[sheet: Cover]

Field	Value
Document Title	Redline Comparison Chart: BRS Draft vs. Skybridge Counter-Proposal — Key Terms Matrix
Prepared By	Alan Burke, Working Associate, Privacy & Data Security, Calderwood & Harkness LLP
Date	December 10, 2025
Matter Number	1009-00004
Client	Skybridge Fintech Ltd.
Counterparty	Meridian Federal Savings Bank
Counterparty Counsel	Blackwell, Raines & Stoddard LLP (Constance Liu / Derek Faulkner)
BRS Form DPA Received	November 25, 2025
Skybridge Counter-Proposal Date	December 12, 2025 (anticipated transmittal)
Purpose	Side-by-side comparison of key terms in the Meridian/BRS form DPA and the Skybridge counter-proposal DPA to identify gaps and inform negotiation strategy
Distribution	Kevin Ostrowski (Responsible Partner), Rachel Bernstein (Billing Partner), Priscilla Wynn (Lead Associate), Thomas Elridge (Skybridge GC/CPO)
Classification	Attorney-Client Privileged / Work Product

[sheet: Key Terms Comparison]

Item No.	DPA Provision	DPA Section Ref	BRS / Meridian Position	Skybridge Counter-Proposal Position	Market Standard (Bank-Vendor DPAs)	Gap Severity	Recommendation	Status
1	Liability Cap	Section 9.1	Aggregate liability capped at fees paid in the 12-month period preceding the claim (1× trailing-12-month fees); for Meridian this would be $2.74M. No floor.	Liability cap equal to the greater of (a) $5.0M or (b) 2× the fees paid by Controller in the 12-month period preceding the claim. For Meridian: 2 × $2.74M = $5.48M (exceeds $5.0M floor, so cap = $5.48M). Template formula applies to each future bank client.	Market range for bank-vendor DPAs typically 1×–3× annual fees; super-cap or floor of $3M–$7M common for mid-market fintech vendors. 2× with a $5.0M floor is within market range but at the higher end of vendor exposure.	High	Recommend Skybridge position (greater of $5.0M or 2× trailing-12-month fees). This balances Meridian's desire for meaningful recourse with Skybridge's need for predictable exposure. The $5.0M floor ensures adequate protection for smaller-ACV future clients. For Meridian, the operative cap is $5.48M, which aligns with Bastion Mutual cyber-insurance coverage ($10M per occurrence). Anticipate pushback from BRS on the floor concept for larger clients.	Open
2	Indemnification	Section 9.2	Mutual indemnification; Processor indemnifies Controller for all losses (including regulatory fines, penalties, and costs of notification) arising from any breach of DPA, not subject to the liability cap. Broad definition of 'Losses' includes consequential and indirect damages.	Skybridge provides indemnification to Controller for third-party claims arising from Skybridge's breach of the DPA, including regulatory fines to the extent permissible under applicable law, subject to the liability cap. Excludes consequential, indirect, and punitive damages. Indemnification is one-way (Processor to Controller only for DPA breach).	Most bank-vendor DPAs include processor-to-controller indemnification for third-party claims arising from processor's data breach or DPA violation. Regulatory fines indemnification is increasingly common but typically subject to the liability cap. Uncapped indemnification is rare in the mid-market.	High	Recommend Skybridge position: indemnification for third-party claims including regulatory fines (to extent legally permissible), subject to the liability cap. Resist BRS position of uncapped indemnification. The cap at $5.48M (Meridian) provides adequate recourse and is backstopped by $10M per-occurrence cyber-insurance from Bastion Mutual Insurance Company (Policy CYB-2025-04821).	Open
3	Breach Notification Timeline	Section 7.1 / Schedule D	24 hours from Processor becoming aware of a Personal Data Breach. Written notice with full incident details required within 24-hour window.	48 hours from Processor becoming aware of a Personal Data Breach. Initial notice within 48 hours; detailed written report to follow within 5 business days. Aligns with Meridian's TPRM program requirement (≤ 48 hours).	48–72 hours is market standard for bank-vendor DPAs. FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53) requires banking organizations to notify their primary federal regulator within 36 hours of a 'notification incident,' but this is the bank's obligation to its regulator, not the vendor's obligation to the bank. 48 hours gives the bank adequate time to assess and escalate to OCC/FDIC within 36 hours of its own awareness.	High	Recommend Skybridge position of 48 hours. This is consistent with Meridian's own TPRM program requirement and gives Meridian sufficient lead time to comply with its 36-hour regulatory notification obligation. 24 hours is operationally burdensome and below market standard. Escalation matrix per Schedule D: CISO Rebecca Muñoz → GC Thomas Elridge → Meridian CCO Andrea Sokolov and VP TPRM Marcus Tibaldi.	Open
4	Sub-Processor Approval Mechanism	Section 5	Specific prior written authorization required for each new sub-processor. Controller retains absolute right to reject any proposed sub-processor. Existing sub-processors must be re-approved annually.	General written authorization with 30-day prior written notice to Controller before engaging any new sub-processor. Controller has the right to object within the 30-day notice period on reasonable grounds. If Controller objects and parties cannot resolve within 15 days, Controller may terminate affected processing. No annual re-approval required for existing approved sub-processors.	General authorization with 30-day notice and objection right is the prevailing market standard for SaaS vendor DPAs with banks. Specific prior approval for each sub-processor is more common in bespoke enterprise agreements. OCC Bulletin 2023-17 requires banks to have contractual provisions for sub-contractor oversight but does not mandate specific prior approval.	Medium	Recommend Skybridge position: general written authorization with 30-day notice and Controller objection right. Specific prior approval is operationally impractical for a SaaS template and inconsistent with scalable sub-processor management. Current approved sub-processors: (1) Osprey Cloud Infrastructure, Inc. (IaaS/PaaS, Ashburn VA and Frankfurt Germany); (2) Skybridge Fintech Europe B.V. (EU processing, Amsterdam Netherlands).	Open
5	Audit Rights	Section 8	Controller (or its designated third-party auditor or regulator, including OCC, FDIC, CFPB) may conduct on-site audits of Processor's facilities, systems, and records with 15 days' advance notice, up to 2 times per calendar year, at Processor's expense. No limitation on scope.	Controller (or its regulator, including OCC, FDIC, CFPB) may audit Processor with 30 days' advance written notice, no more than once per 12-month period (unless triggered by a data breach or regulatory inquiry), at Controller's expense. Skybridge may satisfy audit requests by providing its SOC 2 Type II report (Graystone & Ketchum LLP, audit period October 1, 2024 – September 15, 2025) and supplemental questionnaire responses. On-site audits available if SOC 2 report is insufficient or upon regulatory demand.	SOC 2 Type II as primary audit mechanism with fallback on-site audit right is standard for SaaS vendors. 1× per 12 months at Controller's expense is market. Regulator access (OCC, FDIC, CFPB) must be preserved per OCC Bulletin 2023-17. 30-day notice is typical.	Medium	Recommend Skybridge position with SOC 2 Type II as primary mechanism. This is operationally sustainable across multiple bank clients. Regulator access is non-negotiable and must be preserved. BRS position of 2× per year at Processor's expense is above market and would be burdensome for Skybridge. Compromise: accept annual on-site audit right at Controller's expense, plus unlimited regulator access, with SOC 2 report as default satisfaction mechanism.	Open
6	Data Retention / Post-Termination	Section 10	All personal data to be returned or deleted within 30 days of termination or expiration of the SaaS subscription agreement. Processor to certify deletion in writing.	Personal data retained for duration of SaaS subscription + 90 days post-termination for return/deletion. Processor to provide written certification of deletion upon request after the 90-day period. Exceptions for data required to be retained by applicable law (e.g., GLBA, Regulation P, BSA/AML).	60–90 days post-termination for return/deletion is market standard. 30 days is aggressive and may not allow sufficient time for orderly data migration. Legal hold/regulatory retention exceptions are standard.	Medium	Recommend Skybridge position of 90 days post-termination. This allows orderly data migration and system decommissioning. BRS 30-day position is operationally tight given the volume (~412,000 data subjects, ~18.6M transactions/month). Include legal hold and regulatory retention carve-outs. Written certification of deletion is reasonable and should be accepted.	Open
7	Insurance Requirements	Section 11	Processor shall maintain: (a) technology errors & omissions and cyber-liability insurance with per-occurrence coverage of no less than $15M, (b) commercial general liability of no less than $5M, and (c) workers' compensation as required by law. Certificates to be provided annually.	Processor shall maintain cyber-liability insurance with per-occurrence coverage of no less than $10M throughout the term. Current coverage: Bastion Mutual Insurance Company, Policy CYB-2025-04821, $10M per occurrence / $20M aggregate, Technology E&O and Cyber Liability. Policy period January 1, 2025 – December 31, 2025 (renewal in progress for 2026). Insurance broker: Kestrel Risk Advisors LLC.	$10M per-occurrence cyber-liability coverage is market standard for mid-market fintech vendors with ARR in the $25M–$75M range. $15M is above market for vendors of Skybridge's size (ARR $38.7M, 187 employees).	Medium	Recommend Skybridge position of $10M per occurrence, matching current Bastion Mutual policy. $15M would require additional coverage procurement at material cost. $10M provides adequate coverage relative to the liability cap ($5.48M for Meridian). Flag that Bastion Mutual policy expires December 31, 2025 and renewal must be secured before February 15, 2026 signing.	Open
8	Governing Law — DPA	Section 14.1	State of New York.	State of Delaware.	Governing law typically follows the underlying SaaS subscription agreement. Delaware and New York are both common for fintech transactions. Delaware is Skybridge's state of incorporation.	Low	Recommend Skybridge position (Delaware). Skybridge is a Delaware C-corp, and Delaware law is well-developed for commercial contracts. This is unlikely to be a significant point of contention. If BRS insists, New York is an acceptable alternative.	Open
9	Governing Law — SCCs (Clause 17)	SCC Clause 17	Not addressed in BRS form DPA (SCCs were not included in BRS draft).	The SCCs are governed by the law of the Netherlands, the Member State where Skybridge Fintech Europe B.V. (the EU establishment) is located. Per Clause 17 of the EU Commission SCCs (Implementing Decision 2021/914).	SCC Clause 17 requires the SCCs to be governed by the law of an EU Member State. The Netherlands is appropriate given SBF Europe's registration (KvK 82104593) and Amsterdam office at Keizersgracht 482.	Low	Recommend Skybridge position. Netherlands law for SCCs is required by GDPR framework and consistent with SBF Europe's establishment. This is a compliance-driven provision, not a negotiation point.	Resolved
10	Security Standards	Section 6 / Schedule B	Processor must maintain ISO 27001 certification and SOC 2 Type II. Annual penetration testing by an independent third party. Encryption at rest and in transit (no specific standards cited). MFA for all access (not limited to administrative).	SOC 2 Type II certification (current report by Graystone & Ketchum LLP, dated September 15, 2025, audit period October 1, 2024 – September 15, 2025). AES-256 encryption at rest. TLS 1.2+ encryption in transit. MFA for administrative access. Annual penetration testing by Ironvault Security Group LLC (Reston, VA).	SOC 2 Type II is the prevailing US standard for SaaS vendors to bank clients. ISO 27001 is more common in EU/international contexts. AES-256 and TLS 1.2+ are industry standard. MFA for administrative access is standard; MFA for all user access is emerging but not yet market.	Medium	Recommend Skybridge position. Skybridge does not currently hold ISO 27001 certification; requiring it would impose significant cost and timeline burden. SOC 2 Type II is the appropriate standard for US bank-vendor relationships and is expressly accepted by OCC and FDIC examiners. Compromise: commit to evaluating ISO 27001 certification during the contract term. MFA for administrative access (rather than all access) is reasonable and market-standard.	Open
11	SCC Integration / EU Data Transfer Mechanism	Section 12 / Appendix (SCCs)	BRS form DPA does not include Standard Contractual Clauses or address EU data transfer mechanisms. No reference to GDPR, EU data subjects, or cross-border transfers.	DPA includes appended SCC package: Module 2 (Controller-to-Processor: Meridian → Skybridge) and Module 3 (Processor-to-Sub-processor: Skybridge → Osprey Cloud; Skybridge → SBF Europe). SCCs per EU Commission Implementing Decision 2021/914. Supplemented by Skybridge's EU-US Data Privacy Framework self-certification (Certification ID DPF-2025-03912, effective July 1, 2025). Annexes I (Description of Transfer), II (Technical and Organizational Measures), and III (List of Sub-processors) included.	SCCs are required for transfers of personal data from the EU/EEA to the US under Schrems II (CJEU C-311/18). DPF self-certification provides an additional basis but does not replace SCCs. Banks with EU-resident accountholders must ensure adequate transfer mechanisms are in place.	High	Recommend Skybridge position. Meridian has ~3,200 EU-resident accountholders, triggering GDPR and SCC requirements. BRS form's omission of SCCs is a significant gap. Skybridge's inclusion of both Module 2 and Module 3 SCCs, plus DPF certification, provides a robust transfer framework. This should be presented as a value-add of the Skybridge template. Transfer Impact Assessment supports adequacy of supplementary measures.	Open
12	DPIA Cooperation	Section 4.3	Processor shall conduct Data Protection Impact Assessments at its own expense and provide results to Controller upon request. Processor bears full cost and responsibility for DPIAs related to its processing activities.	Processor shall assist Controller with Data Protection Impact Assessments at Controller's reasonable request. Assistance provided at Controller's expense (for time beyond standard support). DPIA responsibility remains with Controller as data controller under GDPR Article 35.	DPIA cooperation (assistance model) is market standard. GDPR places DPIA obligation on the controller; the processor assists. Processor bearing full cost/responsibility for controller DPIAs is above market.	Low	Recommend Skybridge position. GDPR Article 35 places DPIA obligations on the Controller, with the Processor providing assistance per Article 28(3)(f). BRS position conflates controller and processor responsibilities. Skybridge should assist but not bear full cost or ownership of controller DPIAs.	Open
13	Data Subject Rights Cooperation	Section 4.4	Processor shall respond directly to data subject requests (access, deletion, portability) within 15 days. Processor bears cost of compliance.	Processor shall assist Controller in responding to data subject requests by providing technical measures and information. Processor shall not respond directly to data subjects unless instructed by Controller. Assistance at Controller's expense for requests exceeding standard support.	Processor-assists-controller model is GDPR standard (Article 28(3)(e)). Direct processor response to data subjects is atypical and creates controller/processor role confusion. Applicable under CCPA/CPRA and NJ Data Privacy Act (S3377, effective January 15, 2026) as well.	Low	Recommend Skybridge position. Processor should assist but not directly respond to data subjects. Direct response creates legal and operational risk (processor acting in controller capacity). NJ S3377 effective date (January 15, 2026) reinforces need for clear controller/processor delineation.	Open
14	Termination for Convenience / Material Breach	Section 13	Controller may terminate DPA for convenience on 30 days' notice. Processor material breach: 10-day cure period after written notice.	DPA term co-terminous with SaaS subscription agreement (5-year term, ACV $2.74M/yr, TCV $13.7M). Termination of DPA only upon termination or expiration of underlying subscription. Material breach: 30-day cure period after written notice.	DPA term co-terminous with underlying services agreement is market standard. 30-day cure for material breach is typical. Termination for convenience of DPA separate from subscription is unusual.	Low	Recommend Skybridge position. DPA should be co-terminous with the SaaS subscription. Separate termination for convenience of the DPA alone is commercially impractical — the DPA is a necessary component of the service relationship. 30-day cure period is reasonable.	Resolved

[sheet: Summary Dashboard]

Metric	Value
Total Provisions Compared	14
High Severity Gaps	4
Medium Severity Gaps	5
Low Severity Gaps	5
Items Resolved	2
Items Open	12
Items Pending Discussion	0
Provisions Favoring Skybridge Position	14
Provisions Where BRS Position Accepted	0
Key Financial Figures — Meridian ACV	$2.74M/yr
Key Financial Figures — Meridian TCV (5-year)	$13.7M
Key Financial Figures — Skybridge Liability Cap (Meridian)	$5.48M
Key Financial Figures — Cyber-Insurance Per Occurrence	$10.0M (Bastion Mutual, CYB-2025-04821)
Key Financial Figures — Cyber-Insurance Aggregate	$20.0M
Meridian Accountholders (approx.)	~412,000
Meridian EU Accountholders (approx.)	~3,200
Monthly Transaction Volume (projected)	~18.6M
Prepared By	Alan Burke, Calderwood & Harkness LLP
Date Prepared	December 10, 2025
Next Step	Transmittal of Skybridge counter-proposal DPA to BRS on December 12, 2025

[sheet: Cover]
Field | Value
Document Title | Redline Comparison Chart: BRS Draft vs. Skybridge Counter-Proposal — Key Terms Matrix
Prepared By | Alan Burke, Working Associate, Privacy & Data Security, Calderwood & Harkness LLP
Date | December 10, 2025
Matter Number | 1009-00004
Client | Skybridge Fintech Ltd.
Counterparty | Meridian Federal Savings Bank
Counterparty Counsel | Blackwell, Raines & Stoddard LLP (Constance Liu / Derek Faulkner)
BRS Form DPA Received | November 25, 2025
Skybridge Counter-Proposal Date | December 12, 2025 (anticipated transmittal)
Purpose | Side-by-side comparison of key terms in the Meridian/BRS form DPA and the Skybridge counter-proposal DPA to identify gaps and inform negotiation strategy
Distribution | Kevin Ostrowski (Responsible Partner), Rachel Bernstein (Billing Partner), Priscilla Wynn (Lead Associate), Thomas Elridge (Skybridge GC/CPO)
Classification | Attorney-Client Privileged / Work Product
[sheet: Key Terms Comparison]
Item No. | DPA Provision | DPA Section Ref | BRS / Meridian Position | Skybridge Counter-Proposal Position | Market Standard (Bank-Vendor DPAs) | Gap Severity | Recommendation | Status
1 | Liability Cap | Section 9.1 | Aggregate liability capped at fees paid in the 12-month period preceding the claim (1× trailing-12-month fees); for Meridian this would be $2.74M. No floor. | Liability cap equal to the greater of (a) $5.0M or (b) 2× the fees paid by Controller in the 12-month period preceding the claim. For Meridian: 2 × $2.74M = $5.48M (exceeds $5.0M floor, so cap = $5.48M). Template formula applies to each future bank client. | Market range for bank-vendor DPAs typically 1×–3× annual fees; super-cap or floor of $3M–$7M common for mid-market fintech vendors. 2× with a $5.0M floor is within market range but at the higher end of vendor exposure. | High | Recommend Skybridge position (greater of $5.0M or 2× trailing-12-month fees). This balances Meridian's desire for meaningful recourse with Skybridge's need for predictable exposure. The $5.0M floor ensures adequate protection for smaller-ACV future clients. For Meridian, the operative cap is $5.48M, which aligns with Bastion Mutual cyber-insurance coverage ($10M per occurrence). Anticipate pushback from BRS on the floor concept for larger clients. | Open
2 | Indemnification | Section 9.2 | Mutual indemnification; Processor indemnifies Controller for all losses (including regulatory fines, penalties, and costs of notification) arising from any breach of DPA, not subject to the liability cap. Broad definition of 'Losses' includes consequential and indirect damages. | Skybridge provides indemnification to Controller for third-party claims arising from Skybridge's breach of the DPA, including regulatory fines to the extent permissible under applicable law, subject to the liability cap. Excludes consequential, indirect, and punitive damages. Indemnification is one-way (Processor to Controller only for DPA breach). | Most bank-vendor DPAs include processor-to-controller indemnification for third-party claims arising from processor's data breach or DPA violation. Regulatory fines indemnification is increasingly common but typically subject to the liability cap. Uncapped indemnification is rare in the mid-market. | High | Recommend Skybridge position: indemnification for third-party claims including regulatory fines (to extent legally permissible), subject to the liability cap. Resist BRS position of uncapped indemnification. The cap at $5.48M (Meridian) provides adequate recourse and is backstopped by $10M per-occurrence cyber-insurance from Bastion Mutual Insurance Company (Policy CYB-2025-04821). | Open
3 | Breach Notification Timeline | Section 7.1 / Schedule D | 24 hours from Processor becoming aware of a Personal Data Breach. Written notice with full incident details required within 24-hour window. | 48 hours from Processor becoming aware of a Personal Data Breach. Initial notice within 48 hours; detailed written report to follow within 5 business days. Aligns with Meridian's TPRM program requirement (≤ 48 hours). | 48–72 hours is market standard for bank-vendor DPAs. FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53) requires banking organizations to notify their primary federal regulator within 36 hours of a 'notification incident,' but this is the bank's obligation to its regulator, not the vendor's obligation to the bank. 48 hours gives the bank adequate time to assess and escalate to OCC/FDIC within 36 hours of its own awareness. | High | Recommend Skybridge position of 48 hours. This is consistent with Meridian's own TPRM program requirement and gives Meridian sufficient lead time to comply with its 36-hour regulatory notification obligation. 24 hours is operationally burdensome and below market standard. Escalation matrix per Schedule D: CISO Rebecca Muñoz → GC Thomas Elridge → Meridian CCO Andrea Sokolov and VP TPRM Marcus Tibaldi. | Open
4 | Sub-Processor Approval Mechanism | Section 5 | Specific prior written authorization required for each new sub-processor. Controller retains absolute right to reject any proposed sub-processor. Existing sub-processors must be re-approved annually. | General written authorization with 30-day prior written notice to Controller before engaging any new sub-processor. Controller has the right to object within the 30-day notice period on reasonable grounds. If Controller objects and parties cannot resolve within 15 days, Controller may terminate affected processing. No annual re-approval required for existing approved sub-processors. | General authorization with 30-day notice and objection right is the prevailing market standard for SaaS vendor DPAs with banks. Specific prior approval for each sub-processor is more common in bespoke enterprise agreements. OCC Bulletin 2023-17 requires banks to have contractual provisions for sub-contractor oversight but does not mandate specific prior approval. | Medium | Recommend Skybridge position: general written authorization with 30-day notice and Controller objection right. Specific prior approval is operationally impractical for a SaaS template and inconsistent with scalable sub-processor management. Current approved sub-processors: (1) Osprey Cloud Infrastructure, Inc. (IaaS/PaaS, Ashburn VA and Frankfurt Germany); (2) Skybridge Fintech Europe B.V. (EU processing, Amsterdam Netherlands). | Open
5 | Audit Rights | Section 8 | Controller (or its designated third-party auditor or regulator, including OCC, FDIC, CFPB) may conduct on-site audits of Processor's facilities, systems, and records with 15 days' advance notice, up to 2 times per calendar year, at Processor's expense. No limitation on scope. | Controller (or its regulator, including OCC, FDIC, CFPB) may audit Processor with 30 days' advance written notice, no more than once per 12-month period (unless triggered by a data breach or regulatory inquiry), at Controller's expense. Skybridge may satisfy audit requests by providing its SOC 2 Type II report (Graystone & Ketchum LLP, audit period October 1, 2024 – September 15, 2025) and supplemental questionnaire responses. On-site audits available if SOC 2 report is insufficient or upon regulatory demand. | SOC 2 Type II as primary audit mechanism with fallback on-site audit right is standard for SaaS vendors. 1× per 12 months at Controller's expense is market. Regulator access (OCC, FDIC, CFPB) must be preserved per OCC Bulletin 2023-17. 30-day notice is typical. | Medium | Recommend Skybridge position with SOC 2 Type II as primary mechanism. This is operationally sustainable across multiple bank clients. Regulator access is non-negotiable and must be preserved. BRS position of 2× per year at Processor's expense is above market and would be burdensome for Skybridge. Compromise: accept annual on-site audit right at Controller's expense, plus unlimited regulator access, with SOC 2 report as default satisfaction mechanism. | Open
6 | Data Retention / Post-Termination | Section 10 | All personal data to be returned or deleted within 30 days of termination or expiration of the SaaS subscription agreement. Processor to certify deletion in writing. | Personal data retained for duration of SaaS subscription + 90 days post-termination for return/deletion. Processor to provide written certification of deletion upon request after the 90-day period. Exceptions for data required to be retained by applicable law (e.g., GLBA, Regulation P, BSA/AML). | 60–90 days post-termination for return/deletion is market standard. 30 days is aggressive and may not allow sufficient time for orderly data migration. Legal hold/regulatory retention exceptions are standard. | Medium | Recommend Skybridge position of 90 days post-termination. This allows orderly data migration and system decommissioning. BRS 30-day position is operationally tight given the volume (~412,000 data subjects, ~18.6M transactions/month). Include legal hold and regulatory retention carve-outs. Written certification of deletion is reasonable and should be accepted. | Open
7 | Insurance Requirements | Section 11 | Processor shall maintain: (a) technology errors & omissions and cyber-liability insurance with per-occurrence coverage of no less than $15M, (b) commercial general liability of no less than $5M, and (c) workers' compensation as required by law. Certificates to be provided annually. | Processor shall maintain cyber-liability insurance with per-occurrence coverage of no less than $10M throughout the term. Current coverage: Bastion Mutual Insurance Company, Policy CYB-2025-04821, $10M per occurrence / $20M aggregate, Technology E&O and Cyber Liability. Policy period January 1, 2025 – December 31, 2025 (renewal in progress for 2026). Insurance broker: Kestrel Risk Advisors LLC. | $10M per-occurrence cyber-liability coverage is market standard for mid-market fintech vendors with ARR in the $25M–$75M range. $15M is above market for vendors of Skybridge's size (ARR $38.7M, 187 employees). | Medium | Recommend Skybridge position of $10M per occurrence, matching current Bastion Mutual policy. $15M would require additional coverage procurement at material cost. $10M provides adequate coverage relative to the liability cap ($5.48M for Meridian). Flag that Bastion Mutual policy expires December 31, 2025 and renewal must be secured before February 15, 2026 signing. | Open
8 | Governing Law — DPA | Section 14.1 | State of New York. | State of Delaware. | Governing law typically follows the underlying SaaS subscription agreement. Delaware and New York are both common for fintech transactions. Delaware is Skybridge's state of incorporation. | Low | Recommend Skybridge position (Delaware). Skybridge is a Delaware C-corp, and Delaware law is well-developed for commercial contracts. This is unlikely to be a significant point of contention. If BRS insists, New York is an acceptable alternative. | Open
9 | Governing Law — SCCs (Clause 17) | SCC Clause 17 | Not addressed in BRS form DPA (SCCs were not included in BRS draft). | The SCCs are governed by the law of the Netherlands, the Member State where Skybridge Fintech Europe B.V. (the EU establishment) is located. Per Clause 17 of the EU Commission SCCs (Implementing Decision 2021/914). | SCC Clause 17 requires the SCCs to be governed by the law of an EU Member State. The Netherlands is appropriate given SBF Europe's registration (KvK 82104593) and Amsterdam office at Keizersgracht 482. | Low | Recommend Skybridge position. Netherlands law for SCCs is required by GDPR framework and consistent with SBF Europe's establishment. This is a compliance-driven provision, not a negotiation point. | Resolved
10 | Security Standards | Section 6 / Schedule B | Processor must maintain ISO 27001 certification and SOC 2 Type II. Annual penetration testing by an independent third party. Encryption at rest and in transit (no specific standards cited). MFA for all access (not limited to administrative). | SOC 2 Type II certification (current report by Graystone & Ketchum LLP, dated September 15, 2025, audit period October 1, 2024 – September 15, 2025). AES-256 encryption at rest. TLS 1.2+ encryption in transit. MFA for administrative access. Annual penetration testing by Ironvault Security Group LLC (Reston, VA). | SOC 2 Type II is the prevailing US standard for SaaS vendors to bank clients. ISO 27001 is more common in EU/international contexts. AES-256 and TLS 1.2+ are industry standard. MFA for administrative access is standard; MFA for all user access is emerging but not yet market. | Medium | Recommend Skybridge position. Skybridge does not currently hold ISO 27001 certification; requiring it would impose significant cost and timeline burden. SOC 2 Type II is the appropriate standard for US bank-vendor relationships and is expressly accepted by OCC and FDIC examiners. Compromise: commit to evaluating ISO 27001 certification during the contract term. MFA for administrative access (rather than all access) is reasonable and market-standard. | Open
11 | SCC Integration / EU Data Transfer Mechanism | Section 12 / Appendix (SCCs) | BRS form DPA does not include Standard Contractual Clauses or address EU data transfer mechanisms. No reference to GDPR, EU data subjects, or cross-border transfers. | DPA includes appended SCC package: Module 2 (Controller-to-Processor: Meridian → Skybridge) and Module 3 (Processor-to-Sub-processor: Skybridge → Osprey Cloud; Skybridge → SBF Europe). SCCs per EU Commission Implementing Decision 2021/914. Supplemented by Skybridge's EU-US Data Privacy Framework self-certification (Certification ID DPF-2025-03912, effective July 1, 2025). Annexes I (Description of Transfer), II (Technical and Organizational Measures), and III (List of Sub-processors) included. | SCCs are required for transfers of personal data from the EU/EEA to the US under Schrems II (CJEU C-311/18). DPF self-certification provides an additional basis but does not replace SCCs. Banks with EU-resident accountholders must ensure adequate transfer mechanisms are in place. | High | Recommend Skybridge position. Meridian has ~3,200 EU-resident accountholders, triggering GDPR and SCC requirements. BRS form's omission of SCCs is a significant gap. Skybridge's inclusion of both Module 2 and Module 3 SCCs, plus DPF certification, provides a robust transfer framework. This should be presented as a value-add of the Skybridge template. Transfer Impact Assessment supports adequacy of supplementary measures. | Open
12 | DPIA Cooperation | Section 4.3 | Processor shall conduct Data Protection Impact Assessments at its own expense and provide results to Controller upon request. Processor bears full cost and responsibility for DPIAs related to its processing activities. | Processor shall assist Controller with Data Protection Impact Assessments at Controller's reasonable request. Assistance provided at Controller's expense (for time beyond standard support). DPIA responsibility remains with Controller as data controller under GDPR Article 35. | DPIA cooperation (assistance model) is market standard. GDPR places DPIA obligation on the controller; the processor assists. Processor bearing full cost/responsibility for controller DPIAs is above market. | Low | Recommend Skybridge position. GDPR Article 35 places DPIA obligations on the Controller, with the Processor providing assistance per Article 28(3)(f). BRS position conflates controller and processor responsibilities. Skybridge should assist but not bear full cost or ownership of controller DPIAs. | Open
13 | Data Subject Rights Cooperation | Section 4.4 | Processor shall respond directly to data subject requests (access, deletion, portability) within 15 days. Processor bears cost of compliance. | Processor shall assist Controller in responding to data subject requests by providing technical measures and information. Processor shall not respond directly to data subjects unless instructed by Controller. Assistance at Controller's expense for requests exceeding standard support. | Processor-assists-controller model is GDPR standard (Article 28(3)(e)). Direct processor response to data subjects is atypical and creates controller/processor role confusion. Applicable under CCPA/CPRA and NJ Data Privacy Act (S3377, effective January 15, 2026) as well. | Low | Recommend Skybridge position. Processor should assist but not directly respond to data subjects. Direct response creates legal and operational risk (processor acting in controller capacity). NJ S3377 effective date (January 15, 2026) reinforces need for clear controller/processor delineation. | Open
14 | Termination for Convenience / Material Breach | Section 13 | Controller may terminate DPA for convenience on 30 days' notice. Processor material breach: 10-day cure period after written notice. | DPA term co-terminous with SaaS subscription agreement (5-year term, ACV $2.74M/yr, TCV $13.7M). Termination of DPA only upon termination or expiration of underlying subscription. Material breach: 30-day cure period after written notice. | DPA term co-terminous with underlying services agreement is market standard. 30-day cure for material breach is typical. Termination for convenience of DPA separate from subscription is unusual. | Low | Recommend Skybridge position. DPA should be co-terminous with the SaaS subscription. Separate termination for convenience of the DPA alone is commercially impractical — the DPA is a necessary component of the service relationship. 30-day cure period is reasonable. | Resolved
[sheet: Summary Dashboard]
Metric | Value
Total Provisions Compared | 14
High Severity Gaps | 4
Medium Severity Gaps | 5
Low Severity Gaps | 5
Items Resolved | 2
Items Open | 12
Items Pending Discussion | 0
Provisions Favoring Skybridge Position | 14
Provisions Where BRS Position Accepted | 0
Key Financial Figures — Meridian ACV | $2.74M/yr
Key Financial Figures — Meridian TCV (5-year) | $13.7M
Key Financial Figures — Skybridge Liability Cap (Meridian) | $5.48M
Key Financial Figures — Cyber-Insurance Per Occurrence | $10.0M (Bastion Mutual, CYB-2025-04821)
Key Financial Figures — Cyber-Insurance Aggregate | $20.0M
Meridian Accountholders (approx.) | ~412,000
Meridian EU Accountholders (approx.) | ~3,200
Monthly Transaction Volume (projected) | ~18.6M
Prepared By | Alan Burke, Calderwood & Harkness LLP
Date Prepared | December 10, 2025
Next Step | Transmittal of Skybridge counter-proposal DPA to BRS on December 12, 2025

[sheet: Cover]

Record

Parties

Dates

Amounts