1009-00004 · Skybridge Fintech Ltd · Transaction Documents/Schedules

schedule-d-breach-notification-procedures.docx DOCUMENT Finance & Banking

35 / 35 ← ✕

SCHEDULE D

DATA BREACH NOTIFICATION PROCEDURES

Schedule D to the Data Processing Agreement dated February 15, 2026 (the "Agreement"), between Meridian Federal Savings Bank, a federally chartered savings bank organized under the laws of the United States, with its principal office located at 900 Broad Street, Suite 1200, Newark, New Jersey 07102 ("Controller"), and Skybridge Fintech Ltd., a Delaware limited liability company with its principal office located at 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810 ("Processor").

PREAMBLE

This Schedule D sets forth the procedures governing the detection, reporting, and management of Personal Data Breaches by Processor in connection with the processing of Controller Personal Data under the Agreement. These procedures are designed to ensure that both parties can meet their respective obligations under applicable data protection and financial regulatory frameworks in a timely, coordinated, and efficient manner. Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement. This Schedule D is incorporated into and forms part of the Agreement, and all references to "this Schedule" or "this Schedule D" shall be construed as references to these Data Breach Notification Procedures as they may be amended from time to time in accordance with the amendment provisions of the Agreement.

The parties acknowledge that Controller operates as an FDIC-insured, OCC-regulated federal savings bank and is therefore subject to heightened regulatory obligations with respect to the identification, escalation, and reporting of cybersecurity incidents, including obligations under the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53). The parties further acknowledge that Controller Personal Data processed by Processor under the Agreement includes data subject to the Gramm-Leach-Bliley Act ("GLBA"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the New Jersey Data Privacy Act (NJ S3377), and, with respect to personal data of EU-resident data subjects, the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"). The procedures set forth in this Schedule D are designed to support Controller's compliance with each of these regulatory frameworks.

SECTION 1: DEFINITIONS

1.1 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed by Processor or any of its approved sub-processors in connection with the Agreement. This definition is intended to align with the definition set forth in Article 4(12) of the GDPR and shall be interpreted consistently therewith. For the avoidance of doubt, the term "Personal Data Breach" as used in this Schedule D also encompasses: (a) any "breach of the security of the system" as that term is defined or used under the GLBA, including Regulation P (12 CFR Part 1016) and the Interagency Guidelines Establishing Information Security Standards; (b) any "breach of the security of the system" or "unauthorized access to personal information" as those terms are defined or used under the CCPA/CPRA (California Civil Code § 1798.150 and related provisions); and (c) any breach of security as defined or described under the New Jersey Data Privacy Act (NJ S3377), to the extent applicable to the processing of Controller Personal Data. The determination of whether a particular event constitutes a Personal Data Breach shall be made with reference to the broadest applicable definition under the foregoing laws and regulations.

1.2 "Notification Incident" means, by reference to the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53), a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, a banking organization's ability to carry out banking operations, activities, or processes, or business lines or operations, including activities performed or services provided by third parties such as Processor, that could result in a material loss of revenue, profit, or franchise value, or that poses a threat to the financial stability of the United States. The parties acknowledge that the determination of whether a particular event constitutes a Notification Incident is ultimately the responsibility of Controller, and that Controller bears an independent obligation to notify its primary federal regulator (the Office of the Comptroller of the Currency, or "OCC") within thirty-six (36) hours of Controller determining that a Notification Incident has occurred. Nothing in this Schedule D shall be construed to relieve Controller of, or to impose upon Processor, any obligation to make such regulatory notification, except as expressly set forth herein.

1.3 "Security Incident" means any event that compromises or has the potential to compromise the confidentiality, integrity, or availability of Controller Personal Data, whether or not such event rises to the level of a Personal Data Breach. Security Incidents include, without limitation: unauthorized access attempts (whether successful or unsuccessful); malware infections or ransomware events affecting systems that process, store, or transmit Controller Personal Data; denial-of-service attacks affecting the availability of systems used to process Controller Personal Data; loss or theft of physical media, devices, or equipment containing Controller Personal Data; insider threats, whether intentional or inadvertent; and any other event that Processor reasonably determines may pose a risk to the security of Controller Personal Data. For the avoidance of doubt, a Security Incident may or may not constitute a Personal Data Breach, and the obligations set forth in this Schedule D with respect to Personal Data Breaches are in addition to, and not in lieu of, any obligations Processor may have with respect to Security Incidents that do not constitute Personal Data Breaches.

1.4 "Breach Response Team" means the designated personnel of Processor and Controller who are responsible for managing the response to a Personal Data Breach, as further described in Section 4 (Escalation Matrix) of this Schedule D. The Breach Response Team shall include, at a minimum, the individuals identified as Processor-side and Controller-side contacts in Section 4.1 and Section 4.2 below, together with such additional personnel as may be designated by either party from time to time in accordance with Section 9.2 (Contact Information Updates).

SECTION 2: NOTIFICATION OBLIGATIONS

2.1 Notification Timeline

Processor shall notify Controller of any confirmed or reasonably suspected Personal Data Breach without undue delay and in no event later than forty-eight (48) hours after Processor becomes aware of such Personal Data Breach. For purposes of this Section 2.1, Processor "becomes aware" of a Personal Data Breach at the point at which Processor has a reasonable degree of certainty that a Security Incident has resulted in a Personal Data Breach affecting Controller Personal Data. A reasonable degree of certainty does not require that Processor complete a full forensic investigation prior to notification; rather, it requires that the information available to Processor, after reasonable inquiry and initial triage, indicates that there has been an accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Controller Personal Data. Processor shall not delay notification in order to conduct a comprehensive investigation or to determine the full scope of the Personal Data Breach, provided that Processor may conduct reasonable initial triage to confirm or rule out a Personal Data Breach prior to initiating notification.

Notification shall be made in accordance with the escalation procedures set forth in Section 4 below, using the notification methods described in Section 4.3.

The parties acknowledge and agree that this forty-eight (48) hour notification timeline has been specifically designed to afford Controller sufficient time to assess whether the incident constitutes a Notification Incident requiring Controller to notify its primary federal regulator (OCC or FDIC, as applicable) within thirty-six (36) hours of Controller's determination under the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53). Processor understands that any failure by Processor to meet the forty-eight (48) hour notification timeline may jeopardize Controller's ability to comply with its own regulatory obligations, and Processor agrees that such failure shall constitute a material breach of this Schedule D and the Agreement.

2.2 Preliminary Notification

If Processor is unable to provide a complete notification containing all of the information required by Section 3.1 (Content Requirements for Breach Notice) within the forty-eight (48) hour period specified in Section 2.1, Processor shall nonetheless provide an initial preliminary notification within that period. Such preliminary notification shall contain all information then reasonably available to Processor, including at a minimum: (a) a description of the nature of the suspected or confirmed Personal Data Breach; (b) the approximate date and time Processor became aware of the incident; (c) whether Controller Personal Data is confirmed or suspected to be affected; and (d) the name and contact information of Processor's designated point of contact. Processor shall supplement such preliminary notification in writing as additional information becomes available, without undue delay and in accordance with Section 3.2 (Supplemental Notices) below. Each supplemental notification shall clearly reference the initial preliminary notification and shall identify the new or updated information being provided.

2.3 Sub-Processor Breach Notification

Processor shall ensure that its approved sub-processors are contractually obligated to notify Processor of any Personal Data Breach affecting Controller Personal Data without undue delay and in sufficient time to enable Processor to comply with the forty-eight (48) hour notification obligation set forth in Section 2.1 above. As of the date of this Schedule D, Processor's approved sub-processors for purposes of the Agreement are:

(a) Osprey Cloud Infrastructure, Inc., a Delaware corporation with its principal office at 2200 Campus Drive, San Jose, California 95131, which provides cloud infrastructure hosting services for Processor's SBF Core platform at its US-East data center facility (Ashburn, Virginia), its EU data center facility (Frankfurt, Germany), and a secondary availability zone for disaster recovery purposes (Ashburn, Virginia); and

(b) Skybridge Fintech Europe B.V., a private limited liability company organized under the laws of the Netherlands, with its registered office at Keizersgracht 482, 1017 EG Amsterdam, Netherlands (KvK Registration No. 82104593), which provides localized data processing and customer support services in connection with the personal data of EU-resident Meridian accountholders.

Processor represents and warrants that the existing Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024 (the "Osprey Cloud DPA") contains sub-processor breach notification provisions that are consistent with, and no less protective than, the obligations imposed on Processor under this Section 2. Processor further represents that the data processing agreement between Processor and Skybridge Fintech Europe B.V. contains comparable breach notification provisions. Processor shall not amend or waive any sub-processor breach notification obligation in a manner that would impair Processor's ability to comply with the notification timelines set forth in this Schedule D without Controller's prior written consent.

SECTION 3: CONTENT REQUIREMENTS FOR BREACH NOTICE

3.1 Initial Breach Notice — Required Content

The initial notification delivered by Processor to Controller pursuant to Section 2 above shall include, to the extent reasonably available at the time of notification, the following information:

(a) A description of the nature of the Personal Data Breach, including the categories and approximate number of data subjects affected. For reference, Processor currently processes personal data of approximately 412,000 Meridian accountholders, authorized signers, beneficial owners, and employees through the SBF Core platform, and the initial breach notice shall, to the extent known, specify the subset of such data subjects who are confirmed or reasonably believed to have been affected by the Personal Data Breach.

(b) The categories and approximate volume of personal data records affected by the Personal Data Breach, including whether the breach involves sensitive data categories such as: Social Security numbers; individual taxpayer identification numbers; financial account numbers (including deposit account numbers, loan account numbers, and credit card numbers); transaction data (including wire transfer records, ACH payment details, and investment account activity); authentication credentials; or behavioral biometric data such as keystroke dynamics, mouse movement patterns, or touchscreen interaction data collected through the SBF Core platform's adaptive authentication module.

(c) The date and time Processor became aware of the Personal Data Breach and, if known at the time of notification, the date and time the Personal Data Breach is believed to have occurred, the duration of the breach, and whether the breach is ongoing or has been contained.

(d) A description of the likely consequences of the Personal Data Breach for affected data subjects, including an assessment of the risk of identity theft, financial fraud, unauthorized account access, reputational harm, or other adverse effects.

(e) A description of the measures taken or proposed to be taken by Processor to address the Personal Data Breach, including measures to contain the breach, mitigate its possible adverse effects, and prevent recurrence. Such description shall include, as applicable, details regarding system isolation, credential revocation, access log review, and any temporary service disruptions that may result from containment measures.

(f) The name and contact details of Processor's designated point of contact from whom Controller may obtain further information. The primary designated point of contact shall be Processor's Chief Information Security Officer, Rebecca Muñoz (Skybridge Fintech Ltd., 4100 Silverside Road, Suite 310, Wilmington, DE 19810). In the absence or unavailability of Rebecca Muñoz, the designated alternate point of contact shall be Processor's General Counsel and Chief Privacy Officer, Thomas Elridge (Skybridge Fintech Ltd., same address).

(g) An identification of the processing location(s) affected by the Personal Data Breach, including whether the breach involved data processed at: (i) the primary data center, hosted by Osprey Cloud Infrastructure, Inc., US-East facility, Ashburn, Virginia; (ii) the EU data center, hosted by Osprey Cloud Infrastructure, Inc., Frankfurt, Germany; (iii) the disaster recovery site, hosted by Osprey Cloud Infrastructure, Inc., US-East secondary availability zone, Ashburn, Virginia; or (iv) the SBF Europe facility operated by Skybridge Fintech Europe B.V. at Amsterdam, Netherlands.

3.2 Supplemental Notices

Processor shall provide supplemental written notices to Controller as additional information relating to the Personal Data Breach becomes available. Such supplemental notices shall include, as applicable, updated information regarding: the findings of forensic investigations; root cause analysis; revised or updated data subject counts; identification of additional categories of personal data affected; the status of containment and remediation efforts; and any information relevant to Controller's determination of whether the incident constitutes a Notification Incident or triggers notification obligations to data subjects or regulators under applicable law.

Supplemental notices shall be provided without undue delay and, in any event, within five (5) business days of Processor obtaining material new information. For purposes of this Section 3.2, "material new information" means information that would reasonably be expected to alter Controller's assessment of the severity or scope of the Personal Data Breach, the risk to affected data subjects, or Controller's regulatory notification obligations. Each supplemental notice shall clearly reference the initial breach notice and all prior supplemental notices, and shall identify the specific new or updated information being provided.

SECTION 4: ESCALATION MATRIX

4.1 Processor-Side Escalation

The following escalation procedures shall apply on the Processor side upon the detection of a Security Incident that may constitute a Personal Data Breach affecting Controller Personal Data:

Step 1 — Detection and Initial Assessment

Processor's security operations center ("SOC") shall serve as the first line of detection for Security Incidents. Upon detecting or receiving a report of a Security Incident that may involve Controller Personal Data, the SOC shall immediately escalate the incident to Processor's Chief Information Security Officer, Rebecca Muñoz (Skybridge Fintech Ltd., 4100 Silverside Road, Suite 310, Wilmington, DE 19810). Rebecca Muñoz, or her designated on-call deputy, shall conduct an initial triage and assessment of the Security Incident to determine: (a) whether Controller Personal Data is confirmed or reasonably suspected to be affected; (b) the nature, scope, and severity of the incident; and (c) whether the incident constitutes a confirmed or reasonably suspected Personal Data Breach. This initial triage and assessment shall be conducted as expeditiously as possible and shall not delay notification beyond the timeline specified in Section 2.1.

Step 2 — Internal Escalation within Processor

Upon confirming or reasonably suspecting that a Security Incident constitutes a Personal Data Breach affecting Controller Personal Data, CISO Rebecca Muñoz shall immediately escalate the matter to Processor's General Counsel and Chief Privacy Officer, Thomas Elridge (Skybridge Fintech Ltd.). Thomas Elridge shall be responsible for: (a) formally activating the Breach Response Team; (b) authorizing external notification to Controller; (c) coordinating with Processor's outside legal counsel, if applicable; and (d) initiating any necessary communications with Processor's cyber-liability insurance carrier (Bastion Mutual Insurance Company). In addition, Processor's VP of Engineering, Sanjay Dhillon (Skybridge Fintech Ltd.), shall be engaged to lead the technical investigation and remediation efforts, including system log analysis, threat containment, evidence preservation, and coordination with relevant engineering and infrastructure teams.

If the Personal Data Breach involves or is suspected to involve systems or infrastructure operated by an approved sub-processor, Processor shall immediately coordinate with the relevant sub-processor, including:

(i) Osprey Cloud Infrastructure, Inc. (CEO: Martin Cho; principal office: 2200 Campus Drive, San Jose, CA 95131), for incidents involving the Osprey Cloud US-East data center (Ashburn, VA), the Osprey Cloud EU data center (Frankfurt, Germany), or the Osprey Cloud US-East secondary availability zone (Ashburn, VA); and

(ii) Skybridge Fintech Europe B.V. (Managing Director: Lena Vogt; registered office: Keizersgracht 482, 1017 EG Amsterdam, Netherlands; KvK Registration No. 82104593), for incidents involving the processing of personal data of EU-resident Meridian accountholders, of which there are approximately 3,200 as of the date of this Schedule D.

Processor shall ensure that its sub-processors provide timely information and cooperation necessary for Processor to conduct its investigation and meet its notification obligations under this Schedule D.

Step 3 — Notification to Controller

Within the forty-eight (48) hour notification window specified in Section 2.1, Thomas Elridge (or his designee) shall deliver written notice of the confirmed or reasonably suspected Personal Data Breach to the Controller-side contacts identified in Section 4.2 below, using the notification methods specified in Section 4.3 below. The notification shall contain the information required by Section 3.1 (Initial Breach Notice — Required Content), to the extent reasonably available at the time.

4.2 Controller-Side Escalation

The following individuals are designated as Controller's primary and secondary contacts for purposes of receiving breach notifications under this Schedule D:

Primary Controller Contacts for Breach Notifications:

Secondary Controller Contacts (if primary contacts are unavailable within four (4) hours of Processor's initial attempt to reach a primary contact):

In the event that none of the primary or secondary contacts identified above can be reached within six (6) hours of Processor's initial notification attempt, Processor shall continue its efforts to reach such contacts while simultaneously documenting all attempts made.

Controller's outside counsel, Blackwell, Raines & Stoddard LLP (contact: Constance Liu, Partner; 200 Park Avenue, 31st Floor, New York, NY 10166), may also be notified at Controller's direction. Processor shall not contact Controller's outside counsel directly regarding a Personal Data Breach unless expressly authorized to do so by one of the Controller contacts identified above.

4.3 Notification Methods

The following notification methods shall be used for all breach notifications under this Schedule D:

(a) Primary Method: Encrypted email directed to the designated Controller contacts identified in Section 4.2, using encryption protocols consistent with the technical security requirements specified in Schedule B to the Agreement (TLS 1.2 or higher in transit; AES-256 encryption for attachments containing Personal Data).

(b) Secondary Method: Telephone notification to the designated Controller contacts, followed by written confirmation via encrypted email within two (2) hours of the telephone notification. Telephone notifications shall be documented contemporaneously in Processor's internal incident management system, including the date, time, duration, and substance of the call, and the identity of the individuals involved.

All written notifications under this Schedule D shall be clearly marked "CONFIDENTIAL — DATA BREACH NOTIFICATION" in the subject line and, where applicable, in the header of the document body. Notifications shall not be sent to general-purpose, unmonitored, or shared email addresses. Processor shall verify the identity and authorization of any individual to whom it provides breach notification information under this Schedule D.

SECTION 5: COOPERATION OBLIGATIONS

5.1 Processor's Cooperation

Following the detection of a Personal Data Breach, Processor shall cooperate fully and in good faith with Controller in investigating, remediating, and mitigating the effects of the Personal Data Breach. Without limiting the generality of the foregoing, Processor's cooperation obligations shall include the following:

(a) Providing all information reasonably requested by Controller to enable Controller to fulfill its own notification obligations to affected data subjects, regulators, and law enforcement. Controller's regulatory supervisors include, without limitation, the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the Consumer Financial Protection Bureau (CFPB), each of which may require notification of, or information regarding, a Personal Data Breach affecting Controller. Processor shall respond to Controller's reasonable information requests promptly and in a manner consistent with the urgency of Controller's regulatory deadlines.

(b) Preserving and providing forensic evidence, system logs, access logs, audit trails, network traffic records, and other technical artifacts relevant to the investigation of the Personal Data Breach. Processor shall implement a litigation hold or evidence preservation directive promptly upon becoming aware of a Personal Data Breach, and shall not destroy, alter, or overwrite any potentially relevant evidence without Controller's prior written consent, except where destruction occurs automatically in the ordinary course of system operations prior to the implementation of such hold.

(c) Implementing immediate remediation measures to contain the Personal Data Breach and prevent recurrence, including without limitation: isolating affected systems; revoking or resetting compromised credentials; applying security patches; blocking malicious IP addresses or domains; and taking any other steps reasonably necessary to address the vulnerability or threat vector that gave rise to the breach.

(d) Cooperating with Controller's insurers and Controller's incident response counsel (including Blackwell, Raines & Stoddard LLP or such other counsel as Controller may designate) in connection with the investigation, remediation, and resolution of the Personal Data Breach, including responding to information requests, participating in briefing calls, and providing access to relevant personnel.

(e) Assisting Controller in preparing notifications required under applicable law, including but not limited to: GLBA and Regulation P (12 CFR Part 1016) with respect to financial customer data; GDPR (Regulation (EU) 2016/679) with respect to the personal data of EU-resident data subjects, including notifications under Articles 33 and 34; CCPA/CPRA with respect to the personal data of California-resident data subjects, including any notifications required under California Civil Code § 1798.150; and the New Jersey Data Privacy Act (NJ S3377) with respect to New Jersey-resident data subjects. Processor shall provide drafts, factual summaries, and technical details as reasonably requested by Controller to support the preparation of such notifications.

(f) Facilitating any audit, examination, or investigation by Controller or Controller's regulators (including OCC, FDIC, and CFPB) that is triggered by or related to the Personal Data Breach, in accordance with the audit rights provisions of the Agreement. Such facilitation shall include providing reasonable access to Processor's premises, systems, records, and personnel, subject to reasonable advance notice and Processor's confidentiality obligations to its other clients.

5.2 Controller's Cooperation

Controller shall cooperate with Processor in the investigation and remediation of any Personal Data Breach, including by providing Processor with reasonable access to relevant information, systems, and data under Controller's control that may be necessary for Processor to investigate the root cause of the breach, assess its scope, and implement effective remediation measures. Controller shall designate an internal point of contact to coordinate with Processor's Breach Response Team and shall respond to Processor's reasonable information requests in a timely manner.

5.3 Engagement of Third-Party Resources

Processor shall, at its own expense (subject to any applicable insurance coverage), engage qualified forensic investigators and legal counsel as appropriate to investigate and remediate a Personal Data Breach. Processor shall select forensic investigators and legal counsel with relevant expertise in financial services data breaches and applicable regulatory frameworks, and shall consult with Controller in good faith regarding the selection of such resources.

Processor represents that it currently maintains cyber-liability insurance with Bastion Mutual Insurance Company (Policy No. CYB-2025-04821; coverage limits: $10,000,000 per occurrence / $20,000,000 annual aggregate; insurance broker: Kestrel Risk Advisors LLC), which may provide coverage for breach response costs including forensic investigation, legal fees, notification costs, credit monitoring services, and regulatory defense costs, subject to the terms, conditions, and exclusions of the applicable insurance policy. Processor shall promptly tender any claim arising from a Personal Data Breach to its insurance carrier and shall keep Controller reasonably informed of the status of any such claim.

Processor's independent penetration testing firm, Ironvault Security Group LLC (11710 Plaza America Drive, Suite 400, Reston, VA 20190), may be engaged by Processor for post-incident security assessments and vulnerability testing at Processor's discretion. The engagement of Ironvault Security Group LLC or any other third-party security firm shall not relieve Processor of any of its obligations under this Schedule D or the Agreement.

SECTION 6: REGULATORY NOTIFICATION COORDINATION

6.1 Controller's Regulatory Obligations

The parties acknowledge that Controller, as an FDIC-insured, OCC-regulated federal savings bank (OCC Charter No. 14-2238), is subject to the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53), which requires Controller to notify its primary federal regulator (the OCC) within thirty-six (36) hours of Controller determining that a "notification incident" (as defined in 12 CFR Part 53) has occurred. The parties further acknowledge that Controller may be subject to additional regulatory notification obligations under applicable federal and state laws and regulations, including without limitation the requirements of the GLBA, the Interagency Guidelines Establishing Information Security Standards, and applicable state data breach notification statutes.

The forty-eight (48) hour Processor-to-Controller notification timeline set forth in Section 2.1 is specifically designed to enable Controller to receive timely notification from Processor and thereafter conduct its own assessment of whether the incident constitutes a Notification Incident, such that Controller can meet its independent thirty-six (36) hour regulatory notification timeline from the point of Controller's own determination. Processor understands and acknowledges that any delay by Processor in meeting its notification obligations under this Schedule D may directly impair Controller's ability to comply with mandatory regulatory deadlines and may expose Controller to regulatory enforcement action, supervisory criticism, or other adverse consequences. Processor agrees to use commercially reasonable efforts to provide notification to Controller as promptly as possible within the forty-eight (48) hour period, and sooner if circumstances permit.

6.2 Processor's Prohibition on Independent Regulatory/Public Notification

Processor shall not independently notify any regulatory authority, law enforcement agency, data subject, consumer, member of the public, or any other third party about a Personal Data Breach involving Controller Personal Data without Controller's prior written consent, unless Processor is independently required by applicable law to make such notification with respect to personal data for which Processor is itself a controller or is otherwise independently obligated. If Processor is compelled by law, regulatory order, or legal process to make any such notification, Processor shall, to the extent permitted by law:

(a) Provide Controller with advance written notice of such compelled notification as promptly as reasonably practicable and, where feasible, prior to making such notification;

(b) Provide Controller with a copy of the proposed notification and afford Controller a reasonable opportunity to review and comment on its content;

(d) Cooperate with Controller in seeking a protective order, confidential treatment, or other appropriate remedy to limit the disclosure of information relating to the Personal Data Breach.

6.3 GDPR-Specific Obligations

For Personal Data Breaches affecting the personal data of EU-resident data subjects (approximately 3,200 Meridian accountholders as of the date of this Schedule D whose personal data is processed through the SBF Europe facility or otherwise subject to the GDPR), Processor shall assist Controller in complying with Controller's notification obligations under GDPR Articles 33 and 34. Such assistance shall include, without limitation:

(a) Providing Controller with all information necessary for Controller to complete the notification to the competent supervisory authority as required by GDPR Article 33(3), including the information specified in Section 3.1(a) through (g) of this Schedule D;

(b) Assisting Controller in assessing whether the Personal Data Breach is likely to result in a high risk to the rights and freedoms of natural persons, thereby triggering the data subject notification obligation under GDPR Article 34;

(c) Assisting Controller in preparing and delivering data subject notifications under GDPR Article 34, where required; and

(d) Cooperating with the competent supervisory authority (which, to the extent applicable to the processing activities of Skybridge Fintech Europe B.V., is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Bezuidenhoutseweg 30, 2594 AV The Hague, Netherlands) in connection with any inquiry, investigation, or enforcement action arising from the Personal Data Breach.

The parties acknowledge that the Standard Contractual Clauses appended to the Agreement — including Module 2 (Controller to Processor: Meridian Federal Savings Bank to Skybridge Fintech Ltd.), Module 3 (Processor to Sub-Processor: Skybridge Fintech Ltd. to Osprey Cloud Infrastructure, Inc.), and Module 3 (Processor to Sub-Processor: Skybridge Fintech Ltd. to Skybridge Fintech Europe B.V.) — governed by the law of the Netherlands per Clause 17 thereof, impose independent breach notification obligations on the data importer. To the extent that the Standard Contractual Clauses impose breach notification obligations that are more protective of data subjects than the provisions of this Schedule D, the Standard Contractual Clauses shall prevail.

SECTION 7: RECORD-KEEPING AND DOCUMENTATION

7.1 Breach Register

Processor shall establish and maintain a comprehensive register of all Personal Data Breaches affecting Controller Personal Data (the "Breach Register"). The Breach Register shall include, for each Personal Data Breach, the following information: (a) the date and time the breach was detected; (b) the date and time Processor became aware of the breach; (c) a description of the nature of the breach; (d) the categories and approximate number of data subjects affected; (e) the categories and approximate volume of personal data records affected; (f) the facts surrounding the breach, including the root cause (once determined); (g) the effects of the breach on affected data subjects and on Controller; (h) the remedial actions taken by Processor; (i) the dates and substance of all notifications provided to Controller; and (j) the status and outcome of any investigation. The Breach Register shall be maintained in a format that enables ready access and review, and shall be updated promptly as new information becomes available.

The Breach Register shall be made available to Controller upon written request and shall be accessible to Controller's regulators (including the OCC, FDIC, and CFPB) in connection with any audit, examination, or investigation. Processor shall retain the Breach Register for a period of not less than seven (7) years following the date of the most recent entry, or for such longer period as may be required by applicable law or regulation.

7.2 Post-Incident Report

Within thirty (30) calendar days following the resolution of a Personal Data Breach (or such shorter period as may be reasonably requested by Controller in light of regulatory deadlines), Processor shall provide Controller with a comprehensive written post-incident report. The post-incident report shall contain, at a minimum, the following:

(a) A detailed root cause analysis identifying the vulnerability, threat vector, or failure that gave rise to the Personal Data Breach, including an assessment of whether the breach resulted from a technical failure, a process failure, human error, a malicious act, or a combination thereof;

(b) A complete timeline of events, from the initial occurrence of the breach (or the earliest known date of the breach, if the precise date of occurrence cannot be determined) through detection, notification, containment, remediation, and resolution;

(c) The final count and categorization of affected data subjects and data categories, including any changes from the estimates provided in the initial or supplemental breach notices;

(d) A detailed description of all remediation measures implemented by Processor in response to the Personal Data Breach, including technical, organizational, and procedural measures;

(e) Recommendations for preventing the recurrence of similar incidents, including any proposed enhancements to Processor's information security program, policies, or procedures;

(f) Confirmation that the security measures described in Schedule B to the Agreement — including, without limitation, AES-256 encryption at rest for Controller Personal Data, TLS 1.2 or higher encryption in transit, multi-factor authentication (MFA) for administrative and privileged access to systems processing Controller Personal Data, and all other technical and organizational measures specified therein — have been verified and, if necessary, enhanced in response to the findings of the post-incident investigation.

The post-incident report shall be delivered in writing via encrypted email to Controller's Chief Compliance Officer (Andrea Sokolov) and VP, Third-Party Risk Management (Marcus Tibaldi), and shall be marked "CONFIDENTIAL — POST-INCIDENT REPORT." Controller may share the post-incident report with its regulators, outside counsel, and insurers as Controller deems necessary.

SECTION 8: INTERACTION WITH OTHER AGREEMENT PROVISIONS

8.1 Indemnification. The parties' respective rights and obligations with respect to indemnification arising from or in connection with a Personal Data Breach shall be governed by the indemnification provisions set forth in the Agreement. As set forth in the Agreement, Processor's total aggregate liability for claims arising under or in connection with the Agreement, including claims arising from Personal Data Breaches, is subject to a liability cap equal to the greater of: (a) Five Million United States Dollars ($5,000,000); or (b) two times (2×) the total fees paid or payable by Controller to Processor in the twelve (12) month period immediately preceding the event giving rise to the claim. Nothing in this Schedule D shall be construed to expand, limit, or otherwise modify the indemnification obligations or the liability cap set forth in the Agreement. The indemnification provisions of the Agreement shall be the exclusive remedy of the parties with respect to claims for monetary damages arising from a Personal Data Breach, except to the extent that applicable law prohibits the contractual limitation of liability for such claims.

8.2 Audit Rights

The occurrence of a Personal Data Breach shall constitute grounds for Controller (or its regulators, including the OCC, FDIC, and CFPB) to conduct an additional audit or assessment of Processor's information security program, systems, and controls outside the standard once-per-twelve (12) month audit cycle specified in the Agreement. Such additional audit shall be conducted in accordance with the audit rights provisions of the Agreement, including the provisions governing advance notice, scope, confidentiality, and cost allocation. For the avoidance of doubt, Processor shall not unreasonably refuse or delay any audit or examination requested by Controller or Controller's regulators following a Personal Data Breach.

8.3 Insurance. Processor shall maintain cyber-liability insurance coverage of not less than Ten Million United States Dollars ($10,000,000) per occurrence throughout the term of the Agreement, as set forth in the Agreement. Such insurance coverage shall include, at a minimum, coverage for: breach response costs (including forensic investigation, legal fees, and notification costs); regulatory defense and penalties (to the extent insurable under applicable law); data subject claims and litigation defense; and business interruption losses. Processor shall promptly notify its cyber-insurance carrier, Bastion Mutual Insurance Company (Policy No. CYB-2025-04821; broker: Kestrel Risk Advisors LLC), of any Personal Data Breach that may give rise to a claim under its policy. Processor shall provide Controller with evidence of the existence and currency of its cyber-liability insurance coverage upon request.

8.4 SOC 2 Type II Report

Following a Personal Data Breach, Controller may request an updated SOC 2 Type II report, or a bridge letter covering the period from the end of the most recent SOC 2 Type II audit period through the date of the request, from Processor's independent auditor. Processor's independent auditor for SOC 2 purposes is Graystone & Ketchum LLP, with offices at 300 Delaware Avenue, Suite 700, Wilmington, DE 19801 (lead engagement partner: Sandra Clearfield). As of the date of this Schedule D, the most recent SOC 2 Type II report covers the audit period from October 1, 2024 through September 15, 2025. Processor shall use commercially reasonable efforts to facilitate Controller's request for an updated report or bridge letter, and shall bear the cost of any such report or bridge letter if the Personal Data Breach was caused by or attributable to a failure of Processor's controls.

SECTION 9: TESTING AND READINESS

9.1 Annual Tabletop Exercises

Processor shall conduct, and shall invite Controller to participate in, at least one (1) tabletop incident response exercise per calendar year to test the breach notification procedures set forth in this Schedule D. Each tabletop exercise shall simulate a realistic Personal Data Breach scenario relevant to the processing activities performed under the Agreement and shall be designed to test, at a minimum: (a) the effectiveness of the escalation procedures set forth in Section 4; (b) the ability of Processor to meet the forty-eight (48) hour notification timeline; (c) the completeness and accuracy of breach notifications prepared by Processor; (d) the coordination between Processor and its sub-processors in responding to a breach; and (e) the coordination between Processor and Controller in fulfilling Controller's regulatory notification obligations. Following each tabletop exercise, Processor shall prepare a written summary of the exercise, including any identified gaps or areas for improvement, and shall share such summary with Controller within thirty (30) calendar days of the exercise. Processor shall use commercially reasonable efforts to address any identified gaps or deficiencies within a reasonable timeframe.

9.2 Contact Information Updates

Each party shall promptly notify the other party of any changes to the designated contacts identified in Section 4 (Escalation Matrix) of this Schedule D, including changes to the names, titles, email addresses, telephone numbers, or organizational affiliations of such contacts. Updates shall be provided in writing (including by email) to the other party's primary contact identified in Section 4, and shall take effect upon receipt and acknowledgment by the other party. Each party shall ensure that its designated contacts are available on a twenty-four (24) hours per day, seven (7) days per week basis, or that appropriate alternates are designated and communicated, to ensure that breach notifications can be received and acted upon at all times.

SECTION 10: GOVERNING LAW AND INTERPRETATION

10.1 This Schedule D shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles, consistent with the governing law provision of the Agreement.

10.2 In the event of any conflict between the provisions of this Schedule D and the Standard Contractual Clauses appended to the Agreement (including Module 2: Meridian Federal Savings Bank to Skybridge Fintech Ltd.; Module 3: Skybridge Fintech Ltd. to Osprey Cloud Infrastructure, Inc.; and Module 3: Skybridge Fintech Ltd. to Skybridge Fintech Europe B.V.), which Standard Contractual Clauses are governed by the law of the Netherlands per Clause 17 thereof, the Standard Contractual Clauses shall prevail to the extent of such conflict with respect to the processing of personal data of EU-resident data subjects. In all other respects, this Schedule D shall control.

10.3 In the event of any conflict between the provisions of this Schedule D and any other provision of the Agreement (other than the Standard Contractual Clauses), the provisions of this Schedule D shall prevail to the extent they impose more specific or more protective requirements with respect to Personal Data Breach notification and response. In all other respects, the provisions of the Agreement shall control.

10.4 This Schedule D is effective as of the date of execution of the Agreement (February 15, 2026) and shall remain in effect for the duration of the Agreement, including the ninety (90) day post-termination data retention period during which Processor retains Controller Personal Data for purposes of data return and/or deletion in accordance with the Agreement. The obligations of Processor under Sections 5 (Cooperation Obligations), 6 (Regulatory Notification Coordination), and 7 (Record-Keeping and Documentation) shall survive the termination or expiration of the Agreement and this Schedule D to the extent necessary to address any Personal Data Breach that occurred during the term of the Agreement or the post-termination data retention period.

\* \* \*

This Schedule D is attached to and incorporated by reference into the Data Processing Agreement between Meridian Federal Savings Bank and Skybridge Fintech Ltd. dated as of February 15, 2026. No separate signature to this Schedule D is required; this Schedule D is incorporated into and made effective by the execution of the Agreement and the signature pages thereto.

MERIDIAN FEDERAL SAVINGS BANK ("Controller")

By: ________

Name: Lawrence C. Driscoll

Title: Chief Executive Officer

Date: ________

SKYBRIDGE FINTECH LTD. ("Processor")