1009-00004 · Skybridge Fintech Ltd · Transaction Documents/Schedules

schedule-c-approved-sub-processors.docx DOCUMENT Finance & Banking

34 / 35 ← → ✕

Contract analysis Extract to table

SCHEDULE C

APPROVED SUB-PROCESSORS

to the

Data Processing Agreement

dated February 15, 2026

by and between

MERIDIAN FEDERAL SAVINGS BANK

("Controller")

and

SKYBRIDGE FINTECH LTD.

("Processor")

Effective Date: February 15, 2026

1. PURPOSE AND SCOPE

1.1. This Schedule C (the "Schedule") is attached to and forms an integral part of the Data Processing Agreement dated February 15, 2026 (the "DPA"), entered into by and between Meridian Federal Savings Bank, a federally chartered savings bank organized under the laws of the United States and operating pursuant to Office of the Comptroller of the Currency Charter No. 14-2238, with its principal offices located at 900 Broad Street, Suite 1200, Newark, New Jersey 07102 ("Controller"), and Skybridge Fintech Ltd., a corporation organized and existing under the laws of the State of Delaware, with its principal offices located at 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810 ("Processor").

1.2. The purpose of this Schedule is to: (a) identify the sub-processors that Controller has approved for use by Processor in connection with the processing of Personal Data under the DPA as of the Effective Date; (b) establish the mechanism for the authorization, notice, and objection with respect to sub-processors that Processor may seek to engage after the Effective Date; and (c) set forth the flow-down obligations, ongoing monitoring requirements, and related provisions governing Processor's use of sub-processors in the performance of services under the DPA and the SaaS Subscription Agreement dated February 15, 2026 (the "SaaS Agreement").

1.3. Capitalized terms used but not otherwise defined in this Schedule shall have the meanings ascribed to them in the DPA. In the event of any conflict between a defined term as used in this Schedule and a defined term as used in the DPA, the definition set forth in the DPA shall control unless expressly stated otherwise in this Schedule.

1.4. This Schedule shall be read and interpreted in conjunction with, and is supplementary to, the following documents, each of which forms part of the overall data protection framework governing the relationship between Controller and Processor:

(a) the DPA, including all Schedules thereto;

(b) the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2: Controller-to-Processor and Module 3: Processor-to-Sub-processor), as appended to the DPA (the "SCCs");

(d) SCC Annex II (Technical and Organisational Measures);

(e) SCC Annex III (List of Sub-processors);

(f) Schedule A to the DPA (Description of Processing);

(g) Schedule B to the DPA (Security Measures);

(h) Schedule D to the DPA (Data Breach Notification Procedures); and

(i) the SaaS Agreement.

1.5. To the extent that SCC Annex III (List of Sub-processors) is required to be completed as part of the SCCs, this Schedule C is intended to serve as the substantive basis for, and to be consistent with, SCC Annex III, subject to the conflict resolution provisions set forth in Section 9 below.

2. GENERAL WRITTEN AUTHORIZATION

2.1. Authorization. Controller hereby provides general written authorization for Processor to engage sub-processors to process Personal Data on Controller's behalf in connection with the services provided under the DPA and the SaaS Agreement, subject to the conditions set forth in this Schedule C and the DPA.

2.2. Legal Basis. This general written authorization is provided in accordance with, and is intended to satisfy the requirements of:

(a) Article 28(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR"), which requires that a processor shall not engage another processor without prior specific or general written authorization of the controller;

(b) Clause 9 of the Standard Contractual Clauses (Module 2, Controller-to-Processor), as incorporated into the DPA; and

2.3. Scope of Authorization. The general written authorization granted by Controller in this Section 2 applies to:

(a) the sub-processors identified in the Approved Sub-Processor List set forth in Section 4 below, as of the Effective Date of the DPA; and

(b) any new sub-processors that are added to the Approved Sub-Processor List after the Effective Date, provided that such additions are made in strict compliance with the notice and objection procedures set forth in Section 3 below.

2.4. Contractual Flow-Down. Processor shall impose on each sub-processor, by way of a written agreement executed prior to the commencement of any processing of Controller's Personal Data by such sub-processor, data protection obligations that are no less protective than those set forth in the DPA, including, without limitation, obligations relating to:

(a) the implementation and maintenance of appropriate technical and organizational security measures;

(b) the confidentiality of Personal Data and restrictions on access by personnel;

(d) cooperation with and facilitation of audit rights;

(e) data return or secure deletion upon termination or expiration of the sub-processing arrangement; and

(f) compliance with applicable data protection laws, including the GDPR, the California Consumer Privacy Act (as amended by the CPRA), the Gramm-Leach-Bliley Act, and any other applicable federal, state, or international privacy or data protection laws.

2.5. Processor Liability. Notwithstanding the engagement of any sub-processor, Processor shall remain fully liable to Controller for the performance of each sub-processor's obligations under the DPA and this Schedule. Where a sub-processor fails to fulfil its data protection obligations under the sub-processing agreement or applicable law, Processor shall remain fully liable to Controller for the performance of that sub-processor's obligations, as if Processor itself had performed (or failed to perform) such obligations directly. This provision shall not be construed to limit or modify any other rights or remedies available to Controller under the DPA, the SaaS Agreement, or applicable law.

3. NOTICE AND OBJECTION PROCEDURE FOR NEW SUB-PROCESSORS

3.1 Prior Written Notice

3.1.1. Processor shall provide Controller with no less than thirty (30) calendar days' prior written notice before engaging any new sub-processor, or before replacing any existing sub-processor, to process Personal Data on Controller's behalf under the DPA (a "Sub-Processor Change Notice").

3.1.2. Such Sub-Processor Change Notice shall be provided in writing and delivered by email to each of the following designated contacts of Controller:

(a) Chief Compliance Officer: Andrea Sokolov, asokolov@meridianfederal.com; and

(b) Vice President, Third-Party Risk Management: Marcus Tibaldi, mtibaldi@meridianfederal.com.

3.1.3. Each Sub-Processor Change Notice shall include, at a minimum, the following information:

(a) the full legal name and registered address of the proposed new sub-processor;

(b) a detailed description of the processing activities to be performed by the proposed sub-processor, including the nature and purpose of the processing;

(c) the location(s) of processing, including the specific data center regions and countries in which Personal Data will be processed or stored;

(d) the categories of Personal Data to be processed by the proposed sub-processor, and the categories of data subjects whose Personal Data will be processed;

(e) confirmation that Processor has conducted due diligence on the proposed sub-processor's security measures, data protection practices, and compliance posture, including a summary of the key findings of such due diligence;

(f) a copy of, or reference to, the data processing agreement or equivalent contractual provisions between Processor and the proposed sub-processor, which must meet the flow-down requirements set forth in Section 5 of this Schedule; and

(g) where the proposed sub-processor is located outside the European Economic Area, the United Kingdom, or Switzerland, identification of the lawful transfer mechanism (e.g., Standard Contractual Clauses, adequacy decision) that will be used to ensure the lawfulness of any international transfer of Personal Data to the proposed sub-processor.

3.1.4. In addition to the notice required under this Section 3.1, Processor shall maintain and make available to Controller a list of pending sub-processor changes, which may be accessed by Controller at any time through the Processor's secure client portal or upon written request.

3.2 Controller's Right to Object

3.2.1. Controller shall have thirty (30) calendar days from the date of receipt of a Sub-Processor Change Notice (the "Objection Period") to object to the engagement of the proposed new sub-processor or the replacement of an existing sub-processor.

3.2.2. Any objection must be made in writing and delivered to Processor's designated contact for sub-processor matters (currently: General Counsel, Skybridge Fintech Ltd., legal@skybridgefintech.com). The objection must state reasonable grounds for the objection, which grounds must be based on legitimate data protection concerns, including, without limitation, concerns relating to:

(a) the adequacy of the proposed sub-processor's technical and organizational security measures;

(b) the proposed sub-processor's compliance history, including any prior data breaches, regulatory enforcement actions, or material audit findings;

(c) the jurisdiction(s) in which the proposed sub-processor operates, and the adequacy of data protection laws in such jurisdiction(s);

(d) the potential risk to data subjects, including risks arising from the nature or sensitivity of the Personal Data to be processed;

(e) the proposed sub-processor's financial stability and ability to meet its obligations under the sub-processing agreement; or

(f) any conflict with Controller's regulatory obligations under federal banking regulations, including but not limited to OCC Bulletin 2023-17, FDIC guidance on third-party risk management, or guidance issued by the Board of Governors of the Federal Reserve System.

3.2.3. If Controller objects to the engagement of a proposed new sub-processor in accordance with this Section 3.2, Processor shall not engage the proposed sub-processor for the processing of Controller's Personal Data. In such event, Processor shall work in good faith with Controller to identify a commercially reasonable alternative sub-processor or alternative arrangement that addresses Controller's data protection concerns while enabling Processor to continue to provide the services under the SaaS Agreement.

3.2.4. If, following good-faith efforts by both parties, no commercially reasonable alternative is available, and Processor is unable to provide the services (or a material portion of the services) under the SaaS Agreement without the proposed sub-processor, either party may terminate the affected portion of the services (and, if applicable, the SaaS Agreement in its entirety) in accordance with the termination provisions set forth in Section 12 of the DPA and Section 9 of the SaaS Agreement, without penalty or liability to either party, except that Processor shall refund to Controller any prepaid fees for services not yet rendered as of the effective date of termination, on a pro-rata basis.

3.3 Deemed Approval

3.3.1. If Controller does not deliver a written objection to Processor within the thirty (30) calendar day Objection Period following receipt of a Sub-Processor Change Notice, Controller shall be deemed to have approved the proposed new sub-processor (or replacement sub-processor, as applicable), and Processor may thereafter engage the sub-processor for the processing of Controller's Personal Data in accordance with the terms of this Schedule and the DPA.

3.3.2. Deemed approval under this Section 3.3 shall have the same legal effect as express written approval by Controller, and the approved sub-processor shall be added to the Approved Sub-Processor List maintained under Section 4 of this Schedule.

3.4 Regulatory Access

3.4.1. Nothing in this Schedule C shall restrict, limit, or otherwise impair the rights of Controller's regulatory supervisors—including, without limitation, the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), the Consumer Financial Protection Bureau (CFPB), and any other applicable federal or state banking regulator—to access, examine, or audit any sub-processor engaged by Processor to process Controller's Personal Data, in accordance with:

(a) OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance);

(b) the FDIC's guidance on third-party risk management, including FIL-44-2008 and subsequent guidance;

(d) 12 C.F.R. Part 30, Appendix B (Interagency Guidelines Establishing Information Security Standards); and

(e) any other applicable federal banking regulation or supervisory guidance.

3.4.2. Processor shall use commercially reasonable efforts to ensure that all sub-processing agreements entered into pursuant to this Schedule include provisions expressly permitting examination, access, and audit by Controller's regulatory supervisors as contemplated by this Section 3.4. In the event that a sub-processor refuses to include such provisions, Processor shall promptly notify Controller and shall not engage such sub-processor without Controller's prior express written approval.

4. APPROVED SUB-PROCESSOR LIST

The following sub-processors have been approved by Controller as of the Effective Date for the processing of Personal Data on Controller's behalf in connection with the services provided under the DPA and the SaaS Agreement. This list constitutes the initial Approved Sub-Processor List and shall be updated from time to time in accordance with Sections 3 and 8 of this Schedule.

Sub-Processor No. 1: Osprey Cloud Infrastructure, Inc.

Sub-Processor No. 2: Skybridge Fintech Europe B.V.

5. FLOW-DOWN OBLIGATIONS

5.1. Processor shall ensure that each sub-processor listed in the Approved Sub-Processor List set forth in Section 4 above, and each sub-processor added to the Approved Sub-Processor List in accordance with the notice and objection procedures set forth in Section 3, is bound by a written data processing agreement (a "Sub-Processing Agreement") executed prior to the commencement of any processing of Controller's Personal Data by such sub-processor.

5.2. Each Sub-Processing Agreement shall contain data protection obligations that are no less protective than the obligations imposed on Processor under the DPA, and shall include, at a minimum, obligations relating to each of the following:

(a) Documented Instructions. The sub-processor shall process Personal Data only on the basis of documented instructions from Processor (and, through Processor, from Controller), and shall not process Personal Data for any purpose other than the specific purposes set forth in the Sub-Processing Agreement and Schedule A to the DPA, unless required to do so by applicable law, in which case the sub-processor shall inform Processor of that legal requirement before processing, unless the law prohibits such notice on important grounds of public interest.

(b) Confidentiality. The sub-processor shall ensure that all persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The sub-processor shall limit access to Personal Data to those personnel who have a legitimate need to access such data in connection with the performance of the sub-processor's obligations under the Sub-Processing Agreement.

(c) Security Measures. The sub-processor shall implement and maintain appropriate technical and organizational security measures consistent with those described in Schedule B to the DPA, including, without limitation:

(i) AES-256 encryption (or equivalent) for all Personal Data at rest;

(ii) TLS 1.2 or higher encryption for all Personal Data in transit;

(iii) multi-factor authentication (MFA) for all administrative and privileged access to systems processing Personal Data;

(iv) intrusion detection and prevention systems;

(v) vulnerability scanning and penetration testing on at least an annual basis;

(vi) access logging and monitoring; and

(vii) physical security controls for data center facilities.

(d) Breach Notification. The sub-processor shall notify Processor of any Personal Data Breach without undue delay and, in any event, within a timeframe that enables Processor to comply with the forty-eight (48) hour breach notification obligation to Controller set forth in Schedule D to the DPA (Data Breach Notification Procedures). Such notification shall include, to the extent available, a description of the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences of the breach, and the measures taken or proposed to be taken to address and mitigate the breach.

(e) Data Protection Impact Assessments. The sub-processor shall cooperate with and provide reasonable assistance to Processor (and, through Processor, to Controller) in connection with the conduct of data protection impact assessments (DPIAs) at Controller's reasonable request, to the extent that the processing activities of the sub-processor are relevant to such assessment.

(f) Data Return and Deletion. Upon termination or expiration of the Sub-Processing Agreement, or upon Processor's written instruction, the sub-processor shall, at Controller's election (communicated through Processor), return all Personal Data to Processor or securely delete all Personal Data in its possession, and shall certify such return or deletion in writing, subject to any applicable legal retention requirements that may require the sub-processor to retain certain data for a specified period.

(g) Audit Rights. The sub-processor shall make available to Processor (and, through Processor, to Controller or Controller's duly appointed auditors or representatives, and to Controller's regulatory supervisors, including the OCC, FDIC, and CFPB) all information necessary to demonstrate compliance with the obligations set forth in the Sub-Processing Agreement and applicable data protection laws, and shall allow for and contribute to audits, including inspections, conducted by Processor, Controller, Controller's auditors, or Controller's regulatory supervisors, subject to reasonable advance notice and confidentiality obligations.

(h) Data Subject Rights. The sub-processor shall provide reasonable assistance to Processor in responding to data subject requests for the exercise of their rights under applicable data protection laws, including rights of access, rectification, erasure, restriction of processing, data portability, and objection.

5.3. International Transfers. In the case of any sub-processor located outside the European Economic Area, the United Kingdom, or Switzerland, or in any jurisdiction that has not received an adequacy decision from the European Commission, the Sub-Processing Agreement shall include Standard Contractual Clauses (Module 3, Processor-to-Sub-processor) or an equivalent transfer mechanism approved by the relevant data protection authority, to ensure that Personal Data transferred to such sub-processor is afforded a level of protection that is essentially equivalent to that guaranteed within the EEA.

5.4. Processor shall provide Controller with copies of relevant extracts of Sub-Processing Agreements (redacted to remove commercially sensitive pricing or proprietary technical information, as necessary) upon Controller's reasonable written request, to enable Controller to verify compliance with the flow-down requirements set forth in this Section 5.

6. PROCESSOR'S ONGOING OBLIGATIONS REGARDING SUB-PROCESSORS

6.1. Maintenance of Sub-Processor List. Processor shall maintain an up-to-date and accurate list of all sub-processors engaged to process Controller's Personal Data (the "Current Sub-Processor List"), and shall make such list available to Controller upon written request within five (5) business days. Processor shall also publish the Current Sub-Processor List on its secure client portal, accessible to Controller's authorized personnel, and shall update such portal promptly upon any addition, removal, or replacement of a sub-processor.

6.2. Pre-Engagement Due Diligence. Prior to engaging any new sub-processor, Processor shall conduct appropriate due diligence on the proposed sub-processor, which shall include, at a minimum, review and assessment of:

(a) the sub-processor's current security certifications and compliance posture (e.g., SOC 2 Type II, ISO/IEC 27001, PCI DSS);

(b) the sub-processor's data protection policies, privacy notices, and record of compliance with applicable data protection laws;

(c) the sub-processor's incident response capabilities, including the existence and adequacy of a documented incident response plan;

(d) the sub-processor's business continuity and disaster recovery capabilities;

(e) the sub-processor's financial stability and operational resilience;

(f) any prior data breaches, regulatory enforcement actions, or material audit findings involving the sub-processor; and

(g) the sub-processor's ability to comply with the flow-down obligations described in Section 5 of this Schedule.

6.3. Ongoing Monitoring and Annual Reassessment. Processor shall periodically, and at least annually, reassess each sub-processor to confirm the sub-processor's continued compliance with the requirements of the DPA, this Schedule, and applicable data protection laws. Such annual reassessment shall include, at a minimum:

(a) review of the sub-processor's most recent SOC 2 Type II report or equivalent independent audit report;

(b) review of any material changes to the sub-processor's security certifications, data protection policies, or processing locations;

(c) review of any data breaches, security incidents, or regulatory actions involving the sub-processor during the preceding twelve (12) months;

(d) confirmation that the Sub-Processing Agreement remains in full force and effect and continues to meet the flow-down requirements of Section 5; and

(e) an assessment of any material changes to the sub-processor's ownership, corporate structure, or financial condition that could affect its ability to fulfill its obligations.

6.4. Remedial Action. In the event that a sub-processor fails to fulfill its data protection obligations under the Sub-Processing Agreement, applicable data protection laws, or the requirements of this Schedule, Processor shall:

(a) promptly notify Controller in writing of the failure, including a description of the nature and scope of the failure and any impact on Controller's Personal Data;

(b) take appropriate and timely remedial action to address the failure, which may include requiring the sub-processor to implement corrective measures within a specified timeframe;

(c) if the failure cannot be remedied within a reasonable timeframe, or if the failure poses a material risk to the security or privacy of Controller's Personal Data, suspend or terminate the sub-processing arrangement and, if applicable, migrate Controller's Personal Data to an alternative sub-processor or back to Processor; and

(d) cooperate with Controller in connection with any investigation, notification, or remediation activities arising from the sub-processor's failure.

6.5. Reporting. Upon Controller's reasonable written request, and no more frequently than once per calendar year (except in the event of a security incident or material compliance concern), Processor shall provide Controller with a summary report of its sub-processor oversight activities, including the results of annual reassessments, any material findings, and any remedial actions taken.

7. INSURANCE

7.1. Processor shall ensure that its engagement of sub-processors does not diminish, limit, or otherwise adversely affect the cyber-liability insurance coverage required under Section 14.3 of the DPA. As of the Effective Date, Processor maintains cyber-liability insurance through Bastion Mutual Insurance Company (Policy No. CYB-2025-04821), with the following coverage limits:

(a) Per-Occurrence Coverage: Not less than Ten Million Dollars ($10,000,000) per occurrence; and

(b) Aggregate Coverage: Not less than Twenty Million Dollars ($20,000,000) in the aggregate per policy year.

7.2. Processor shall promptly notify Controller in writing of any material change to its cyber-liability insurance coverage, including any reduction in coverage limits, cancellation of the policy, or change of insurer.

7.3. Processor shall, upon Controller's written request, provide Controller with a certificate of insurance evidencing the coverage described in this Section 7, including confirmation that the policy covers losses arising from the acts or omissions of sub-processors engaged by Processor.

8. UPDATES TO THIS SCHEDULE

8.1. This Schedule C shall be updated by Processor from time to time as sub-processors are added to, removed from, or replaced on the Approved Sub-Processor List, in accordance with the notice and objection procedures set forth in Section 3 of this Schedule.

8.2. Updated versions of this Schedule shall be provided to Controller in writing (including by email to the designated contacts identified in Section 3.1.2) and shall be deemed effective upon the expiration of the applicable Objection Period without objection by Controller (or upon Controller's express written approval, if such approval is given prior to the expiration of the Objection Period).

8.3. For the avoidance of doubt, updates to the Approved Sub-Processor List in this Schedule C that are made in compliance with the notice and objection procedures set forth in Section 3 do not require a formal amendment to, or restatement of, the DPA, provided that such procedures have been followed in all material respects. All other amendments to this Schedule C shall require the written agreement of both parties in accordance with the amendment provisions of the DPA.

8.4. Processor shall maintain an archive of all prior versions of this Schedule C, including the date of each update and the sub-processor(s) added, removed, or replaced, and shall make such archive available to Controller upon reasonable written request.

9. INTERACTION WITH SCC ANNEX III

9.1. This Schedule C is intended to be consistent with, and supplementary to, SCC Annex III (List of Sub-processors) appended to the Standard Contractual Clauses package forming part of the DPA. The information set forth in Section 4 of this Schedule has been used as the basis for completing SCC Annex III, and the parties acknowledge that SCC Annex III is derived from and should be read together with this Schedule C.

9.2. In the event of any conflict or inconsistency between the terms and provisions of this Schedule C and the terms and provisions of SCC Annex III, the provisions that afford greater protection to data subjects shall prevail. In determining which provisions afford greater protection, the parties shall have regard to the purpose and objectives of the GDPR and the SCCs, as well as the guidance of the European Data Protection Board.

9.3. Governing Law. The parties acknowledge that the Standard Contractual Clauses, including SCC Annex III, are governed by the law of the Netherlands, as selected by the parties pursuant to Clause 17 of the Standard Contractual Clauses. This Schedule C, as a schedule to the DPA, is governed by the law of the State of Delaware, as set forth in Section 18.1 of the DPA. Notwithstanding the foregoing, to the extent that any provision of this Schedule C relates to or implements the requirements of the Standard Contractual Clauses, such provision shall be interpreted and applied in a manner consistent with the SCCs and the laws governing the SCCs.

9.4. In the event that the Standard Contractual Clauses are amended, replaced, or supplemented by a new decision of the European Commission, or if additional transfer mechanisms are required by applicable data protection authorities, the parties shall cooperate in good faith to update this Schedule C and SCC Annex III as necessary to ensure continued compliance.

10. INCORPORATION AND CROSS-REFERENCES

10.1. This Schedule C is incorporated by reference into the Data Processing Agreement dated February 15, 2026, entered into by and between Meridian Federal Savings Bank (Controller) and Skybridge Fintech Ltd. (Processor), and forms an integral part thereof.

10.2. No separate signature is required for this Schedule C. This Schedule C shall become effective upon, and is deemed executed concurrently with, the execution of the DPA by the authorized representatives of both parties.

10.3. This Schedule C should be read in conjunction with the following documents, which collectively form the complete data protection framework between Controller and Processor:

(a) Schedule A — Description of Processing (setting forth the subject matter, duration, nature, and purpose of processing, the types of Personal Data processed, and the categories of data subjects);

(b) Schedule B — Security Measures (setting forth the technical and organizational security measures implemented by Processor to protect Personal Data);

(c) Schedule D — Data Breach Notification Procedures (setting forth the procedures and timelines for notification of Personal Data Breaches); and

(d) SCC Annexes — Annex I (Description of the Transfer), Annex II (Technical and Organisational Measures), and Annex III (List of Sub-processors), each appended to the Standard Contractual Clauses forming part of the DPA.

[No separate execution required. This Schedule C is effective upon execution of the DPA dated February 15, 2026.]

ACKNOWLEDGED AND AGREED

as part of the Data Processing Agreement dated February 15, 2026

MERIDIAN FEDERAL SAVINGS BANK ("Controller")

By: ________

Name: Andrea Sokolov

Title: Chief Compliance Officer

Date: ________

SKYBRIDGE FINTECH LTD. ("Processor")

By: ________

Name: David Hargrove

Title: General Counsel

Date: ________

CONFIDENTIAL — This Schedule C to the Data Processing Agreement between Meridian Federal Savings Bank and Skybridge Fintech Ltd. contains confidential and proprietary information. Distribution is limited to authorized personnel of each party and their respective legal and compliance advisors. Any unauthorized disclosure, reproduction, or distribution of this document is strictly prohibited.

Field	Detail
Full Legal Name	Osprey Cloud Infrastructure, Inc.
Short Name / Abbreviation	Osprey Cloud / OCI
Entity Type	Corporation organized and existing under the laws of the State of Delaware
Registered Address	2200 Campus Drive, San Jose, California 95131, United States
Chief Executive Officer	Martin Cho
Description of Processing Activities	Primary Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) provider hosting the SBF Core platform. Osprey Cloud provides cloud computing, data storage, database management, network infrastructure, and platform services for the operation of the SBF Core platform, including but not limited to payment processing, anti-fraud analytics, transaction monitoring, regulatory reporting data aggregation, and associated application services. Osprey Cloud does not access or use Personal Data for its own purposes; all processing is performed solely in accordance with Processor's documented instructions and the terms of the Skybridge–Osprey Cloud DPA.
Processing Locations	Primary: US-East data center region (Ashburn, Virginia, United States). Secondary / DR: US-East secondary availability zone (Ashburn, Virginia, United States). EU Region: Frankfurt, Germany (EU data center region), used for processing and storage of Personal Data of EU-resident data subjects.
Categories of Personal Data Processed	All categories of Personal Data described in Schedule A to the DPA and SCC Annex I, including but not limited to: names, Social Security numbers (SSNs), dates of birth, postal addresses, email addresses, telephone numbers, bank account numbers, debit and credit card numbers, transaction data (amounts, dates, merchant identifiers, payment types), IP addresses, device identifiers, mobile device information, geolocation data, behavioral biometric data (keystroke dynamics, navigation patterns), and authentication credentials.
Categories of Data Subjects	Meridian Federal Savings Bank accountholders, authorized signatories, beneficial owners, and other individuals whose Personal Data is processed through the SBF Core platform.
Applicable SCC Module	Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (as data exporter / Processor) → Osprey Cloud Infrastructure, Inc. (as data importer / Sub-processor)
Existing Data Processing Agreement	Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024, as amended, including Module 3 Standard Contractual Clauses (Processor-to-Sub-processor), executed concurrently therewith. A copy of the executed Skybridge–Osprey Cloud DPA (redacted to remove commercially sensitive pricing terms) has been made available to Controller upon request.
Security Certifications	SOC 2 Type II (most recent report dated September 15, 2025, covering the period January 1, 2025 – June 30, 2025); ISO/IEC 27001:2022 certification (Certificate No. OCI-27001-2024-0089); AES-256 encryption at rest for all stored data; TLS 1.2 or higher encryption for all data in transit; hardware security modules (HSMs) for cryptographic key management.
Disaster Recovery	Osprey Cloud US-East secondary availability zone (Ashburn, Virginia), with real-time data replication and automated failover capabilities. Recovery Point Objective (RPO): ≤ 15 minutes. Recovery Time Objective (RTO): ≤ 4 hours. Annual disaster recovery testing conducted and results shared with Processor.
Date of Initial Approval	February 15, 2026 (concurrent with execution of the DPA)
Field	Detail
Full Legal Name	Skybridge Fintech Europe B.V.
Short Name / Abbreviation	SBF Europe
Entity Type	Dutch private limited liability company (besloten vennootschap met beperkte aansprakelijkheid) organized and existing under the laws of the Netherlands
Registered Address	Keizersgracht 482, 1017 EG Amsterdam, Netherlands
KvK (Chamber of Commerce) Number	82104593
Managing Director	Lena Vogt
Relationship to Processor	Wholly-owned subsidiary and affiliate of Skybridge Fintech Ltd. SBF Europe is 100% owned by Skybridge Fintech Ltd. and operates under the direction and control of Processor for the purposes described in this Schedule.
Description of Processing Activities	Processes Personal Data of EU-resident data subjects on behalf of Processor in connection with the SBF Core platform. SBF Europe provides: (i) engineering support services, including bug fixes, platform maintenance, feature development, and quality assurance testing involving Personal Data; (ii) customer support services, including Tier 2 and Tier 3 technical support for EU-resident accountholders of Controller; and (iii) compliance services, including regulatory reporting support, data subject access request (DSAR) fulfillment assistance, and data protection impact assessment (DPIA) support relating to EU data protection requirements.
Processing Location	Amsterdam, Netherlands. All processing by SBF Europe occurs within the European Economic Area and does not involve the transfer of Personal Data outside the EEA, except as otherwise authorized by Controller and in accordance with the SCCs.

Categories of Personal Data Processed	Personal Data of EU-resident data subjects (approximately 3,200 Meridian Federal Savings Bank accountholders with EU residency as of the Effective Date), including but not limited to: names, bank account numbers, transaction data (amounts, dates, merchant identifiers, payment types), IP addresses, device identifiers, and mobile device information, as further described in Schedule A to the DPA and SCC Annex I. SBF Europe does not process Social Security numbers or behavioral biometric data.
Categories of Data Subjects	Meridian Federal Savings Bank accountholders who are resident in the European Economic Area, as identified through Controller's customer residency records.
Applicable SCC Module	Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (as data exporter / Processor) → Skybridge Fintech Europe B.V. (as data importer / Sub-processor)
Employees	14 full-time employees (8 engineers, 4 customer support specialists, 2 compliance professionals). All employees have undergone background checks and are bound by confidentiality obligations consistent with the requirements of the DPA.
Dutch Regulatory Status	Registered with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). Registration reference available upon request.
Security Certifications	SBF Europe operates under Skybridge Fintech Ltd.'s enterprise-wide SOC 2 Type II certification (most recent report dated November 1, 2025); ISO/IEC 27001:2022 certification (Certificate No. SBF-EU-27001-2025-0012); AES-256 encryption at rest; TLS 1.3 encryption in transit; role-based access controls (RBAC) with multi-factor authentication (MFA) for all administrative and production environment access.
Existing Data Processing Agreement	Skybridge–SBF Europe Intra-Group Data Processing Agreement dated January 15, 2024, as amended, including Module 3 Standard Contractual Clauses (Processor-to-Sub-processor).
Date of Initial Approval	February 15, 2026 (concurrent with execution of the DPA)

SCHEDULE C
APPROVED SUB-PROCESSORS
to the
Data Processing Agreement
dated February 15, 2026
by and between
MERIDIAN FEDERAL SAVINGS BANK
("Controller")
and
SKYBRIDGE FINTECH LTD.
("Processor")
Effective Date: February 15, 2026
1. PURPOSE AND SCOPE
1.1. This Schedule C (the "Schedule") is attached to and forms an integral part of the Data Processing Agreement dated February 15, 2026 (the "DPA"), entered into by and between Meridian Federal Savings Bank, a federally chartered savings bank organized under the laws of the United States and operating pursuant to Office of the Comptroller of the Currency Charter No. 14-2238, with its principal offices located at 900 Broad Street, Suite 1200, Newark, New Jersey 07102 ("Controller"), and Skybridge Fintech Ltd., a corporation organized and existing under the laws of the State of Delaware, with its principal offices located at 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810 ("Processor").
1.2. The purpose of this Schedule is to: (a) identify the sub-processors that Controller has approved for use by Processor in connection with the processing of Personal Data under the DPA as of the Effective Date; (b) establish the mechanism for the authorization, notice, and objection with respect to sub-processors that Processor may seek to engage after the Effective Date; and (c) set forth the flow-down obligations, ongoing monitoring requirements, and related provisions governing Processor's use of sub-processors in the performance of services under the DPA and the SaaS Subscription Agreement dated February 15, 2026 (the "SaaS Agreement").
1.3. Capitalized terms used but not otherwise defined in this Schedule shall have the meanings ascribed to them in the DPA. In the event of any conflict between a defined term as used in this Schedule and a defined term as used in the DPA, the definition set forth in the DPA shall control unless expressly stated otherwise in this Schedule.
1.4. This Schedule shall be read and interpreted in conjunction with, and is supplementary to, the following documents, each of which forms part of the overall data protection framework governing the relationship between Controller and Processor:
(a) the DPA, including all Schedules thereto;
(b) the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2: Controller-to-Processor and Module 3: Processor-to-Sub-processor), as appended to the DPA (the "SCCs");
(c) SCC Annex I (Description of the Transfer);
(d) SCC Annex II (Technical and Organisational Measures);
(e) SCC Annex III (List of Sub-processors);
(f) Schedule A to the DPA (Description of Processing);
(g) Schedule B to the DPA (Security Measures);
(h) Schedule D to the DPA (Data Breach Notification Procedures); and
(i) the SaaS Agreement.
1.5. To the extent that SCC Annex III (List of Sub-processors) is required to be completed as part of the SCCs, this Schedule C is intended to serve as the substantive basis for, and to be consistent with, SCC Annex III, subject to the conflict resolution provisions set forth in Section 9 below.
2. GENERAL WRITTEN AUTHORIZATION
2.1. Authorization. Controller hereby provides general written authorization for Processor to engage sub-processors to process Personal Data on Controller's behalf in connection with the services provided under the DPA and the SaaS Agreement, subject to the conditions set forth in this Schedule C and the DPA.
2.2. Legal Basis. This general written authorization is provided in accordance with, and is intended to satisfy the requirements of:
(a) Article 28(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR"), which requires that a processor shall not engage another processor without prior specific or general written authorization of the controller;
(b) Clause 9 of the Standard Contractual Clauses (Module 2, Controller-to-Processor), as incorporated into the DPA; and
(c) Section 6.1 of the DPA, which sets forth the general framework for sub-processor engagement.
2.3. Scope of Authorization. The general written authorization granted by Controller in this Section 2 applies to:
(a) the sub-processors identified in the Approved Sub-Processor List set forth in Section 4 below, as of the Effective Date of the DPA; and
(b) any new sub-processors that are added to the Approved Sub-Processor List after the Effective Date, provided that such additions are made in strict compliance with the notice and objection procedures set forth in Section 3 below.
2.4. Contractual Flow-Down. Processor shall impose on each sub-processor, by way of a written agreement executed prior to the commencement of any processing of Controller's Personal Data by such sub-processor, data protection obligations that are no less protective than those set forth in the DPA, including, without limitation, obligations relating to:
(a) the implementation and maintenance of appropriate technical and organizational security measures;
(b) the confidentiality of Personal Data and restrictions on access by personnel;
(c) prompt notification of Personal Data Breaches;
(d) cooperation with and facilitation of audit rights;
(e) data return or secure deletion upon termination or expiration of the sub-processing arrangement; and
(f) compliance with applicable data protection laws, including the GDPR, the California Consumer Privacy Act (as amended by the CPRA), the Gramm-Leach-Bliley Act, and any other applicable federal, state, or international privacy or data protection laws.
2.5. Processor Liability. Notwithstanding the engagement of any sub-processor, Processor shall remain fully liable to Controller for the performance of each sub-processor's obligations under the DPA and this Schedule. Where a sub-processor fails to fulfil its data protection obligations under the sub-processing agreement or applicable law, Processor shall remain fully liable to Controller for the performance of that sub-processor's obligations, as if Processor itself had performed (or failed to perform) such obligations directly. This provision shall not be construed to limit or modify any other rights or remedies available to Controller under the DPA, the SaaS Agreement, or applicable law.
3. NOTICE AND OBJECTION PROCEDURE FOR NEW SUB-PROCESSORS
3.1 Prior Written Notice
3.1.1. Processor shall provide Controller with no less than thirty (30) calendar days' prior written notice before engaging any new sub-processor, or before replacing any existing sub-processor, to process Personal Data on Controller's behalf under the DPA (a "Sub-Processor Change Notice").
3.1.2. Such Sub-Processor Change Notice shall be provided in writing and delivered by email to each of the following designated contacts of Controller:
(a) Chief Compliance Officer: Andrea Sokolov, asokolov@meridianfederal.com; and
(b) Vice President, Third-Party Risk Management: Marcus Tibaldi, mtibaldi@meridianfederal.com.
3.1.3. Each Sub-Processor Change Notice shall include, at a minimum, the following information:
(a) the full legal name and registered address of the proposed new sub-processor;
(b) a detailed description of the processing activities to be performed by the proposed sub-processor, including the nature and purpose of the processing;
(c) the location(s) of processing, including the specific data center regions and countries in which Personal Data will be processed or stored;
(d) the categories of Personal Data to be processed by the proposed sub-processor, and the categories of data subjects whose Personal Data will be processed;
(e) confirmation that Processor has conducted due diligence on the proposed sub-processor's security measures, data protection practices, and compliance posture, including a summary of the key findings of such due diligence;
(f) a copy of, or reference to, the data processing agreement or equivalent contractual provisions between Processor and the proposed sub-processor, which must meet the flow-down requirements set forth in Section 5 of this Schedule; and
(g) where the proposed sub-processor is located outside the European Economic Area, the United Kingdom, or Switzerland, identification of the lawful transfer mechanism (e.g., Standard Contractual Clauses, adequacy decision) that will be used to ensure the lawfulness of any international transfer of Personal Data to the proposed sub-processor.
3.1.4. In addition to the notice required under this Section 3.1, Processor shall maintain and make available to Controller a list of pending sub-processor changes, which may be accessed by Controller at any time through the Processor's secure client portal or upon written request.
3.2 Controller's Right to Object
3.2.1. Controller shall have thirty (30) calendar days from the date of receipt of a Sub-Processor Change Notice (the "Objection Period") to object to the engagement of the proposed new sub-processor or the replacement of an existing sub-processor.
3.2.2. Any objection must be made in writing and delivered to Processor's designated contact for sub-processor matters (currently: General Counsel, Skybridge Fintech Ltd., legal@skybridgefintech.com). The objection must state reasonable grounds for the objection, which grounds must be based on legitimate data protection concerns, including, without limitation, concerns relating to:
(a) the adequacy of the proposed sub-processor's technical and organizational security measures;
(b) the proposed sub-processor's compliance history, including any prior data breaches, regulatory enforcement actions, or material audit findings;
(c) the jurisdiction(s) in which the proposed sub-processor operates, and the adequacy of data protection laws in such jurisdiction(s);
(d) the potential risk to data subjects, including risks arising from the nature or sensitivity of the Personal Data to be processed;
(e) the proposed sub-processor's financial stability and ability to meet its obligations under the sub-processing agreement; or
(f) any conflict with Controller's regulatory obligations under federal banking regulations, including but not limited to OCC Bulletin 2023-17, FDIC guidance on third-party risk management, or guidance issued by the Board of Governors of the Federal Reserve System.
3.2.3. If Controller objects to the engagement of a proposed new sub-processor in accordance with this Section 3.2, Processor shall not engage the proposed sub-processor for the processing of Controller's Personal Data. In such event, Processor shall work in good faith with Controller to identify a commercially reasonable alternative sub-processor or alternative arrangement that addresses Controller's data protection concerns while enabling Processor to continue to provide the services under the SaaS Agreement.
3.2.4. If, following good-faith efforts by both parties, no commercially reasonable alternative is available, and Processor is unable to provide the services (or a material portion of the services) under the SaaS Agreement without the proposed sub-processor, either party may terminate the affected portion of the services (and, if applicable, the SaaS Agreement in its entirety) in accordance with the termination provisions set forth in Section 12 of the DPA and Section 9 of the SaaS Agreement, without penalty or liability to either party, except that Processor shall refund to Controller any prepaid fees for services not yet rendered as of the effective date of termination, on a pro-rata basis.
3.3 Deemed Approval
3.3.1. If Controller does not deliver a written objection to Processor within the thirty (30) calendar day Objection Period following receipt of a Sub-Processor Change Notice, Controller shall be deemed to have approved the proposed new sub-processor (or replacement sub-processor, as applicable), and Processor may thereafter engage the sub-processor for the processing of Controller's Personal Data in accordance with the terms of this Schedule and the DPA.
3.3.2. Deemed approval under this Section 3.3 shall have the same legal effect as express written approval by Controller, and the approved sub-processor shall be added to the Approved Sub-Processor List maintained under Section 4 of this Schedule.
3.4 Regulatory Access
3.4.1. Nothing in this Schedule C shall restrict, limit, or otherwise impair the rights of Controller's regulatory supervisors—including, without limitation, the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), the Consumer Financial Protection Bureau (CFPB), and any other applicable federal or state banking regulator—to access, examine, or audit any sub-processor engaged by Processor to process Controller's Personal Data, in accordance with:
(a) OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance);
(b) the FDIC's guidance on third-party risk management, including FIL-44-2008 and subsequent guidance;
(c) the CFPB's supervisory authority under the Consumer Financial Protection Act of 2010;
(d) 12 C.F.R. Part 30, Appendix B (Interagency Guidelines Establishing Information Security Standards); and
(e) any other applicable federal banking regulation or supervisory guidance.
3.4.2. Processor shall use commercially reasonable efforts to ensure that all sub-processing agreements entered into pursuant to this Schedule include provisions expressly permitting examination, access, and audit by Controller's regulatory supervisors as contemplated by this Section 3.4. In the event that a sub-processor refuses to include such provisions, Processor shall promptly notify Controller and shall not engage such sub-processor without Controller's prior express written approval.
4. APPROVED SUB-PROCESSOR LIST
The following sub-processors have been approved by Controller as of the Effective Date for the processing of Personal Data on Controller's behalf in connection with the services provided under the DPA and the SaaS Agreement. This list constitutes the initial Approved Sub-Processor List and shall be updated from time to time in accordance with Sections 3 and 8 of this Schedule.
Sub-Processor No. 1: Osprey Cloud Infrastructure, Inc.
Sub-Processor No. 2: Skybridge Fintech Europe B.V.
5. FLOW-DOWN OBLIGATIONS
5.1. Processor shall ensure that each sub-processor listed in the Approved Sub-Processor List set forth in Section 4 above, and each sub-processor added to the Approved Sub-Processor List in accordance with the notice and objection procedures set forth in Section 3, is bound by a written data processing agreement (a "Sub-Processing Agreement") executed prior to the commencement of any processing of Controller's Personal Data by such sub-processor.
5.2. Each Sub-Processing Agreement shall contain data protection obligations that are no less protective than the obligations imposed on Processor under the DPA, and shall include, at a minimum, obligations relating to each of the following:
(a) Documented Instructions. The sub-processor shall process Personal Data only on the basis of documented instructions from Processor (and, through Processor, from Controller), and shall not process Personal Data for any purpose other than the specific purposes set forth in the Sub-Processing Agreement and Schedule A to the DPA, unless required to do so by applicable law, in which case the sub-processor shall inform Processor of that legal requirement before processing, unless the law prohibits such notice on important grounds of public interest.
(b) Confidentiality. The sub-processor shall ensure that all persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The sub-processor shall limit access to Personal Data to those personnel who have a legitimate need to access such data in connection with the performance of the sub-processor's obligations under the Sub-Processing Agreement.
(c) Security Measures. The sub-processor shall implement and maintain appropriate technical and organizational security measures consistent with those described in Schedule B to the DPA, including, without limitation:
(i) AES-256 encryption (or equivalent) for all Personal Data at rest;
(ii) TLS 1.2 or higher encryption for all Personal Data in transit;
(iii) multi-factor authentication (MFA) for all administrative and privileged access to systems processing Personal Data;
(iv) intrusion detection and prevention systems;
(v) vulnerability scanning and penetration testing on at least an annual basis;
(vi) access logging and monitoring; and
(vii) physical security controls for data center facilities.
(d) Breach Notification. The sub-processor shall notify Processor of any Personal Data Breach without undue delay and, in any event, within a timeframe that enables Processor to comply with the forty-eight (48) hour breach notification obligation to Controller set forth in Schedule D to the DPA (Data Breach Notification Procedures). Such notification shall include, to the extent available, a description of the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences of the breach, and the measures taken or proposed to be taken to address and mitigate the breach.
(e) Data Protection Impact Assessments. The sub-processor shall cooperate with and provide reasonable assistance to Processor (and, through Processor, to Controller) in connection with the conduct of data protection impact assessments (DPIAs) at Controller's reasonable request, to the extent that the processing activities of the sub-processor are relevant to such assessment.
(f) Data Return and Deletion. Upon termination or expiration of the Sub-Processing Agreement, or upon Processor's written instruction, the sub-processor shall, at Controller's election (communicated through Processor), return all Personal Data to Processor or securely delete all Personal Data in its possession, and shall certify such return or deletion in writing, subject to any applicable legal retention requirements that may require the sub-processor to retain certain data for a specified period.
(g) Audit Rights. The sub-processor shall make available to Processor (and, through Processor, to Controller or Controller's duly appointed auditors or representatives, and to Controller's regulatory supervisors, including the OCC, FDIC, and CFPB) all information necessary to demonstrate compliance with the obligations set forth in the Sub-Processing Agreement and applicable data protection laws, and shall allow for and contribute to audits, including inspections, conducted by Processor, Controller, Controller's auditors, or Controller's regulatory supervisors, subject to reasonable advance notice and confidentiality obligations.
(h) Data Subject Rights. The sub-processor shall provide reasonable assistance to Processor in responding to data subject requests for the exercise of their rights under applicable data protection laws, including rights of access, rectification, erasure, restriction of processing, data portability, and objection.
5.3. International Transfers. In the case of any sub-processor located outside the European Economic Area, the United Kingdom, or Switzerland, or in any jurisdiction that has not received an adequacy decision from the European Commission, the Sub-Processing Agreement shall include Standard Contractual Clauses (Module 3, Processor-to-Sub-processor) or an equivalent transfer mechanism approved by the relevant data protection authority, to ensure that Personal Data transferred to such sub-processor is afforded a level of protection that is essentially equivalent to that guaranteed within the EEA.
5.4. Processor shall provide Controller with copies of relevant extracts of Sub-Processing Agreements (redacted to remove commercially sensitive pricing or proprietary technical information, as necessary) upon Controller's reasonable written request, to enable Controller to verify compliance with the flow-down requirements set forth in this Section 5.
6. PROCESSOR'S ONGOING OBLIGATIONS REGARDING SUB-PROCESSORS
6.1. Maintenance of Sub-Processor List. Processor shall maintain an up-to-date and accurate list of all sub-processors engaged to process Controller's Personal Data (the "Current Sub-Processor List"), and shall make such list available to Controller upon written request within five (5) business days. Processor shall also publish the Current Sub-Processor List on its secure client portal, accessible to Controller's authorized personnel, and shall update such portal promptly upon any addition, removal, or replacement of a sub-processor.
6.2. Pre-Engagement Due Diligence. Prior to engaging any new sub-processor, Processor shall conduct appropriate due diligence on the proposed sub-processor, which shall include, at a minimum, review and assessment of:
(a) the sub-processor's current security certifications and compliance posture (e.g., SOC 2 Type II, ISO/IEC 27001, PCI DSS);
(b) the sub-processor's data protection policies, privacy notices, and record of compliance with applicable data protection laws;
(c) the sub-processor's incident response capabilities, including the existence and adequacy of a documented incident response plan;
(d) the sub-processor's business continuity and disaster recovery capabilities;
(e) the sub-processor's financial stability and operational resilience;
(f) any prior data breaches, regulatory enforcement actions, or material audit findings involving the sub-processor; and
(g) the sub-processor's ability to comply with the flow-down obligations described in Section 5 of this Schedule.
6.3. Ongoing Monitoring and Annual Reassessment. Processor shall periodically, and at least annually, reassess each sub-processor to confirm the sub-processor's continued compliance with the requirements of the DPA, this Schedule, and applicable data protection laws. Such annual reassessment shall include, at a minimum:
(a) review of the sub-processor's most recent SOC 2 Type II report or equivalent independent audit report;
(b) review of any material changes to the sub-processor's security certifications, data protection policies, or processing locations;
(c) review of any data breaches, security incidents, or regulatory actions involving the sub-processor during the preceding twelve (12) months;
(d) confirmation that the Sub-Processing Agreement remains in full force and effect and continues to meet the flow-down requirements of Section 5; and
(e) an assessment of any material changes to the sub-processor's ownership, corporate structure, or financial condition that could affect its ability to fulfill its obligations.
6.4. Remedial Action. In the event that a sub-processor fails to fulfill its data protection obligations under the Sub-Processing Agreement, applicable data protection laws, or the requirements of this Schedule, Processor shall:
(a) promptly notify Controller in writing of the failure, including a description of the nature and scope of the failure and any impact on Controller's Personal Data;
(b) take appropriate and timely remedial action to address the failure, which may include requiring the sub-processor to implement corrective measures within a specified timeframe;
(c) if the failure cannot be remedied within a reasonable timeframe, or if the failure poses a material risk to the security or privacy of Controller's Personal Data, suspend or terminate the sub-processing arrangement and, if applicable, migrate Controller's Personal Data to an alternative sub-processor or back to Processor; and
(d) cooperate with Controller in connection with any investigation, notification, or remediation activities arising from the sub-processor's failure.
6.5. Reporting. Upon Controller's reasonable written request, and no more frequently than once per calendar year (except in the event of a security incident or material compliance concern), Processor shall provide Controller with a summary report of its sub-processor oversight activities, including the results of annual reassessments, any material findings, and any remedial actions taken.
7. INSURANCE
7.1. Processor shall ensure that its engagement of sub-processors does not diminish, limit, or otherwise adversely affect the cyber-liability insurance coverage required under Section 14.3 of the DPA. As of the Effective Date, Processor maintains cyber-liability insurance through Bastion Mutual Insurance Company (Policy No. CYB-2025-04821), with the following coverage limits:
(a) Per-Occurrence Coverage: Not less than Ten Million Dollars ($10,000,000) per occurrence; and
(b) Aggregate Coverage: Not less than Twenty Million Dollars ($20,000,000) in the aggregate per policy year.
7.2. Processor shall promptly notify Controller in writing of any material change to its cyber-liability insurance coverage, including any reduction in coverage limits, cancellation of the policy, or change of insurer.
7.3. Processor shall, upon Controller's written request, provide Controller with a certificate of insurance evidencing the coverage described in this Section 7, including confirmation that the policy covers losses arising from the acts or omissions of sub-processors engaged by Processor.
8. UPDATES TO THIS SCHEDULE
8.1. This Schedule C shall be updated by Processor from time to time as sub-processors are added to, removed from, or replaced on the Approved Sub-Processor List, in accordance with the notice and objection procedures set forth in Section 3 of this Schedule.
8.2. Updated versions of this Schedule shall be provided to Controller in writing (including by email to the designated contacts identified in Section 3.1.2) and shall be deemed effective upon the expiration of the applicable Objection Period without objection by Controller (or upon Controller's express written approval, if such approval is given prior to the expiration of the Objection Period).
8.3. For the avoidance of doubt, updates to the Approved Sub-Processor List in this Schedule C that are made in compliance with the notice and objection procedures set forth in Section 3 do not require a formal amendment to, or restatement of, the DPA, provided that such procedures have been followed in all material respects. All other amendments to this Schedule C shall require the written agreement of both parties in accordance with the amendment provisions of the DPA.
8.4. Processor shall maintain an archive of all prior versions of this Schedule C, including the date of each update and the sub-processor(s) added, removed, or replaced, and shall make such archive available to Controller upon reasonable written request.
9. INTERACTION WITH SCC ANNEX III
9.1. This Schedule C is intended to be consistent with, and supplementary to, SCC Annex III (List of Sub-processors) appended to the Standard Contractual Clauses package forming part of the DPA. The information set forth in Section 4 of this Schedule has been used as the basis for completing SCC Annex III, and the parties acknowledge that SCC Annex III is derived from and should be read together with this Schedule C.
9.2. In the event of any conflict or inconsistency between the terms and provisions of this Schedule C and the terms and provisions of SCC Annex III, the provisions that afford greater protection to data subjects shall prevail. In determining which provisions afford greater protection, the parties shall have regard to the purpose and objectives of the GDPR and the SCCs, as well as the guidance of the European Data Protection Board.
9.3. Governing Law. The parties acknowledge that the Standard Contractual Clauses, including SCC Annex III, are governed by the law of the Netherlands, as selected by the parties pursuant to Clause 17 of the Standard Contractual Clauses. This Schedule C, as a schedule to the DPA, is governed by the law of the State of Delaware, as set forth in Section 18.1 of the DPA. Notwithstanding the foregoing, to the extent that any provision of this Schedule C relates to or implements the requirements of the Standard Contractual Clauses, such provision shall be interpreted and applied in a manner consistent with the SCCs and the laws governing the SCCs.
9.4. In the event that the Standard Contractual Clauses are amended, replaced, or supplemented by a new decision of the European Commission, or if additional transfer mechanisms are required by applicable data protection authorities, the parties shall cooperate in good faith to update this Schedule C and SCC Annex III as necessary to ensure continued compliance.
10. INCORPORATION AND CROSS-REFERENCES
10.1. This Schedule C is incorporated by reference into the Data Processing Agreement dated February 15, 2026, entered into by and between Meridian Federal Savings Bank (Controller) and Skybridge Fintech Ltd. (Processor), and forms an integral part thereof.
10.2. No separate signature is required for this Schedule C. This Schedule C shall become effective upon, and is deemed executed concurrently with, the execution of the DPA by the authorized representatives of both parties.
10.3. This Schedule C should be read in conjunction with the following documents, which collectively form the complete data protection framework between Controller and Processor:
(a) Schedule A — Description of Processing (setting forth the subject matter, duration, nature, and purpose of processing, the types of Personal Data processed, and the categories of data subjects);
(b) Schedule B — Security Measures (setting forth the technical and organizational security measures implemented by Processor to protect Personal Data);
(c) Schedule D — Data Breach Notification Procedures (setting forth the procedures and timelines for notification of Personal Data Breaches); and
(d) SCC Annexes — Annex I (Description of the Transfer), Annex II (Technical and Organisational Measures), and Annex III (List of Sub-processors), each appended to the Standard Contractual Clauses forming part of the DPA.
[No separate execution required. This Schedule C is effective upon execution of the DPA dated February 15, 2026.]
ACKNOWLEDGED AND AGREED
as part of the Data Processing Agreement dated February 15, 2026
MERIDIAN FEDERAL SAVINGS BANK ("Controller")
By: ________
Name: Andrea Sokolov
Title: Chief Compliance Officer
Date: ________
SKYBRIDGE FINTECH LTD. ("Processor")
By: ________
Name: David Hargrove
Title: General Counsel
Date: ________
CONFIDENTIAL — This Schedule C to the Data Processing Agreement between Meridian Federal Savings Bank and Skybridge Fintech Ltd. contains confidential and proprietary information. Distribution is limited to authorized personnel of each party and their respective legal and compliance advisors. Any unauthorized disclosure, reproduction, or distribution of this document is strictly prohibited.
Field | Detail
Full Legal Name | Osprey Cloud Infrastructure, Inc.
Short Name / Abbreviation | Osprey Cloud / OCI
Entity Type | Corporation organized and existing under the laws of the State of Delaware
Registered Address | 2200 Campus Drive, San Jose, California 95131, United States
Chief Executive Officer | Martin Cho
Description of Processing Activities | Primary Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) provider hosting the SBF Core platform. Osprey Cloud provides cloud computing, data storage, database management, network infrastructure, and platform services for the operation of the SBF Core platform, including but not limited to payment processing, anti-fraud analytics, transaction monitoring, regulatory reporting data aggregation, and associated application services. Osprey Cloud does not access or use Personal Data for its own purposes; all processing is performed solely in accordance with Processor's documented instructions and the terms of the Skybridge–Osprey Cloud DPA.
Processing Locations | Primary: US-East data center region (Ashburn, Virginia, United States). Secondary / DR: US-East secondary availability zone (Ashburn, Virginia, United States). EU Region: Frankfurt, Germany (EU data center region), used for processing and storage of Personal Data of EU-resident data subjects.
Categories of Personal Data Processed | All categories of Personal Data described in Schedule A to the DPA and SCC Annex I, including but not limited to: names, Social Security numbers (SSNs), dates of birth, postal addresses, email addresses, telephone numbers, bank account numbers, debit and credit card numbers, transaction data (amounts, dates, merchant identifiers, payment types), IP addresses, device identifiers, mobile device information, geolocation data, behavioral biometric data (keystroke dynamics, navigation patterns), and authentication credentials.
Categories of Data Subjects | Meridian Federal Savings Bank accountholders, authorized signatories, beneficial owners, and other individuals whose Personal Data is processed through the SBF Core platform.
Applicable SCC Module | Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (as data exporter / Processor) → Osprey Cloud Infrastructure, Inc. (as data importer / Sub-processor)
Existing Data Processing Agreement | Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024, as amended, including Module 3 Standard Contractual Clauses (Processor-to-Sub-processor), executed concurrently therewith. A copy of the executed Skybridge–Osprey Cloud DPA (redacted to remove commercially sensitive pricing terms) has been made available to Controller upon request.
Security Certifications | SOC 2 Type II (most recent report dated September 15, 2025, covering the period January 1, 2025 – June 30, 2025); ISO/IEC 27001:2022 certification (Certificate No. OCI-27001-2024-0089); AES-256 encryption at rest for all stored data; TLS 1.2 or higher encryption for all data in transit; hardware security modules (HSMs) for cryptographic key management.
Disaster Recovery | Osprey Cloud US-East secondary availability zone (Ashburn, Virginia), with real-time data replication and automated failover capabilities. Recovery Point Objective (RPO): ≤ 15 minutes. Recovery Time Objective (RTO): ≤ 4 hours. Annual disaster recovery testing conducted and results shared with Processor.
Date of Initial Approval | February 15, 2026 (concurrent with execution of the DPA)
Field | Detail
Full Legal Name | Skybridge Fintech Europe B.V.
Short Name / Abbreviation | SBF Europe
Entity Type | Dutch private limited liability company (besloten vennootschap met beperkte aansprakelijkheid) organized and existing under the laws of the Netherlands
Registered Address | Keizersgracht 482, 1017 EG Amsterdam, Netherlands
KvK (Chamber of Commerce) Number | 82104593
Managing Director | Lena Vogt
Relationship to Processor | Wholly-owned subsidiary and affiliate of Skybridge Fintech Ltd. SBF Europe is 100% owned by Skybridge Fintech Ltd. and operates under the direction and control of Processor for the purposes described in this Schedule.
Description of Processing Activities | Processes Personal Data of EU-resident data subjects on behalf of Processor in connection with the SBF Core platform. SBF Europe provides: (i) engineering support services, including bug fixes, platform maintenance, feature development, and quality assurance testing involving Personal Data; (ii) customer support services, including Tier 2 and Tier 3 technical support for EU-resident accountholders of Controller; and (iii) compliance services, including regulatory reporting support, data subject access request (DSAR) fulfillment assistance, and data protection impact assessment (DPIA) support relating to EU data protection requirements.
Processing Location | Amsterdam, Netherlands. All processing by SBF Europe occurs within the European Economic Area and does not involve the transfer of Personal Data outside the EEA, except as otherwise authorized by Controller and in accordance with the SCCs.
Categories of Personal Data Processed | Personal Data of EU-resident data subjects (approximately 3,200 Meridian Federal Savings Bank accountholders with EU residency as of the Effective Date), including but not limited to: names, bank account numbers, transaction data (amounts, dates, merchant identifiers, payment types), IP addresses, device identifiers, and mobile device information, as further described in Schedule A to the DPA and SCC Annex I. SBF Europe does not process Social Security numbers or behavioral biometric data.
Categories of Data Subjects | Meridian Federal Savings Bank accountholders who are resident in the European Economic Area, as identified through Controller's customer residency records.
Applicable SCC Module | Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (as data exporter / Processor) → Skybridge Fintech Europe B.V. (as data importer / Sub-processor)
Employees | 14 full-time employees (8 engineers, 4 customer support specialists, 2 compliance professionals). All employees have undergone background checks and are bound by confidentiality obligations consistent with the requirements of the DPA.
Dutch Regulatory Status | Registered with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). Registration reference available upon request.
Security Certifications | SBF Europe operates under Skybridge Fintech Ltd.'s enterprise-wide SOC 2 Type II certification (most recent report dated November 1, 2025); ISO/IEC 27001:2022 certification (Certificate No. SBF-EU-27001-2025-0012); AES-256 encryption at rest; TLS 1.3 encryption in transit; role-based access controls (RBAC) with multi-factor authentication (MFA) for all administrative and production environment access.
Existing Data Processing Agreement | Skybridge–SBF Europe Intra-Group Data Processing Agreement dated January 15, 2024, as amended, including Module 3 Standard Contractual Clauses (Processor-to-Sub-processor).
Date of Initial Approval | February 15, 2026 (concurrent with execution of the DPA)

SCHEDULE C

APPROVED SUB-PROCESSORS

MERIDIAN FEDERAL SAVINGS BANK

SKYBRIDGE FINTECH LTD.

ACKNOWLEDGED AND AGREED

Record

Parties

Dates

Amounts