1009-00007 · Skybridge Fintech Ltd · Closing

bring-down-certificate-skybridge.docx DOCUMENT Funds

1 / 35 → ✕

BRING-DOWN CERTIFICATE

Delivered Pursuant to Section [____] of the Master Software-as-a-Service Agreement

This Bring-Down Certificate (this "Certificate") is delivered by [Insert Full Legal Name of Licensor] ("Licensor") to [Insert Full Legal Name of Licensee] ("Licensee") as of [Insert Go-Live Date] (the "Go-Live Date") pursuant to Section [__] of that certain Master Software-as-a-Service Agreement, dated as of [Insert MSA Execution Date] (as amended, restated, supplemented, or otherwise modified from time to time, the "Agreement"), by and between Licensor and Licensee. Capitalized terms used but not defined in this Certificate shall have the meanings ascribed to such terms in the Agreement, including all Order Forms, the Service Level Agreement (Exhibit A), the Security Exhibit (Exhibit B), the Data Processing Addendum (Exhibit C), and the Acceptable Use Policy (Exhibit D) attached thereto and incorporated therein by reference.

SECTION 1: RECITALS

A. The Agreement. Licensor, a [Insert State/Jurisdiction of Organization] [Insert Entity Type] with its principal place of business at [Insert Licensor Address], and Licensee, a [Insert State/Jurisdiction of Organization] [Insert Entity Type] with its principal place of business at [Insert Licensee Address], entered into the Agreement as of [Insert MSA Execution Date]. Pursuant to the Agreement, Licensor has agreed to provide Licensee with access to and use of Licensor's proprietary cloud-based software platform known as "[Insert Platform Trade Name]" (the "Platform"), together with certain related implementation, support, maintenance, and professional services, all as more particularly described in the Agreement and in Order Form No. [__], dated as of [Insert Order Form Date], attached to the Agreement, and the associated Exhibits, including Exhibit A (Service Level Agreement), Exhibit B (Security Exhibit), Exhibit C (Data Processing Addendum), and Exhibit D (Acceptable Use Policy) (each, an "Exhibit" and, collectively, the "Exhibits").

B. Go-Live Date Delivery Requirement. Section [__] of the Agreement requires that, on or prior to the Go-Live Date on which the Platform is made available to Licensee for production use, Licensor shall deliver to Licensee a duly executed bring-down certificate certifying that the representations and warranties of Licensor set forth in the Agreement remain true and correct in all material respects as of the Go-Live Date and that no material breach of the Agreement by Licensor has occurred and is continuing. The delivery of this Certificate by Licensor to Licensee is a condition precedent to Licensee's obligations under Section [__] of the Agreement with respect to the commencement of Production Use Fees and Go-Live Milestone Payments, if any.

C. Purpose. This Certificate is delivered by Licensor to Licensee to confirm that: (i) each of the representations and warranties of Licensor set forth in the Agreement is true and correct in all material respects as of the Go-Live Date (or, where a representation or warranty expressly relates to an earlier date, as of such earlier date); (ii) no event has occurred and no condition exists that constitutes, or with the giving of notice or the passage of time (or both) would constitute, a material breach by Licensor of any provision of the Agreement; and (iii) certain additional certifications regarding security, insurance, regulatory compliance, and data protection, as required by the Agreement, are satisfied as of the Go-Live Date.

SECTION 2: DEFINITIONS

Capitalized terms used but not defined herein shall have the meanings ascribed to such terms in the Agreement. For purposes of this Certificate, the following additional definitions shall apply:

"Certificate" means this Bring-Down Certificate, including all attachments and schedules hereto, as delivered by Licensor to Licensee on the Go-Live Date.

"Certification Date" means the date on which this Certificate is executed by the undersigned authorized officer of Licensor, which date shall be the Go-Live Date or a date not more than [__] Business Days prior to the Go-Live Date.

"Go-Live Date" has the meaning set forth in the preamble of this Certificate and corresponds to the date on which the Platform is made available to Licensee for production use in accordance with Section [__] of the Agreement and the applicable Order Form.

[Insert any additional Certificate-specific definitions, if applicable, or state "No additional definitions are required for purposes of this Certificate."]

SECTION 3: CERTIFICATIONS

The undersigned, [Insert Name of Authorized Officer], [Insert Title] of Licensor, acting in such capacity and not in an individual capacity, hereby certifies to Licensee, as of the Go-Live Date, as follows:

3.1 Bring-Down of Representations and Warranties

The undersigned officer of Licensor hereby certifies that each of the representations and warranties made by Licensor in Article [__] of the Agreement is true and correct in all material respects as of the Go-Live Date, with the same force and effect as though such representations and warranties had been made on and as of the Go-Live Date, except to the extent that any such representation or warranty expressly relates to an earlier date, in which case such representation or warranty was true and correct in all material respects as of such earlier date.

Without limiting the generality of the foregoing, the undersigned officer of Licensor specifically certifies that, as of the Go-Live Date, the following representations and warranties set forth in Article [__] of the Agreement remain true and correct in all material respects:

(a) Performance in Accordance with Documentation. The Platform performs, and will continue to perform, materially in accordance with the Documentation (as defined in the Agreement), including the functional specifications, user guides, and technical reference materials provided or made available to Licensee, and all features and functionalities described in the Order Form and the applicable Statement of Work are operational and available for production use.

(b) Professional and Workmanlike Manner. All services provided by Licensor under the Agreement, including implementation services, configuration services, data migration services, training, and ongoing support and maintenance, have been and will continue to be performed in a professional and workmanlike manner, consistent with generally accepted industry standards and practices applicable to providers of enterprise software-as-a-service solutions for the financial services industry.

(c) Sufficient Rights to Grant License. Licensor has all necessary rights, title, interests, licenses, consents, and authorizations — whether arising under contract, intellectual property law, or otherwise — to grant to Licensee the rights and licenses set forth in the Agreement, including the right to access and use the Platform and all related Documentation, without infringement, misappropriation, or other violation of the intellectual property rights or other rights of any third party.

(d) Absence of Malicious Code. The Platform does not contain, and Licensor has not knowingly introduced into the Platform, any virus, worm, Trojan horse, ransomware, spyware, adware, time bomb, drop-dead device, back door, or other malicious or harmful code, program, or routine (collectively, "Malicious Code") designed to (i) permit unauthorized access to or use of Licensee's systems or data, (ii) disable, disrupt, damage, or otherwise interfere with the operation of the Platform or any Licensee system or network, or (iii) permit the unauthorized extraction, deletion, encryption, or modification of Licensee data.

(e) Compliance with Applicable Laws. Licensor is in material compliance with all applicable federal, state, local, and, to the extent applicable, international laws, statutes, rules, regulations, ordinances, orders, and governmental requirements (collectively, "Applicable Laws") relating to or affecting the performance of Licensor's obligations under the Agreement, including the provision of the Platform and related services.

(f) Security Practices. Licensor's information security practices, policies, procedures, and technical and organizational measures, as described in the Security Exhibit (Exhibit B) attached to the Agreement, meet or exceed industry standards for software-as-a-service providers serving financial institutions and financial services companies, including standards established by the National Institute of Standards and Technology (NIST), the Federal Financial Institutions Examination Council (FFIEC), and the Cloud Security Alliance (CSA), as applicable.

3.2 No Material Breach

The undersigned officer of Licensor hereby certifies that, as of the Go-Live Date, no event has occurred and no condition exists that constitutes, or that with the giving of notice or the passage of time (or both) would constitute, a material breach by Licensor of any provision of the Agreement, including any provision of the Order Form, the Service Level Agreement, the Security Exhibit, the Data Processing Addendum, or the Acceptable Use Policy.

Known Exceptions: [Insert "None" or describe any exceptions in reasonable detail, including a description of the nature of the event or condition, the provision(s) of the Agreement implicated, the current status of the event or condition, and any remediation steps taken or planned by Licensor.]

3.3 Security Certifications

The undersigned officer of Licensor hereby certifies that, as of the Go-Live Date, Licensor maintains the following information security certifications and independent audit reports, each in full force and effect:

(a) SOC 2 Type II Report. Licensor has obtained and maintains a current Service Organization Control (SOC) 2 Type II report (prepared in accordance with the AICPA's Trust Services Criteria), issued by [Insert Name of Independent Auditor], an independent certified public accounting firm. The most recent SOC 2 Type II report covers the audit period from [Insert Audit Period Start Date] through [Insert Audit Period End Date] and was issued on [Insert Report Issuance Date]. A copy of the most recent SOC 2 Type II report has been [delivered to Licensee on or prior to the date hereof / made available for Licensee's review in Licensor's secure document portal / will be made available to Licensee promptly upon request, subject to Licensor's standard confidentiality and non-disclosure requirements].

(b) ISO 27001 Certification. Licensor has obtained and maintains a current ISO/IEC 27001:2022 (or most recent version) certification for its information security management system (ISMS) applicable to the Platform and the services provided under the Agreement. Such certification was issued by [Insert Name of Certifying Body/Auditor], an accredited certification body. The most recent certification was issued on [Insert Certification Date], and the most recent surveillance audit was completed on [Insert Surveillance Audit Date]. A copy of the current ISO 27001 certificate has been [delivered to Licensee on or prior to the date hereof / made available for Licensee's review in Licensor's secure document portal / will be made available to Licensee promptly upon request].

The undersigned officer of Licensor further certifies that no material findings, qualifications, exceptions, or carve-outs were identified in the most recent SOC 2 Type II report or the most recent ISO 27001 certification or surveillance audit that (i) have not been fully remediated as of the Go-Live Date, or (ii) are not the subject of a written remediation plan that has been disclosed to Licensee in writing, including the anticipated timeline for completion of such remediation. To the extent any non-material observations or management recommendations were noted in such reports or audits, Licensor has addressed or is in the process of addressing such observations and recommendations in the ordinary course of its information security management program.

3.4 Insurance Coverage

The undersigned officer of Licensor hereby certifies that, as of the Go-Live Date, Licensor maintains insurance coverage meeting or exceeding the requirements set forth in Section [__] of the Agreement. Such insurance coverage includes, at a minimum, the following:

(a) Technology Errors & Omissions / Cyber Liability Insurance. Per-occurrence limit of not less than $[Insert Per-Occurrence Limit] and an annual aggregate limit of not less than $[Insert Aggregate Limit], provided by [Insert Insurance Carrier Name], Policy No. [Insert Policy Number], with a policy period of [Insert Policy Period Start Date] through [Insert Policy Period End Date]. Such policy includes, at a minimum, coverage for technology errors and omissions, network security liability, privacy liability, data breach response costs, regulatory defense and penalties (where insurable), and media liability.

(b) Commercial General Liability Insurance. Per-occurrence limit of not less than $[Insert Per-Occurrence Limit] and an annual aggregate limit of not less than $[Insert Aggregate Limit], including coverage for bodily injury, property damage, personal and advertising injury, and products/completed operations liability.

(c) Workers' Compensation Insurance. Workers' compensation insurance as required by Applicable Law in each state or jurisdiction in which Licensor's employees perform services, with coverage at or above statutory limits, and employer's liability insurance with limits of not less than $[Insert Limit] per accident, $[Insert Limit] per employee for disease, and $[Insert Limit] aggregate for disease.

(d) Umbrella / Excess Liability Insurance. Umbrella or excess liability coverage in an amount not less than $[Insert Limit] per occurrence and in the annual aggregate, following form and in excess of the underlying Commercial General Liability and Employer's Liability policies described above.

The undersigned officer of Licensor further certifies that:

(i) Licensee has been added as an additional insured on Licensor's Commercial General Liability, Technology Errors & Omissions / Cyber Liability, and Umbrella / Excess Liability policies, to the extent required by Section [__] of the Agreement;

(ii) A current certificate of insurance evidencing all coverage required by the Agreement has been delivered to Licensee concurrently with this Certificate (or has been previously delivered to Licensee and remains current as of the Go-Live Date); and

(iii) Licensor has not received, as of the date hereof, any notice of cancellation, non-renewal, or material modification of any of the insurance policies described above, and to Licensor's knowledge, no event has occurred that would give rise to a right of cancellation, non-renewal, or material modification by the applicable insurance carrier.

3.5 Compliance with Applicable Law

The undersigned officer of Licensor hereby certifies that, as of the Go-Live Date, Licensor is in material compliance with all Applicable Laws relevant to the performance of Licensor's obligations under the Agreement, including, without limitation, the following regulatory frameworks to the extent applicable to Licensor in connection with the Platform and the services provided under the Agreement:

• The Gramm-Leach-Bliley Act ("GLBA"), including the Safeguards Rule (16 C.F.R. Part 314) and the Privacy Rule (12 C.F.R. Part 1016), as applicable to service providers of financial institutions;

• The Bank Secrecy Act ("BSA") and applicable anti-money laundering ("AML") regulations promulgated thereunder, to the extent Licensor's Platform or services are implicated in Licensee's BSA/AML compliance program;

• State data breach notification laws applicable to the personal information of Licensee's customers and employees processed through the Platform;

• The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA"), to the extent applicable;

• [Insert any additional applicable regulatory frameworks, e.g., the Health Insurance Portability and Accountability Act ("HIPAA"), the Payment Card Industry Data Security Standard ("PCI DSS"), the EU General Data Protection Regulation ("GDPR"), or state-specific financial services regulations];

• All other federal, state, and local laws and regulations applicable to Licensor's business and the services provided under the Agreement.

The undersigned officer of Licensor further certifies that Licensor has not received, as of the Go-Live Date, any notice of investigation, enforcement action, consent order, cease-and-desist order, civil investigative demand, subpoena, or material regulatory finding or examination report from any governmental authority, regulatory body, or self-regulatory organization that relates to the Platform, the services provided under the Agreement, or Licensor's performance of its obligations under the Agreement, or that would reasonably be expected to materially and adversely affect Licensor's ability to perform its obligations under the Agreement.

3.6 No Litigation or Proceedings

The undersigned officer of Licensor hereby certifies that, as of the Go-Live Date, there is no pending or, to Licensor's knowledge (after due and reasonable inquiry), threatened action, suit, claim, litigation, arbitration, regulatory proceeding, governmental investigation, or other legal or administrative proceeding of any kind (collectively, "Proceedings") against Licensor, any of its officers, directors, or key personnel, or any of its affiliates or subcontractors engaged in the performance of services under the Agreement, that:

(a) challenges or seeks to enjoin, restrain, or otherwise prevent the consummation of the transactions contemplated by the Agreement or the performance of Licensor's obligations thereunder;

(b) relates to the Platform, the services, the Licensee Data, or the intellectual property rights licensed under the Agreement; or

(c) would, individually or in the aggregate, reasonably be expected to have a material adverse effect on Licensor's financial condition, business operations, or ability to perform its obligations under the Agreement in a timely and complete manner.

For purposes of this Section 3.6, "knowledge" of Licensor means the actual knowledge, after due and reasonable inquiry, of Licensor's Chief Executive Officer, Chief Technology Officer, Chief Information Security Officer, General Counsel (or equivalent officer), and Vice President of Engineering (or equivalent officer responsible for Platform development and delivery).

3.7 Data Security

The undersigned officer of Licensor hereby certifies that, as of the Go-Live Date:

(a) No Undisclosed Security Incidents. No Security Incident (as defined in the Agreement) affecting Licensee Data or Licensee's tenant environment within the Platform has occurred since the date of the Agreement that has not been previously disclosed to Licensee in writing in accordance with the notification and incident response procedures set forth in Section [__] of the Agreement and the Security Exhibit (Exhibit B). For the avoidance of doubt, this certification encompasses unauthorized access to, acquisition of, use of, disclosure of, modification of, destruction of, or loss of any Licensee Data, whether resulting from a breach of Licensor's security measures, the actions of Licensor's personnel, the actions of a subprocessor, or a third-party attack or intrusion.

(b) Data Residency. All Licensee Data processed, stored, transmitted, or otherwise maintained by Licensor or its approved subprocessors in connection with the Platform and the services is hosted and maintained exclusively within the data hosting regions approved by Licensee as set forth in the Agreement, the Security Exhibit, and/or the Data Processing Addendum. As of the Go-Live Date, the approved data hosting regions are: [Insert Approved Data Hosting Region(s), e.g., "United States (Meridian Technologies us-east-1 and us-west-2 regions)" or "United States and European Union (as further specified in the Security Exhibit)"]. No Licensee Data is stored, processed, or accessible from any data center, server, or computing environment located outside of the approved data hosting regions, except as expressly permitted by the Agreement and approved by Licensee in writing.

(c) Subprocessor Disclosure and Approval. All subprocessors (as defined in the Data Processing Addendum) engaged by Licensor as of the Go-Live Date in connection with the processing of Licensee Data have been disclosed to Licensee and approved by Licensee in accordance with Section [__] of the Data Processing Addendum (Exhibit C). As of the Go-Live Date, the approved subprocessors are as follows:

No subprocessor has been engaged or authorized to process Licensee Data that has not been disclosed to and approved by Licensee in accordance with the procedures set forth in the Data Processing Addendum. Each such subprocessor is bound by written contractual obligations providing data protection and information security obligations no less protective than those set forth in the Agreement and the Data Processing Addendum.

SECTION 4: RELIANCE

This Certificate is delivered for the benefit of Licensee and its successors and permitted assigns, and Licensee and such successors and permitted assigns are entitled to rely on the certifications contained herein in connection with the Go-Live Date and the commencement of production use of the Platform. The undersigned officer acknowledges that Licensee is relying on the truth and accuracy of the certifications set forth herein as a material inducement to (a) permit the Platform to proceed to Go-Live, (b) commence payment of Production Use Fees and other amounts due under the Agreement and the applicable Order Form, and (c) begin processing Licensee Data through the Platform in a production environment.

This Certificate is delivered pursuant to, and is subject to the terms and conditions of, the Agreement. Nothing in this Certificate shall be deemed to modify, amend, supplement, or supersede any term or provision of the Agreement, and in the event of any conflict or inconsistency between the terms of this Certificate and the terms of the Agreement, the terms of the Agreement shall govern and control. The certifications set forth herein are made as of the Go-Live Date and shall not be construed to impose upon Licensor any obligation to update or supplement such certifications after the Go-Live Date, except as may be expressly required by the Agreement.

SECTION 5: GOVERNING LAW

This Certificate shall be governed by and construed in accordance with the laws of the State of [Insert Governing Law Jurisdiction], without giving effect to any choice or conflict of law provision or rule (whether of the State of [Insert Governing Law Jurisdiction] or any other jurisdiction) that would cause the application of the laws of any jurisdiction other than the State of [Insert Governing Law Jurisdiction]. The governing law provision of this Certificate is intended to be consistent with, and shall be interpreted in a manner consistent with, the governing law provision set forth in Section [__] of the Agreement.

SECTION 6: EXECUTION

IN WITNESS WHEREOF, the undersigned has executed this Bring-Down Certificate as of the Go-Live Date first written above.

[INSERT FULL LEGAL NAME OF LICENSOR]

By: ________

Name: [Insert Name of Authorized Officer]

Title: [Insert Title, e.g., Chief Executive Officer]

Date: [Insert Go-Live Date]

Instruction: This Certificate is to be executed by a duly authorized officer of Licensor. The signatory must have actual authority to deliver this Certificate on behalf of Licensor and must have made due inquiry — including consultation with Licensor's legal, information security, engineering, compliance, and insurance personnel, as appropriate — sufficient to support each of the certifications set forth herein. If the signatory is not the Chief Executive Officer of Licensor, evidence of such signatory's authority (e.g., a board resolution, officer's certificate, or delegation of authority letter) should be provided to Licensee upon request.

SCHEDULE OF ATTACHMENTS

The following documents are attached to, or delivered concurrently with, this Certificate, as indicated below. Documents marked as "Previously Delivered" have been provided to Licensee prior to the Go-Live Date; Licensor confirms that such documents remain current and accurate as of the Go-Live Date unless otherwise noted.

Instruction: Complete the status column above by checking the applicable box for each document. Ensure that all documents required to be delivered on or prior to the Go-Live Date pursuant to the Agreement have been delivered or are being delivered concurrently with this Certificate. Retain copies of all attachments and delivery confirmations in Licensor's records.

[END OF BRING-DOWN CERTIFICATE]

Subprocessor Name	Service Provided	Data Hosting Location
[Insert Subprocessor Name]	[Insert Description of Service]	[Insert Location]
[Insert Subprocessor Name]	[Insert Description of Service]	[Insert Location]
[Insert Subprocessor Name]	[Insert Description of Service]	[Insert Location]

[Insert additional rows as applicable]

No.	Document	Status
1	Most recent SOC 2 Type II audit report	[ ] Attached hereto / [ ] Previously delivered on [date] / [ ] Available upon request subject to NDA
2	Most recent ISO 27001 certificate	[ ] Attached hereto / [ ] Previously delivered on [date] / [ ] Available upon request
3	Current certificate of insurance	[ ] Attached hereto / [ ] Previously delivered on [date]
4	List of approved subprocessors as of the Go-Live Date	[ ] Set forth in Section 3.7(c) above / [ ] Attached hereto as Schedule A
5	[Insert any additional deliverables required by the Agreement, e.g., penetration test executive summary, disaster recovery test results, data flow diagram, or evidence of completed background checks for key personnel]	[ ] Attached hereto / [ ] Previously delivered on [date] / [ ] Not applicable

BRING-DOWN CERTIFICATE
Delivered Pursuant to Section [____] of the Master Software-as-a-Service Agreement
This Bring-Down Certificate (this "Certificate") is delivered by [Insert Full Legal Name of Licensor] ("Licensor") to [Insert Full Legal Name of Licensee] ("Licensee") as of [Insert Go-Live Date] (the "Go-Live Date") pursuant to Section [__] of that certain Master Software-as-a-Service Agreement, dated as of [Insert MSA Execution Date] (as amended, restated, supplemented, or otherwise modified from time to time, the "Agreement"), by and between Licensor and Licensee. Capitalized terms used but not defined in this Certificate shall have the meanings ascribed to such terms in the Agreement, including all Order Forms, the Service Level Agreement (Exhibit A), the Security Exhibit (Exhibit B), the Data Processing Addendum (Exhibit C), and the Acceptable Use Policy (Exhibit D) attached thereto and incorporated therein by reference.
SECTION 1: RECITALS
A. The Agreement. Licensor, a [Insert State/Jurisdiction of Organization] [Insert Entity Type] with its principal place of business at [Insert Licensor Address], and Licensee, a [Insert State/Jurisdiction of Organization] [Insert Entity Type] with its principal place of business at [Insert Licensee Address], entered into the Agreement as of [Insert MSA Execution Date]. Pursuant to the Agreement, Licensor has agreed to provide Licensee with access to and use of Licensor's proprietary cloud-based software platform known as "[Insert Platform Trade Name]" (the "Platform"), together with certain related implementation, support, maintenance, and professional services, all as more particularly described in the Agreement and in Order Form No. [__], dated as of [Insert Order Form Date], attached to the Agreement, and the associated Exhibits, including Exhibit A (Service Level Agreement), Exhibit B (Security Exhibit), Exhibit C (Data Processing Addendum), and Exhibit D (Acceptable Use Policy) (each, an "Exhibit" and, collectively, the "Exhibits").
B. Go-Live Date Delivery Requirement. Section [__] of the Agreement requires that, on or prior to the Go-Live Date on which the Platform is made available to Licensee for production use, Licensor shall deliver to Licensee a duly executed bring-down certificate certifying that the representations and warranties of Licensor set forth in the Agreement remain true and correct in all material respects as of the Go-Live Date and that no material breach of the Agreement by Licensor has occurred and is continuing. The delivery of this Certificate by Licensor to Licensee is a condition precedent to Licensee's obligations under Section [__] of the Agreement with respect to the commencement of Production Use Fees and Go-Live Milestone Payments, if any.
C. Purpose. This Certificate is delivered by Licensor to Licensee to confirm that: (i) each of the representations and warranties of Licensor set forth in the Agreement is true and correct in all material respects as of the Go-Live Date (or, where a representation or warranty expressly relates to an earlier date, as of such earlier date); (ii) no event has occurred and no condition exists that constitutes, or with the giving of notice or the passage of time (or both) would constitute, a material breach by Licensor of any provision of the Agreement; and (iii) certain additional certifications regarding security, insurance, regulatory compliance, and data protection, as required by the Agreement, are satisfied as of the Go-Live Date.
SECTION 2: DEFINITIONS
Capitalized terms used but not defined herein shall have the meanings ascribed to such terms in the Agreement. For purposes of this Certificate, the following additional definitions shall apply:
"Certificate" means this Bring-Down Certificate, including all attachments and schedules hereto, as delivered by Licensor to Licensee on the Go-Live Date.
"Certification Date" means the date on which this Certificate is executed by the undersigned authorized officer of Licensor, which date shall be the Go-Live Date or a date not more than [__] Business Days prior to the Go-Live Date.
"Go-Live Date" has the meaning set forth in the preamble of this Certificate and corresponds to the date on which the Platform is made available to Licensee for production use in accordance with Section [__] of the Agreement and the applicable Order Form.
[Insert any additional Certificate-specific definitions, if applicable, or state "No additional definitions are required for purposes of this Certificate."]
SECTION 3: CERTIFICATIONS
The undersigned, [Insert Name of Authorized Officer], [Insert Title] of Licensor, acting in such capacity and not in an individual capacity, hereby certifies to Licensee, as of the Go-Live Date, as follows:
3.1 Bring-Down of Representations and Warranties
The undersigned officer of Licensor hereby certifies that each of the representations and warranties made by Licensor in Article [__] of the Agreement is true and correct in all material respects as of the Go-Live Date, with the same force and effect as though such representations and warranties had been made on and as of the Go-Live Date, except to the extent that any such representation or warranty expressly relates to an earlier date, in which case such representation or warranty was true and correct in all material respects as of such earlier date.
Without limiting the generality of the foregoing, the undersigned officer of Licensor specifically certifies that, as of the Go-Live Date, the following representations and warranties set forth in Article [__] of the Agreement remain true and correct in all material respects:
(a) Performance in Accordance with Documentation. The Platform performs, and will continue to perform, materially in accordance with the Documentation (as defined in the Agreement), including the functional specifications, user guides, and technical reference materials provided or made available to Licensee, and all features and functionalities described in the Order Form and the applicable Statement of Work are operational and available for production use.
(b) Professional and Workmanlike Manner. All services provided by Licensor under the Agreement, including implementation services, configuration services, data migration services, training, and ongoing support and maintenance, have been and will continue to be performed in a professional and workmanlike manner, consistent with generally accepted industry standards and practices applicable to providers of enterprise software-as-a-service solutions for the financial services industry.
(c) Sufficient Rights to Grant License. Licensor has all necessary rights, title, interests, licenses, consents, and authorizations — whether arising under contract, intellectual property law, or otherwise — to grant to Licensee the rights and licenses set forth in the Agreement, including the right to access and use the Platform and all related Documentation, without infringement, misappropriation, or other violation of the intellectual property rights or other rights of any third party.
(d) Absence of Malicious Code. The Platform does not contain, and Licensor has not knowingly introduced into the Platform, any virus, worm, Trojan horse, ransomware, spyware, adware, time bomb, drop-dead device, back door, or other malicious or harmful code, program, or routine (collectively, "Malicious Code") designed to (i) permit unauthorized access to or use of Licensee's systems or data, (ii) disable, disrupt, damage, or otherwise interfere with the operation of the Platform or any Licensee system or network, or (iii) permit the unauthorized extraction, deletion, encryption, or modification of Licensee data.
(e) Compliance with Applicable Laws. Licensor is in material compliance with all applicable federal, state, local, and, to the extent applicable, international laws, statutes, rules, regulations, ordinances, orders, and governmental requirements (collectively, "Applicable Laws") relating to or affecting the performance of Licensor's obligations under the Agreement, including the provision of the Platform and related services.
(f) Security Practices. Licensor's information security practices, policies, procedures, and technical and organizational measures, as described in the Security Exhibit (Exhibit B) attached to the Agreement, meet or exceed industry standards for software-as-a-service providers serving financial institutions and financial services companies, including standards established by the National Institute of Standards and Technology (NIST), the Federal Financial Institutions Examination Council (FFIEC), and the Cloud Security Alliance (CSA), as applicable.
3.2 No Material Breach
The undersigned officer of Licensor hereby certifies that, as of the Go-Live Date, no event has occurred and no condition exists that constitutes, or that with the giving of notice or the passage of time (or both) would constitute, a material breach by Licensor of any provision of the Agreement, including any provision of the Order Form, the Service Level Agreement, the Security Exhibit, the Data Processing Addendum, or the Acceptable Use Policy.
Known Exceptions: [Insert "None" or describe any exceptions in reasonable detail, including a description of the nature of the event or condition, the provision(s) of the Agreement implicated, the current status of the event or condition, and any remediation steps taken or planned by Licensor.]
3.3 Security Certifications
The undersigned officer of Licensor hereby certifies that, as of the Go-Live Date, Licensor maintains the following information security certifications and independent audit reports, each in full force and effect:
(a) SOC 2 Type II Report. Licensor has obtained and maintains a current Service Organization Control (SOC) 2 Type II report (prepared in accordance with the AICPA's Trust Services Criteria), issued by [Insert Name of Independent Auditor], an independent certified public accounting firm. The most recent SOC 2 Type II report covers the audit period from [Insert Audit Period Start Date] through [Insert Audit Period End Date] and was issued on [Insert Report Issuance Date]. A copy of the most recent SOC 2 Type II report has been [delivered to Licensee on or prior to the date hereof / made available for Licensee's review in Licensor's secure document portal / will be made available to Licensee promptly upon request, subject to Licensor's standard confidentiality and non-disclosure requirements].
(b) ISO 27001 Certification. Licensor has obtained and maintains a current ISO/IEC 27001:2022 (or most recent version) certification for its information security management system (ISMS) applicable to the Platform and the services provided under the Agreement. Such certification was issued by [Insert Name of Certifying Body/Auditor], an accredited certification body. The most recent certification was issued on [Insert Certification Date], and the most recent surveillance audit was completed on [Insert Surveillance Audit Date]. A copy of the current ISO 27001 certificate has been [delivered to Licensee on or prior to the date hereof / made available for Licensee's review in Licensor's secure document portal / will be made available to Licensee promptly upon request].
The undersigned officer of Licensor further certifies that no material findings, qualifications, exceptions, or carve-outs were identified in the most recent SOC 2 Type II report or the most recent ISO 27001 certification or surveillance audit that (i) have not been fully remediated as of the Go-Live Date, or (ii) are not the subject of a written remediation plan that has been disclosed to Licensee in writing, including the anticipated timeline for completion of such remediation. To the extent any non-material observations or management recommendations were noted in such reports or audits, Licensor has addressed or is in the process of addressing such observations and recommendations in the ordinary course of its information security management program.
3.4 Insurance Coverage
The undersigned officer of Licensor hereby certifies that, as of the Go-Live Date, Licensor maintains insurance coverage meeting or exceeding the requirements set forth in Section [__] of the Agreement. Such insurance coverage includes, at a minimum, the following:
(a) Technology Errors & Omissions / Cyber Liability Insurance. Per-occurrence limit of not less than $[Insert Per-Occurrence Limit] and an annual aggregate limit of not less than $[Insert Aggregate Limit], provided by [Insert Insurance Carrier Name], Policy No. [Insert Policy Number], with a policy period of [Insert Policy Period Start Date] through [Insert Policy Period End Date]. Such policy includes, at a minimum, coverage for technology errors and omissions, network security liability, privacy liability, data breach response costs, regulatory defense and penalties (where insurable), and media liability.
(b) Commercial General Liability Insurance. Per-occurrence limit of not less than $[Insert Per-Occurrence Limit] and an annual aggregate limit of not less than $[Insert Aggregate Limit], including coverage for bodily injury, property damage, personal and advertising injury, and products/completed operations liability.
(c) Workers' Compensation Insurance. Workers' compensation insurance as required by Applicable Law in each state or jurisdiction in which Licensor's employees perform services, with coverage at or above statutory limits, and employer's liability insurance with limits of not less than $[Insert Limit] per accident, $[Insert Limit] per employee for disease, and $[Insert Limit] aggregate for disease.
(d) Umbrella / Excess Liability Insurance. Umbrella or excess liability coverage in an amount not less than $[Insert Limit] per occurrence and in the annual aggregate, following form and in excess of the underlying Commercial General Liability and Employer's Liability policies described above.
The undersigned officer of Licensor further certifies that:
(i) Licensee has been added as an additional insured on Licensor's Commercial General Liability, Technology Errors & Omissions / Cyber Liability, and Umbrella / Excess Liability policies, to the extent required by Section [__] of the Agreement;
(ii) A current certificate of insurance evidencing all coverage required by the Agreement has been delivered to Licensee concurrently with this Certificate (or has been previously delivered to Licensee and remains current as of the Go-Live Date); and
(iii) Licensor has not received, as of the date hereof, any notice of cancellation, non-renewal, or material modification of any of the insurance policies described above, and to Licensor's knowledge, no event has occurred that would give rise to a right of cancellation, non-renewal, or material modification by the applicable insurance carrier.
3.5 Compliance with Applicable Law
The undersigned officer of Licensor hereby certifies that, as of the Go-Live Date, Licensor is in material compliance with all Applicable Laws relevant to the performance of Licensor's obligations under the Agreement, including, without limitation, the following regulatory frameworks to the extent applicable to Licensor in connection with the Platform and the services provided under the Agreement:
•  The Gramm-Leach-Bliley Act ("GLBA"), including the Safeguards Rule (16 C.F.R. Part 314) and the Privacy Rule (12 C.F.R. Part 1016), as applicable to service providers of financial institutions;
•  The Bank Secrecy Act ("BSA") and applicable anti-money laundering ("AML") regulations promulgated thereunder, to the extent Licensor's Platform or services are implicated in Licensee's BSA/AML compliance program;
•  State data breach notification laws applicable to the personal information of Licensee's customers and employees processed through the Platform;
•  The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA"), to the extent applicable;
•  [Insert any additional applicable regulatory frameworks, e.g., the Health Insurance Portability and Accountability Act ("HIPAA"), the Payment Card Industry Data Security Standard ("PCI DSS"), the EU General Data Protection Regulation ("GDPR"), or state-specific financial services regulations];
•  All other federal, state, and local laws and regulations applicable to Licensor's business and the services provided under the Agreement.
The undersigned officer of Licensor further certifies that Licensor has not received, as of the Go-Live Date, any notice of investigation, enforcement action, consent order, cease-and-desist order, civil investigative demand, subpoena, or material regulatory finding or examination report from any governmental authority, regulatory body, or self-regulatory organization that relates to the Platform, the services provided under the Agreement, or Licensor's performance of its obligations under the Agreement, or that would reasonably be expected to materially and adversely affect Licensor's ability to perform its obligations under the Agreement.
3.6 No Litigation or Proceedings
The undersigned officer of Licensor hereby certifies that, as of the Go-Live Date, there is no pending or, to Licensor's knowledge (after due and reasonable inquiry), threatened action, suit, claim, litigation, arbitration, regulatory proceeding, governmental investigation, or other legal or administrative proceeding of any kind (collectively, "Proceedings") against Licensor, any of its officers, directors, or key personnel, or any of its affiliates or subcontractors engaged in the performance of services under the Agreement, that:
(a) challenges or seeks to enjoin, restrain, or otherwise prevent the consummation of the transactions contemplated by the Agreement or the performance of Licensor's obligations thereunder;
(b) relates to the Platform, the services, the Licensee Data, or the intellectual property rights licensed under the Agreement; or
(c) would, individually or in the aggregate, reasonably be expected to have a material adverse effect on Licensor's financial condition, business operations, or ability to perform its obligations under the Agreement in a timely and complete manner.
For purposes of this Section 3.6, "knowledge" of Licensor means the actual knowledge, after due and reasonable inquiry, of Licensor's Chief Executive Officer, Chief Technology Officer, Chief Information Security Officer, General Counsel (or equivalent officer), and Vice President of Engineering (or equivalent officer responsible for Platform development and delivery).
3.7 Data Security
The undersigned officer of Licensor hereby certifies that, as of the Go-Live Date:
(a) No Undisclosed Security Incidents. No Security Incident (as defined in the Agreement) affecting Licensee Data or Licensee's tenant environment within the Platform has occurred since the date of the Agreement that has not been previously disclosed to Licensee in writing in accordance with the notification and incident response procedures set forth in Section [__] of the Agreement and the Security Exhibit (Exhibit B). For the avoidance of doubt, this certification encompasses unauthorized access to, acquisition of, use of, disclosure of, modification of, destruction of, or loss of any Licensee Data, whether resulting from a breach of Licensor's security measures, the actions of Licensor's personnel, the actions of a subprocessor, or a third-party attack or intrusion.
(b) Data Residency. All Licensee Data processed, stored, transmitted, or otherwise maintained by Licensor or its approved subprocessors in connection with the Platform and the services is hosted and maintained exclusively within the data hosting regions approved by Licensee as set forth in the Agreement, the Security Exhibit, and/or the Data Processing Addendum. As of the Go-Live Date, the approved data hosting regions are: [Insert Approved Data Hosting Region(s), e.g., "United States (Meridian Technologies us-east-1 and us-west-2 regions)" or "United States and European Union (as further specified in the Security Exhibit)"]. No Licensee Data is stored, processed, or accessible from any data center, server, or computing environment located outside of the approved data hosting regions, except as expressly permitted by the Agreement and approved by Licensee in writing.
(c) Subprocessor Disclosure and Approval. All subprocessors (as defined in the Data Processing Addendum) engaged by Licensor as of the Go-Live Date in connection with the processing of Licensee Data have been disclosed to Licensee and approved by Licensee in accordance with Section [__] of the Data Processing Addendum (Exhibit C). As of the Go-Live Date, the approved subprocessors are as follows:
No subprocessor has been engaged or authorized to process Licensee Data that has not been disclosed to and approved by Licensee in accordance with the procedures set forth in the Data Processing Addendum. Each such subprocessor is bound by written contractual obligations providing data protection and information security obligations no less protective than those set forth in the Agreement and the Data Processing Addendum.
SECTION 4: RELIANCE
This Certificate is delivered for the benefit of Licensee and its successors and permitted assigns, and Licensee and such successors and permitted assigns are entitled to rely on the certifications contained herein in connection with the Go-Live Date and the commencement of production use of the Platform. The undersigned officer acknowledges that Licensee is relying on the truth and accuracy of the certifications set forth herein as a material inducement to (a) permit the Platform to proceed to Go-Live, (b) commence payment of Production Use Fees and other amounts due under the Agreement and the applicable Order Form, and (c) begin processing Licensee Data through the Platform in a production environment.
This Certificate is delivered pursuant to, and is subject to the terms and conditions of, the Agreement. Nothing in this Certificate shall be deemed to modify, amend, supplement, or supersede any term or provision of the Agreement, and in the event of any conflict or inconsistency between the terms of this Certificate and the terms of the Agreement, the terms of the Agreement shall govern and control. The certifications set forth herein are made as of the Go-Live Date and shall not be construed to impose upon Licensor any obligation to update or supplement such certifications after the Go-Live Date, except as may be expressly required by the Agreement.
SECTION 5: GOVERNING LAW
This Certificate shall be governed by and construed in accordance with the laws of the State of [Insert Governing Law Jurisdiction], without giving effect to any choice or conflict of law provision or rule (whether of the State of [Insert Governing Law Jurisdiction] or any other jurisdiction) that would cause the application of the laws of any jurisdiction other than the State of [Insert Governing Law Jurisdiction]. The governing law provision of this Certificate is intended to be consistent with, and shall be interpreted in a manner consistent with, the governing law provision set forth in Section [__] of the Agreement.
SECTION 6: EXECUTION
IN WITNESS WHEREOF, the undersigned has executed this Bring-Down Certificate as of the Go-Live Date first written above.
[INSERT FULL LEGAL NAME OF LICENSOR]
By: ________
Name: [Insert Name of Authorized Officer]
Title: [Insert Title, e.g., Chief Executive Officer]
Date: [Insert Go-Live Date]
Instruction: This Certificate is to be executed by a duly authorized officer of Licensor. The signatory must have actual authority to deliver this Certificate on behalf of Licensor and must have made due inquiry — including consultation with Licensor's legal, information security, engineering, compliance, and insurance personnel, as appropriate — sufficient to support each of the certifications set forth herein. If the signatory is not the Chief Executive Officer of Licensor, evidence of such signatory's authority (e.g., a board resolution, officer's certificate, or delegation of authority letter) should be provided to Licensee upon request.
SCHEDULE OF ATTACHMENTS
The following documents are attached to, or delivered concurrently with, this Certificate, as indicated below. Documents marked as "Previously Delivered" have been provided to Licensee prior to the Go-Live Date; Licensor confirms that such documents remain current and accurate as of the Go-Live Date unless otherwise noted.
Instruction: Complete the status column above by checking the applicable box for each document. Ensure that all documents required to be delivered on or prior to the Go-Live Date pursuant to the Agreement have been delivered or are being delivered concurrently with this Certificate. Retain copies of all attachments and delivery confirmations in Licensor's records.
[END OF BRING-DOWN CERTIFICATE]
Subprocessor Name | Service Provided | Data Hosting Location
[Insert Subprocessor Name] | [Insert Description of Service] | [Insert Location]
[Insert Subprocessor Name] | [Insert Description of Service] | [Insert Location]
[Insert Subprocessor Name] | [Insert Description of Service] | [Insert Location]
[Insert additional rows as applicable]
No. | Document | Status
1 | Most recent SOC 2 Type II audit report | [ ] Attached hereto / [ ] Previously delivered on [date] / [ ] Available upon request subject to NDA
2 | Most recent ISO 27001 certificate | [ ] Attached hereto / [ ] Previously delivered on [date] / [ ] Available upon request
3 | Current certificate of insurance | [ ] Attached hereto / [ ] Previously delivered on [date]
4 | List of approved subprocessors as of the Go-Live Date | [ ] Set forth in Section 3.7(c) above / [ ] Attached hereto as Schedule A
5 | [Insert any additional deliverables required by the Agreement, e.g., penetration test executive summary, disaster recovery test results, data flow diagram, or evidence of completed background checks for key personnel] | [ ] Attached hereto / [ ] Previously delivered on [date] / [ ] Not applicable

BRING-DOWN CERTIFICATE

SECTION 1: RECITALS

SECTION 2: DEFINITIONS

SECTION 3: CERTIFICATIONS

SECTION 4: RELIANCE

SECTION 5: GOVERNING LAW

SECTION 6: EXECUTION

SCHEDULE OF ATTACHMENTS

Record

Parties

Dates

Amounts