and Sundial Data Systems
Constance Liu, Esq. Partner Blackwell, Raines & Stoddard LLP 200 Park Avenue, 31st Floor New York, NY 10166
Re: Execution-Ready Data Processing Agreement and Standard Contractual Clauses Package — Skybridge Fintech Ltd. / Meridian Federal Savings Bank Matter No.: 1009-00004
Dear Ms. Liu:
On behalf of our client, Skybridge Fintech Ltd. ("Skybridge" or "Processor"), we are pleased to transmit herewith the enclosed execution-ready Data Processing Agreement ("DPA") and Standard Contractual Clauses ("SCC") package for execution by Meridian Federal Savings Bank ("Meridian" or "Controller") and Skybridge. As you are aware, this package is the culmination of extensive and productive negotiations between our respective clients and their counsel, which commenced upon Skybridge's receipt of Meridian's form DPA from your office on November 25, 2025 and continued through multiple rounds of redlining, supplemental diligence, and the final resolution call held on January 30, 2026. The enclosed execution-ready documents reflect the agreed-upon terms on all material points, and we believe the package is now in final form suitable for execution by authorized representatives of both parties. Consistent with the timeline discussed between our firms and the parties' respective business teams, the DPA and SCC package is intended for concurrent execution with the five-year SaaS subscription agreement between Meridian and Skybridge (the "Subscription Agreement"), with a target execution date of February 15, 2026.
We set forth below a summary description of each enclosed document and its material terms, followed by certain requests regarding Meridian's review, approval, and execution logistics.
I. Data Processing Agreement — Execution Version
Enclosed is the execution-ready Data Processing Agreement, dated February 5, 2026, between Meridian Federal Savings Bank, in its capacity as Controller, and Skybridge Fintech Ltd., in its capacity as Processor, governing the processing of personal data by Skybridge in connection with the services provided under the Subscription Agreement. The DPA is governed by the laws of the State of Delaware, without regard to conflicts-of-law principles, consistent with the governing-law provision of the Subscription Agreement.
The DPA reflects the final resolution of all open items that were the subject of discussion during the January 30, 2026 resolution call among counsel and the parties' respective privacy and compliance teams. For your convenience, we summarize below the agreed positions on the principal negotiated terms:
Liability Cap (Section 8.2). The aggregate liability of Processor under the DPA is capped at the greater of (a) five million dollars ($5,000,000) or (b) two times (2×) the fees actually paid by Controller to Processor in the twelve (12) month period immediately preceding the event giving rise to the claim. Based on Meridian's annual contract value of $2,740,000 under the Subscription Agreement, the effective liability cap at initial execution is $5,480,000. This cap is subject to recalculation on a rolling twelve-month basis as fees are paid during the term, as agreed on the January 30 call.
Indemnification (Section 8.3). Skybridge has agreed to indemnify, defend, and hold harmless Meridian and its officers, directors, employees, and agents from and against any third-party claims, demands, suits, actions, or proceedings arising out of or relating to Skybridge's breach of the DPA, including, to the extent permissible under applicable law, regulatory fines and penalties imposed by competent supervisory authorities. This indemnification obligation is subject to the aggregate liability cap set forth in Section 8.2. Controller's corresponding indemnification obligations under Section 8.4 are reciprocal in scope, subject to the same cap structure.
Breach Notification (Section 5.1). Processor is obligated to notify Controller of any Personal Data Breach (as defined in the DPA, incorporating the definition under Article 4(12) of the GDPR and analogous state-law definitions) without undue delay, and in any event within forty-eight (48) hours of Processor's becoming aware of such breach. The notification must include, to the extent then reasonably available, the categories and approximate number of data subjects affected, the nature and likely consequences of the breach, and the measures taken or proposed to be taken to address the breach and mitigate its effects. Detailed breach notification procedures, including escalation contacts and communication protocols, are set forth in Schedule D to the DPA.
Sub-Processor Approval (Section 6). Processor has been granted a general written authorization from Controller to engage sub-processors for the processing of personal data, subject to the following conditions: (i) Processor shall provide Controller with at least thirty (30) days' prior written notice of any intended addition or replacement of a sub-processor; (ii) Controller shall have the right to object to such addition or replacement on reasonable grounds relating to the protection of personal data; and (iii) in the event of an unresolved objection, the parties shall engage in good-faith discussions to resolve the matter, with Controller retaining the right to terminate the DPA for convenience if no resolution is reached within fifteen (15) days of Controller's objection. Processor shall remain fully liable for the acts and omissions of its sub-processors as though such acts and omissions were those of Processor itself. The list of currently approved sub-processors is set forth in Schedule C.
Audit Rights (Section 7). Controller is entitled to conduct or commission audits of Processor's processing activities and security measures no more than once per twelve (12) month period, at Controller's sole cost and expense. This limitation does not apply in the event of a Personal Data Breach or a regulatory inquiry, investigation, or examination directed at Controller or Processor that necessitates additional audit activity. As the primary audit mechanism, Processor shall make available to Controller, upon request, its most recent SOC 2 Type II report. As discussed and agreed on the January 30 call, the DPA expressly preserves the right of Controller's federal banking regulators — including the Office of the Comptroller of the Currency ("OCC"), the Federal Deposit Insurance Corporation ("FDIC"), and the Consumer Financial Protection Bureau ("CFPB") — to examine and access Processor's facilities, systems, and records in accordance with applicable banking regulations, including OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance) and related interagency guidance. Nothing in the DPA shall be construed to limit or restrict such regulatory access rights.
Post-Termination Data Retention (Section 9.3). Following expiration or termination of the DPA or the Subscription Agreement (whichever occurs later), Processor shall, at Controller's election, return or securely delete all personal data processed on behalf of Controller within ninety (90) calendar days of receipt of Controller's written instructions. Processor shall certify in writing to Controller upon completion of the return or deletion, as applicable, and shall retain no copies of such personal data except to the extent required by applicable law, in which case Processor shall continue to maintain the confidentiality and security of such retained data.
Cyber-Liability Insurance (Section 10.4). Processor shall maintain in full force and effect throughout the term of the DPA a cyber-liability insurance policy providing coverage of not less than ten million dollars ($10,000,000) per occurrence, issued by a carrier with an A.M. Best rating of "A-" or better. Evidence of such coverage shall be provided to Controller upon execution and annually thereafter, and Processor shall provide Controller with not less than thirty (30) days' advance written notice of any material change to, cancellation of, or failure to renew such policy.
II. DPA Schedules
The following Schedules are appended to and form an integral part of the DPA:
Schedule A: Description of Processing. Schedule A sets forth a detailed description of the processing activities to be carried out by Processor on behalf of Controller, including: (i) the categories of data subjects, encompassing approximately 412,000 Meridian accountholders, authorized signers on deposit and lending accounts, beneficial owners identified pursuant to Meridian's Customer Identification Program and beneficial-ownership requirements, and Meridian employees whose data is processed through the SBF Core platform; (ii) the categories of personal data processed, including full legal name, Social Security number, date of birth, residential and mailing address, email address, telephone number, deposit and loan account numbers, transaction data (including payment amounts, dates, payees, and merchant category codes), IP addresses, device identifiers, behavioral biometric data (including keystroke dynamics, mouse movement patterns, and touchscreen interactions collected for anti-fraud and authentication purposes), and such other categories as may be specified in the Subscription Agreement; (iii) the purposes of processing, including payment processing, anti-fraud analytics and monitoring, regulatory reporting via the SBF Core platform, customer authentication, and such other purposes as are necessary for the provision of services under the Subscription Agreement; and (iv) the duration of processing, which shall be co-terminus with the term of the Subscription Agreement unless otherwise instructed in writing by Controller.
Schedule B: Security Measures. Schedule B describes the technical and organizational security measures implemented and maintained by Processor to protect personal data against unauthorized access, use, alteration, disclosure, or destruction. Key measures referenced in Schedule B include, without limitation: Processor's SOC 2 Type II certification, as most recently audited by Graystone & Ketchum LLP for the audit period of October 1, 2024 through September 15, 2025; AES-256 encryption for all personal data at rest; TLS 1.2 or higher encryption for all personal data in transit; multi-factor authentication ("MFA") for all administrative and privileged access to systems that process personal data; role-based access controls with least-privilege principles; network segmentation and intrusion detection systems; annual penetration testing conducted by an independent third-party security firm (currently Ironvault Security Group LLC); vulnerability management and patch management programs; and employee security awareness training. Processor's security measures are subject to continuous review and improvement, and any material reduction in the level of security shall require prior written notice to Controller.
Schedule C: Approved Sub-Processor List. Schedule C identifies the sub-processors currently approved for the processing of personal data on behalf of Controller, together with a description of each sub-processor's processing activities and location. The approved sub-processors are: (i) Osprey Cloud Infrastructure, Inc., providing infrastructure-as-a-service ("IaaS") and platform-as-a-service ("PaaS") hosting for the SBF Core platform, with data center regions located in the United States (US-East, Northern Virginia) and the European Union (Frankfurt, Germany); and (ii) Skybridge Fintech Europe B.V., Processor's wholly owned EU subsidiary, which processes personal data of EU-resident data subjects in Amsterdam, the Netherlands. Schedule C also incorporates the general authorization, thirty-day notice, and Controller objection mechanics described in Section 6 of the DPA.
Schedule D: Data Breach Notification Procedures. Schedule D sets forth the specific procedures, contacts, and escalation matrix applicable to Processor's notification obligations in the event of a Personal Data Breach, as described in Section 5.1 of the DPA. Schedule D provides for an initial notification within forty-eight (48) hours, supplemental written reports at twenty-four (24) hour intervals until the incident is resolved, and designated escalation contacts within both Processor's and Controller's security and privacy teams.
III. Standard Contractual Clauses — Full Execution-Ready Package
Enclosed is the execution-ready Standard Contractual Clauses package, prepared pursuant to the European Commission Implementing Decision (EU) 2021/914 of June 4, 2021, as published in the Official Journal of the European Union (OJ L 199, 7.6.2021, pp. 31–61). The SCC package is appended to and forms part of the DPA. The package incorporates the following modules:
Module 2 (Controller-to-Processor). This module governs the transfer of personal data from Meridian Federal Savings Bank, acting as data exporter and Controller, to Skybridge Fintech Ltd., acting as data importer and Processor. Module 2 addresses, among other things, the instructions of the Controller, the obligations of the Processor with respect to data security, sub-processing, international onward transfers, data subject rights, and supervisory authority cooperation.
Module 3 (Processor-to-Sub-processor) — Osprey Cloud Infrastructure, Inc. This module governs the onward transfer of personal data from Skybridge Fintech Ltd., acting as data exporter and Processor, to Osprey Cloud Infrastructure, Inc., acting as data importer and Sub-processor, in connection with the IaaS and PaaS hosting services provided by Osprey for the SBF Core platform.
Module 3 (Processor-to-Sub-processor) — Skybridge Fintech Europe B.V. This module governs the transfer of personal data from Skybridge Fintech Ltd. to its wholly owned EU subsidiary, Skybridge Fintech Europe B.V. (registered address: Keizersgracht 482, 1017 EG Amsterdam, the Netherlands; Kamer van Koophandel No. 82104593), in connection with the processing of personal data of EU-resident data subjects.
Pursuant to Clause 17 of the SCCs (Governing Law), the parties have selected the law of the Netherlands as the governing law for the SCCs, consistent with Skybridge Fintech Europe B.V.'s establishment as the EU entity and Processor's principal EU data-processing operations being located in the Netherlands. This selection ensures alignment with the supervisory authority competent for Processor's EU establishment.
The SCC package includes the following completed Annexes:
Annex I (Description of Transfer). Annex I was finalized by the parties on January 15, 2026, and describes the international data transfers covered by the SCCs. The transfer involves the personal data of approximately 3,200 EU-resident Meridian accountholders and encompasses approximately 18.6 million transactions per month processed through the SBF Core platform. Annex I further specifies the data exporter, data importer, categories of data subjects, categories of personal data, sensitive data (if any), the frequency of the transfer, the nature and purpose of the processing, and the period for which the data will be retained.
Annex II (Technical and Organizational Measures). Annex II was finalized by the parties on January 15, 2026, and sets forth a description of the technical and organizational measures implemented by the data importer(s) to ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the processing and the risks for the rights and freedoms of data subjects. The measures described in Annex II are consistent with and cross-reference the security measures detailed in Schedule B to the DPA.
Annex III (List of Sub-processors). Annex III was finalized by the parties on January 15, 2026, and identifies the sub-processors authorized to process personal data on behalf of the data importer, specifically Osprey Cloud Infrastructure, Inc. and Skybridge Fintech Europe B.V., together with a description of each sub-processor's processing activities, location, and contact details.
IV. Additional Enclosed and Supplementary Materials
For your reference and records, we note the following supplementary materials:
Skybridge maintains a current self-certification under the EU-U.S. Data Privacy Framework ("DPF"), Certification ID: DPF-2025-03912, effective as of July 1, 2025. Skybridge's DPF self-certification is listed on the Data Privacy Framework Program website maintained by the International Trade Administration of the U.S. Department of Commerce. While Skybridge's DPF certification supplements the transfer mechanism established by the SCCs and provides an additional legal basis for certain EU-to-U.S. personal data transfers, it does not replace or supersede the SCCs, which remain the primary transfer mechanism under the DPA.
In addition, Skybridge's current SOC 2 Type II report, issued on September 15, 2025 by Graystone & Ketchum LLP, and Skybridge's certificate of cyber-liability insurance issued by Bastion Mutual Insurance Company (Policy No. CYB-2025-04821, providing coverage of $10,000,000 per occurrence and $20,000,000 in the aggregate) will be delivered separately to Meridian as closing deliverables in advance of the February 15, 2026 execution date. We will coordinate delivery of these items with your office and Meridian's third-party risk management team.
V. Requested Actions by Meridian
In order to maintain the parties' agreed-upon timeline for execution on February 15, 2026, we respectfully request the following actions by Meridian and its counsel:
1. Review and Approval. We request confirmation that Meridian's management team — including Chief Executive Officer Lawrence C. Driscoll, General Counsel Vanessa Hartwell, Chief Compliance Officer Andrea Sokolov, and Vice President, Third-Party Risk Management, Marcus Tibaldi — has completed its review of the execution-ready DPA and SCC package enclosed herewith, and that Meridian has approved the package in all material respects and is prepared to proceed to execution.
2. Board or Management Sign-Off. We request confirmation that any required board-level or senior management sign-off on Meridian's part can be obtained no later than February 10, 2026, consistent with the execution timeline agreed upon by the parties. If any additional internal governance approvals are required at Meridian (e.g., approval by the board's technology or risk committee), we would appreciate prompt notice so that we may adjust the timeline accordingly, if necessary.
3. Officer's Certificate. We request that Meridian deliver, in advance of the February 15, 2026 signing date, an officer's certificate confirming the authority of the designated signatory (CEO Lawrence C. Driscoll) to execute the DPA and SCC package on behalf of Meridian Federal Savings Bank, and confirming that all requisite corporate authorizations and approvals have been duly obtained. We note for your reference that Skybridge's corresponding officer's certificate, to be executed by Thomas Elridge in his capacity as General Counsel of Skybridge Fintech Ltd., will be provided concurrent with execution on February 15, 2026.
VI. Execution Logistics
We propose that the DPA and SCC package be executed by counterpart signature pages on February 15, 2026. Enclosed herewith are the pre-prepared signature pages for each party's execution. The signature pages include execution blocks for the following parties and documents:
• Data Processing Agreement: Meridian Federal Savings Bank (to be executed by Lawrence C. Driscoll, Chief Executive Officer) and Skybridge Fintech Ltd. (to be executed by Nadia Karimova, Chief Executive Officer);
• Standard Contractual Clauses — Module 2 (Controller-to-Processor): Meridian Federal Savings Bank (data exporter) and Skybridge Fintech Ltd. (data importer);
• Standard Contractual Clauses — Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (data exporter) and Osprey Cloud Infrastructure, Inc. (data importer); and
• Standard Contractual Clauses — Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (data exporter) and Skybridge Fintech Europe B.V. (data importer).
We note that the DPA and SCC package is to be executed concurrently with the Subscription Agreement. We understand from discussions with your office that the Subscription Agreement signature pages are being coordinated separately, and we would appreciate confirmation that both sets of documents will be available for simultaneous execution on the target date.
VII. Closing Remarks
We wish to express our sincere appreciation for the collaborative and professional manner in which Blackwell, Raines & Stoddard LLP has engaged throughout this negotiation process. In particular, the contributions of you and your colleague Derek Faulkner have been instrumental in facilitating the efficient resolution of complex data protection, regulatory, and commercial issues, and we are pleased that the parties have been able to reach agreement on a comprehensive and balanced DPA and SCC package.
Should you or your client have any final questions, comments, or requests for clarification regarding the enclosed package prior to execution, please do not hesitate to contact me directly at (215) 864-7238 or kostrowski@calderwoodharkness.com. In addition, my colleagues Priscilla Wynn (pwynn@calderwoodharkness.com, (215) 864-7245) and Alan Burke (aburke@calderwoodharkness.com, (215) 864-7252) are available for coordination on execution logistics and any remaining administrative matters.
We look forward to bringing this matter to a successful close on February 15, 2026.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security 1735 Market Street, Suite 2800 Philadelphia, PA 19103
Enclosures:
1. Data Processing Agreement — Execution Version (dated February 5, 2026)
2. Schedule A: Description of Processing
3. Schedule B: Security Measures
4. Schedule C: Approved Sub-Processor List
5. Schedule D: Data Breach Notification Procedures
6. Standard Contractual Clauses — Full Execution-Ready Package (Modules 2 and 3, with Annexes I, II, and III)
7. Signature Pages — DPA and SCC Package
cc:
Thomas Elridge, General Counsel / Chief Privacy Officer, Skybridge Fintech Ltd. Derek Faulkner, Esq., Blackwell, Raines & Stoddard LLP Priscilla Wynn, Esq., Calderwood & Harkness LLP Alan Burke, Esq., Calderwood & Harkness LLP

CALDERWOOD & HARKNESS LLP Attorneys at Law

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts