CALDERWOOD & HARKNESS LLP

1735 Market Street, Suite 2800 Philadelphia, PA 19103

ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT / NOT FOR DISTRIBUTION OUTSIDE CALDERWOOD & HARKNESS LLP

INTERNAL MEMORANDUM — PRIVILEGED & CONFIDENTIAL

TO: Kevin Ostrowski, Responsible Partner, Privacy & Data Security Practice Group

FROM: Alan Burke, Working Associate, Privacy & Data Security Practice Group

DATE: November 20, 2025

RE: Conflict Check Results — Representation of Skybridge Fintech Ltd. in Connection with DPA/SCC Negotiations with Meridian Federal Savings Bank

MATTER NO.: 1009-00004

This memorandum is protected by the attorney-client privilege and constitutes attorney work product prepared in anticipation of the firm's internal ethical and professional responsibility review. It is intended solely for internal use by Calderwood & Harkness LLP personnel and may not be distributed, reproduced, or disclosed to any person or entity outside the firm without the prior written authorization of the firm's General Counsel.

I. PURPOSE OF MEMORANDUM

This memorandum documents the results of the firm-wide conflicts clearance process performed in connection with the proposed engagement of Calderwood & Harkness LLP ("the Firm" or "Calderwood & Harkness") to represent Skybridge Fintech Ltd. ("Skybridge" or "SBF"), a Delaware C-corporation headquartered at 4100 Silverside Road, Suite 310, Wilmington, DE 19810, in the drafting, negotiation, and finalization of a customer-facing Data Processing Agreement ("DPA") and Standard Contractual Clauses ("SCC") package that will govern the processing of personal data by Skybridge in connection with the services it provides to regulated banking clients.

The DPA/SCC package will initially be negotiated with Meridian Federal Savings Bank ("Meridian" or "MFSB"), a federally chartered savings bank (OCC Charter No. 14-2238) headquartered at 900 Broad Street, Suite 1200, Newark, NJ 07102. Meridian is a prospective bank client of Skybridge and is in the process of migrating its payment-processing and regulatory-reporting operations to Skybridge's SaaS platform, SBF Core, pursuant to a five-year SaaS subscription agreement. Once the DPA/SCC package is negotiated and finalized with Meridian, it is intended to serve as Skybridge's standardized, bank-grade template for deployment with future FDIC-insured bank and credit-union clients.

Meridian is represented in the DPA/SCC negotiations by Blackwell, Raines & Stoddard LLP ("BRS"), with Constance Liu serving as lead partner and Derek Faulkner serving as associate counsel.

The proposed Calderwood & Harkness engagement team for this matter consists of the following attorneys:

• Kevin Ostrowski — Responsible Partner, Privacy & Data Security Practice Group

• Rachel Bernstein — Billing Partner, Privacy & Data Security Practice Group

• Priscilla Wynn — Lead Associate, Privacy & Data Security Practice Group

• Alan Burke — Working Associate, Privacy & Data Security Practice Group

Pursuant to the Firm's New Matter Intake Policy (NMIP § 3.2) and the requirements of the Pennsylvania Rules of Professional Conduct, this memorandum sets forth the complete results of the conflict check, the methodology employed, and the analysis and determination reached regarding the Firm's ability to accept and proceed with the proposed engagement.

II. PARTIES AND ENTITIES SEARCHED

The following parties, affiliated entities, and individuals were run through the Firm's conflict check database. All searches described in this Section II were conducted on November 20, 2025. Each subsection sets forth the full legal name, entity type, key identifying information, relevant officers and contacts, and the rationale for inclusion in the conflict search.

A. Prospective Client — Skybridge Fintech Ltd.

Skybridge is the prospective client in this engagement. All officers, directors, and key contacts identified above were individually searched. Skybridge was searched as both the prospective client and as a party against whom any adverse representation might exist.

B. Prospective Client Affiliate — Skybridge Fintech Europe B.V.

Skybridge Fintech Europe B.V. is included in this search because it is a wholly-owned subsidiary of the prospective client and will act as a sub-processor under the DPA. The entity is relevant to the SCC package, as it may serve as a data importer under Module 3 (Processor-to-Processor) of the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). Any conflict involving SBF Europe could be imputed to the prospective client relationship with Skybridge Fintech Ltd.

C. Counterparty — Meridian Federal Savings Bank

Meridian is the counterparty to the proposed DPA/SCC negotiations. Skybridge is a prospective technology vendor to Meridian, and the parties are in the process of negotiating a five-year SaaS subscription agreement with an annual contract value ("ACV") of approximately $2.74 million per year and a total contract value ("TCV") of approximately $13.7 million. The DPA/SCC package is ancillary to and will be incorporated into the master SaaS subscription agreement. Meridian is not a prospective client of Calderwood & Harkness in this matter; it is the opposing party. However, any current or prior client relationship between the Firm and Meridian (or its affiliates or officers) would require analysis under Pennsylvania Rules of Professional Conduct 1.7 and 1.9.

D. Counterparty's Outside Counsel — Blackwell, Raines & Stoddard LLP

BRS is included in the search because it serves as opposing counsel in the proposed engagement. While the engagement is transactional rather than adversarial in the litigation sense, BRS will be negotiating on behalf of Meridian against the Firm's client, Skybridge. Any current representation of BRS or its partners by Calderwood & Harkness, or any active matter in which BRS and Calderwood & Harkness serve as co-counsel, would require disclosure and evaluation.

E. Prospective Client's Key Sub-Processor — Osprey Cloud Infrastructure, Inc.

Osprey Cloud Infrastructure, Inc. is included in the search because it serves as Skybridge's primary infrastructure provider and will be directly implicated in the DPA/SCC package as a sub-processor. The Firm's role with respect to Osprey Cloud is limited to advising Skybridge; no attorney-client relationship with Osprey Cloud will be formed in connection with this engagement. Nonetheless, any existing representation of Osprey Cloud by the Firm, or any adverse matter involving Osprey Cloud, must be identified and evaluated.

F. Prospective Client's PE Sponsor — Halcyon Ridge Capital Partners, LP

Halcyon Ridge Capital Partners, LP is included in this search because of its significant equity position in Skybridge (34.2% of outstanding equity, held in Series B preferred stock) and because it maintains board-level observer rights through Catherine Shin. A private equity sponsor with this level of ownership and governance involvement could give rise to a conflict if the Firm currently represents Halcyon Ridge or any of its portfolio companies in a matter that could be adverse to Skybridge's interests. The search also encompasses Halcyon Ridge's known portfolio companies to the extent they appear in the Firm's conflicts database. No separate engagement with Halcyon Ridge is contemplated; the Firm's client in this matter is Skybridge Fintech Ltd. only.

G. Additional Parties Searched

The following additional parties were searched because of their material involvement in Skybridge's operations, compliance posture, or risk management program, each of which may be relevant to the DPA/SCC engagement:

1. Graystone & Ketchum LLP — Independent auditor and SOC 2 Type II report provider to Skybridge.

2. Bastion Mutual Insurance Company — Skybridge's cyber-liability insurance carrier.

3. Kestrel Risk Advisors LLC — Skybridge's insurance broker.

4. Ironvault Security Group LLC — Independent penetration testing firm retained by Skybridge.

Each of the foregoing entities was included in the search because the DPA/SCC package may reference, implicate, or require disclosure of information relating to auditors, insurers, and security-testing firms. While the likelihood of a conflict involving these peripheral parties is low, the Firm's NMIP requires that all known third parties with material involvement in the subject matter of a proposed engagement be included in the initial conflict search.

III. CONFLICT CHECK METHODOLOGY

The conflict check documented in this memorandum was conducted in accordance with the Firm's New Matter Intake Policy (NMIP § 3.2) and the requirements of the Pennsylvania Rules of Professional Conduct, Rules 1.7 through 1.10. The methodology employed is described below.

1. Database Searches. All entity names, short names, variant spellings, and trade names identified in Sections II.A through II.G above were searched in Calderwood & Harkness's firm-wide conflicts database, which is integrated into the Firm's new matter intake system ("NMIS"). The NMIS maintains records of all current client engagements, all former client engagements (including matters closed within the preceding ten years, with an emphasis on matters closed within the last five years), all adverse and counterparty records, and all prospective matters currently in the intake pipeline.

2. Individual Name Searches. All individual names identified in Sections II.A through II.G — including officers, directors, general counsel, key contacts, board observers, lead partners, and associates — were separately searched in the NMIS. These searches were conducted using both exact-match and fuzzy-match algorithms to account for variant spellings, name changes, and common abbreviations.

3. Counterparty and Adverse Party Searches. The NMIS was specifically searched for any matter in which the Firm represented Meridian Federal Savings Bank, any Meridian affiliate (including any holding company, subsidiary, or affiliated entity), or any officer or director of Meridian in any capacity, whether current or former. The database was also searched for any matter in which the Firm represented Blackwell, Raines & Stoddard LLP or any of its partners or associates in any capacity.

4. Adverse Interest Searches. The NMIS was searched for any matter in which any of the parties identified in Section II appeared as an adverse party, counterparty, or opposing party to a current or former client of the Firm. Particular attention was paid to any matter adverse to Skybridge, Skybridge Fintech Europe B.V., Osprey Cloud Infrastructure, Inc., or Halcyon Ridge Capital Partners, LP.

5. Lateral Hire Disclosure Review. The Firm's lateral hire disclosure forms were reviewed for any attorney currently employed by Calderwood & Harkness who previously represented any of the parties identified in Section II at a prior firm. This review covers all lateral hires within the preceding five years and is maintained by the Firm's General Counsel's office.

6. Practice Group Consultation. In addition to the automated database searches, the undersigned consulted with the leads of the Firm's Financial Services Regulatory, Corporate / M&A, and Litigation practice groups to confirm that no unreported representation of or adverse matter involving any of the searched parties exists.

7. Timing. All searches described above were conducted on November 20, 2025. The results set forth in Section IV are current as of that date.