1009-00004 · Skybridge Fintech Ltd · Transaction Documents/Execution

scc-annex-iii-execution.docx DOCUMENT Finance & Banking

27 / 35 ← → ✕

ANNEX III

LIST OF SUB-PROCESSORS

Execution Version

Annex III to the Standard Contractual Clauses pursuant to EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679

Applicable Modules: Module 2 (Controller-to-Processor) and Module 3 (Processor-to-Sub-processor)

This Annex III forms an integral part of the Standard Contractual Clauses (the "SCCs") appended to and incorporated by reference into the Data Processing Agreement (the "DPA") entered into between:

Meridian Federal Savings Bank, a federally chartered savings bank organized under the laws of the United States, with its principal office at 900 Broad Street, Suite 1200, Newark, NJ 07102 (the "Controller" and/or "Data Exporter");

and

Skybridge Fintech Ltd., a corporation organized under the laws of the State of Delaware, with its principal office at 4100 Silverside Road, Suite 310, Wilmington, DE 19810 (the "Processor" and/or "Data Importer").

The list of sub-processors set forth herein was finalized as of January 15, 2026 and is executed as of the date of the signatures affixed below (the "Execution Date"). This Annex III is governed by and shall be construed in accordance with the governing law of the SCCs as selected by the parties under Clause 17, being the law of the Netherlands, without regard to its conflict-of-laws principles except as otherwise required by Regulation (EU) 2016/679 or by the DPA.

SECTION 1: INTRODUCTORY PROVISIONS

1.1 General Authorization. The Controller has authorized the Processor to engage the sub-processors identified in Section 2 of this Annex III for the processing of personal data in accordance with Clause 9 of the Standard Contractual Clauses and the terms and conditions of the DPA. This authorization constitutes a general written authorization within the meaning of Clause 9(a), Option 2 of the SCCs.

1.2 Sub-processor Authorization Mechanism. The engagement of sub-processors by the Processor is subject to the general written authorization mechanism set forth in Schedule C (Sub-processor Management) of the DPA. Pursuant to Schedule C, the Processor shall provide the Controller with prior written notice at least thirty (30) calendar days before the engagement of any new sub-processor or the replacement of any existing sub-processor. During such thirty (30) calendar day notice period, the Controller retains the right to object to the proposed engagement or replacement of any sub-processor on reasonable grounds relating to the protection of personal data.

1.3 Objection Right. In the event that the Controller objects to a proposed new or replacement sub-processor in accordance with the procedures established in the DPA, the parties shall engage in good-faith consultations to address the Controller's concerns. If the parties are unable to resolve the objection within a reasonable period, the Controller may exercise its rights under the DPA, including the right to terminate the affected processing activities as further described in Section 4 of this Annex III.

1.4 Changes to This Annex. Any changes to the list of sub-processors contained in this Annex III — including the addition of new sub-processors, the removal of existing sub-processors, or the modification of processing activities performed by any sub-processor — shall be communicated to the Controller in writing at least thirty (30) calendar days in advance of the effective date of such change. The Controller retains the right to object to such changes in accordance with the DPA, and an updated version of this Annex III shall be provided to the Controller promptly upon any such change becoming effective.

1.5 Cross-Reference to the DPA. This Annex III is made pursuant to and should be read together with the Data Processing Agreement between Meridian Federal Savings Bank (900 Broad Street, Suite 1200, Newark, NJ 07102) and Skybridge Fintech Ltd. (4100 Silverside Road, Suite 310, Wilmington, DE 19810), dated as of October 1, 2025, as may be amended from time to time, which DPA is governed by the law of the State of Delaware. In the event of any conflict between the provisions of this Annex III and the DPA with respect to sub-processor management, the provisions of the DPA shall prevail, except to the extent that the SCCs impose more stringent obligations, in which case the SCCs shall take precedence.

SECTION 2: LIST OF APPROVED SUB-PROCESSORS

The Controller has approved the engagement of the following sub-processors by the Processor. Each sub-processor listed below has been vetted by the Processor in accordance with the requirements of Clause 9 of the SCCs and Schedule C of the DPA. The Processor has entered into, or shall enter into prior to the commencement of processing, a written agreement with each sub-processor that imposes data protection obligations no less protective than those set forth in the SCCs and the DPA.

2.1 Sub-processor 1: Osprey Cloud Infrastructure, Inc.

Description of Processing (Nature and Purpose). Osprey Cloud Infrastructure, Inc. provides Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) hosting for the Processor's proprietary SBF Core platform. The processing performed by Osprey Cloud includes, without limitation, the provision of compute resources, persistent and ephemeral storage services, virtual networking, managed database services, and ancillary platform services that collectively support the following functional areas of the SBF Core platform:

(a) real-time payment processing, including the initiation, authorization, clearing, and settlement of electronic fund transfers and card-based transactions on behalf of Meridian accountholders;

(b) anti-fraud analytics, including the real-time scoring of transactions against behavioral and rules-based fraud detection models, generation of alerts, and storage of investigation data;

(c) regulatory reporting functionality, including the automated generation, formatting, and transmission of reports required under applicable United States banking regulations (including, without limitation, Bank Secrecy Act / Anti-Money Laundering reporting, Suspicious Activity Reports, and Currency Transaction Reports); and

(d) disaster recovery and business continuity services, including the replication of data and system state across geographically separated availability zones.

Data Center Locations. Osprey Cloud processes personal data at the following data center locations:

(i) US-East Region — Ashburn, Virginia, United States: This location serves as the primary processing site for all personal data flowing through the SBF Core platform. In addition, a geographically separated secondary availability zone within the US-East Region (also located in Ashburn, Virginia) is designated for disaster recovery and failover purposes.

(ii) EU Region — Frankfurt, Germany: This location is designated for the processing of personal data of EU-resident data subjects. Personal data originating from EU-resident Meridian accountholders is processed and stored within the Frankfurt data center in accordance with the data localization requirements agreed upon between the parties in the DPA.

Categories of Personal Data Processed. Osprey Cloud processes the following categories of personal data in connection with the services described above:

• Full name (first name, middle name or initial, last name, suffix)

• Date of birth

• Social Security number (SSN)

• Taxpayer identification number (TIN), including individual TIN and employer identification number (EIN)

• Account numbers, including checking account numbers, savings account numbers, and loan account numbers

• Bank routing numbers (ABA routing transit numbers)

• Transaction amounts and associated transaction metadata (including timestamps, merchant category codes, terminal identifiers, and authorization codes)

• Internet Protocol (IP) addresses

• Device identifiers (including mobile device identifiers, browser fingerprint data, and hardware serial numbers)

• Geolocation data (city-level granularity)

• Email addresses

• Telephone numbers (mobile and landline)

• Behavioral biometric data, including keystroke dynamics and mouse movement patterns, collected in connection with anti-fraud analytics

Categories of Data Subjects. The personal data processed by Osprey Cloud pertains to the following categories of data subjects:

• Meridian accountholders (retail individual accounts and small-business accounts)

• Authorized signers on Meridian accounts

• Beneficial owners of Meridian accounts (as identified pursuant to applicable Customer Due Diligence requirements)

• Meridian employees whose personal data is transmitted through or processed by the SBF Core platform in connection with internal banking operations

Applicable SCC Module. Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (Processor) → Osprey Cloud Infrastructure, Inc. (Sub-processor).

Existing Sub-processing Agreement. The Processor and Osprey Cloud Infrastructure, Inc. have entered into a Data Processing Agreement dated March 1, 2024 (the "Skybridge–Osprey Cloud DPA"), which incorporates Module 3 Standard Contractual Clauses (Processor-to-Sub-processor) in accordance with EU Commission Implementing Decision (EU) 2021/914. The Skybridge–Osprey Cloud DPA remains in full force and effect as of the date of execution of this Annex III.

Security Measures. Osprey Cloud Infrastructure, Inc. implements and maintains technical and organizational security measures as described in SCC Annex II (Technical and Organizational Measures). Without limiting the generality of the foregoing, Osprey Cloud's data centers maintain the following baseline security measures:

• Physical security controls, including 24/7 manned security, biometric access controls, visitor management systems, perimeter fencing, and surveillance camera systems with a minimum retention period of ninety (90) days

• AES-256 encryption for all personal data at rest

• TLS 1.2 or higher encryption for all personal data in transit

• SOC 2 Type II certification, with the most recent audit report covering the twelve (12) month period ending September 30, 2025

• Additional measures as specified in SCC Annex II

2.2 Sub-processor 2: Skybridge Fintech Europe B.V.

Description of Processing (Nature and Purpose). Skybridge Fintech Europe B.V. processes personal data of EU-resident Meridian accountholders in connection with the following activities on behalf of the Processor:

(a) Engineering Support: SBF Europe's engineering team provides development, testing, debugging, and maintenance services for the SBF Core platform, specifically as those services relate to the processing of personal data of EU-resident data subjects. Engineering support activities include the development and deployment of platform features, resolution of software defects, and performance optimization of platform components that process EU personal data.

(b) Customer Support: SBF Europe provides Tier 2 and Tier 3 customer support for Meridian accountholders who are EU residents. Customer support activities may involve accessing personal data to investigate and resolve account inquiries, transaction disputes, and technical issues reported by EU-resident accountholders.

(c) Compliance Functions: SBF Europe performs compliance-related processing activities for EU-resident data subjects, including the monitoring of transactions for compliance with applicable anti-money laundering regulations, the generation of regulatory reports for EU supervisory authorities where required, and the management of data subject access requests and other requests made pursuant to Chapter III of the General Data Protection Regulation (EU) 2016/679.

Data Processing Location. All processing activities performed by SBF Europe take place at its registered office in Amsterdam, Netherlands. No personal data is transferred outside of the European Economic Area by SBF Europe without prior authorization from the Processor and compliance with the transfer mechanisms established in the SCCs and the DPA.

Staff. SBF Europe currently maintains a staff of fourteen (14) employees, comprising:

• Eight (8) software engineers

• Four (4) customer support specialists

• Two (2) compliance officers

All SBF Europe employees are subject to binding confidentiality obligations and have received training on data protection requirements under the General Data Protection Regulation (EU) 2016/679.

Categories of Personal Data Processed. SBF Europe processes personal data of EU-resident Meridian accountholders (approximately 3,200 data subjects as of the date of this Annex III), including:

• Full name (first name, middle name or initial, last name, suffix)

• Date of birth

• Account numbers (checking, savings, and loan)

• Transaction data, including transaction amounts, timestamps, merchant information, and transaction status

• Internet Protocol (IP) addresses

• Device identifiers

• Geolocation data

• Email addresses

• Telephone numbers

• Such other categories of personal data as may be described in SCC Annex I (List of Parties / Description of Transfer)

Categories of Data Subjects. The personal data processed by SBF Europe pertains to the following categories of data subjects:

• EU-resident Meridian accountholders, including expatriate and dual-resident accounts

• Authorized signers on EU-resident Meridian accounts

• Beneficial owners of EU-resident Meridian accounts

Applicable SCC Module. Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (Processor) → Skybridge Fintech Europe B.V. (Sub-processor).

Dutch DPA Registration. Skybridge Fintech Europe B.V. is registered with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) as a data processor engaged in the processing of personal data on behalf of controllers and processors outside the Netherlands.

Security Measures. Skybridge Fintech Europe B.V. implements and maintains technical and organizational security measures as described in SCC Annex II (Technical and Organizational Measures). As a wholly owned subsidiary of the Processor, SBF Europe is subject to the same technical and organizational measures as the Processor, including the Processor's information security policies, access control procedures, incident response plans, and data protection impact assessment protocols. SBF Europe's compliance with these measures is subject to periodic internal audit by the Processor's information security team.

SECTION 3: SUPPLEMENTARY INFORMATION

3.1 EU-US Data Privacy Framework Certification. The Processor, Skybridge Fintech Ltd., is self-certified under the EU-US Data Privacy Framework (the "DPF") as administered by the International Trade Administration within the U.S. Department of Commerce. The Processor's DPF certification bears Certification ID: DPF-2025-03912 and became effective on July 1, 2025. The Processor's DPF self-certification is publicly available on the Data Privacy Framework List maintained by the U.S. Department of Commerce at dataprivacyframework.gov. This DPF certification supplements, but does not replace, the Standard Contractual Clauses as the primary transfer mechanism for personal data transferred from the European Economic Area to the United States pursuant to the DPA. In the event that the DPF certification is invalidated, suspended, or withdrawn for any reason, the Standard Contractual Clauses shall continue to serve as the lawful transfer mechanism for such data transfers without interruption.

3.2 Transfer Impact Assessment. In connection with the requirements established by the Court of Justice of the European Union in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems, Case C-311/18 (July 16, 2020) ("Schrems II"), the Processor has conducted a Transfer Impact Assessment (the "TIA") for all transfers of personal data to sub-processors located in the United States. The TIA evaluates the laws and practices of the United States that may affect the level of protection afforded to personal data transferred pursuant to the SCCs, including, without limitation, Section 702 of the Foreign intelligence Surveillance Act (FISA), Executive Order 12333, and the redress mechanisms available under Executive Order 14086 and the implementing regulations of the Data Protection Review Court. A copy of the TIA has been made available to the Controller upon request. The Processor shall update the TIA as necessary to reflect material changes in the legal framework of the United States relevant to data protection and government access to personal data.

3.3 Minimum Security Measures for Sub-processors. All sub-processors listed in this Annex III are required to maintain technical and organizational security measures that are no less protective than those described in SCC Annex II (Technical and Organizational Measures) appended to the Standard Contractual Clauses. Without limiting the generality of the foregoing, all sub-processors are required to implement and maintain, at a minimum, the following security measures:

(a) Encryption at Rest: AES-256 (or equivalent) encryption for all personal data stored on any medium, including databases, file systems, and backup storage;

(b) Encryption in Transit: TLS 1.2 or higher encryption for all personal data transmitted over any network, including internal networks and public internet connections;

(c) Multi-Factor Authentication (MFA): Multi-factor authentication is required for all administrative and privileged access to systems that process personal data, including remote access by employees, contractors, and support personnel;

(d) Annual Penetration Testing: Each sub-processor shall undergo at least one (1) comprehensive penetration test per calendar year, conducted by a qualified independent third party, with results and remediation plans made available to the Processor upon request; and

(e) Additional Measures: Such other measures as may be required by SCC Annex II or the DPA.

3.4 SOC 2 Type II Auditing Requirements. Each sub-processor that processes personal data on behalf of the Processor in connection with the services provided to the Controller is required to obtain and maintain a current SOC 2 Type II audit report, issued by an independent certified public accounting firm in accordance with the AICPA Trust Services Criteria. The SOC 2 Type II audit report must cover the Trust Services Criteria for Security and, where applicable, Availability, Processing Integrity, and Confidentiality. Each sub-processor shall provide its most recent SOC 2 Type II audit report to the Processor upon request, and the Processor shall make such reports available to the Controller subject to applicable confidentiality restrictions. In the event that a sub-processor is unable to obtain or maintain a SOC 2 Type II certification, the Processor shall promptly notify the Controller and propose alternative assurance mechanisms acceptable to the Controller.

SECTION 4: UPDATE AND NOTIFICATION PROCEDURES

4.1 Prior Written Notice. The Processor shall update this Annex III and provide written notice to the Controller at least thirty (30) calendar days prior to engaging any new sub-processor or replacing any existing sub-processor listed herein. Such written notice shall include, at a minimum: (a) the full legal name and address of the proposed new or replacement sub-processor; (b) a description of the processing activities to be performed by the proposed sub-processor; (c) the categories of personal data to be processed; (d) the location(s) at which processing will take place; (e) the applicable SCC module; and (f) a summary of the technical and organizational security measures to be implemented by the proposed sub-processor.

4.2 Right to Object. The Controller may object to a new or replacement sub-processor in writing within the thirty (30) calendar day notice period described in Section 4.1 above. Any such objection shall be submitted in accordance with the sub-processor objection mechanism set forth in Schedule C (Sub-processor Management) of the DPA and shall state reasonable grounds for the objection relating to the protection of personal data. Upon receipt of a timely objection, the Processor shall not engage the proposed sub-processor for the processing of the Controller's personal data until the objection has been resolved in accordance with the procedures set forth in the DPA.

4.3 Resolution of Objections. If the Controller objects to a proposed new or replacement sub-processor and the parties are unable to resolve the objection within a reasonable period (not to exceed thirty (30) calendar days from the date of the Controller's objection, unless the parties mutually agree to an extension), the Controller may terminate the affected processing activities in accordance with the termination provisions of the DPA. For the avoidance of doubt, termination of affected processing activities under this Section 4.3 shall not constitute a termination of the DPA in its entirety, but shall be limited to those processing activities that would be performed by the objected-to sub-processor, unless the DPA otherwise provides.

4.4 Prompt Delivery of Updated Annex. An updated version of this Annex III shall be provided to the Controller promptly — and in no event later than five (5) business days — upon any change to the list of sub-processors becoming effective, including the addition of a new sub-processor, the removal of an existing sub-processor, or any material modification to the processing activities, data center locations, or security measures of any sub-processor listed herein.

4.5 Form of Notice. All notices required under this Section 4 shall be provided in writing (which may include electronic mail) to the Controller's designated contact for data protection matters, as identified in the DPA or as otherwise communicated by the Controller to the Processor in writing.

SIGNATURE BLOCK

IN WITNESS WHEREOF, the undersigned authorized representatives of the Data Exporter and the Data Importer have executed this Annex III as of the Execution Date set forth below.

DATA EXPORTER / CONTROLLER:

MERIDIAN FEDERAL SAVINGS BANK

By: ________

Name: Lawrence C. Driscoll

Title: Chief Executive Officer

Date: February 15, 2026

DATA IMPORTER / PROCESSOR:

SKYBRIDGE FINTECH LTD.