1009-00004 · Skybridge Fintech Ltd · Transaction Documents/Schedules

schedule-b-security-measures.docx DOCUMENT Finance & Banking

33 / 35 ← → ✕

Contract analysis Extract to table

SCHEDULE B — SECURITY MEASURES

to the Data Processing Agreement dated February 15, 2026 (the "Agreement")

between

Meridian Federal Savings Bank ("Controller")

and

Skybridge Fintech Ltd. ("Processor")

This Schedule B is attached to and forms an integral part of the Data Processing Agreement between Controller and Processor. Capitalized terms not defined herein shall have the meanings ascribed to them in the Agreement. Processor shall implement and maintain the following technical and organizational measures to protect Personal Data processed on behalf of Controller in connection with the SBF Core platform (the "Security Measures").

1. OVERVIEW AND SCOPE

1.1 The Security Measures described in this Schedule B apply to all Personal Data processed by Processor under the Agreement, including, without limitation, Personal Data hosted on infrastructure provided by approved sub-processors, namely Osprey Cloud Infrastructure, Inc. and Skybridge Fintech Europe B.V., as further identified in Schedule C (Approved Sub-Processor List) to the Agreement.

1.2 The Security Measures described herein are consistent with those assessed under Processor's current SOC 2 Type II report, as further described in Section 2 below, and reflect industry-recognized practices for the protection of Personal Data in the financial-services technology sector.

1.3 Processor shall maintain Security Measures no less protective than those described in this Schedule B throughout the entire term of the Agreement, including any renewal or extension periods, and for so long as Processor retains any Personal Data following expiration or termination of the Agreement in accordance with the data return and deletion provisions set forth therein.

1.4 Without limiting the foregoing, the Security Measures are designed to comply with the safeguards requirements of the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809, and the Interagency Guidelines Establishing Information Security Standards promulgated thereunder, as well as the supervisory expectations for third-party service provider security articulated in OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance). Processor acknowledges that Controller is a federally chartered savings bank supervised by the Office of the Comptroller of the Currency ("OCC") and that Controller's regulators may rely upon the adequacy of these Security Measures in evaluating Controller's third-party risk management program.

2. INDEPENDENT AUDIT AND CERTIFICATION

2.1 SOC 2 Type II Report

2.1.1 Processor maintains a current System and Organization Controls 2 (SOC 2) Type II report prepared in accordance with the AICPA Trust Services Criteria and issued by an independent certified public accounting firm.

2.1.2 Processor's current SOC 2 Type II report has been issued by Graystone & Ketchum LLP, 300 Delaware Avenue, Suite 700, Wilmington, DE 19801. The lead partner responsible for Processor's information-technology audit engagement is Sandra Clearfield.

2.1.3 The current SOC 2 Type II report covers the reporting period from October 1, 2024 through September 15, 2025, and addresses the following Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

2.1.4 Processor shall obtain a new SOC 2 Type II report on at least an annual basis. Processor shall provide a copy of each new SOC 2 Type II report to Controller promptly upon Controller's written request, subject to the audit rights provisions set forth in the Agreement, including the limitation of one audit request per twelve (12) month period unless such request is triggered by a Personal Data Breach, a material security incident, or a regulatory inquiry or examination directed at Controller or Processor.

2.1.5 If any SOC 2 Type II report identifies material control deficiencies or qualified opinions, Processor shall promptly notify Controller and provide a written remediation plan with estimated timelines for resolution.

2.2 EU-US Data Privacy Framework

2.2.1 Processor has self-certified under the EU-US Data Privacy Framework ("DPF") administered by the International Trade Administration of the U.S. Department of Commerce. Processor's self-certification became effective as of July 1, 2025, and Processor's DPF Certification ID is DPF-2025-03912.

2.2.2 Processor's DPF self-certification supplements, but does not replace, the Standard Contractual Clauses appended to the Agreement as Schedule E (EU Standard Contractual Clauses). In the event that the DPF self-certification is invalidated, revoked, or otherwise ceases to constitute a valid transfer mechanism under applicable European data protection law, the Standard Contractual Clauses shall continue to serve as the lawful basis for the transfer of Personal Data from the European Economic Area to the United States.

2.2.3 Processor shall maintain its DPF self-certification throughout the term of the Agreement and shall promptly notify Controller in writing if Processor's self-certification lapses, is withdrawn, or is the subject of any enforcement action by the Federal Trade Commission.

3. ENCRYPTION

3.1 Encryption at Rest

3.1.1 All Personal Data stored on Processor's systems and on the infrastructure of Osprey Cloud Infrastructure, Inc. is encrypted at rest using the Advanced Encryption Standard with 256-bit keys (AES-256), or a successor cryptographic standard providing equivalent or greater protection.

3.1.2 Encryption keys are managed through a centralized key management system ("KMS") that enforces separation of duties between key custodians and system administrators. Key rotation is performed at least annually, and Processor maintains documented key lifecycle management procedures covering key generation, distribution, storage, rotation, revocation, and destruction.

3.1.3 Encryption at rest applies to all environments in which Personal Data resides, including:

(a) Primary / US: Osprey Cloud US-East, located in Ashburn, Virginia, which serves as the primary production processing environment;

(b) EU: Osprey Cloud EU, located in Frankfurt, Germany, which is used for the processing and storage of Personal Data relating to EU-resident data subjects; and

(c) Disaster Recovery: The disaster recovery environment described in Section 10 below, including all backup and replication storage within the Osprey Cloud infrastructure.

3.2 Encryption in Transit

3.2.1 All Personal Data transmitted between Controller and Processor, between Processor's internal systems, and between Processor and its approved sub-processors is encrypted in transit using Transport Layer Security version 1.2 or higher (TLS 1.2+).

3.2.2 Deprecated cipher suites and protocols, including without limitation SSL 3.0, TLS 1.0, and TLS 1.1, are disabled across all production environments. Processor reviews supported cipher suites on at least a semi-annual basis and disables any cipher suite that is identified as weak or compromised by authoritative sources such as NIST or the Internet Engineering Task Force.

3.2.3 Application programming interface ("API") communications between the SBF Core platform and Controller's systems are secured via mutual Transport Layer Security ("mTLS") where supported by Controller's infrastructure. In the event Controller's infrastructure does not support mTLS, Processor shall implement alternative authentication and encryption mechanisms that provide a substantially equivalent level of protection.

4. ACCESS CONTROLS

4.1 Multi-Factor Authentication (MFA)

4.1.1 Multi-factor authentication is required for all administrative access to SBF Core production environments, hosting infrastructure management consoles, and any system or interface through which Personal Data may be accessed, modified, or exported.

4.1.2 MFA is required for all remote access by Processor personnel, including employees of Skybridge Fintech Ltd. and employees of Skybridge Fintech Europe B.V., regardless of the location from which such remote access originates.

4.1.3 Approved MFA mechanisms include hardware security tokens (e.g., FIDO2-compliant keys) and authenticator application-based time-based one-time passwords ("TOTP"). SMS-based one-time passwords are not accepted as a primary MFA factor for access to production environments.

4.2 Role-Based Access Control (RBAC)

4.2.1 Access to Personal Data is granted on a least-privilege, need-to-know basis. No personnel shall be granted access to Personal Data beyond that which is strictly necessary for the performance of their assigned duties in connection with the services provided under the Agreement.

4.2.2 Role-based access control ("RBAC") is implemented across all production systems within the SBF Core platform. Roles are defined, documented, and mapped to specific access privileges commensurate with job function and responsibility.

4.2.3 Access privileges are reviewed on at least a quarterly basis by Processor's information security team under the direction of the Chief Information Security Officer ("CISO"), Rebecca Muñoz. Each quarterly review includes a reconciliation of active access privileges against current role assignments and personnel rosters, with prompt remediation of any unauthorized, excessive, or orphaned access.

4.2.4 Privileged accounts, including without limitation system administrator accounts, database administrator accounts, and root-level accounts, are subject to enhanced monitoring and logging. Access using privileged accounts is limited to authorized personnel and is recorded in the audit logs described in Section 11 below.

4.3 Identity and Account Management

4.3.1 Unique user identifiers are assigned to all personnel who access systems containing Personal Data. The use of shared, group, or generic accounts in production environments is strictly prohibited.

4.3.2 Processor maintains documented account provisioning and de-provisioning procedures that include defined timelines for the termination of access upon employee departure, contractor engagement termination, or change in role or responsibility. Access shall be revoked within twenty-four (24) hours of an employee's separation from Processor and within forty-eight (48) hours of a change in role that no longer requires access to Personal Data.

4.3.3 Password complexity requirements are enforced across all systems through which Personal Data may be accessed. At a minimum, passwords must meet the following requirements:

(a) minimum length of fourteen (14) characters;

(b) inclusion of at least three of the following four character types: uppercase letters, lowercase letters, numerals, and special characters;

(d) mandatory password change at intervals not to exceed ninety (90) days, unless Processor implements an equivalent or superior compensating control (e.g., credential monitoring for compromise).

5. NETWORK SECURITY

5.1 Firewalls and Network Segmentation

5.1.1 Network firewalls are deployed at all perimeter and internal trust boundaries within Processor's infrastructure. Firewall rule sets are reviewed on at least a semi-annual basis and follow a default-deny posture, permitting only explicitly authorized traffic.

5.1.2 Production environments hosting Personal Data are logically segmented from development, staging, quality-assurance, and corporate network environments. Network segmentation controls are designed to prevent lateral movement and to ensure that non-production environments cannot directly access production data stores.

5.1.3 Intrusion detection and prevention systems ("IDS/IPS") are deployed at key network boundaries and are monitored continuously on a twenty-four hours per day, seven days per week (24/7) basis. Alerts generated by IDS/IPS systems are reviewed and triaged by Processor's security operations team in accordance with documented escalation procedures.

5.2 Vulnerability Management

5.2.1 Automated vulnerability scanning is performed on at least a monthly basis across all production systems, including operating systems, application components, network devices, and databases that process or store Personal Data.

5.2.2 Identified vulnerabilities are classified according to severity using an industry-recognized scoring system (e.g., the Common Vulnerability Scoring System, CVSS) and are remediated within the following defined timelines:

(a) Critical-severity vulnerabilities (CVSS 9.0–10.0): remediation within seventy-two (72) hours of identification;

(b) High-severity vulnerabilities (CVSS 7.0–8.9): remediation within fourteen (14) calendar days of identification;

(c) Medium- and low-severity vulnerabilities: remediation in accordance with Processor's standard patch management cycle, not to exceed ninety (90) calendar days.

5.2.3 Processor maintains a patch management program with defined service-level agreements for operating system and application patching. Emergency or out-of-band patches for actively exploited vulnerabilities shall be applied on an expedited basis.

6. PENETRATION TESTING

6.1 Processor shall engage an independent, qualified third-party firm to conduct penetration testing of the SBF Core platform and associated infrastructure at least once per calendar year.

6.2 Processor's current penetration testing firm is Ironvault Security Group LLC, 11710 Plaza America Drive, Suite 400, Reston, VA 20190. Processor may change its penetration testing firm upon reasonable written notice to Controller, provided that any replacement firm possesses equivalent qualifications and industry certifications (e.g., CREST, OSCP, GPEN).

6.3 The scope of each annual penetration test shall include, at a minimum:

(a) external network penetration testing;

(b) web application penetration testing of the SBF Core platform; and

(c) API security assessment covering all API endpoints used in the exchange of Personal Data between SBF Core and Controller's systems.

6.4 A summary of the results of the most recent penetration test shall be made available to Controller upon Controller's reasonable written request, subject to execution of appropriate confidentiality protections and Processor's reasonable redaction of information that, if disclosed, could compromise the security of Processor's systems or the systems of other Processor clients.

6.5 Material findings identified through penetration testing are remediated in accordance with the vulnerability management timelines set forth in Section 5.2.2 above. Processor shall track remediation status and provide Controller, upon request, with confirmation that material findings have been resolved.

7. INCIDENT RESPONSE

7.1 Incident Response Plan

7.1.1 Processor maintains a documented information security incident response plan (the "IRP") that addresses the full lifecycle of incident management, including the following phases: identification, containment, eradication, recovery, and post-incident review.

7.1.2 The IRP is tested at least annually through tabletop exercises and/or simulated incident drills designed to validate the effectiveness of response procedures, communication protocols, and escalation pathways.

7.1.3 The IRP designates the CISO, Rebecca Muñoz, as the primary incident commander with authority to activate the incident response team, allocate resources, authorize containment actions, and coordinate external communications. In the event of the CISO's unavailability, the IRP designates a qualified alternate incident commander from Processor's senior security leadership.

7.2 Breach Notification Coordination

7.2.1 The notification obligations and escalation procedures applicable in the event of a Personal Data Breach are set forth in detail in Schedule D (Data Breach Notification Procedures) to the Agreement, including the requirement that Processor provide initial notification to Controller within forty-eight (48) hours of becoming aware of a confirmed or reasonably suspected Personal Data Breach.

7.2.2 Processor's IRP is aligned with the requirements of the FDIC/OCC Computer-Security Incident Notification Rule codified at 12 CFR Part 53 (OCC) and 12 CFR Part 304 (FDIC), which require banking organizations to notify their primary federal regulator within thirty-six (36) hours of determining that a notification incident has occurred. Processor acknowledges that timely notification to Controller is essential to facilitate Controller's compliance with the thirty-six (36) hour bank-to-regulator notification obligation, and Processor shall structure its internal escalation procedures accordingly.

7.3 Forensic Investigation

7.3.1 Processor retains the capability, whether through qualified internal personnel or through engagement of a qualified third-party digital forensics firm, to conduct forensic investigation of security incidents affecting Personal Data processed under the Agreement.

7.3.2 Processor shall cooperate fully with Controller and Controller's regulators, including the OCC, the Federal Deposit Insurance Corporation ("FDIC"), and the Consumer Financial Protection Bureau ("CFPB"), in the investigation of any Personal Data Breach or security incident affecting Controller's Personal Data, as further described in the Agreement. Such cooperation shall include, without limitation, preservation of evidence, provision of forensic reports, and participation in interviews or examinations as reasonably requested.

8. EMPLOYEE SECURITY TRAINING AND PERSONNEL CONTROLS

8.1 Security Awareness Training

8.1.1 All Processor personnel receive mandatory security awareness training upon hire and at least annually thereafter. For purposes of this Section 8, "Processor personnel" includes all employees of Skybridge Fintech Ltd. (currently approximately one hundred eighty-seven (187) employees) and all employees of Skybridge Fintech Europe B.V. (currently approximately fourteen (14) employees), as well as any individual contractors or temporary staff who access systems containing Personal Data.

8.1.2 Security awareness training covers, at a minimum, the following topics:

(a) phishing awareness and recognition of social engineering tactics;

(b) secure data handling procedures, including classification, storage, transmission, and disposal of Personal Data;

(d) acceptable use of information systems and mobile devices;

(e) password hygiene and authentication best practices; and

(f) privacy obligations under applicable law, including the Gramm-Leach-Bliley Act ("GLBA"), the General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), and the New Jersey Data Privacy Act.

8.1.3 Completion of security awareness training is tracked, and Processor maintains records of training completion for each individual. Personnel who fail to complete required training within the prescribed timeframe are subject to suspension of access privileges until training is completed.

8.2 Background Checks

8.2.1 Processor conducts pre-employment background checks on all personnel who will have access to Personal Data, to the extent permitted by applicable law in the jurisdiction in which such personnel are located.

8.2.2 The background check program includes, at a minimum:

(a) verification of criminal history (at the national, state, and county levels, as applicable);

(b) verification of employment history for at least the prior five (5) years; and

(c) where applicable and permitted by law, verification of credit history for personnel in positions involving access to financial data.

8.3 Confidentiality Obligations

8.3.1 All Processor personnel with access to Personal Data are bound by written confidentiality obligations, whether through the terms of an employment agreement, an independent contractor agreement, or a standalone non-disclosure agreement. Such confidentiality obligations survive the termination of the individual's relationship with Processor.

9. PHYSICAL SECURITY

9.1 Data Center Physical Security (Osprey Cloud Infrastructure, Inc.)

9.1.1 Personal Data processed under the Agreement is hosted exclusively at data center facilities operated by Osprey Cloud Infrastructure, Inc., as follows:

(a) Primary / US: Osprey Cloud US-East, located in Ashburn, Virginia, which serves as the primary processing facility and also provides a secondary availability zone used for disaster recovery purposes; and

(b) EU: Osprey Cloud EU, located in Frankfurt, Germany, which is used for the processing and storage of Personal Data relating to EU-resident data subjects in accordance with the data localization requirements set forth in the Agreement and the Standard Contractual Clauses.

9.1.2 Exact data center street addresses are withheld in accordance with Osprey Cloud Infrastructure, Inc.'s physical security policy and are available to Controller and Controller's regulators upon execution of a separate non-disclosure undertaking, as reasonably required for regulatory examination purposes.

9.1.3 Physical security measures at Osprey Cloud data centers include, without limitation:

(a) twenty-four hours per day, seven days per week (24/7) on-site security personnel;

(b) closed-circuit television (CCTV) surveillance with recording and retention of footage;

(d) mantrap (interlocking door) entry systems at facility perimeters and data hall entrances;

(e) visitor logging, identification verification, and mandatory escort requirements for all non-credentialed individuals;

(f) environmental controls including FM-200 or equivalent fire suppression systems, precision climate control (temperature and humidity), and redundant power supply with uninterruptible power supply (UPS) and diesel generator backup; and

(g) redundant cooling systems to ensure continuous operation under adverse conditions.

9.1.4 Physical security controls at Osprey Cloud data centers are assessed under Osprey Cloud Infrastructure, Inc.'s own SOC 2 Type II program. These controls are further addressed in the Data Processing Agreement between Skybridge Fintech Ltd. and Osprey Cloud Infrastructure, Inc. dated March 1, 2024 (the "Skybridge–Osprey Cloud DPA").

9.2 Processor Office Security

9.2.1 Physical access to Processor's corporate offices is controlled through the following measures:

(a) Wilmington, Delaware Office: Skybridge Fintech Ltd., 4100 Silverside Road, Suite 310, Wilmington, DE 19810. Access is controlled through electronic key-card access systems, visitor management procedures (including sign-in, identification verification, and escort), and clean-desk policies requiring the secure storage of all sensitive materials when workstations are unattended.

(b) Amsterdam, Netherlands Office: Skybridge Fintech Europe B.V., Keizersgracht 482, 1017 EG Amsterdam, Netherlands. Access is controlled through electronic key-card access systems, visitor management procedures, and clean-desk policies consistent with those maintained at the Wilmington office.

9.2.2 No Personal Data is stored on local workstations, laptop computers, or removable media (including USB drives, external hard drives, and optical media). All processing of Personal Data occurs within the hosted cloud environments described in Section 9.1 above. Processor enforces endpoint management controls, including device encryption and restrictions on the use of removable storage devices, to mitigate the risk of unauthorized local storage.

10. BUSINESS CONTINUITY AND DISASTER RECOVERY

10.1 Processor maintains a documented business continuity and disaster recovery plan ("BCP/DR Plan") that is designed to ensure the continued availability of the SBF Core platform and the protection of Personal Data in the event of a disruption, including natural disasters, infrastructure failures, cyberattacks, and other adverse events.

10.2 The disaster recovery environment is located at the Osprey Cloud US-East secondary availability zone in Ashburn, Virginia, which is physically and logically separated from the primary production availability zone to provide resilience against single-zone failures.

10.3 Recovery time objectives ("RTO") and recovery point objectives ("RPO") for the SBF Core platform are defined in the BCP/DR Plan and are tested at least annually through simulated failover exercises. Test results are documented and retained, and any deficiencies identified during testing are remediated promptly.

10.4 Backups of Personal Data are encrypted using AES-256 (consistent with Section 3.1 above) and are stored in geographically separated facilities within the Osprey Cloud infrastructure. Backup integrity is verified on a regular basis through automated validation processes and periodic restoration testing.

11. LOGGING, MONITORING, AND AUDIT TRAILS

11.1 Processor maintains comprehensive audit logs of access to systems containing Personal Data, including, without limitation:

(a) user authentication events (successful and failed login attempts);

(b) administrative actions, including account creation, modification, and deletion;

(d) data modifications, including creation, update, and deletion of Personal Data records.

11.2 Audit logs are retained for a minimum period consistent with applicable regulatory requirements and the data retention provisions of the Agreement. In no event shall logs relating to access to Personal Data be retained for less than twelve (12) months in an immediately accessible format and twenty-four (24) months in archival storage.

11.3 Processor deploys a security information and event management ("SIEM") system for real-time monitoring, alerting, and correlation of security events across all production environments. The SIEM system is configured to generate alerts for anomalous activity, including unauthorized access attempts, privilege escalation, and bulk data exfiltration patterns.

11.4 Audit logs are protected against unauthorized access, modification, and tampering through access controls, integrity monitoring, and segregation from the systems they monitor. Log storage infrastructure is logically separated from production application infrastructure.

12. DATA SEGREGATION

12.1 Controller's Personal Data is logically segregated from the data of all other Processor clients within the SBF Core platform. Data segregation is maintained across all environments, including production, backup, and disaster recovery.

12.2 Tenant isolation is enforced at both the application layer and the database layer through a combination of dedicated tenant identifiers, schema-level separation, and application-enforced access controls.

12.3 Access controls are designed and tested to prevent cross-tenant data access. Processor periodically validates the effectiveness of tenant isolation controls through internal testing and as part of the SOC 2 Type II audit process described in Section 2.1 above.

13. SECURE DEVELOPMENT PRACTICES

13.1 Processor follows a secure software development lifecycle ("SDLC") for the design, development, testing, and deployment of the SBF Core platform. The SDLC is overseen by Processor's VP of Engineering, Sanjay Dhillon, and incorporates security considerations at each phase of the development process, from requirements definition through post-deployment monitoring.

13.2 Mandatory code review is performed for all code changes prior to deployment to production environments. In addition, static application security testing ("SAST") is integrated into the continuous integration/continuous deployment (CI/CD) pipeline and is executed automatically as part of the build process to identify vulnerabilities in source code before production release.

13.3 Processor maintains a formal change management process that requires documented approval, thorough testing in non-production environments, defined rollback procedures, and post-deployment validation for all changes to production systems that process or store Personal Data. Emergency changes are subject to retrospective review and documentation within forty-eight (48) hours.

14. SUB-PROCESSOR SECURITY REQUIREMENTS

14.1 Processor imposes data protection and security obligations on all approved sub-processors that are materially consistent with the Security Measures set forth in this Schedule B.

14.2 The security requirements applicable to each currently approved sub-processor are as follows:

(a) Osprey Cloud Infrastructure, Inc.: Subject to the Skybridge–Osprey Cloud DPA dated March 1, 2024, which includes security obligations substantially similar to those described herein. Osprey Cloud Infrastructure, Inc. maintains its own SOC 2 Type II certification, the most recent report of which has been reviewed by Processor and is available to Controller upon request subject to Osprey Cloud's confidentiality requirements.

(b) Skybridge Fintech Europe B.V.: As a wholly owned subsidiary of Processor, Skybridge Fintech Europe B.V. is subject to Processor's internal information security policies, standards, and procedures. Skybridge Fintech Europe B.V. maintains a GDPR compliance program and is registered with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) as a data processor.

14.3 A complete list of approved sub-processors is set forth in Schedule C (Approved Sub-Processor List) to the Agreement. The sub-processor approval mechanics, including general written authorization, the requirement for thirty (30) days' prior written notice of any proposed new sub-processor or replacement sub-processor, and Controller's right to object on reasonable grounds, are set forth in the Agreement.

15. INSURANCE

15.1 Processor shall maintain cyber-liability insurance coverage throughout the term of the Agreement, including any renewal or extension periods, with per-occurrence coverage of not less than ten million United States dollars ($10,000,000).

15.2 Details of Processor's current cyber-liability insurance coverage are as follows:

15.3 Processor shall provide a certificate of insurance evidencing the coverage described in this Section 15 to Controller upon Controller's written request, and shall provide prompt written notice to Controller in the event of any material reduction in coverage, cancellation, or non-renewal of the cyber-liability insurance policy.

16. UPDATES TO SECURITY MEASURES

16.1 Processor may update the Security Measures described in this Schedule B from time to time to reflect changes in technology, evolving threat landscapes, changes in applicable law or regulation, and developments in industry best practices, provided that any such update does not materially diminish the overall level of protection afforded to Personal Data processed under the Agreement.

16.2 Material changes to the Security Measures shall be communicated to Controller in writing with reasonable advance notice, and in no event less than thirty (30) days' prior written notice, except where a shorter notice period is necessitated by an urgent security threat that requires immediate implementation of a protective measure.

16.3 Controller may review any updated Security Measures through the audit mechanisms described in the Agreement, including the right to request updated documentation, certifications, and the most recent SOC 2 Type II report, and to conduct or commission audits in accordance with the applicable provisions of the Agreement.

ACKNOWLEDGMENT AND INCORPORATION

This Schedule B is incorporated into and forms an integral part of the Data Processing Agreement between Meridian Federal Savings Bank and Skybridge Fintech Ltd. dated as of February 15, 2026. No separate signature is required for this Schedule B; this Schedule B shall be effective upon execution of the Agreement by the authorized representatives of the parties.

End of Schedule B — Security Measures

Item	Detail
Carrier	Bastion Mutual Insurance Company
Policy Number	CYB-2025-04821
Coverage Type	Technology Errors & Omissions and Cyber Liability
Per Occurrence Limit	$10,000,000
Aggregate Limit	$20,000,000
Current Policy Period	January 1, 2025 through December 31, 2025
Renewal Status	Renewal in progress for 2026 policy year
Broker	Kestrel Risk Advisors LLC

SCHEDULE B — SECURITY MEASURES
to the Data Processing Agreement dated February 15, 2026 (the "Agreement")
between
Meridian Federal Savings Bank ("Controller")
and
Skybridge Fintech Ltd. ("Processor")
This Schedule B is attached to and forms an integral part of the Data Processing Agreement between Controller and Processor. Capitalized terms not defined herein shall have the meanings ascribed to them in the Agreement. Processor shall implement and maintain the following technical and organizational measures to protect Personal Data processed on behalf of Controller in connection with the SBF Core platform (the "Security Measures").
1. OVERVIEW AND SCOPE
1.1 The Security Measures described in this Schedule B apply to all Personal Data processed by Processor under the Agreement, including, without limitation, Personal Data hosted on infrastructure provided by approved sub-processors, namely Osprey Cloud Infrastructure, Inc. and Skybridge Fintech Europe B.V., as further identified in Schedule C (Approved Sub-Processor List) to the Agreement.
1.2 The Security Measures described herein are consistent with those assessed under Processor's current SOC 2 Type II report, as further described in Section 2 below, and reflect industry-recognized practices for the protection of Personal Data in the financial-services technology sector.
1.3 Processor shall maintain Security Measures no less protective than those described in this Schedule B throughout the entire term of the Agreement, including any renewal or extension periods, and for so long as Processor retains any Personal Data following expiration or termination of the Agreement in accordance with the data return and deletion provisions set forth therein.
1.4 Without limiting the foregoing, the Security Measures are designed to comply with the safeguards requirements of the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809, and the Interagency Guidelines Establishing Information Security Standards promulgated thereunder, as well as the supervisory expectations for third-party service provider security articulated in OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance). Processor acknowledges that Controller is a federally chartered savings bank supervised by the Office of the Comptroller of the Currency ("OCC") and that Controller's regulators may rely upon the adequacy of these Security Measures in evaluating Controller's third-party risk management program.
2. INDEPENDENT AUDIT AND CERTIFICATION
2.1 SOC 2 Type II Report
2.1.1 Processor maintains a current System and Organization Controls 2 (SOC 2) Type II report prepared in accordance with the AICPA Trust Services Criteria and issued by an independent certified public accounting firm.
2.1.2 Processor's current SOC 2 Type II report has been issued by Graystone & Ketchum LLP, 300 Delaware Avenue, Suite 700, Wilmington, DE 19801. The lead partner responsible for Processor's information-technology audit engagement is Sandra Clearfield.
2.1.3 The current SOC 2 Type II report covers the reporting period from October 1, 2024 through September 15, 2025, and addresses the following Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
2.1.4 Processor shall obtain a new SOC 2 Type II report on at least an annual basis. Processor shall provide a copy of each new SOC 2 Type II report to Controller promptly upon Controller's written request, subject to the audit rights provisions set forth in the Agreement, including the limitation of one audit request per twelve (12) month period unless such request is triggered by a Personal Data Breach, a material security incident, or a regulatory inquiry or examination directed at Controller or Processor.
2.1.5 If any SOC 2 Type II report identifies material control deficiencies or qualified opinions, Processor shall promptly notify Controller and provide a written remediation plan with estimated timelines for resolution.
2.2 EU-US Data Privacy Framework
2.2.1 Processor has self-certified under the EU-US Data Privacy Framework ("DPF") administered by the International Trade Administration of the U.S. Department of Commerce. Processor's self-certification became effective as of July 1, 2025, and Processor's DPF Certification ID is DPF-2025-03912.
2.2.2 Processor's DPF self-certification supplements, but does not replace, the Standard Contractual Clauses appended to the Agreement as Schedule E (EU Standard Contractual Clauses). In the event that the DPF self-certification is invalidated, revoked, or otherwise ceases to constitute a valid transfer mechanism under applicable European data protection law, the Standard Contractual Clauses shall continue to serve as the lawful basis for the transfer of Personal Data from the European Economic Area to the United States.
2.2.3 Processor shall maintain its DPF self-certification throughout the term of the Agreement and shall promptly notify Controller in writing if Processor's self-certification lapses, is withdrawn, or is the subject of any enforcement action by the Federal Trade Commission.
3. ENCRYPTION
3.1 Encryption at Rest
3.1.1 All Personal Data stored on Processor's systems and on the infrastructure of Osprey Cloud Infrastructure, Inc. is encrypted at rest using the Advanced Encryption Standard with 256-bit keys (AES-256), or a successor cryptographic standard providing equivalent or greater protection.
3.1.2 Encryption keys are managed through a centralized key management system ("KMS") that enforces separation of duties between key custodians and system administrators. Key rotation is performed at least annually, and Processor maintains documented key lifecycle management procedures covering key generation, distribution, storage, rotation, revocation, and destruction.
3.1.3 Encryption at rest applies to all environments in which Personal Data resides, including:
(a) Primary / US: Osprey Cloud US-East, located in Ashburn, Virginia, which serves as the primary production processing environment;
(b) EU: Osprey Cloud EU, located in Frankfurt, Germany, which is used for the processing and storage of Personal Data relating to EU-resident data subjects; and
(c) Disaster Recovery: The disaster recovery environment described in Section 10 below, including all backup and replication storage within the Osprey Cloud infrastructure.
3.2 Encryption in Transit
3.2.1 All Personal Data transmitted between Controller and Processor, between Processor's internal systems, and between Processor and its approved sub-processors is encrypted in transit using Transport Layer Security version 1.2 or higher (TLS 1.2+).
3.2.2 Deprecated cipher suites and protocols, including without limitation SSL 3.0, TLS 1.0, and TLS 1.1, are disabled across all production environments. Processor reviews supported cipher suites on at least a semi-annual basis and disables any cipher suite that is identified as weak or compromised by authoritative sources such as NIST or the Internet Engineering Task Force.
3.2.3 Application programming interface ("API") communications between the SBF Core platform and Controller's systems are secured via mutual Transport Layer Security ("mTLS") where supported by Controller's infrastructure. In the event Controller's infrastructure does not support mTLS, Processor shall implement alternative authentication and encryption mechanisms that provide a substantially equivalent level of protection.
4. ACCESS CONTROLS
4.1 Multi-Factor Authentication (MFA)
4.1.1 Multi-factor authentication is required for all administrative access to SBF Core production environments, hosting infrastructure management consoles, and any system or interface through which Personal Data may be accessed, modified, or exported.
4.1.2 MFA is required for all remote access by Processor personnel, including employees of Skybridge Fintech Ltd. and employees of Skybridge Fintech Europe B.V., regardless of the location from which such remote access originates.
4.1.3 Approved MFA mechanisms include hardware security tokens (e.g., FIDO2-compliant keys) and authenticator application-based time-based one-time passwords ("TOTP"). SMS-based one-time passwords are not accepted as a primary MFA factor for access to production environments.
4.2 Role-Based Access Control (RBAC)
4.2.1 Access to Personal Data is granted on a least-privilege, need-to-know basis. No personnel shall be granted access to Personal Data beyond that which is strictly necessary for the performance of their assigned duties in connection with the services provided under the Agreement.
4.2.2 Role-based access control ("RBAC") is implemented across all production systems within the SBF Core platform. Roles are defined, documented, and mapped to specific access privileges commensurate with job function and responsibility.
4.2.3 Access privileges are reviewed on at least a quarterly basis by Processor's information security team under the direction of the Chief Information Security Officer ("CISO"), Rebecca Muñoz. Each quarterly review includes a reconciliation of active access privileges against current role assignments and personnel rosters, with prompt remediation of any unauthorized, excessive, or orphaned access.
4.2.4 Privileged accounts, including without limitation system administrator accounts, database administrator accounts, and root-level accounts, are subject to enhanced monitoring and logging. Access using privileged accounts is limited to authorized personnel and is recorded in the audit logs described in Section 11 below.
4.3 Identity and Account Management
4.3.1 Unique user identifiers are assigned to all personnel who access systems containing Personal Data. The use of shared, group, or generic accounts in production environments is strictly prohibited.
4.3.2 Processor maintains documented account provisioning and de-provisioning procedures that include defined timelines for the termination of access upon employee departure, contractor engagement termination, or change in role or responsibility. Access shall be revoked within twenty-four (24) hours of an employee's separation from Processor and within forty-eight (48) hours of a change in role that no longer requires access to Personal Data.
4.3.3 Password complexity requirements are enforced across all systems through which Personal Data may be accessed. At a minimum, passwords must meet the following requirements:
(a) minimum length of fourteen (14) characters;
(b) inclusion of at least three of the following four character types: uppercase letters, lowercase letters, numerals, and special characters;
(c) prohibition on reuse of the last twelve (12) passwords; and
(d) mandatory password change at intervals not to exceed ninety (90) days, unless Processor implements an equivalent or superior compensating control (e.g., credential monitoring for compromise).
5. NETWORK SECURITY
5.1 Firewalls and Network Segmentation
5.1.1 Network firewalls are deployed at all perimeter and internal trust boundaries within Processor's infrastructure. Firewall rule sets are reviewed on at least a semi-annual basis and follow a default-deny posture, permitting only explicitly authorized traffic.
5.1.2 Production environments hosting Personal Data are logically segmented from development, staging, quality-assurance, and corporate network environments. Network segmentation controls are designed to prevent lateral movement and to ensure that non-production environments cannot directly access production data stores.
5.1.3 Intrusion detection and prevention systems ("IDS/IPS") are deployed at key network boundaries and are monitored continuously on a twenty-four hours per day, seven days per week (24/7) basis. Alerts generated by IDS/IPS systems are reviewed and triaged by Processor's security operations team in accordance with documented escalation procedures.
5.2 Vulnerability Management
5.2.1 Automated vulnerability scanning is performed on at least a monthly basis across all production systems, including operating systems, application components, network devices, and databases that process or store Personal Data.
5.2.2 Identified vulnerabilities are classified according to severity using an industry-recognized scoring system (e.g., the Common Vulnerability Scoring System, CVSS) and are remediated within the following defined timelines:
(a) Critical-severity vulnerabilities (CVSS 9.0–10.0): remediation within seventy-two (72) hours of identification;
(b) High-severity vulnerabilities (CVSS 7.0–8.9): remediation within fourteen (14) calendar days of identification;
(c) Medium- and low-severity vulnerabilities: remediation in accordance with Processor's standard patch management cycle, not to exceed ninety (90) calendar days.
5.2.3 Processor maintains a patch management program with defined service-level agreements for operating system and application patching. Emergency or out-of-band patches for actively exploited vulnerabilities shall be applied on an expedited basis.
6. PENETRATION TESTING
6.1 Processor shall engage an independent, qualified third-party firm to conduct penetration testing of the SBF Core platform and associated infrastructure at least once per calendar year.
6.2 Processor's current penetration testing firm is Ironvault Security Group LLC, 11710 Plaza America Drive, Suite 400, Reston, VA 20190. Processor may change its penetration testing firm upon reasonable written notice to Controller, provided that any replacement firm possesses equivalent qualifications and industry certifications (e.g., CREST, OSCP, GPEN).
6.3 The scope of each annual penetration test shall include, at a minimum:
(a) external network penetration testing;
(b) web application penetration testing of the SBF Core platform; and
(c) API security assessment covering all API endpoints used in the exchange of Personal Data between SBF Core and Controller's systems.
6.4 A summary of the results of the most recent penetration test shall be made available to Controller upon Controller's reasonable written request, subject to execution of appropriate confidentiality protections and Processor's reasonable redaction of information that, if disclosed, could compromise the security of Processor's systems or the systems of other Processor clients.
6.5 Material findings identified through penetration testing are remediated in accordance with the vulnerability management timelines set forth in Section 5.2.2 above. Processor shall track remediation status and provide Controller, upon request, with confirmation that material findings have been resolved.
7. INCIDENT RESPONSE
7.1 Incident Response Plan
7.1.1 Processor maintains a documented information security incident response plan (the "IRP") that addresses the full lifecycle of incident management, including the following phases: identification, containment, eradication, recovery, and post-incident review.
7.1.2 The IRP is tested at least annually through tabletop exercises and/or simulated incident drills designed to validate the effectiveness of response procedures, communication protocols, and escalation pathways.
7.1.3 The IRP designates the CISO, Rebecca Muñoz, as the primary incident commander with authority to activate the incident response team, allocate resources, authorize containment actions, and coordinate external communications. In the event of the CISO's unavailability, the IRP designates a qualified alternate incident commander from Processor's senior security leadership.
7.2 Breach Notification Coordination
7.2.1 The notification obligations and escalation procedures applicable in the event of a Personal Data Breach are set forth in detail in Schedule D (Data Breach Notification Procedures) to the Agreement, including the requirement that Processor provide initial notification to Controller within forty-eight (48) hours of becoming aware of a confirmed or reasonably suspected Personal Data Breach.
7.2.2 Processor's IRP is aligned with the requirements of the FDIC/OCC Computer-Security Incident Notification Rule codified at 12 CFR Part 53 (OCC) and 12 CFR Part 304 (FDIC), which require banking organizations to notify their primary federal regulator within thirty-six (36) hours of determining that a notification incident has occurred. Processor acknowledges that timely notification to Controller is essential to facilitate Controller's compliance with the thirty-six (36) hour bank-to-regulator notification obligation, and Processor shall structure its internal escalation procedures accordingly.
7.3 Forensic Investigation
7.3.1 Processor retains the capability, whether through qualified internal personnel or through engagement of a qualified third-party digital forensics firm, to conduct forensic investigation of security incidents affecting Personal Data processed under the Agreement.
7.3.2 Processor shall cooperate fully with Controller and Controller's regulators, including the OCC, the Federal Deposit Insurance Corporation ("FDIC"), and the Consumer Financial Protection Bureau ("CFPB"), in the investigation of any Personal Data Breach or security incident affecting Controller's Personal Data, as further described in the Agreement. Such cooperation shall include, without limitation, preservation of evidence, provision of forensic reports, and participation in interviews or examinations as reasonably requested.
8. EMPLOYEE SECURITY TRAINING AND PERSONNEL CONTROLS
8.1 Security Awareness Training
8.1.1 All Processor personnel receive mandatory security awareness training upon hire and at least annually thereafter. For purposes of this Section 8, "Processor personnel" includes all employees of Skybridge Fintech Ltd. (currently approximately one hundred eighty-seven (187) employees) and all employees of Skybridge Fintech Europe B.V. (currently approximately fourteen (14) employees), as well as any individual contractors or temporary staff who access systems containing Personal Data.
8.1.2 Security awareness training covers, at a minimum, the following topics:
(a) phishing awareness and recognition of social engineering tactics;
(b) secure data handling procedures, including classification, storage, transmission, and disposal of Personal Data;
(c) incident identification and reporting obligations;
(d) acceptable use of information systems and mobile devices;
(e) password hygiene and authentication best practices; and
(f) privacy obligations under applicable law, including the Gramm-Leach-Bliley Act ("GLBA"), the General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), and the New Jersey Data Privacy Act.
8.1.3 Completion of security awareness training is tracked, and Processor maintains records of training completion for each individual. Personnel who fail to complete required training within the prescribed timeframe are subject to suspension of access privileges until training is completed.
8.2 Background Checks
8.2.1 Processor conducts pre-employment background checks on all personnel who will have access to Personal Data, to the extent permitted by applicable law in the jurisdiction in which such personnel are located.
8.2.2 The background check program includes, at a minimum:
(a) verification of criminal history (at the national, state, and county levels, as applicable);
(b) verification of employment history for at least the prior five (5) years; and
(c) where applicable and permitted by law, verification of credit history for personnel in positions involving access to financial data.
8.3 Confidentiality Obligations
8.3.1 All Processor personnel with access to Personal Data are bound by written confidentiality obligations, whether through the terms of an employment agreement, an independent contractor agreement, or a standalone non-disclosure agreement. Such confidentiality obligations survive the termination of the individual's relationship with Processor.
9. PHYSICAL SECURITY
9.1 Data Center Physical Security (Osprey Cloud Infrastructure, Inc.)
9.1.1 Personal Data processed under the Agreement is hosted exclusively at data center facilities operated by Osprey Cloud Infrastructure, Inc., as follows:
(a) Primary / US: Osprey Cloud US-East, located in Ashburn, Virginia, which serves as the primary processing facility and also provides a secondary availability zone used for disaster recovery purposes; and
(b) EU: Osprey Cloud EU, located in Frankfurt, Germany, which is used for the processing and storage of Personal Data relating to EU-resident data subjects in accordance with the data localization requirements set forth in the Agreement and the Standard Contractual Clauses.
9.1.2 Exact data center street addresses are withheld in accordance with Osprey Cloud Infrastructure, Inc.'s physical security policy and are available to Controller and Controller's regulators upon execution of a separate non-disclosure undertaking, as reasonably required for regulatory examination purposes.
9.1.3 Physical security measures at Osprey Cloud data centers include, without limitation:
(a) twenty-four hours per day, seven days per week (24/7) on-site security personnel;
(b) closed-circuit television (CCTV) surveillance with recording and retention of footage;
(c) biometric access controls, including fingerprint scanning and/or iris scanning, at all entry points to data halls;
(d) mantrap (interlocking door) entry systems at facility perimeters and data hall entrances;
(e) visitor logging, identification verification, and mandatory escort requirements for all non-credentialed individuals;
(f) environmental controls including FM-200 or equivalent fire suppression systems, precision climate control (temperature and humidity), and redundant power supply with uninterruptible power supply (UPS) and diesel generator backup; and
(g) redundant cooling systems to ensure continuous operation under adverse conditions.
9.1.4 Physical security controls at Osprey Cloud data centers are assessed under Osprey Cloud Infrastructure, Inc.'s own SOC 2 Type II program. These controls are further addressed in the Data Processing Agreement between Skybridge Fintech Ltd. and Osprey Cloud Infrastructure, Inc. dated March 1, 2024 (the "Skybridge–Osprey Cloud DPA").
9.2 Processor Office Security
9.2.1 Physical access to Processor's corporate offices is controlled through the following measures:
(a) Wilmington, Delaware Office: Skybridge Fintech Ltd., 4100 Silverside Road, Suite 310, Wilmington, DE 19810. Access is controlled through electronic key-card access systems, visitor management procedures (including sign-in, identification verification, and escort), and clean-desk policies requiring the secure storage of all sensitive materials when workstations are unattended.
(b) Amsterdam, Netherlands Office: Skybridge Fintech Europe B.V., Keizersgracht 482, 1017 EG Amsterdam, Netherlands. Access is controlled through electronic key-card access systems, visitor management procedures, and clean-desk policies consistent with those maintained at the Wilmington office.
9.2.2 No Personal Data is stored on local workstations, laptop computers, or removable media (including USB drives, external hard drives, and optical media). All processing of Personal Data occurs within the hosted cloud environments described in Section 9.1 above. Processor enforces endpoint management controls, including device encryption and restrictions on the use of removable storage devices, to mitigate the risk of unauthorized local storage.
10. BUSINESS CONTINUITY AND DISASTER RECOVERY
10.1 Processor maintains a documented business continuity and disaster recovery plan ("BCP/DR Plan") that is designed to ensure the continued availability of the SBF Core platform and the protection of Personal Data in the event of a disruption, including natural disasters, infrastructure failures, cyberattacks, and other adverse events.
10.2 The disaster recovery environment is located at the Osprey Cloud US-East secondary availability zone in Ashburn, Virginia, which is physically and logically separated from the primary production availability zone to provide resilience against single-zone failures.
10.3 Recovery time objectives ("RTO") and recovery point objectives ("RPO") for the SBF Core platform are defined in the BCP/DR Plan and are tested at least annually through simulated failover exercises. Test results are documented and retained, and any deficiencies identified during testing are remediated promptly.
10.4 Backups of Personal Data are encrypted using AES-256 (consistent with Section 3.1 above) and are stored in geographically separated facilities within the Osprey Cloud infrastructure. Backup integrity is verified on a regular basis through automated validation processes and periodic restoration testing.
11. LOGGING, MONITORING, AND AUDIT TRAILS
11.1 Processor maintains comprehensive audit logs of access to systems containing Personal Data, including, without limitation:
(a) user authentication events (successful and failed login attempts);
(b) administrative actions, including account creation, modification, and deletion;
(c) access to Personal Data, including read, write, copy, and export operations; and
(d) data modifications, including creation, update, and deletion of Personal Data records.
11.2 Audit logs are retained for a minimum period consistent with applicable regulatory requirements and the data retention provisions of the Agreement. In no event shall logs relating to access to Personal Data be retained for less than twelve (12) months in an immediately accessible format and twenty-four (24) months in archival storage.
11.3 Processor deploys a security information and event management ("SIEM") system for real-time monitoring, alerting, and correlation of security events across all production environments. The SIEM system is configured to generate alerts for anomalous activity, including unauthorized access attempts, privilege escalation, and bulk data exfiltration patterns.
11.4 Audit logs are protected against unauthorized access, modification, and tampering through access controls, integrity monitoring, and segregation from the systems they monitor. Log storage infrastructure is logically separated from production application infrastructure.
12. DATA SEGREGATION
12.1 Controller's Personal Data is logically segregated from the data of all other Processor clients within the SBF Core platform. Data segregation is maintained across all environments, including production, backup, and disaster recovery.
12.2 Tenant isolation is enforced at both the application layer and the database layer through a combination of dedicated tenant identifiers, schema-level separation, and application-enforced access controls.
12.3 Access controls are designed and tested to prevent cross-tenant data access. Processor periodically validates the effectiveness of tenant isolation controls through internal testing and as part of the SOC 2 Type II audit process described in Section 2.1 above.
13. SECURE DEVELOPMENT PRACTICES
13.1 Processor follows a secure software development lifecycle ("SDLC") for the design, development, testing, and deployment of the SBF Core platform. The SDLC is overseen by Processor's VP of Engineering, Sanjay Dhillon, and incorporates security considerations at each phase of the development process, from requirements definition through post-deployment monitoring.
13.2 Mandatory code review is performed for all code changes prior to deployment to production environments. In addition, static application security testing ("SAST") is integrated into the continuous integration/continuous deployment (CI/CD) pipeline and is executed automatically as part of the build process to identify vulnerabilities in source code before production release.
13.3 Processor maintains a formal change management process that requires documented approval, thorough testing in non-production environments, defined rollback procedures, and post-deployment validation for all changes to production systems that process or store Personal Data. Emergency changes are subject to retrospective review and documentation within forty-eight (48) hours.
14. SUB-PROCESSOR SECURITY REQUIREMENTS
14.1 Processor imposes data protection and security obligations on all approved sub-processors that are materially consistent with the Security Measures set forth in this Schedule B.
14.2 The security requirements applicable to each currently approved sub-processor are as follows:
(a) Osprey Cloud Infrastructure, Inc.: Subject to the Skybridge–Osprey Cloud DPA dated March 1, 2024, which includes security obligations substantially similar to those described herein. Osprey Cloud Infrastructure, Inc. maintains its own SOC 2 Type II certification, the most recent report of which has been reviewed by Processor and is available to Controller upon request subject to Osprey Cloud's confidentiality requirements.
(b) Skybridge Fintech Europe B.V.: As a wholly owned subsidiary of Processor, Skybridge Fintech Europe B.V. is subject to Processor's internal information security policies, standards, and procedures. Skybridge Fintech Europe B.V. maintains a GDPR compliance program and is registered with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) as a data processor.
14.3 A complete list of approved sub-processors is set forth in Schedule C (Approved Sub-Processor List) to the Agreement. The sub-processor approval mechanics, including general written authorization, the requirement for thirty (30) days' prior written notice of any proposed new sub-processor or replacement sub-processor, and Controller's right to object on reasonable grounds, are set forth in the Agreement.
15. INSURANCE
15.1 Processor shall maintain cyber-liability insurance coverage throughout the term of the Agreement, including any renewal or extension periods, with per-occurrence coverage of not less than ten million United States dollars ($10,000,000).
15.2 Details of Processor's current cyber-liability insurance coverage are as follows:
15.3 Processor shall provide a certificate of insurance evidencing the coverage described in this Section 15 to Controller upon Controller's written request, and shall provide prompt written notice to Controller in the event of any material reduction in coverage, cancellation, or non-renewal of the cyber-liability insurance policy.
16. UPDATES TO SECURITY MEASURES
16.1 Processor may update the Security Measures described in this Schedule B from time to time to reflect changes in technology, evolving threat landscapes, changes in applicable law or regulation, and developments in industry best practices, provided that any such update does not materially diminish the overall level of protection afforded to Personal Data processed under the Agreement.
16.2 Material changes to the Security Measures shall be communicated to Controller in writing with reasonable advance notice, and in no event less than thirty (30) days' prior written notice, except where a shorter notice period is necessitated by an urgent security threat that requires immediate implementation of a protective measure.
16.3 Controller may review any updated Security Measures through the audit mechanisms described in the Agreement, including the right to request updated documentation, certifications, and the most recent SOC 2 Type II report, and to conduct or commission audits in accordance with the applicable provisions of the Agreement.
ACKNOWLEDGMENT AND INCORPORATION
This Schedule B is incorporated into and forms an integral part of the Data Processing Agreement between Meridian Federal Savings Bank and Skybridge Fintech Ltd. dated as of February 15, 2026. No separate signature is required for this Schedule B; this Schedule B shall be effective upon execution of the Agreement by the authorized representatives of the parties.
End of Schedule B — Security Measures
Item | Detail
Carrier | Bastion Mutual Insurance Company
Policy Number | CYB-2025-04821
Coverage Type | Technology Errors & Omissions and Cyber Liability
Per Occurrence Limit | $10,000,000
Aggregate Limit | $20,000,000
Current Policy Period | January 1, 2025 through December 31, 2025
Renewal Status | Renewal in progress for 2026 policy year
Broker | Kestrel Risk Advisors LLC

SCHEDULE B — SECURITY MEASURES

ACKNOWLEDGMENT AND INCORPORATION

Record

Parties

Dates

Amounts