1009-00004 · Skybridge Fintech Ltd · Engagement & Administration

engagement-letter-skybridge.docx DOCUMENT Finance & Banking

17 / 35 ← → ✕

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION

CALDERWOOD & HARKNESS LLP Attorneys at Law

1735 Market Street, Suite 2800 Philadelphia, PA 19103 Telephone: (215) 553-7100 Facsimile: (215) 553-7199 www.calderwoodharkness.com

November 20, 2025

Thomas Elridge, Esq. General Counsel and Chief Privacy Officer Skybridge Fintech Ltd. 4100 Silverside Road, Suite 310 Wilmington, DE 19810

Re: Engagement of Calderwood & Harkness LLP — Data Processing Agreement and Standard Contractual Clauses Package Matter No. 1009-00004

Dear Thomas:

1. Purpose and Engagement Overview

Calderwood & Harkness LLP ("we," "our," or the "Firm") is pleased to confirm our engagement by Skybridge Fintech Ltd. ("Skybridge" or the "Company") to provide legal services in connection with the negotiation, drafting, and finalization of a standardized customer-facing Data Processing Agreement ("DPA") and Standard Contractual Clauses ("SCC") package for Skybridge's bank clients. This letter sets forth the terms and conditions of our engagement, including the scope of representation, fee arrangements, engagement team composition, and related matters (this "Engagement Letter").

This Engagement Letter memorializes the understanding reached during our initial discussions with you and Rebecca Muñoz, Chief Information Security Officer of Skybridge, on November 20, 2025, in which we discussed the Company's need for a bank-grade DPA and SCC package to support Skybridge's expansion into the regulated financial institution market. We are excited about the opportunity to assist the Company in this critical initiative and believe our Privacy & Data Security practice is well-positioned to deliver the work product and counsel that Skybridge requires.

By executing this Engagement Letter, both parties agree to be bound by the terms and conditions set forth herein. In the event of any conflict between this Engagement Letter and any prior oral or written communications between the Firm and the Company regarding this engagement, the terms of this Engagement Letter shall control.

2. Scope of Representation

(a) Description of the Matter. The Firm has been engaged to prepare, negotiate, and finalize a customer-facing DPA and appended SCC package to be used by Skybridge as its standardized template for FDIC-insured bank clients. The SCC package will conform to the requirements of EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, and will encompass Module 2 (Controller-to-Processor) and Module 3 (Processor-to-Sub-processor) of the approved clauses, together with the associated annexes and appendices required thereunder. The DPA and SCC package will be structured to satisfy the data protection and third-party risk management requirements applicable to FDIC-insured depository institutions and to reflect current regulatory expectations under the General Data Protection Regulation ("GDPR"), the Gramm-Leach-Bliley Act, and applicable federal banking agency guidance on third-party relationships.

The DPA/SCC package will initially be negotiated with, and tailored to the requirements of, Meridian Federal Savings Bank ("Meridian"), a federally chartered savings bank and Skybridge's prospective bank client, and Meridian's outside counsel, Blackwell, Raines & Stoddard LLP. It is anticipated that the negotiated DPA will thereafter serve as the basis for a reusable, standardized bank-grade template that Skybridge may deploy — with appropriate customizations — across future engagements with other FDIC-insured bank clients.

(b) Specific Scope Items. Without limiting the generality of the foregoing, the Firm's representation in this engagement will include the following specific work streams:

(i) Review and analysis of Meridian's form DPA and Third-Party Risk Management ("TPRM") due-diligence questionnaire, including identification of risk allocation positions, regulatory compliance requirements, and areas requiring negotiation or clarification;

(ii) Preparation of gap analysis memoranda assessing the differences between Meridian's form DPA and Skybridge's existing privacy and data processing framework, as well as regulatory landscape assessments addressing applicable requirements under the GDPR, the FDIC's guidance on third-party relationships (FIL-44-2008, as supplemented), the OCC's Bulletin 2013-29 and its successor guidance, and related federal banking agency pronouncements;

(iii) Drafting of Skybridge's counter-proposal DPA template, incorporating commercially reasonable positions reflective of Skybridge's role as a SaaS-based fintech processor and its operational capabilities;

(iv) Negotiation of DPA terms with Meridian's counsel, Blackwell, Raines & Stoddard LLP (lead partner: Constance Liu), including without limitation provisions addressing indemnification obligations and carve-outs, liability caps and exclusions, data breach notification timing and procedures, sub-processor appointment and approval mechanisms, audit rights and inspection procedures, data protection impact assessment cooperation obligations, data subject rights fulfillment processes, cross-border transfer mechanisms, and data deletion and return obligations;

(v) Drafting and negotiation of Standard Contractual Clauses, including Module 2 (Controller-to-Processor) for the direct relationship between Meridian and Skybridge, and Module 3 (Processor-to-Sub-processor) for the relationship between Skybridge and its downstream sub-processors, together with the preparation of associated Annexes I (list of parties, description of transfer, competent supervisory authority), II (technical and organizational security measures), and III (list of sub-processors);

(vi) Preparation of supporting schedules and exhibits to the DPA, including a detailed description of processing activities, a comprehensive description of technical and organizational security measures implemented by Skybridge, a current sub-processor list with processing descriptions and locations, and breach notification procedures and escalation protocols;

(vii) Preparation of a customization guide (the "Bank Client DPA Playbook") designed to enable Skybridge's in-house legal team to adapt the negotiated DPA as a reusable bank-grade template for future FDIC-insured bank clients, including guidance on which provisions are considered market-standard and may be treated as non-negotiable, which provisions are subject to reasonable customization, and recommended fallback positions for key commercial terms; and

(viii) Preparation of closing deliverables, including an officer's certificate, execution signature pages, and a document checklist confirming the completeness of the DPA/SCC package.

(c) Scope Limitations. The Company acknowledges and agrees that the Firm is not engaged to provide, and this engagement does not encompass, legal advice on the underlying SaaS subscription agreement or master services agreement between Skybridge and Meridian (or any other Skybridge customer), tax advice of any kind, advice on Skybridge's corporate governance matters (including matters related to its board structure, equity capitalization, or investor relationships), employment law advice, or advice on any matter other than the DPA/SCC package and related privacy and data security matters specifically described in this Section 2. Should the Company desire the Firm's assistance with matters outside the scope described herein, such additional work will be the subject of a separate engagement letter or an amendment to this Engagement Letter, as mutually agreed upon in writing by the parties.

The Firm's representation is further limited to the laws and regulations of the United States and the European Union (and its Member States) as they relate to the subject matter of this engagement. The Firm does not hold itself out as providing legal advice under the laws of any other jurisdiction, and the Company should seek separate counsel to the extent it requires advice on the data protection or privacy laws of jurisdictions outside the United States and the European Union.

3. Engagement Team

The following attorneys will serve as the primary engagement team for this matter:

Kevin Ostrowski — Responsible Partner, Privacy & Data Security. Mr. Ostrowski will serve as the engagement partner with overall supervisory responsibility for the matter. Mr. Ostrowski has extensive experience advising fintech companies and financial institutions on data processing arrangements, cross-border data transfers, and regulatory compliance under the GDPR and U.S. federal banking regulations. He will participate in key strategic decisions, review all major deliverables, and serve as the Firm's primary relationship partner for this engagement.

Rachel Bernstein — Billing Partner, Privacy & Data Security. Ms. Bernstein will serve as the billing partner and provide senior strategic counsel on complex negotiation points, particularly those involving indemnification, liability allocation, and regulatory compliance matters. Ms. Bernstein brings deep experience in negotiating data processing agreements for regulated financial institutions and will be available to participate in escalation calls and strategy sessions as the negotiation progresses.

Priscilla Wynn — Lead Associate, Privacy & Data Security. Ms. Wynn will serve as the lead associate responsible for day-to-day management of drafting, negotiations, and communications with Meridian's counsel. Ms. Wynn will be the Company's primary point of contact for routine matters related to this engagement, will coordinate all redline exchanges and negotiation sessions, and will be responsible for the preparation and quality control of all work product.

Alan Burke — Working Associate, Privacy & Data Security. Mr. Burke will support Ms. Wynn in drafting, legal research, regulatory analysis, and preparation of the gap analysis memoranda and customization guide. Mr. Burke has particular experience in EU data protection law and cross-border transfer mechanisms, including the Standard Contractual Clauses and the framework established by the Court of Justice of the European Union in Schrems II.

Other attorneys or professional staff of the Firm may be assigned to the matter from time to time as necessary to ensure timely and efficient completion of the engagement. The Company will be notified of any material changes to the composition of the engagement team, including the addition of any timekeeper not identified above, prior to the commencement of such timekeeper's work on the matter. The applicable billing rates for any additional timekeepers will be communicated to the Company at that time.

The Company has identified Thomas Elridge, General Counsel and Chief Privacy Officer, and Rebecca Muñoz, Chief Information Security Officer, as the primary client contacts for this engagement. All substantive communications, deliverables, and invoices will be directed to Mr. Elridge unless the Company instructs us otherwise in writing. Ms. Muñoz will serve as the Firm's primary technical contact for matters relating to Skybridge's security infrastructure, sub-processor arrangements, and technical and organizational measures.

4. Fees and Billing Arrangements

(a) Hourly Billing Rates. Professional services rendered in connection with this engagement will be billed at the following hourly rates:

The foregoing rates reflect a courtesy discount from the Firm's standard published rates for the referenced timekeepers. Rates for any additional timekeepers assigned to the matter will be communicated to the Company prior to their assignment, and such timekeepers will not begin work on the matter until the Company has been informed of the applicable rate. Hourly rates are subject to annual adjustment in accordance with the Firm's standard rate-setting practices, which typically occur on or about January 1 of each calendar year; however, no adjustment to the rates set forth above is anticipated during the expected term of this engagement.

Time will be recorded in increments of one-tenth (0.1) of an hour. All timekeepers assigned to the matter will maintain contemporaneous time records reflecting the date of service, a description of the work performed, and the time expended.

(b) Fee Estimate and Cap. Based on the anticipated scope of work described in Section 2 above, including the negotiation of the DPA/SCC package with Meridian's counsel, the Firm estimates that total professional fees for this engagement will fall in the range of $185,000 to $225,000. This estimate is based on certain assumptions regarding the complexity and duration of negotiations with Meridian's counsel, the number of redline iterations required, and the level of involvement of the Firm's partners in direct negotiation sessions. The actual fees incurred may be higher or lower than this estimate depending on the course of the engagement, and this estimate does not constitute a guarantee or commitment regarding the total fees to be charged.

Notwithstanding the foregoing, total professional fees for this engagement shall not exceed $240,000 without the prior written consent of the Company (the "Fee Cap"). The Firm will notify the Company promptly if it appears likely that professional fees will approach or exceed the Fee Cap, and will not continue to accrue fees in excess of the Fee Cap without the Company's express written authorization. For the avoidance of doubt, the Fee Cap applies solely to professional fees for attorney time and does not include disbursements and out-of-pocket expenses, which are addressed separately in Section 5 below.

(c) Billing Cycle. Invoices for professional services and disbursements will be rendered on a monthly basis, generally within fifteen (15) business days following the close of each calendar month. Invoices are due and payable within thirty (30) days of the invoice date. Each invoice will include reasonable detail of the services performed during the applicable billing period, including the name of each timekeeper, the date of each service, a narrative description of the work performed, and the time expended. Disbursements and expenses will be itemized separately on each invoice.

The Firm reserves the right to suspend work on the matter in the event that any invoice remains unpaid for more than sixty (60) days following its due date, provided that the Firm shall provide the Company with at least fifteen (15) days' prior written notice of its intention to suspend work and an opportunity to cure the outstanding balance.

5. Disbursements and Expenses

The Company will be responsible for reimbursement of all reasonable out-of-pocket disbursements and expenses incurred by the Firm in connection with this engagement. Such disbursements and expenses may include, but are not limited to, the following: travel expenses (including airfare, lodging, ground transportation, and meals) incurred in connection with in-person negotiation sessions or client meetings, if any; courier and delivery charges; long-distance telephone and videoconference service charges; filing fees; document reproduction and printing costs; third-party vendor costs, including costs associated with any specialized data protection consultants retained with the Company's approval; and other reasonable expenses directly attributable to the engagement.

Any individual disbursement reasonably expected to exceed $1,000 will be submitted for approval by the Company's General Counsel in advance of being incurred. The Firm will use commercially reasonable efforts to minimize disbursements and expenses and to seek cost-effective alternatives where practicable.

6. Identification of Adverse and Related Parties

The Firm has performed a conflicts of interest check in connection with this proposed engagement in accordance with the applicable Rules of Professional Conduct. The following parties have been identified and checked against the Firm's conflicts database:

• Meridian Federal Savings Bank — counterparty to the proposed DPA/SCC package and Skybridge's prospective bank client;

• Blackwell, Raines & Stoddard LLP — outside counsel to Meridian Federal Savings Bank (lead partner: Constance Liu, Esq.), with whom the Firm anticipates conducting the DPA/SCC negotiations on behalf of Skybridge;

• Osprey Cloud Infrastructure, Inc. — Skybridge's primary infrastructure-as-a-service provider and sub-processor, whose processing activities will be addressed in the sub-processor provisions and Annex III of the DPA/SCC package;

• Halcyon Ridge Capital Partners, LP — Skybridge's private equity sponsor and Series B investor, holding approximately 34.2% of Skybridge's equity on a fully diluted basis; and

• Skybridge Fintech Europe B.V. — Skybridge's EU affiliate and sub-processor, incorporated under the laws of the Netherlands, whose processing activities in the European Economic Area will be addressed in the SCC and related annexes.

Based on the results of our conflicts check, no conflicts of interest have been identified that would preclude the Firm from undertaking this engagement. The Firm does not currently represent, and has not within the past twenty-four (24) months represented, Meridian Federal Savings Bank, Blackwell, Raines & Stoddard LLP, or any of the other parties identified above in any matter adverse to Skybridge or related to the subject matter of this engagement.

The Company agrees to promptly notify the Firm of any additional parties, affiliates, related entities, or relationships that may be relevant to the Firm's ongoing conflicts analysis. The Firm's obligation to perform conflicts checks is a continuing one, and the Firm will promptly notify the Company in the event that any conflict or potential conflict is identified during the course of the engagement.

7. Confidentiality

The Firm will maintain the confidentiality of all information provided by the Company in connection with this engagement, in accordance with the applicable Rules of Professional Conduct governing the attorney-client relationship, the attorney-client privilege, and the work product doctrine. The Firm will not disclose confidential information received from the Company to any third party except as authorized by the Company, required by law, or permitted under the applicable Rules of Professional Conduct.

Without limiting the generality of the foregoing, the Firm acknowledges its obligation to protect Skybridge's proprietary and commercially sensitive information, including but not limited to information relating to the SBF Core platform (Skybridge's proprietary cloud-based banking software-as-a-service platform), Skybridge's security infrastructure and technical and organizational measures, the terms of the DPA negotiations with Meridian and its counsel, Skybridge's customer pipeline and business development strategies, and any financial, technical, or operational information provided to the Firm in connection with this engagement. The Firm will implement appropriate administrative, physical, and technical safeguards to protect such information against unauthorized access, disclosure, or loss, consistent with the Firm's information security policies and applicable professional obligations.

8. Document Retention

The Firm's document retention policy provides that client files, work product, correspondence, and related materials will be maintained for a period of seven (7) years following the conclusion of the engagement, after which time such materials may be disposed of or destroyed in accordance with the Firm's standard records management policies. The Company may request in writing, at any time prior to the expiration of the seven-year retention period, that the Firm retain specific files or materials for a longer period or that such materials be returned to the Company. In the absence of such a written request, the Company agrees that the Firm may dispose of engagement-related materials following the expiration of the retention period without further notice to the Company.

The Firm will, upon the Company's request at the conclusion of the engagement, return to the Company any original documents or materials provided by the Company to the Firm in connection with this engagement. Work product prepared by the Firm in connection with this engagement will be the property of the Company upon payment of all fees and expenses due to the Firm.

9. Anticipated Timeline

The parties are targeting execution of the DPA/SCC package by February 15, 2026, concurrent with the anticipated execution of the SaaS subscription agreement between Skybridge and Meridian. The Firm proposes the following key milestones for the engagement:

The Firm will endeavor to adhere to the foregoing timeline, subject to the pace and course of negotiations with Meridian's counsel, the timely availability of information and approvals from the Company, and other factors outside the Firm's reasonable control. The Firm will provide the Company with regular status updates and will promptly notify the Company of any anticipated delays or deviations from the timeline set forth above. The dates set forth in this Section 9 are targets and do not constitute binding commitments or deadlines, and any failure to meet a target date shall not constitute a breach of this Engagement Letter.

10. Governing Law

This Engagement Letter and the terms of the Firm's engagement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles. Any dispute arising out of or relating to this Engagement Letter or the Firm's representation of the Company shall be subject to the exclusive jurisdiction of the state and federal courts located in New Castle County, Delaware, and each party hereby consents to the personal jurisdiction and venue of such courts.

11. Termination

Either party may terminate this engagement at any time upon written notice to the other party. The Company's right to terminate this engagement is absolute and unconditional, subject only to the Company's obligation to pay fees and expenses incurred through the date of termination as provided below. The Firm's right to terminate is subject to the applicable Rules of Professional Conduct governing withdrawal from representation, including the obligation to take reasonable steps to avoid prejudice to the Company's interests.

In the event of termination of this engagement by either party, the Company will remain responsible for all professional fees accrued and expenses incurred through the effective date of termination, which shall be payable in accordance with the billing terms set forth in Section 4(c) above. Upon termination, the Firm will take reasonable steps to protect the Company's interests, including returning to the Company all client materials and files in the Firm's possession (or, at the Company's election, transferring such materials to successor counsel), providing a final accounting of fees and expenses, and cooperating in the orderly transition of the matter to successor counsel designated by the Company.

12. Limitation of Liability

The Firm's aggregate liability to the Company and its affiliates arising out of or related to this engagement, whether based on contract, tort (including negligence), breach of fiduciary duty, or any other theory of liability, shall not exceed the total amount of professional fees actually paid by the Company to the Firm under this Engagement Letter. This limitation of liability shall not apply to losses arising from the Firm's willful misconduct or fraud. The Company acknowledges that the Firm's fees have been established in consideration of, among other factors, the limitation of liability set forth in this Section 12, and that the Company may negotiate a higher limitation in exchange for a corresponding adjustment to the Firm's fees.

In no event shall the Firm be liable to the Company for any indirect, consequential, special, incidental, or punitive damages, regardless of the form of action and whether or not such damages were foreseeable.

13. Acceptance and Counterparts

We respectfully request that the Company indicate its acceptance of the terms and conditions of this engagement by having an authorized representative sign and return a copy of this Engagement Letter to the undersigned. This Engagement Letter shall become effective upon execution by both parties.

This Engagement Letter may be executed in one or more counterparts, including by electronic signature (e.g., Brightwater Software or Ashford Health IT), each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Delivery of an executed counterpart by electronic mail (including PDF) or other electronic transmission shall be effective as delivery of a manually executed original.

This Engagement Letter, together with any amendments or supplements agreed to in writing by the parties, constitutes the entire agreement between the Firm and the Company with respect to the subject matter hereof and supersedes all prior or contemporaneous oral or written communications, proposals, and representations with respect to the Firm's engagement on this matter.

We look forward to working with you and the Skybridge team on this important matter. Please do not hesitate to contact me or Priscilla Wynn with any questions regarding this Engagement Letter or the substance of the engagement.

Sincerely,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security

Telephone: (215) 553-7142

Email: kostrowski@calderwoodharkness.com

ACKNOWLEDGMENT AND ACCEPTANCE

The undersigned, on behalf of Skybridge Fintech Ltd., hereby acknowledges receipt of this Engagement Letter, confirms that the undersigned is duly authorized to execute this Engagement Letter on behalf of the Company, and agrees to the terms and conditions set forth herein.

ACKNOWLEDGED AND AGREED:

SKYBRIDGE FINTECH LTD.

By: ________

Name: Thomas Elridge

Title: General Counsel and Chief Privacy Officer

Date: ________

cc: Rachel Bernstein, Partner, Calderwood & Harkness LLP cc: Nadia Karimova, Chief Executive Officer, Skybridge Fintech Ltd. cc: Rebecca Muñoz, Chief Information Security Officer, Skybridge Fintech Ltd.

For the avoidance of doubt, the Client, Skybridge Fintech Ltd., is a portfolio company of Pinnacle Venture Fund II LP, and certain consents and reporting obligations to the sponsor may apply in connection with this matter.

Timekeeper	Position	Hourly Rate
Kevin Ostrowski	Partner	$1,150.00
Rachel Bernstein	Partner	$1,075.00
Priscilla Wynn	Associate	$685.00
Alan Burke	Associate	$525.00
Target Date	Milestone
Late November 2025	Receipt and review of Meridian's TPRM questionnaire and form DPA; commencement of gap analysis
Early December 2025	Delivery of gap analysis memorandum and initial redline of Meridian's form DPA to Skybridge for review
Mid-December 2025	Transmission of Skybridge's counter-proposal DPA to Meridian's counsel (Blackwell, Raines & Stoddard LLP)
January 2026	Iterative redline exchanges, key issues negotiations, and negotiation sessions with Meridian's counsel
Early February 2026	Circulation of execution-ready DPA/SCC package to all parties for final review
February 15, 2026	Target signing date for the DPA/SCC package

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION
CALDERWOOD & HARKNESS LLP Attorneys at Law
1735 Market Street, Suite 2800 Philadelphia, PA 19103 Telephone: (215) 553-7100 Facsimile: (215) 553-7199 www.calderwoodharkness.com
November 20, 2025
Thomas Elridge, Esq. General Counsel and Chief Privacy Officer Skybridge Fintech Ltd. 4100 Silverside Road, Suite 310 Wilmington, DE 19810
Re: Engagement of Calderwood & Harkness LLP — Data Processing Agreement and Standard Contractual Clauses Package Matter No. 1009-00004
Dear Thomas:
1. Purpose and Engagement Overview
Calderwood & Harkness LLP ("we," "our," or the "Firm") is pleased to confirm our engagement by Skybridge Fintech Ltd. ("Skybridge" or the "Company") to provide legal services in connection with the negotiation, drafting, and finalization of a standardized customer-facing Data Processing Agreement ("DPA") and Standard Contractual Clauses ("SCC") package for Skybridge's bank clients. This letter sets forth the terms and conditions of our engagement, including the scope of representation, fee arrangements, engagement team composition, and related matters (this "Engagement Letter").
This Engagement Letter memorializes the understanding reached during our initial discussions with you and Rebecca Muñoz, Chief Information Security Officer of Skybridge, on November 20, 2025, in which we discussed the Company's need for a bank-grade DPA and SCC package to support Skybridge's expansion into the regulated financial institution market. We are excited about the opportunity to assist the Company in this critical initiative and believe our Privacy & Data Security practice is well-positioned to deliver the work product and counsel that Skybridge requires.
By executing this Engagement Letter, both parties agree to be bound by the terms and conditions set forth herein. In the event of any conflict between this Engagement Letter and any prior oral or written communications between the Firm and the Company regarding this engagement, the terms of this Engagement Letter shall control.
2. Scope of Representation
(a) Description of the Matter. The Firm has been engaged to prepare, negotiate, and finalize a customer-facing DPA and appended SCC package to be used by Skybridge as its standardized template for FDIC-insured bank clients. The SCC package will conform to the requirements of EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, and will encompass Module 2 (Controller-to-Processor) and Module 3 (Processor-to-Sub-processor) of the approved clauses, together with the associated annexes and appendices required thereunder. The DPA and SCC package will be structured to satisfy the data protection and third-party risk management requirements applicable to FDIC-insured depository institutions and to reflect current regulatory expectations under the General Data Protection Regulation ("GDPR"), the Gramm-Leach-Bliley Act, and applicable federal banking agency guidance on third-party relationships.
The DPA/SCC package will initially be negotiated with, and tailored to the requirements of, Meridian Federal Savings Bank ("Meridian"), a federally chartered savings bank and Skybridge's prospective bank client, and Meridian's outside counsel, Blackwell, Raines & Stoddard LLP. It is anticipated that the negotiated DPA will thereafter serve as the basis for a reusable, standardized bank-grade template that Skybridge may deploy — with appropriate customizations — across future engagements with other FDIC-insured bank clients.
(b) Specific Scope Items. Without limiting the generality of the foregoing, the Firm's representation in this engagement will include the following specific work streams:
(i) Review and analysis of Meridian's form DPA and Third-Party Risk Management ("TPRM") due-diligence questionnaire, including identification of risk allocation positions, regulatory compliance requirements, and areas requiring negotiation or clarification;
(ii) Preparation of gap analysis memoranda assessing the differences between Meridian's form DPA and Skybridge's existing privacy and data processing framework, as well as regulatory landscape assessments addressing applicable requirements under the GDPR, the FDIC's guidance on third-party relationships (FIL-44-2008, as supplemented), the OCC's Bulletin 2013-29 and its successor guidance, and related federal banking agency pronouncements;
(iii) Drafting of Skybridge's counter-proposal DPA template, incorporating commercially reasonable positions reflective of Skybridge's role as a SaaS-based fintech processor and its operational capabilities;
(iv) Negotiation of DPA terms with Meridian's counsel, Blackwell, Raines & Stoddard LLP (lead partner: Constance Liu), including without limitation provisions addressing indemnification obligations and carve-outs, liability caps and exclusions, data breach notification timing and procedures, sub-processor appointment and approval mechanisms, audit rights and inspection procedures, data protection impact assessment cooperation obligations, data subject rights fulfillment processes, cross-border transfer mechanisms, and data deletion and return obligations;
(v) Drafting and negotiation of Standard Contractual Clauses, including Module 2 (Controller-to-Processor) for the direct relationship between Meridian and Skybridge, and Module 3 (Processor-to-Sub-processor) for the relationship between Skybridge and its downstream sub-processors, together with the preparation of associated Annexes I (list of parties, description of transfer, competent supervisory authority), II (technical and organizational security measures), and III (list of sub-processors);
(vi) Preparation of supporting schedules and exhibits to the DPA, including a detailed description of processing activities, a comprehensive description of technical and organizational security measures implemented by Skybridge, a current sub-processor list with processing descriptions and locations, and breach notification procedures and escalation protocols;
(vii) Preparation of a customization guide (the "Bank Client DPA Playbook") designed to enable Skybridge's in-house legal team to adapt the negotiated DPA as a reusable bank-grade template for future FDIC-insured bank clients, including guidance on which provisions are considered market-standard and may be treated as non-negotiable, which provisions are subject to reasonable customization, and recommended fallback positions for key commercial terms; and
(viii) Preparation of closing deliverables, including an officer's certificate, execution signature pages, and a document checklist confirming the completeness of the DPA/SCC package.
(c) Scope Limitations. The Company acknowledges and agrees that the Firm is not engaged to provide, and this engagement does not encompass, legal advice on the underlying SaaS subscription agreement or master services agreement between Skybridge and Meridian (or any other Skybridge customer), tax advice of any kind, advice on Skybridge's corporate governance matters (including matters related to its board structure, equity capitalization, or investor relationships), employment law advice, or advice on any matter other than the DPA/SCC package and related privacy and data security matters specifically described in this Section 2. Should the Company desire the Firm's assistance with matters outside the scope described herein, such additional work will be the subject of a separate engagement letter or an amendment to this Engagement Letter, as mutually agreed upon in writing by the parties.
The Firm's representation is further limited to the laws and regulations of the United States and the European Union (and its Member States) as they relate to the subject matter of this engagement. The Firm does not hold itself out as providing legal advice under the laws of any other jurisdiction, and the Company should seek separate counsel to the extent it requires advice on the data protection or privacy laws of jurisdictions outside the United States and the European Union.
3. Engagement Team
The following attorneys will serve as the primary engagement team for this matter:
Kevin Ostrowski — Responsible Partner, Privacy & Data Security. Mr. Ostrowski will serve as the engagement partner with overall supervisory responsibility for the matter. Mr. Ostrowski has extensive experience advising fintech companies and financial institutions on data processing arrangements, cross-border data transfers, and regulatory compliance under the GDPR and U.S. federal banking regulations. He will participate in key strategic decisions, review all major deliverables, and serve as the Firm's primary relationship partner for this engagement.
Rachel Bernstein — Billing Partner, Privacy & Data Security. Ms. Bernstein will serve as the billing partner and provide senior strategic counsel on complex negotiation points, particularly those involving indemnification, liability allocation, and regulatory compliance matters. Ms. Bernstein brings deep experience in negotiating data processing agreements for regulated financial institutions and will be available to participate in escalation calls and strategy sessions as the negotiation progresses.
Priscilla Wynn — Lead Associate, Privacy & Data Security. Ms. Wynn will serve as the lead associate responsible for day-to-day management of drafting, negotiations, and communications with Meridian's counsel. Ms. Wynn will be the Company's primary point of contact for routine matters related to this engagement, will coordinate all redline exchanges and negotiation sessions, and will be responsible for the preparation and quality control of all work product.
Alan Burke — Working Associate, Privacy & Data Security. Mr. Burke will support Ms. Wynn in drafting, legal research, regulatory analysis, and preparation of the gap analysis memoranda and customization guide. Mr. Burke has particular experience in EU data protection law and cross-border transfer mechanisms, including the Standard Contractual Clauses and the framework established by the Court of Justice of the European Union in Schrems II.
Other attorneys or professional staff of the Firm may be assigned to the matter from time to time as necessary to ensure timely and efficient completion of the engagement. The Company will be notified of any material changes to the composition of the engagement team, including the addition of any timekeeper not identified above, prior to the commencement of such timekeeper's work on the matter. The applicable billing rates for any additional timekeepers will be communicated to the Company at that time.
The Company has identified Thomas Elridge, General Counsel and Chief Privacy Officer, and Rebecca Muñoz, Chief Information Security Officer, as the primary client contacts for this engagement. All substantive communications, deliverables, and invoices will be directed to Mr. Elridge unless the Company instructs us otherwise in writing. Ms. Muñoz will serve as the Firm's primary technical contact for matters relating to Skybridge's security infrastructure, sub-processor arrangements, and technical and organizational measures.
4. Fees and Billing Arrangements
(a) Hourly Billing Rates. Professional services rendered in connection with this engagement will be billed at the following hourly rates:
The foregoing rates reflect a courtesy discount from the Firm's standard published rates for the referenced timekeepers. Rates for any additional timekeepers assigned to the matter will be communicated to the Company prior to their assignment, and such timekeepers will not begin work on the matter until the Company has been informed of the applicable rate. Hourly rates are subject to annual adjustment in accordance with the Firm's standard rate-setting practices, which typically occur on or about January 1 of each calendar year; however, no adjustment to the rates set forth above is anticipated during the expected term of this engagement.
Time will be recorded in increments of one-tenth (0.1) of an hour. All timekeepers assigned to the matter will maintain contemporaneous time records reflecting the date of service, a description of the work performed, and the time expended.
(b) Fee Estimate and Cap. Based on the anticipated scope of work described in Section 2 above, including the negotiation of the DPA/SCC package with Meridian's counsel, the Firm estimates that total professional fees for this engagement will fall in the range of $185,000 to $225,000. This estimate is based on certain assumptions regarding the complexity and duration of negotiations with Meridian's counsel, the number of redline iterations required, and the level of involvement of the Firm's partners in direct negotiation sessions. The actual fees incurred may be higher or lower than this estimate depending on the course of the engagement, and this estimate does not constitute a guarantee or commitment regarding the total fees to be charged.
Notwithstanding the foregoing, total professional fees for this engagement shall not exceed $240,000 without the prior written consent of the Company (the "Fee Cap"). The Firm will notify the Company promptly if it appears likely that professional fees will approach or exceed the Fee Cap, and will not continue to accrue fees in excess of the Fee Cap without the Company's express written authorization. For the avoidance of doubt, the Fee Cap applies solely to professional fees for attorney time and does not include disbursements and out-of-pocket expenses, which are addressed separately in Section 5 below.
(c) Billing Cycle. Invoices for professional services and disbursements will be rendered on a monthly basis, generally within fifteen (15) business days following the close of each calendar month. Invoices are due and payable within thirty (30) days of the invoice date. Each invoice will include reasonable detail of the services performed during the applicable billing period, including the name of each timekeeper, the date of each service, a narrative description of the work performed, and the time expended. Disbursements and expenses will be itemized separately on each invoice.
The Firm reserves the right to suspend work on the matter in the event that any invoice remains unpaid for more than sixty (60) days following its due date, provided that the Firm shall provide the Company with at least fifteen (15) days' prior written notice of its intention to suspend work and an opportunity to cure the outstanding balance.
5. Disbursements and Expenses
The Company will be responsible for reimbursement of all reasonable out-of-pocket disbursements and expenses incurred by the Firm in connection with this engagement. Such disbursements and expenses may include, but are not limited to, the following: travel expenses (including airfare, lodging, ground transportation, and meals) incurred in connection with in-person negotiation sessions or client meetings, if any; courier and delivery charges; long-distance telephone and videoconference service charges; filing fees; document reproduction and printing costs; third-party vendor costs, including costs associated with any specialized data protection consultants retained with the Company's approval; and other reasonable expenses directly attributable to the engagement.
Any individual disbursement reasonably expected to exceed $1,000 will be submitted for approval by the Company's General Counsel in advance of being incurred. The Firm will use commercially reasonable efforts to minimize disbursements and expenses and to seek cost-effective alternatives where practicable.
6. Identification of Adverse and Related Parties
The Firm has performed a conflicts of interest check in connection with this proposed engagement in accordance with the applicable Rules of Professional Conduct. The following parties have been identified and checked against the Firm's conflicts database:
•  Meridian Federal Savings Bank — counterparty to the proposed DPA/SCC package and Skybridge's prospective bank client;
•  Blackwell, Raines & Stoddard LLP — outside counsel to Meridian Federal Savings Bank (lead partner: Constance Liu, Esq.), with whom the Firm anticipates conducting the DPA/SCC negotiations on behalf of Skybridge;
•  Osprey Cloud Infrastructure, Inc. — Skybridge's primary infrastructure-as-a-service provider and sub-processor, whose processing activities will be addressed in the sub-processor provisions and Annex III of the DPA/SCC package;
•  Halcyon Ridge Capital Partners, LP — Skybridge's private equity sponsor and Series B investor, holding approximately 34.2% of Skybridge's equity on a fully diluted basis; and
•  Skybridge Fintech Europe B.V. — Skybridge's EU affiliate and sub-processor, incorporated under the laws of the Netherlands, whose processing activities in the European Economic Area will be addressed in the SCC and related annexes.
Based on the results of our conflicts check, no conflicts of interest have been identified that would preclude the Firm from undertaking this engagement. The Firm does not currently represent, and has not within the past twenty-four (24) months represented, Meridian Federal Savings Bank, Blackwell, Raines & Stoddard LLP, or any of the other parties identified above in any matter adverse to Skybridge or related to the subject matter of this engagement.
The Company agrees to promptly notify the Firm of any additional parties, affiliates, related entities, or relationships that may be relevant to the Firm's ongoing conflicts analysis. The Firm's obligation to perform conflicts checks is a continuing one, and the Firm will promptly notify the Company in the event that any conflict or potential conflict is identified during the course of the engagement.
7. Confidentiality
The Firm will maintain the confidentiality of all information provided by the Company in connection with this engagement, in accordance with the applicable Rules of Professional Conduct governing the attorney-client relationship, the attorney-client privilege, and the work product doctrine. The Firm will not disclose confidential information received from the Company to any third party except as authorized by the Company, required by law, or permitted under the applicable Rules of Professional Conduct.
Without limiting the generality of the foregoing, the Firm acknowledges its obligation to protect Skybridge's proprietary and commercially sensitive information, including but not limited to information relating to the SBF Core platform (Skybridge's proprietary cloud-based banking software-as-a-service platform), Skybridge's security infrastructure and technical and organizational measures, the terms of the DPA negotiations with Meridian and its counsel, Skybridge's customer pipeline and business development strategies, and any financial, technical, or operational information provided to the Firm in connection with this engagement. The Firm will implement appropriate administrative, physical, and technical safeguards to protect such information against unauthorized access, disclosure, or loss, consistent with the Firm's information security policies and applicable professional obligations.
8. Document Retention
The Firm's document retention policy provides that client files, work product, correspondence, and related materials will be maintained for a period of seven (7) years following the conclusion of the engagement, after which time such materials may be disposed of or destroyed in accordance with the Firm's standard records management policies. The Company may request in writing, at any time prior to the expiration of the seven-year retention period, that the Firm retain specific files or materials for a longer period or that such materials be returned to the Company. In the absence of such a written request, the Company agrees that the Firm may dispose of engagement-related materials following the expiration of the retention period without further notice to the Company.
The Firm will, upon the Company's request at the conclusion of the engagement, return to the Company any original documents or materials provided by the Company to the Firm in connection with this engagement. Work product prepared by the Firm in connection with this engagement will be the property of the Company upon payment of all fees and expenses due to the Firm.
9. Anticipated Timeline
The parties are targeting execution of the DPA/SCC package by February 15, 2026, concurrent with the anticipated execution of the SaaS subscription agreement between Skybridge and Meridian. The Firm proposes the following key milestones for the engagement:
The Firm will endeavor to adhere to the foregoing timeline, subject to the pace and course of negotiations with Meridian's counsel, the timely availability of information and approvals from the Company, and other factors outside the Firm's reasonable control. The Firm will provide the Company with regular status updates and will promptly notify the Company of any anticipated delays or deviations from the timeline set forth above. The dates set forth in this Section 9 are targets and do not constitute binding commitments or deadlines, and any failure to meet a target date shall not constitute a breach of this Engagement Letter.
10. Governing Law
This Engagement Letter and the terms of the Firm's engagement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles. Any dispute arising out of or relating to this Engagement Letter or the Firm's representation of the Company shall be subject to the exclusive jurisdiction of the state and federal courts located in New Castle County, Delaware, and each party hereby consents to the personal jurisdiction and venue of such courts.
11. Termination
Either party may terminate this engagement at any time upon written notice to the other party. The Company's right to terminate this engagement is absolute and unconditional, subject only to the Company's obligation to pay fees and expenses incurred through the date of termination as provided below. The Firm's right to terminate is subject to the applicable Rules of Professional Conduct governing withdrawal from representation, including the obligation to take reasonable steps to avoid prejudice to the Company's interests.
In the event of termination of this engagement by either party, the Company will remain responsible for all professional fees accrued and expenses incurred through the effective date of termination, which shall be payable in accordance with the billing terms set forth in Section 4(c) above. Upon termination, the Firm will take reasonable steps to protect the Company's interests, including returning to the Company all client materials and files in the Firm's possession (or, at the Company's election, transferring such materials to successor counsel), providing a final accounting of fees and expenses, and cooperating in the orderly transition of the matter to successor counsel designated by the Company.
12. Limitation of Liability
The Firm's aggregate liability to the Company and its affiliates arising out of or related to this engagement, whether based on contract, tort (including negligence), breach of fiduciary duty, or any other theory of liability, shall not exceed the total amount of professional fees actually paid by the Company to the Firm under this Engagement Letter. This limitation of liability shall not apply to losses arising from the Firm's willful misconduct or fraud. The Company acknowledges that the Firm's fees have been established in consideration of, among other factors, the limitation of liability set forth in this Section 12, and that the Company may negotiate a higher limitation in exchange for a corresponding adjustment to the Firm's fees.
In no event shall the Firm be liable to the Company for any indirect, consequential, special, incidental, or punitive damages, regardless of the form of action and whether or not such damages were foreseeable.
13. Acceptance and Counterparts
We respectfully request that the Company indicate its acceptance of the terms and conditions of this engagement by having an authorized representative sign and return a copy of this Engagement Letter to the undersigned. This Engagement Letter shall become effective upon execution by both parties.
This Engagement Letter may be executed in one or more counterparts, including by electronic signature (e.g., Brightwater Software or Ashford Health IT), each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Delivery of an executed counterpart by electronic mail (including PDF) or other electronic transmission shall be effective as delivery of a manually executed original.
This Engagement Letter, together with any amendments or supplements agreed to in writing by the parties, constitutes the entire agreement between the Firm and the Company with respect to the subject matter hereof and supersedes all prior or contemporaneous oral or written communications, proposals, and representations with respect to the Firm's engagement on this matter.
We look forward to working with you and the Skybridge team on this important matter. Please do not hesitate to contact me or Priscilla Wynn with any questions regarding this Engagement Letter or the substance of the engagement.
Sincerely,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security
Telephone: (215) 553-7142
Email: kostrowski@calderwoodharkness.com
ACKNOWLEDGMENT AND ACCEPTANCE
The undersigned, on behalf of Skybridge Fintech Ltd., hereby acknowledges receipt of this Engagement Letter, confirms that the undersigned is duly authorized to execute this Engagement Letter on behalf of the Company, and agrees to the terms and conditions set forth herein.
ACKNOWLEDGED AND AGREED:
SKYBRIDGE FINTECH LTD.
By: ________
Name: Thomas Elridge
Title: General Counsel and Chief Privacy Officer
Date: ________
cc: Rachel Bernstein, Partner, Calderwood & Harkness LLP cc: Nadia Karimova, Chief Executive Officer, Skybridge Fintech Ltd. cc: Rebecca Muñoz, Chief Information Security Officer, Skybridge Fintech Ltd.
For the avoidance of doubt, the Client, Skybridge Fintech Ltd., is a portfolio company of Pinnacle Venture Fund II LP, and certain consents and reporting obligations to the sponsor may apply in connection with this matter.
Timekeeper | Position | Hourly Rate
Kevin Ostrowski | Partner | $1,150.00
Rachel Bernstein | Partner | $1,075.00
Priscilla Wynn | Associate | $685.00
Alan Burke | Associate | $525.00
Target Date | Milestone
Late November 2025 | Receipt and review of Meridian's TPRM questionnaire and form DPA; commencement of gap analysis
Early December 2025 | Delivery of gap analysis memorandum and initial redline of Meridian's form DPA to Skybridge for review
Mid-December 2025 | Transmission of Skybridge's counter-proposal DPA to Meridian's counsel (Blackwell, Raines & Stoddard LLP)
January 2026 | Iterative redline exchanges, key issues negotiations, and negotiation sessions with Meridian's counsel
Early February 2026 | Circulation of execution-ready DPA/SCC package to all parties for final review
February 15, 2026 | Target signing date for the DPA/SCC package

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION

CALDERWOOD & HARKNESS LLP

ACKNOWLEDGMENT AND ACCEPTANCE

ACKNOWLEDGED AND AGREED:

SKYBRIDGE FINTECH LTD.

Record

Parties

Dates

Amounts