MEMORANDUM
PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT
To: File
From: Kevin Ostrowski, Responsible Partner, Privacy & Data Security
Date: November 20, 2025
Re: Matter Opening — Skybridge Fintech Ltd. — Customer-Facing DPA and SCC Package — Matter No. 1009-00004
Office: Calderwood & Harkness LLP, 1735 Market Street, Suite 2800, Philadelphia, PA 19103
This memorandum is prepared for the purpose of documenting the opening of Matter No. 1009-00004 and establishing the factual, legal, and administrative framework for the engagement described herein. This memorandum is protected by the attorney-client privilege and the work-product doctrine. It is not intended for distribution outside of Calderwood & Harkness LLP without the express written consent of the undersigned.
1. Client Information
Client Full Legal Name: Skybridge Fintech Ltd.
Short Names Used: Skybridge; SBF
Entity Type: Delaware corporation (C-corp)
Headquarters: 4100 Silverside Road, Suite 310, Wilmington, DE 19810
Year Founded: 2019
Business Description: Skybridge Fintech Ltd. is a software-as-a-service ("SaaS") fintech company that develops, operates, and licenses a proprietary platform branded as "SBF Core." SBF Core provides real-time payment processing, anti-fraud analytics, and regulatory reporting software to FDIC-insured banks and credit unions. The platform is designed to integrate with the core banking systems of its financial institution clients and to enable those institutions to comply with their regulatory reporting obligations under applicable federal and state banking laws. Skybridge's target customer base consists primarily of mid-size community banks, savings institutions, and credit unions seeking to modernize legacy payment and fraud-detection infrastructure through a cloud-based solution.
Key Personnel:
Employees: Approximately 187
Projected 2025 Annual Recurring Revenue ("ARR"): $38.7 million
PE Sponsor: Halcyon Ridge Capital Partners, LP served as the lead investor in Skybridge's Series B financing round and currently holds a 34.2% equity stake in the company (Series B preferred). The managing partner of Halcyon Ridge is Gregory Falcone. Catherine Shin, Vice President at Halcyon Ridge, serves as a board observer on the Skybridge board of directors. Halcyon Ridge's principal office is located at 600 Lexington Avenue, 22nd Floor, New York, NY 10022.
EU Subsidiary: Skybridge Fintech Europe B.V. ("SBF Europe"), a private limited liability company organized under the laws of the Netherlands, with its registered office at Keizersgracht 482, 1017 EG Amsterdam, Netherlands. SBF Europe is registered with the Dutch Chamber of Commerce under KvK number 82104593. The Managing Director of SBF Europe is Lena Vogt. SBF Europe employs fourteen (14) individuals: eight (8) engineers, four (4) customer-support personnel, and two (2) compliance professionals. SBF Europe functions as an affiliate sub-processor with respect to personal data of EU-resident data subjects processed through SBF Core, and also serves as Skybridge's establishment in the European Union for purposes of the General Data Protection Regulation.
2. Matter Type and Description
Practice Group: Privacy & Data Security
Matter Number: 1009-00004
Matter Type: Data Processing Agreement / Standard Contractual Clauses — Negotiation and Drafting
Description of Engagement: Calderwood & Harkness LLP ("C&H") has been engaged by Skybridge Fintech Ltd. ("Skybridge" or "Client") to finalize a standardized customer-facing Data Processing Agreement ("DPA") and Standard Contractual Clauses ("SCC") package for deployment in connection with Skybridge's SaaS subscription relationships with its bank and credit union clients. The DPA/SCC package is being initially negotiated against the specific requirements of Skybridge's largest prospective bank client, Meridian Federal Savings Bank ("Meridian" or "MFSB"), but is expressly intended to serve as Skybridge's reusable, bank-grade template for all future similarly situated bank and credit union customers.
Underlying Transaction Context: Meridian Federal Savings Bank is in the process of migrating from its legacy in-house payment processing and fraud-detection system to Skybridge's SBF Core platform. The migration is to be effectuated under a five-year SaaS subscription agreement between Meridian and Skybridge. The annual contract value of the subscription is $2.74 million per year, resulting in a total contract value of approximately $13.7 million over the five-year term ($2.74M × 5 years). Meridian's Third-Party Risk Management ("TPRM") program, which is aligned with OCC Bulletin 2013-29 (as updated and superseded by OCC Bulletin 2023-17) and relevant FFIEC interagency guidance, requires that a negotiated DPA and SCC package be fully executed as a condition precedent to the execution of the underlying SaaS subscription agreement.
DPA Governing Law: The DPA will be governed by the laws of the State of Delaware, without regard to its conflict-of-laws principles, consistent with the governing law provision of the underlying SaaS subscription agreement.
SCC Governing Law (Clause 17): The Standard Contractual Clauses, including Clause 17 (Governing Law), will be governed by the laws of the Netherlands, as the Netherlands is the Member State of establishment of SBF Europe, Skybridge's EU establishment and the entity that functions as the data importer's representative within the European Union.
SCC Modules Applicable:
• Module 2 (Controller-to-Processor): Governing the transfer of personal data from Meridian, acting as the data controller, to Skybridge, acting as the data processor, with respect to personal data of EU-resident data subjects transferred from the European Union to the United States.
• Module 3 (Processor-to-Sub-processor): Governing the onward transfer of personal data from Skybridge, acting as the data processor, to (a) Osprey Cloud Infrastructure, Inc. ("Osprey Cloud" or "OCI"), acting as a sub-processor in its capacity as Skybridge's IaaS/PaaS provider, and (b) Skybridge Fintech Europe B.V. ("SBF Europe"), acting as an affiliate sub-processor processing EU personal data from its Amsterdam facility.
3. Opposing Party
Full Legal Name: Meridian Federal Savings Bank
Short Names: Meridian; MFSB
Entity Type: Federally chartered savings bank, insured by the Federal Deposit Insurance Corporation ("FDIC")
OCC Charter Number: 14-2238
Headquarters: 900 Broad Street, Suite 1200, Newark, NJ 07102
Key Personnel:
Total Assets (as of December 31, 2024): $6.1 billion
Total Deposits: $4.3 billion
Retail Branches: 47 branches across four states (New Jersey, New York, Pennsylvania, and Connecticut)
Accountholders (Approximate): 412,000 (retail and small-business)
EU-Resident Accountholders (Approximate): Approximately 3,200 EU-resident accountholders maintain accounts with Meridian. The presence of these EU-resident data subjects triggers the application of the GDPR to Skybridge's processing activities on behalf of Meridian and necessitates the inclusion of Standard Contractual Clauses within the DPA/SCC package to legitimize the transfer of personal data from the European Union to the United States.
Regulatory Supervisors: Office of the Comptroller of the Currency ("OCC"); Federal Deposit Insurance Corporation ("FDIC"); Consumer Financial Protection Bureau ("CFPB")
Role Under DPA: Meridian will be designated as the "Data Controller" (under GDPR nomenclature) and "Customer" (under the DPA's defined terms) with respect to all personal data processed by Skybridge through SBF Core in the course of performing services under the SaaS subscription agreement.
4. Opposing Counsel
Firm Name: Blackwell, Raines & Stoddard LLP
Short Name: BRS
Office Address: 200 Park Avenue, 31st Floor, New York, NY 10166
Lead Partner: Constance Liu, Partner, Financial Services / Data Privacy Practice Group. Ms. Liu is known to this firm from prior transactions and is regarded as an experienced and commercially reasonable negotiator in the bank TPRM and data privacy space. She is expected to take the lead on substantive DPA and SCC negotiations on behalf of Meridian.
Associate: Derek Faulkner, Associate, Financial Services / Data Privacy Practice Group. Mr. Faulkner is expected to handle first-draft markups and coordination of the TPRM due-diligence questionnaire responses.
Our team should anticipate that BRS will negotiate aggressively on certain key provisions, particularly with respect to liability caps, indemnification scope (including the recoverability of regulatory fines), breach notification timelines, and the scope and frequency of audit rights, given Meridian's status as a federally regulated institution subject to OCC and FDIC oversight.
5. Key Third Parties
The following third parties are material to this engagement and should be reflected in the matter file:
5.1 Osprey Cloud Infrastructure, Inc. ("Osprey Cloud" or "OCI")
Osprey Cloud Infrastructure, Inc. is a Delaware corporation with its headquarters at 2200 Campus Drive, San Jose, CA 95131. Its Chief Executive Officer is Martin Cho. Osprey Cloud serves as Skybridge's primary infrastructure-as-a-service ("IaaS") and platform-as-a-service ("PaaS") sub-processor, hosting the SBF Core platform and all associated data in its cloud infrastructure. Osprey Cloud operates a US-East data center located in Ashburn, Virginia, and an EU data center located in Frankfurt, Germany. Skybridge and Osprey Cloud are parties to an existing Data Processing Agreement dated March 1, 2024 (the "Osprey Cloud DPA"), which includes Module 3 Standard Contractual Clauses governing processor-to-sub-processor transfers. The existing Osprey Cloud DPA will need to be reviewed for consistency with the flow-down provisions of the Skybridge–Meridian DPA, and any gaps will need to be identified and addressed as part of this engagement.
5.2 Skybridge Fintech Europe B.V. ("SBF Europe")
As described in Section 1 above, SBF Europe is a Dutch private limited liability company (besloten vennootschap) and a wholly owned subsidiary of Skybridge Fintech Ltd. SBF Europe functions as an affiliate sub-processor with respect to EU personal data processed through SBF Core. Its registered office is at Keizersgracht 482, 1017 EG Amsterdam, Netherlands (KvK number 82104593). Its Managing Director is Lena Vogt. SBF Europe will be listed as an approved sub-processor on Schedule C of the DPA, and Module 3 SCCs will govern transfers from Skybridge to SBF Europe.
5.3 Graystone & Ketchum LLP ("G&K")
Graystone & Ketchum LLP is an independent auditing firm that serves as Skybridge's SOC 2 auditor. G&K issued Skybridge's most recent SOC 2 Type II report covering the audit period from October 1, 2024 through September 15, 2025, with a report date of September 15, 2025. The lead partner on the engagement is Sandra Clearfield. G&K's office is located at 300 Delaware Avenue, Suite 700, Wilmington, DE 19801. The SOC 2 Type II report is a critical component of the audit-rights framework to be incorporated in the DPA, as Skybridge intends to offer the SOC 2 Type II report as the primary audit mechanism, supplemented by regulator access rights as required by applicable banking regulations.
5.4 Bastion Mutual Insurance Company
Bastion Mutual Insurance Company is Skybridge's cyber-liability insurance carrier. The current policy is identified as Policy No. CYB-2025-04821 and provides Technology Errors & Omissions and Cyber Liability coverage with limits of $10 million per occurrence and $20 million in the aggregate. The policy period runs from January 1, 2025 through December 31, 2025. Renewal of the policy for the 2026 policy year is currently in progress. The insurance broker is Kestrel Risk Advisors LLC, located at 140 Broadway, 18th Floor, New York, NY 10005. The DPA will include a covenant requiring Skybridge to maintain continuous cyber-liability coverage of not less than $10 million per occurrence throughout the term of the agreement. Given that the current policy expires on December 31, 2025, the renewal status should be monitored and confirmed prior to execution of the DPA/SCC package.
5.5 Ironvault Security Group LLC
Ironvault Security Group LLC is an independent penetration testing firm retained by Skybridge to conduct annual penetration testing of the SBF Core platform and associated infrastructure. Ironvault's offices are located at 11710 Plaza America Drive, Suite 400, Reston, VA 20190. The results of Ironvault's annual penetration tests are referenced in Skybridge's SOC 2 Type II report and will be reflected in Schedule B (Security Measures) of the DPA. Meridian may request access to penetration testing summaries as part of its TPRM due-diligence process, and the scope and format of any such disclosure should be carefully managed to protect the confidentiality of Skybridge's security posture.
5.6 Halcyon Ridge Capital Partners, LP
As described in Section 1 above, Halcyon Ridge Capital Partners, LP is Skybridge's PE sponsor and Series B lead investor, holding a 34.2% equity stake. Its Managing Partner is Gregory Falcone, and Catherine Shin serves as a board observer on the Skybridge board of directors. Halcyon Ridge's principal office is at 600 Lexington Avenue, 22nd Floor, New York, NY 10022. Although Halcyon Ridge is not a party to the DPA or SCC package, its governance interests are noted in Section 13 below.
6. Engagement Team
The following Calderwood & Harkness professionals are assigned to this matter:
Kevin Ostrowski will serve as the responsible partner and primary relationship manager for this engagement. He will supervise all substantive work product and participate in key negotiation sessions with opposing counsel. Rachel Bernstein will serve as billing partner and will be responsible for billing oversight, invoice review, and fee-arrangement compliance. Priscilla Wynn will serve as lead associate and will be principally responsible for drafting the DPA and SCC package, preparing the gap analysis, and coordinating redline exchanges with BRS. Alan Burke will serve as working associate and will be responsible for supporting research, drafting schedules and annexes, preparing the Transfer Impact Assessment, and handling administrative tasks including the conflict check and document management.
All engagement team members should familiarize themselves with the regulatory frameworks identified in Section 12 below before commencing substantive work on this matter.
7. Billing Arrangements
Fee Arrangement: Hourly
Estimated Total Fees: $185,000 – $225,000
This estimate reflects the anticipated scope of work described in Section 9, including the negotiation and drafting of the DPA and SCC package, preparation of all supporting schedules and annexes, completion of the Transfer Impact Assessment, and the development of Skybridge's standardized bank-grade DPA template with accompanying customization guide. The estimate is based on the assumption that the negotiation will proceed through approximately three to four rounds of redline exchanges, with the final DPA/SCC package reaching execution-ready form by mid-February 2026. The estimate may need to be revised upward if the negotiation proves more protracted than anticipated or if additional regulatory issues arise (e.g., in connection with the NJ Data Privacy Act effective date).
Fee Cap: $240,000, as set forth in the engagement letter executed on November 20, 2025. Total fees billed to this matter shall not exceed $240,000 without prior written approval from the Client.
Billing Rates: As set forth in Section 6 above.
Billing Partner: Rachel Bernstein
Invoice Instructions: Client invoices are to be directed to Thomas Elridge, General Counsel / Chief Privacy Officer, Skybridge Fintech Ltd., 4100 Silverside Road, Suite 310, Wilmington, DE 19810. Invoices should be submitted monthly in arrears and should include sufficient detail regarding the nature of the work performed to enable Mr. Elridge to evaluate the charges in accordance with Skybridge's standard outside-counsel billing guidelines.
8. Conflict Check
A comprehensive conflict check was completed on November 20, 2025, by Alan Burke, Working Associate, and was reviewed and cleared by Kevin Ostrowski, Responsible Partner.
The following parties were run through the firm's conflict-checking system (SterlingConflict v4.2):
• Meridian Federal Savings Bank (and all known affiliates and subsidiaries)
• Halcyon Ridge Capital Partners, LP (and related fund entities)
• Osprey Cloud Infrastructure, Inc.
• Blackwell, Raines & Stoddard LLP
• Skybridge Fintech Ltd. (existing client — confirmed no adverse matter)
• Skybridge Fintech Europe B.V.
• Graystone & Ketchum LLP
• Bastion Mutual Insurance Company
• Ironvault Security Group LLC
• Kestrel Risk Advisors LLC
• All individual key personnel identified in Sections 1, 3, and 4
Result: No conflicts were identified. The matter has been cleared for opening.
Reference: A separate conflict check memorandum, documenting the full search parameters, results, and clearance analysis, is on file under Matter No. 1009-00004.
9. Scope of Representation
The scope of Calderwood & Harkness's representation in this matter encompasses the following workstreams:
9.1 Review and Analysis of Meridian's TPRM Materials
C&H will review and analyze Meridian's Third-Party Risk Management due-diligence questionnaire and Meridian's form Data Processing Agreement, both of which are expected to be received from BRS on or about November 25, 2025. The due-diligence questionnaire is expected to address, among other things, Skybridge's information security program, business-continuity and disaster-recovery capabilities, sub-processor management practices, incident-response procedures, and compliance with applicable data privacy and banking regulations.
9.2 Gap Analysis
C&H will prepare a gap analysis comparing Meridian's form DPA against Skybridge's existing internal DPA template and against prevailing market standards for bank-grade data processing agreements. The gap analysis will identify areas where Meridian's form departs from Skybridge's preferred positions, highlight provisions that present unacceptable risk to Skybridge, and recommend negotiation strategies for bridging identified gaps.
9.3 DPA Drafting and Negotiation
C&H will draft and negotiate Skybridge's customer-facing Data Processing Agreement, incorporating the following key provisions:
(a) Liability Cap. The DPA will include a liability cap set at the greater of (i) $5.0 million or (ii) two times (2×) the trailing-twelve-month fees paid or payable by Meridian to Skybridge under the SaaS subscription agreement. This structure is designed to provide Meridian with a meaningful remedy while protecting Skybridge from disproportionate exposure relative to the contract value.
(b) Indemnification. Skybridge will indemnify the Controller (Meridian) against third-party claims arising from Skybridge's breach of the DPA, including regulatory fines and penalties to the extent that indemnification for such fines is permissible under applicable law. All indemnification obligations will be subject to the liability cap described in subsection (a) above.
(c) Breach Notification. Skybridge will be required to notify Meridian of any confirmed personal data breach within forty-eight (48) hours of Skybridge becoming aware of the breach. This timeline is designed to provide Meridian with adequate time to satisfy its own regulatory notification obligations, including the thirty-six (36) hour bank-to-regulator notification requirement under the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53).
(d) Sub-Processor Approval. The DPA will adopt a general written authorization model, pursuant to which Meridian will provide general authorization for Skybridge to engage sub-processors, subject to Skybridge providing at least thirty (30) days' prior written notice of any proposed new sub-processor or replacement of an existing sub-processor. Meridian will have the right to object to any proposed sub-processor on reasonable grounds within the notice period.
(e) Audit Rights. The DPA will grant Meridian the right to conduct audits of Skybridge's data processing activities no more than once per twelve-month period. Skybridge's SOC 2 Type II report, issued by Graystone & Ketchum LLP, will serve as the primary audit mechanism, with Skybridge providing a copy of its most recent SOC 2 Type II report upon request. The DPA will preserve the right of Meridian's regulatory supervisors (OCC, FDIC, CFPB) to conduct examinations and access Skybridge's books and records as required by applicable banking regulations.
(f) DPIA Cooperation. Skybridge will cooperate with Meridian in the conduct of data protection impact assessments ("DPIAs") as required by Article 35 of the GDPR or analogous provisions of applicable data privacy laws.
(g) Insurance Requirements. The DPA will require Skybridge to maintain cyber-liability insurance coverage of not less than $10 million per occurrence throughout the term of the agreement, consistent with Skybridge's existing coverage under Bastion Mutual Policy No. CYB-2025-04821.
(h) Security Standards. The DPA will incorporate detailed security standards, to be set forth in Schedule B, including SOC 2 Type II compliance, AES-256 encryption at rest, TLS 1.2+ encryption in transit, multi-factor authentication for administrative access, and annual penetration testing.
9.4 SCC Package
C&H will draft the SCC package incorporating the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in the following configurations:
(a) Module 2 (Controller-to-Processor): Governing the transfer of personal data from Meridian (Controller) to Skybridge (Processor) with respect to approximately 3,200 EU-resident data subjects.
(b) Module 3 (Processor-to-Sub-processor): Two sets — (i) governing the onward transfer from Skybridge (Processor) to Osprey Cloud Infrastructure, Inc. (Sub-processor), and (ii) governing the onward transfer from Skybridge (Processor) to Skybridge Fintech Europe B.V. (Affiliate Sub-processor).
The SCC package will include the following annexes:
• Annex I: Description of Transfer (parties, data subjects, categories of data, purpose, frequency, retention period, competent supervisory authority)
• Annex II: Technical and Organizational Measures (aligned with Schedule B of the DPA)
• Annex III: List of Sub-processors (aligned with Schedule C of the DPA)
9.5 Supporting Schedules
C&H will draft the following schedules to be appended to the DPA:
• Schedule A: Description of Processing (data subjects, categories of data, processing purposes, processing operations, duration)
• Schedule B: Security Measures (technical and organizational measures implemented by Skybridge)
• Schedule C: Approved Sub-processor List (initial list of approved sub-processors, including Osprey Cloud and SBF Europe)
• Schedule D: Data Breach Notification Procedures (detailed procedures for breach detection, investigation, notification, and remediation)
9.6 Transfer Impact Assessment
C&H will prepare a Transfer Impact Assessment ("TIA") for the EU–US data transfers contemplated under the DPA/SCC package, in compliance with the requirements established by the Court of Justice of the European Union in Data Protection Commissioner v. Kestrel Services Inc. Ireland and Maximillian Schrems (Case C-311/18, "Schrems II"). The TIA will evaluate the laws and practices of the United States with respect to government access to personal data, assess the effectiveness of the SCCs and supplementary measures in ensuring an essentially equivalent level of protection, and consider the relevance of Skybridge's EU-US Data Privacy Framework self-certification as a supplementary transfer safeguard.
9.7 Regulatory Framework Analysis
C&H will ensure that the DPA/SCC package appropriately addresses the following applicable regulatory frameworks:
• Gramm-Leach-Bliley Act ("GLBA") and Regulation P (12 CFR Part 1016)
• OCC Bulletin 2023-17 (Third-Party Risk Management)
• FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53)
• General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR")
• California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA")
• New Jersey Data Privacy Act (S3377, expected effective January 15, 2026)
9.8 EU-US Data Privacy Framework Self-Certification
C&H will consider Skybridge's existing EU-US Data Privacy Framework self-certification (DPF-2025-03912, effective July 2025) as a supplementary transfer safeguard within the TIA and will address the DPF certification within the SCC package and DPA as appropriate.
9.9 Closing Deliverables
C&H will prepare the following closing deliverables upon finalization of the DPA/SCC package:
• Execution-ready DPA and SCC package (with all schedules and annexes)
• Officer's certificate confirming accuracy of representations
• Signature pages (for execution by authorized officers of each party)
• Closing checklist
9.10 Standardized Bank-Grade DPA Template
Following execution of the Meridian DPA/SCC package, C&H will develop a standardized, bank-grade DPA template for Skybridge's use with future bank and credit union clients. The template will be accompanied by a customization guide identifying provisions that may require client-specific tailoring and providing guidance on acceptable negotiation parameters for key commercial terms.
10. Data Processing Overview
The following information summarizes the data processing activities that will be governed by the DPA/SCC package. This overview is based on information provided by Thomas Elridge and Rebecca Muñoz during the initial kickoff call on November 20, 2025, and is subject to refinement as the engagement progresses.
10.1 Data Subjects
The personal data processed by Skybridge through SBF Core on behalf of Meridian pertains to the following categories of data subjects:
• Meridian accountholders (retail and small-business customers)
• Authorized signers on Meridian accounts
• Beneficial owners of Meridian accounts (as identified pursuant to the Customer Due Diligence Rule, 31 CFR § 1010.230)
• Meridian employees whose data passes through SBF Core in connection with internal transaction processing or administrative functions
The total number of data subjects is approximately 412,000, of which approximately 3,200 are EU-resident data subjects. The presence of EU-resident data subjects is the primary trigger for GDPR applicability and the necessity of Standard Contractual Clauses.
10.2 Categories of Personal Data
The categories of personal data processed through SBF Core include, but are not limited to:
• Full name
• Date of birth
• Social Security Number ("SSN")
• Taxpayer Identification Number ("TIN")
• Account numbers (checking, savings, loan)
• Routing numbers
• Transaction amounts and transaction metadata (timestamps, merchant codes, authorization codes)
• IP addresses
• Device identifiers
• Geolocation data (city-level)
• Email addresses
• Phone numbers
• Behavioral biometric data, including keystroke dynamics and mouse movement patterns (collected by SBF Core's anti-fraud analytics module)
10.3 Sensitive Data
Social Security Numbers and behavioral biometric data are classified as "sensitive" personal data under both the CCPA/CPRA and the New Jersey Data Privacy Act (S3377). The processing of these categories of data may require heightened consent mechanisms, additional security safeguards, and specific disclosure obligations, depending on the applicable regulatory framework. The DPA will include specific provisions addressing the processing of sensitive data and the parties' respective obligations with respect to such processing.
10.4 Processing Volume
Skybridge projects that approximately 18.6 million transactions per month will be processed through SBF Core on behalf of Meridian once the platform migration is complete. This volume reflects Meridian's current transaction volume across its 47-branch retail network, adjusted for anticipated growth. The processing volume is relevant to capacity planning, security assessment, and the risk profile of the engagement.
10.5 Data Locations
Personal data processed through SBF Core will be stored and processed at the following locations:
10.6 Retention Period
Personal data will be retained by Skybridge for the duration of the SaaS subscription agreement plus ninety (90) days post-termination. During the 90-day post-termination period, Skybridge will make the personal data available for return to Meridian upon request. At the conclusion of the 90-day period, Skybridge will securely delete or destroy all personal data in its possession, except to the extent that retention is required by applicable law, regulation, or legal hold obligation.
10.7 Security Standards
Skybridge maintains the following security standards with respect to its processing of personal data through SBF Core:
• SOC 2 Type II Compliance: Skybridge has obtained a SOC 2 Type II report from Graystone & Ketchum LLP, covering the period from October 1, 2024 through September 15, 2025, with a report date of September 15, 2025.
• Encryption at Rest: AES-256 encryption for all personal data at rest.
• Encryption in Transit: TLS 1.2 or higher for all personal data in transit.
• Multi-Factor Authentication: MFA is required for all administrative access to the SBF Core platform and underlying infrastructure.
• Annual Penetration Testing: Skybridge engages Ironvault Security Group LLC to conduct annual penetration testing of the SBF Core platform and associated infrastructure.
These security standards will be documented in Schedule B (Security Measures) of the DPA and Annex II (Technical and Organizational Measures) of the SCC package.
11. Anticipated Timeline
The following table sets forth the anticipated timeline for this engagement, based on discussions with Thomas Elridge during the initial kickoff call on November 20, 2025:
This timeline is subject to adjustment based on the pace of negotiations and the complexity of open issues. The engagement team should plan staffing and resource allocation accordingly. Of particular note, the NJ Data Privacy Act (S3377) is expected to become effective on January 15, 2026, and the DPA/SCC package should be drafted to accommodate the requirements of that statute from inception.
12. Key Regulatory Considerations
The DPA/SCC package must be drafted and negotiated with careful attention to the following regulatory frameworks, each of which imposes obligations on one or both parties:
12.1 OCC Bulletin 2023-17 (Third-Party Risk Management)
OCC Bulletin 2023-17, issued June 6, 2023, and superseding OCC Bulletin 2013-29, establishes the OCC's expectations for the risk management of third-party relationships by national banks and federal savings associations. Because Skybridge is providing critical activities—specifically, real-time payment processing and anti-fraud analytics—to a federally chartered savings bank, the DPA must include contractual provisions that satisfy the OCC's requirements for agreements with critical third-party service providers. These include, among other things, provisions addressing: the right of the bank and its regulators to audit the service provider; business-continuity and disaster-recovery planning; data security and confidentiality obligations; sub-contractor oversight and approval mechanisms; default and termination triggers; and dispute-resolution procedures. The DPA must also be structured to facilitate Meridian's ongoing monitoring and oversight obligations with respect to Skybridge as a critical service provider.
12.2 FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53)
The final rule promulgated jointly by the OCC, the Federal Reserve Board, and the FDIC (effective April 1, 2022) requires banking organizations to notify their primary federal regulator within thirty-six (36) hours of determining that a "notification incident" has occurred. A notification incident is defined as a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, a banking organization's ability to carry out banking operations, business lines, or operations that could result in a material loss of revenue, profit, or franchise value. The rule also requires bank service providers (including Skybridge) to notify at least one designated bank representative as soon as possible when the service provider determines that it has experienced a computer-security incident that could materially affect the banking organization. The DPA's 48-hour breach notification timeline from Skybridge to Meridian is calibrated to provide Meridian with a buffer of at least twelve (12) hours within which to conduct its internal assessment and, if necessary, make its own 36-hour notification to the OCC.
12.3 GLBA / Regulation P (12 CFR Part 1016)
Skybridge qualifies as a "service provider" under the Gramm-Leach-Bliley Act ("GLBA") and the FTC's Safeguards Rule (16 CFR Part 314), as well as the relevant interagency guidance implementing GLBA's safeguards provisions for banking institutions. As a service provider under GLBA, Skybridge is subject to contractual obligations imposed by Meridian to safeguard the security, confidentiality, and integrity of customer information, as that term is defined under GLBA and its implementing regulations. The DPA must include provisions sufficient to satisfy Meridian's obligations under GLBA's service-provider oversight requirements.
12.4 GDPR (Regulation (EU) 2016/679)
The General Data Protection Regulation is applicable to Skybridge's processing of personal data pertaining to Meridian's approximately 3,200 EU-resident accountholders. Article 28 of the GDPR imposes specific requirements on data processing agreements between controllers and processors, including obligations to process personal data only on documented instructions from the controller, to ensure that persons authorized to process the data are subject to confidentiality obligations, to implement appropriate technical and organizational measures, to assist the controller with data subject rights requests and DPIAs, and to provide for audit rights. The SCC package addresses the cross-border transfer dimension of GDPR compliance.
12.5 Schrems II / CJEU C-311/18
The Court of Justice of the European Union's July 16, 2020 decision in Data Protection Commissioner v. Kestrel Services Inc. Ireland and Maximillian Schrems (Case C-311/18) invalidated the EU-US Privacy Shield and imposed heightened obligations on data exporters relying on Standard Contractual Clauses for EU–US data transfers. Under Schrems II, data exporters must conduct a case-by-case assessment (a "Transfer Impact Assessment") to determine whether the laws and practices of the data-importing country ensure an essentially equivalent level of protection for transferred personal data, and must implement supplementary measures if necessary. The TIA for this engagement will evaluate the relevant US legal framework, including Section 702 of the Foreign intelligence Surveillance Act ("FISA") and Executive Order 12333, in light of the safeguards introduced by Executive Order 14086 (October 7, 2022) and the European Commission's adequacy decision establishing the EU-US Data Privacy Framework (July 10, 2023).
12.6 EU-US Data Privacy Framework