1009-00004 · Skybridge Fintech Ltd · Correspondence

transmittal-letter-second-redline-010826.docx DOCUMENT Finance & Banking

15 / 35 ← → ✕

Contract analysis Extract to table

PRIVILEGED & CONFIDENTIAL ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP Attorneys at Law 1735 Market Street, Suite 2800 Philadelphia, PA 19103 Tel: (215) 498-7200

Fax: (215) 498-7201

www.calderwoodharkness.com

January 8, 2026

VIA ELECTRONIC MAIL AND HAND DELIVERY

Constance Liu, Esq. Partner Blackwell, Raines & Stoddard LLP 200 Park Avenue, 31st Floor New York, NY 10166

Re: Data Processing Agreement — Skybridge Fintech Ltd. and Meridian Federal Savings Bank Our Matter No.: 1009-00004

Dear Ms. Liu:

On behalf of our client, Skybridge Fintech Ltd. ("Skybridge" or "Processor"), we enclose herewith the second redline of the Data Processing Agreement (the "DPA") by and between Meridian Federal Savings Bank ("Meridian," "Bank," or "Controller") and Skybridge Fintech Ltd. (as Processor), together with the appended Standard Contractual Clauses ("SCCs") package and updated Schedules. This redline has been prepared in response to the markup circulated by Blackwell, Raines & Stoddard LLP ("BRS") on behalf of Meridian, which we received on December 20, 2025.

As you are aware, the enclosed redline also reflects the substantive discussions from the key issues call held earlier today, January 8, 2026, among Kevin Ostrowski and Priscilla Wynn of Calderwood & Harkness, and Constance Liu and Derek Faulkner of BRS. We found that call productive and believe it has narrowed several of the outstanding issues between the parties. For the avoidance of doubt, the DPA remains governed by the laws of the State of Delaware, without regard to its conflicts of law principles, and the SCCs are governed by the law of the Netherlands pursuant to Clause 17 of the SCCs, as previously agreed.

We set forth below a summary of Skybridge's positions on the key open issues addressed in this redline, followed by a discussion of certain additional matters reflected in the marked draft.

I. Summary of Skybridge's Positions on Key Open Issues

A. Liability Cap (Section 11.2)

Skybridge maintains its position that the aggregate liability cap applicable to the Processor under the DPA should be equal to the greater of (a) five million U.S. dollars ($5,000,000) or (b) two times (2×) the fees actually paid by Controller to Processor in the twelve (12) month period immediately preceding the date on which the applicable claim first arises (the "Trailing Fee Amount").

Applied to the Meridian engagement specifically, based on the annual contract value of $2.74 million per year under the SaaS subscription agreement, this formula yields a liability cap of $5.48 million (calculated as 2 × $2,740,000 = $5,480,000), which exceeds the $5.0 million floor and therefore serves as the operative cap. We note that this result demonstrates the intended operation of the formula: the $5.0 million floor provides a meaningful minimum level of exposure for smaller engagements, while the 2× trailing-twelve-month-fees component scales proportionally with larger or growing engagements. Skybridge's template DPA is designed for deployment across all of its bank clients, and this formula-based approach ensures proportionality and consistency across its client base without the need for bespoke negotiations on cap amounts in each instance.

Skybridge has carefully considered and respectfully rejected Meridian's counter-proposal for an uncapped liability structure. An uncapped liability regime is inconsistent with prevailing market standards for bank-vendor data processing agreements and would represent a significant departure from the risk allocation framework that supports Skybridge's pricing and service delivery model. We note that the proposed cap is well-supported by Skybridge's cyber-liability insurance coverage, which provides limits of $10.0 million per occurrence and $20.0 million in the aggregate under Skybridge's current policy with Bastion Mutual Insurance Company (Policy No. CYB-2025-04821). This coverage provides Meridian with a meaningful and commercially reasonable backstop that substantially exceeds the proposed contractual cap. We are confident that this structure is consistent with market practice and provides Meridian with robust protection commensurate with the scope and risk profile of the processing activities contemplated by the DPA.

B. Indemnification (Section 12)

Skybridge agrees to provide indemnification to Controller for third-party claims arising from Skybridge's breach of its obligations under the DPA, including claims brought by data subjects and, where applicable, claims by governmental or regulatory authorities.

In response to Meridian's specific request, Skybridge has accepted the inclusion of regulatory fines and penalties within the scope of Processor's indemnification obligations, to the extent that indemnification for such fines is permissible under applicable law. This acceptance is, however, expressly subject to the aggregate liability cap described in Section I.A above. We wish to note that this is a significant concession on Skybridge's part, as many processor-side templates exclude regulatory fines from the indemnification framework entirely.

Skybridge has proposed — and the redline reflects — that the indemnification obligations under Section 12 be structured on a mutual basis. Specifically, Controller should similarly indemnify Processor for third-party claims arising from Controller's breach of its own obligations under the DPA, including but not limited to claims arising from unlawful, unauthorized, or otherwise non-compliant processing instructions issued by Controller to Processor. This mutual structure is appropriate given that Controller retains sole authority to determine the purposes and means of processing and issues binding instructions to Processor under the DPA. Where those instructions are themselves unlawful or give rise to third-party liability, it is appropriate that Controller bear responsibility for the resulting claims.

We have also included carve-out language in the redline to clarify the scope of the regulatory fines indemnification. Specifically, Processor's indemnification obligation with respect to regulatory fines and penalties applies only to fines that are directly attributable to Processor's breach of its obligations under the DPA or applicable data protection law. Fines arising from Controller's own regulatory non-compliance, including fines resulting from Controller's failure to implement appropriate technical and organizational measures within its own systems, Controller's failure to comply with data subject access requests, or Controller's independent violations of applicable banking regulations, are expressly excluded from Processor's indemnification obligations and remain the sole responsibility of Controller.

C. Sub-Processor Approval (Section 8)

Skybridge proposes a general written authorization model for the engagement of sub-processors, consistent with Article 28(2) of the GDPR and prevailing market practice for cloud-based SaaS platforms. Under this model, Controller provides general authorization for Processor to engage sub-processors, subject to the following safeguards:

1. Prior Written Notice. Processor shall provide Controller with no fewer than thirty (30) days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor. Such notice shall identify the proposed sub-processor, the nature and scope of the processing to be performed, and the location(s) of processing.

2. Right to Object. Controller retains the right to object to the engagement of any proposed new sub-processor within the thirty (30) day notice period. Any such objection must be in writing, must specify reasonable grounds related to data protection, and must be communicated to Processor before the expiration of the notice period.

3. Resolution and Termination Right. In the event Controller objects to a proposed sub-processor and the parties are unable to resolve the objection within a reasonable period (not to exceed an additional fifteen (15) business days), Controller may, as its sole and exclusive remedy, terminate the affected processing activities (i.e., the specific processing that would have been performed by the objected-to sub-processor) without terminating the DPA as a whole or the underlying SaaS subscription agreement. For the avoidance of doubt, this termination right does not extend to the entirety of the DPA or the SaaS subscription and is limited to the specific processing streams at issue.

The current list of approved sub-processors is set forth in Schedule C to the DPA, which has been updated in the enclosed redline. As of the date of this letter, Skybridge's approved sub-processors are as follows:

We note for the record that Skybridge maintains a separate Data Processing Agreement with Osprey Cloud Infrastructure, Inc., dated March 1, 2024, which includes Module 3 SCCs (processor-to-sub-processor) and contains appropriate flow-down obligations consistent with the requirements of OCC Bulletin 2023-17 regarding sub-contractor oversight and fourth-party risk management. Skybridge is prepared to provide a summary of the Osprey Cloud DPA's key terms to Meridian upon request, subject to applicable confidentiality restrictions.

D. Audit Rights (Section 9)

Skybridge agrees to provide Controller with audit rights under the DPA, subject to the following framework:

1. Standard Audit. Controller shall have the right to conduct or commission an audit of Processor's processing activities, facilities, and technical and organizational measures, upon no fewer than thirty (30) days' advance written notice. Standard audits shall be limited to no more than one (1) audit per twelve (12) month period and shall be conducted at Controller's sole cost and expense, including any third-party auditor fees, travel expenses, and related costs.

2. Additional Audits. Notwithstanding the foregoing frequency limitation, Controller shall be entitled to conduct additional audits in the event of (a) a Personal Data Breach (as defined in the DPA), (b) a regulatory examination or inquiry directed at Controller that necessitates review of Processor's processing activities, or (c) Processor's material failure to remediate a finding from a prior audit within the agreed-upon timeline.

3. SOC 2 Report Alternative. Skybridge proposes that it may satisfy Controller's audit requests, in the first instance, by providing its current SOC 2 Type II report, together with supplemental questionnaire responses addressing any specific areas of concern identified by Controller. Skybridge's most recent SOC 2 Type II report was issued by Graystone & Ketchum LLP and covers the audit period from October 1, 2024 through September 15, 2025. This report includes a detailed assessment of Skybridge's controls related to security, availability, processing integrity, confidentiality, and privacy, and provides a comprehensive basis for Controller's evaluation of Processor's compliance posture.

4. On-Site Audit. In the event that the SOC 2 Type II report and supplemental questionnaire responses are reasonably deemed insufficient by Controller to address Controller's specific audit objectives, an on-site audit shall be made available at Processor's principal processing facility, subject to reasonable scheduling requirements and Processor's confidentiality and security protocols.

Critically, the redline preserves and expressly acknowledges the right of Controller's federal and state banking regulators — including, without limitation, the Office of the Comptroller of the Currency ("OCC"), the Federal Deposit Insurance Corporation ("FDIC"), and the Consumer Financial Protection Bureau ("CFPB") — to examine, audit, and inspect Skybridge's operations, records, and facilities in its capacity as a service provider to Meridian, consistent with the requirements of OCC Bulletin 2023-17, the Bank Service Company Act (12 U.S.C. § 1867(c)), and all other applicable banking regulations. Nothing in the DPA shall be construed to limit, restrict, or impede the authority of any such regulator to exercise its examination and oversight functions with respect to Processor.

E. Breach Notification (Section 10)

Skybridge has accepted Meridian's proposed forty-eight (48) hour breach notification timeline. Under the redline, Processor shall notify Controller without undue delay, and in any event within forty-eight (48) hours from the point at which Processor becomes aware of a Personal Data Breach affecting Controller's personal data. This timeline is consistent with Meridian's third-party risk management ("TPRM") requirements and the incident response protocols set forth in Meridian's vendor management framework.

We note that this forty-eight (48) hour vendor-to-bank notification window has been calibrated with reference to the FDIC and OCC Computer-Security Incident Notification Rule (12 CFR Part 53), which requires banking organizations to notify their primary federal regulator no later than thirty-six (36) hours after the banking organization determines that a "notification incident" has occurred. The forty-eight (48) hour Processor notification window is designed to provide Meridian with sufficient time to assess any incident reported by Skybridge and, where necessary, meet its own regulatory notification obligations within the thirty-six (36) hour window mandated by Part 53.

Detailed breach notification procedures, including the required content of notifications, escalation matrices, points of contact, and communication protocols, are set forth in Schedule D to the DPA. Schedule D has been updated in the enclosed redline to reflect certain refinements discussed during today's call.

F. Data Retention and Return/Deletion (Section 14)

Personal data processed by Skybridge under the DPA shall be retained for the duration of the SaaS subscription term and for a period of ninety (90) days following the effective date of termination or expiration of the subscription (the "Wind-Down Period"). During the Wind-Down Period, Controller may elect to have its personal data returned in a structured, commonly used, machine-readable format or securely deleted, at Controller's option and written direction.

Upon the expiration of the ninety (90) day Wind-Down Period, Processor shall securely delete all personal data in its possession, custody, or control, including all copies, backups, and archived data, except to the extent that retention of specific data is required by applicable law, regulation, or legal hold obligation. In the event that any personal data must be retained beyond the Wind-Down Period due to a legal requirement, Processor shall (i) promptly notify Controller of such requirement, (ii) limit the scope of retention to the minimum data necessary to satisfy the applicable legal obligation, and (iii) continue to protect such data in accordance with the terms of the DPA for so long as it remains in Processor's possession.

Skybridge will provide written certification of deletion to Controller upon Controller's written request following the completion of the Wind-Down Period and the deletion of personal data.

II. Additional Matters Addressed in Redline

In addition to the key open issues summarized above, the enclosed redline addresses a number of additional matters, including the following:

DPIA Cooperation. Skybridge agrees to provide reasonable assistance to Controller in connection with the preparation of Data Protection Impact Assessments ("DPIAs") as may be required under Article 35 of the GDPR or other applicable data protection law, at Controller's reasonable request and expense. Processor shall make available to Controller such information in Processor's possession as is reasonably necessary for Controller to conduct and document DPIAs related to the processing activities performed under the DPA.

Insurance Requirement. The redline confirms that Skybridge maintains cyber-liability and technology errors and omissions insurance coverage with per-occurrence limits of no less than ten million U.S. dollars ($10,000,000) and aggregate limits of no less than twenty million U.S. dollars ($20,000,000) throughout the term of the DPA. Skybridge shall provide Controller with a certificate of insurance upon request and shall provide prompt written notice in the event of any material reduction in coverage.

Security Standards. The redline incorporates references to the specific technical and organizational security measures maintained by Skybridge, including: SOC 2 Type II compliance (as described in Section I.D above); AES-256 encryption for data at rest; TLS 1.2 or higher encryption for data in transit; multi-factor authentication ("MFA") for all administrative and privileged access to systems processing Controller personal data; and annual penetration testing conducted by Ironvault Security Group LLC, with results and remediation plans made available to Controller upon request.

SCC Modules. The enclosed SCCs package includes: (i) Module 2 (Controller-to-Processor), governing the transfer of personal data from Meridian (as Controller) to Skybridge (as Processor); and (ii) Module 3 (Processor-to-Sub-processor), governing the onward transfer of personal data from Skybridge (as Processor) to Osprey Cloud Infrastructure, Inc. and Skybridge Fintech Europe B.V. (each as Sub-processor). Annexes I through III to the SCCs remain in substantially the form circulated with BRS's counter-proposal dated December 20, 2025, with targeted updates to reflect the discussions from today's call. As noted above, the SCCs are governed by the law of the Netherlands pursuant to Clause 17.

EU-US Data Privacy Framework. We note for the record that Skybridge maintains a valid self-certification under the EU-U.S. Data Privacy Framework (Certification ID: DPF-2025-03912, effective July 1, 2025). This self-certification serves as a supplementary transfer mechanism providing additional assurances for the transfer of personal data from the European Economic Area to the United States, but is not intended to displace or supersede the SCCs as the primary transfer mechanism under the DPA.

III. Remaining Open Items

We note that, notwithstanding the substantial progress reflected in this redline, several items remain open and will require further discussion between the parties. Specifically, we have identified approximately four areas that remain subject to negotiation, including: (1) the precise scope of the data subject categories and data elements described in Annex I to the SCCs; (2) the allocation of costs for Processor's cooperation with regulatory examinations beyond the standard audit framework; (3) Controller's requested termination-for-convenience right and the associated notice period and wind-down obligations; and (4) the treatment of aggregated and de-identified data following termination of the DPA. We anticipate that these items can be resolved efficiently through a focused exchange of markups and, if necessary, a follow-up call among counsel.

In order to permit the parties to finalize the DPA and SCC package in advance of the February 15, 2026 target signing date — which, as you know, is intended to be concurrent with the execution of the five (5) year SaaS subscription agreement (total contract value of $13,700,000) — we respectfully request that BRS provide its markup or written comments on the enclosed redline by no later than January 26, 2026. This timeline will allow sufficient opportunity for the parties to address any remaining items and prepare execution copies of all transaction documents in advance of the target date.

IV. Enclosures

The following documents are enclosed herewith:

1. Second Redline of Data Processing Agreement (redline/tracked changes format);

2. Clean copy of Data Processing Agreement (for reference);

3. Updated Schedules A through D to the Data Processing Agreement (marked to show changes from the December 20, 2025 version); and

4. Draft Standard Contractual Clauses (Modules 2 and 3), with Annexes I through III.

We are available at your convenience to discuss any questions you or your team may have regarding the enclosed materials or to schedule a follow-up call to address the remaining open items identified above. We look forward to resolving the remaining open items promptly and to bringing this transaction to a successful close.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1735 Market Street, Suite 2800 Philadelphia, PA 19103 Tel: (215) 498-7244 kostrowski@calderwoodharkness.com

cc:

Thomas Elridge, Esq., General Counsel and Chief Privacy Officer, Skybridge Fintech Ltd. Priscilla Wynn, Esq., Calderwood & Harkness LLP Alan Burke, Esq., Calderwood & Harkness LLP Derek Faulkner, Esq., Blackwell, Raines & Stoddard LLP

Enclosures (4)

Sub-Processor	Processing Activity	Location(s)
Osprey Cloud Infrastructure, Inc.	IaaS/PaaS hosting and infrastructure services	US-East data center (Ashburn, Virginia); EU data center (Frankfurt, Germany)
Skybridge Fintech Europe B.V.	EU personal data processing operations	Amsterdam, Netherlands

PRIVILEGED & CONFIDENTIAL ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP Attorneys at Law 1735 Market Street, Suite 2800 Philadelphia, PA 19103 Tel: (215) 498-7200
Fax: (215) 498-7201
www.calderwoodharkness.com
January 8, 2026
VIA ELECTRONIC MAIL AND HAND DELIVERY
Constance Liu, Esq. Partner Blackwell, Raines & Stoddard LLP 200 Park Avenue, 31st Floor New York, NY 10166
Re: Data Processing Agreement — Skybridge Fintech Ltd. and Meridian Federal Savings Bank Our Matter No.: 1009-00004
Dear Ms. Liu:
On behalf of our client, Skybridge Fintech Ltd. ("Skybridge" or "Processor"), we enclose herewith the second redline of the Data Processing Agreement (the "DPA") by and between Meridian Federal Savings Bank ("Meridian," "Bank," or "Controller") and Skybridge Fintech Ltd. (as Processor), together with the appended Standard Contractual Clauses ("SCCs") package and updated Schedules. This redline has been prepared in response to the markup circulated by Blackwell, Raines & Stoddard LLP ("BRS") on behalf of Meridian, which we received on December 20, 2025.
As you are aware, the enclosed redline also reflects the substantive discussions from the key issues call held earlier today, January 8, 2026, among Kevin Ostrowski and Priscilla Wynn of Calderwood & Harkness, and Constance Liu and Derek Faulkner of BRS. We found that call productive and believe it has narrowed several of the outstanding issues between the parties. For the avoidance of doubt, the DPA remains governed by the laws of the State of Delaware, without regard to its conflicts of law principles, and the SCCs are governed by the law of the Netherlands pursuant to Clause 17 of the SCCs, as previously agreed.
We set forth below a summary of Skybridge's positions on the key open issues addressed in this redline, followed by a discussion of certain additional matters reflected in the marked draft.
I. Summary of Skybridge's Positions on Key Open Issues
A. Liability Cap (Section 11.2)
Skybridge maintains its position that the aggregate liability cap applicable to the Processor under the DPA should be equal to the greater of (a) five million U.S. dollars ($5,000,000) or (b) two times (2×) the fees actually paid by Controller to Processor in the twelve (12) month period immediately preceding the date on which the applicable claim first arises (the "Trailing Fee Amount").
Applied to the Meridian engagement specifically, based on the annual contract value of $2.74 million per year under the SaaS subscription agreement, this formula yields a liability cap of $5.48 million (calculated as 2 × $2,740,000 = $5,480,000), which exceeds the $5.0 million floor and therefore serves as the operative cap. We note that this result demonstrates the intended operation of the formula: the $5.0 million floor provides a meaningful minimum level of exposure for smaller engagements, while the 2× trailing-twelve-month-fees component scales proportionally with larger or growing engagements. Skybridge's template DPA is designed for deployment across all of its bank clients, and this formula-based approach ensures proportionality and consistency across its client base without the need for bespoke negotiations on cap amounts in each instance.
Skybridge has carefully considered and respectfully rejected Meridian's counter-proposal for an uncapped liability structure. An uncapped liability regime is inconsistent with prevailing market standards for bank-vendor data processing agreements and would represent a significant departure from the risk allocation framework that supports Skybridge's pricing and service delivery model. We note that the proposed cap is well-supported by Skybridge's cyber-liability insurance coverage, which provides limits of $10.0 million per occurrence and $20.0 million in the aggregate under Skybridge's current policy with Bastion Mutual Insurance Company (Policy No. CYB-2025-04821). This coverage provides Meridian with a meaningful and commercially reasonable backstop that substantially exceeds the proposed contractual cap. We are confident that this structure is consistent with market practice and provides Meridian with robust protection commensurate with the scope and risk profile of the processing activities contemplated by the DPA.
B. Indemnification (Section 12)
Skybridge agrees to provide indemnification to Controller for third-party claims arising from Skybridge's breach of its obligations under the DPA, including claims brought by data subjects and, where applicable, claims by governmental or regulatory authorities.
In response to Meridian's specific request, Skybridge has accepted the inclusion of regulatory fines and penalties within the scope of Processor's indemnification obligations, to the extent that indemnification for such fines is permissible under applicable law. This acceptance is, however, expressly subject to the aggregate liability cap described in Section I.A above. We wish to note that this is a significant concession on Skybridge's part, as many processor-side templates exclude regulatory fines from the indemnification framework entirely.
Skybridge has proposed — and the redline reflects — that the indemnification obligations under Section 12 be structured on a mutual basis. Specifically, Controller should similarly indemnify Processor for third-party claims arising from Controller's breach of its own obligations under the DPA, including but not limited to claims arising from unlawful, unauthorized, or otherwise non-compliant processing instructions issued by Controller to Processor. This mutual structure is appropriate given that Controller retains sole authority to determine the purposes and means of processing and issues binding instructions to Processor under the DPA. Where those instructions are themselves unlawful or give rise to third-party liability, it is appropriate that Controller bear responsibility for the resulting claims.
We have also included carve-out language in the redline to clarify the scope of the regulatory fines indemnification. Specifically, Processor's indemnification obligation with respect to regulatory fines and penalties applies only to fines that are directly attributable to Processor's breach of its obligations under the DPA or applicable data protection law. Fines arising from Controller's own regulatory non-compliance, including fines resulting from Controller's failure to implement appropriate technical and organizational measures within its own systems, Controller's failure to comply with data subject access requests, or Controller's independent violations of applicable banking regulations, are expressly excluded from Processor's indemnification obligations and remain the sole responsibility of Controller.
C. Sub-Processor Approval (Section 8)
Skybridge proposes a general written authorization model for the engagement of sub-processors, consistent with Article 28(2) of the GDPR and prevailing market practice for cloud-based SaaS platforms. Under this model, Controller provides general authorization for Processor to engage sub-processors, subject to the following safeguards:
1. Prior Written Notice. Processor shall provide Controller with no fewer than thirty (30) days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor. Such notice shall identify the proposed sub-processor, the nature and scope of the processing to be performed, and the location(s) of processing.
2. Right to Object. Controller retains the right to object to the engagement of any proposed new sub-processor within the thirty (30) day notice period. Any such objection must be in writing, must specify reasonable grounds related to data protection, and must be communicated to Processor before the expiration of the notice period.
3. Resolution and Termination Right. In the event Controller objects to a proposed sub-processor and the parties are unable to resolve the objection within a reasonable period (not to exceed an additional fifteen (15) business days), Controller may, as its sole and exclusive remedy, terminate the affected processing activities (i.e., the specific processing that would have been performed by the objected-to sub-processor) without terminating the DPA as a whole or the underlying SaaS subscription agreement. For the avoidance of doubt, this termination right does not extend to the entirety of the DPA or the SaaS subscription and is limited to the specific processing streams at issue.
The current list of approved sub-processors is set forth in Schedule C to the DPA, which has been updated in the enclosed redline. As of the date of this letter, Skybridge's approved sub-processors are as follows:
We note for the record that Skybridge maintains a separate Data Processing Agreement with Osprey Cloud Infrastructure, Inc., dated March 1, 2024, which includes Module 3 SCCs (processor-to-sub-processor) and contains appropriate flow-down obligations consistent with the requirements of OCC Bulletin 2023-17 regarding sub-contractor oversight and fourth-party risk management. Skybridge is prepared to provide a summary of the Osprey Cloud DPA's key terms to Meridian upon request, subject to applicable confidentiality restrictions.
D. Audit Rights (Section 9)
Skybridge agrees to provide Controller with audit rights under the DPA, subject to the following framework:
1. Standard Audit. Controller shall have the right to conduct or commission an audit of Processor's processing activities, facilities, and technical and organizational measures, upon no fewer than thirty (30) days' advance written notice. Standard audits shall be limited to no more than one (1) audit per twelve (12) month period and shall be conducted at Controller's sole cost and expense, including any third-party auditor fees, travel expenses, and related costs.
2. Additional Audits. Notwithstanding the foregoing frequency limitation, Controller shall be entitled to conduct additional audits in the event of (a) a Personal Data Breach (as defined in the DPA), (b) a regulatory examination or inquiry directed at Controller that necessitates review of Processor's processing activities, or (c) Processor's material failure to remediate a finding from a prior audit within the agreed-upon timeline.
3. SOC 2 Report Alternative. Skybridge proposes that it may satisfy Controller's audit requests, in the first instance, by providing its current SOC 2 Type II report, together with supplemental questionnaire responses addressing any specific areas of concern identified by Controller. Skybridge's most recent SOC 2 Type II report was issued by Graystone & Ketchum LLP and covers the audit period from October 1, 2024 through September 15, 2025. This report includes a detailed assessment of Skybridge's controls related to security, availability, processing integrity, confidentiality, and privacy, and provides a comprehensive basis for Controller's evaluation of Processor's compliance posture.
4. On-Site Audit. In the event that the SOC 2 Type II report and supplemental questionnaire responses are reasonably deemed insufficient by Controller to address Controller's specific audit objectives, an on-site audit shall be made available at Processor's principal processing facility, subject to reasonable scheduling requirements and Processor's confidentiality and security protocols.
Critically, the redline preserves and expressly acknowledges the right of Controller's federal and state banking regulators — including, without limitation, the Office of the Comptroller of the Currency ("OCC"), the Federal Deposit Insurance Corporation ("FDIC"), and the Consumer Financial Protection Bureau ("CFPB") — to examine, audit, and inspect Skybridge's operations, records, and facilities in its capacity as a service provider to Meridian, consistent with the requirements of OCC Bulletin 2023-17, the Bank Service Company Act (12 U.S.C. § 1867(c)), and all other applicable banking regulations. Nothing in the DPA shall be construed to limit, restrict, or impede the authority of any such regulator to exercise its examination and oversight functions with respect to Processor.
E. Breach Notification (Section 10)
Skybridge has accepted Meridian's proposed forty-eight (48) hour breach notification timeline. Under the redline, Processor shall notify Controller without undue delay, and in any event within forty-eight (48) hours from the point at which Processor becomes aware of a Personal Data Breach affecting Controller's personal data. This timeline is consistent with Meridian's third-party risk management ("TPRM") requirements and the incident response protocols set forth in Meridian's vendor management framework.
We note that this forty-eight (48) hour vendor-to-bank notification window has been calibrated with reference to the FDIC and OCC Computer-Security Incident Notification Rule (12 CFR Part 53), which requires banking organizations to notify their primary federal regulator no later than thirty-six (36) hours after the banking organization determines that a "notification incident" has occurred. The forty-eight (48) hour Processor notification window is designed to provide Meridian with sufficient time to assess any incident reported by Skybridge and, where necessary, meet its own regulatory notification obligations within the thirty-six (36) hour window mandated by Part 53.
Detailed breach notification procedures, including the required content of notifications, escalation matrices, points of contact, and communication protocols, are set forth in Schedule D to the DPA. Schedule D has been updated in the enclosed redline to reflect certain refinements discussed during today's call.
F. Data Retention and Return/Deletion (Section 14)
Personal data processed by Skybridge under the DPA shall be retained for the duration of the SaaS subscription term and for a period of ninety (90) days following the effective date of termination or expiration of the subscription (the "Wind-Down Period"). During the Wind-Down Period, Controller may elect to have its personal data returned in a structured, commonly used, machine-readable format or securely deleted, at Controller's option and written direction.
Upon the expiration of the ninety (90) day Wind-Down Period, Processor shall securely delete all personal data in its possession, custody, or control, including all copies, backups, and archived data, except to the extent that retention of specific data is required by applicable law, regulation, or legal hold obligation. In the event that any personal data must be retained beyond the Wind-Down Period due to a legal requirement, Processor shall (i) promptly notify Controller of such requirement, (ii) limit the scope of retention to the minimum data necessary to satisfy the applicable legal obligation, and (iii) continue to protect such data in accordance with the terms of the DPA for so long as it remains in Processor's possession.
Skybridge will provide written certification of deletion to Controller upon Controller's written request following the completion of the Wind-Down Period and the deletion of personal data.
II. Additional Matters Addressed in Redline
In addition to the key open issues summarized above, the enclosed redline addresses a number of additional matters, including the following:
DPIA Cooperation. Skybridge agrees to provide reasonable assistance to Controller in connection with the preparation of Data Protection Impact Assessments ("DPIAs") as may be required under Article 35 of the GDPR or other applicable data protection law, at Controller's reasonable request and expense. Processor shall make available to Controller such information in Processor's possession as is reasonably necessary for Controller to conduct and document DPIAs related to the processing activities performed under the DPA.
Insurance Requirement. The redline confirms that Skybridge maintains cyber-liability and technology errors and omissions insurance coverage with per-occurrence limits of no less than ten million U.S. dollars ($10,000,000) and aggregate limits of no less than twenty million U.S. dollars ($20,000,000) throughout the term of the DPA. Skybridge shall provide Controller with a certificate of insurance upon request and shall provide prompt written notice in the event of any material reduction in coverage.
Security Standards. The redline incorporates references to the specific technical and organizational security measures maintained by Skybridge, including: SOC 2 Type II compliance (as described in Section I.D above); AES-256 encryption for data at rest; TLS 1.2 or higher encryption for data in transit; multi-factor authentication ("MFA") for all administrative and privileged access to systems processing Controller personal data; and annual penetration testing conducted by Ironvault Security Group LLC, with results and remediation plans made available to Controller upon request.
SCC Modules. The enclosed SCCs package includes: (i) Module 2 (Controller-to-Processor), governing the transfer of personal data from Meridian (as Controller) to Skybridge (as Processor); and (ii) Module 3 (Processor-to-Sub-processor), governing the onward transfer of personal data from Skybridge (as Processor) to Osprey Cloud Infrastructure, Inc. and Skybridge Fintech Europe B.V. (each as Sub-processor). Annexes I through III to the SCCs remain in substantially the form circulated with BRS's counter-proposal dated December 20, 2025, with targeted updates to reflect the discussions from today's call. As noted above, the SCCs are governed by the law of the Netherlands pursuant to Clause 17.
EU-US Data Privacy Framework. We note for the record that Skybridge maintains a valid self-certification under the EU-U.S. Data Privacy Framework (Certification ID: DPF-2025-03912, effective July 1, 2025). This self-certification serves as a supplementary transfer mechanism providing additional assurances for the transfer of personal data from the European Economic Area to the United States, but is not intended to displace or supersede the SCCs as the primary transfer mechanism under the DPA.
III. Remaining Open Items
We note that, notwithstanding the substantial progress reflected in this redline, several items remain open and will require further discussion between the parties. Specifically, we have identified approximately four areas that remain subject to negotiation, including: (1) the precise scope of the data subject categories and data elements described in Annex I to the SCCs; (2) the allocation of costs for Processor's cooperation with regulatory examinations beyond the standard audit framework; (3) Controller's requested termination-for-convenience right and the associated notice period and wind-down obligations; and (4) the treatment of aggregated and de-identified data following termination of the DPA. We anticipate that these items can be resolved efficiently through a focused exchange of markups and, if necessary, a follow-up call among counsel.
In order to permit the parties to finalize the DPA and SCC package in advance of the February 15, 2026 target signing date — which, as you know, is intended to be concurrent with the execution of the five (5) year SaaS subscription agreement (total contract value of $13,700,000) — we respectfully request that BRS provide its markup or written comments on the enclosed redline by no later than January 26, 2026. This timeline will allow sufficient opportunity for the parties to address any remaining items and prepare execution copies of all transaction documents in advance of the target date.
IV. Enclosures
The following documents are enclosed herewith:
1. Second Redline of Data Processing Agreement (redline/tracked changes format);
2. Clean copy of Data Processing Agreement (for reference);
3. Updated Schedules A through D to the Data Processing Agreement (marked to show changes from the December 20, 2025 version); and
4. Draft Standard Contractual Clauses (Modules 2 and 3), with Annexes I through III.
We are available at your convenience to discuss any questions you or your team may have regarding the enclosed materials or to schedule a follow-up call to address the remaining open items identified above. We look forward to resolving the remaining open items promptly and to bringing this transaction to a successful close.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1735 Market Street, Suite 2800 Philadelphia, PA 19103 Tel: (215) 498-7244 kostrowski@calderwoodharkness.com
cc:
Thomas Elridge, Esq., General Counsel and Chief Privacy Officer, Skybridge Fintech Ltd. Priscilla Wynn, Esq., Calderwood & Harkness LLP Alan Burke, Esq., Calderwood & Harkness LLP Derek Faulkner, Esq., Blackwell, Raines & Stoddard LLP
Enclosures (4)
Sub-Processor | Processing Activity | Location(s)
Osprey Cloud Infrastructure, Inc. | IaaS/PaaS hosting and infrastructure services | US-East data center (Ashburn, Virginia); EU data center (Frankfurt, Germany)
Skybridge Fintech Europe B.V. | EU personal data processing operations | Amsterdam, Netherlands

PRIVILEGED & CONFIDENTIAL ATTORNEY WORK PRODUCT

VIA ELECTRONIC MAIL AND HAND DELIVERY

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts