CLOSING MEMORANDUM
CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED
This memorandum is protected by the attorney-client privilege and work product doctrine. It is intended solely for the use of Skybridge Fintech Ltd. and its authorized representatives. Any distribution, copying, or disclosure to third parties without prior written consent of Calderwood & Harkness LLP is strictly prohibited.
Matter Number: 1009-00007
Prepared By: Amy Chesterton, Lead Associate, Calderwood & Harkness LLP
Reviewed By: Angela Fontaine, Responsible Partner; Liam Prescott, Of Counsel (Technology Transactions)
Date: [Date of Closing — to be inserted upon execution]
Re: Enterprise Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. and Meridian National Bank, National Association — SkyComply™ Platform
Right-click to update Table of Contents
I. PURPOSE AND EXECUTIVE SUMMARY
This memorandum summarizes the closing of the enterprise Software-as-a-Service transaction between Skybridge Fintech Ltd. ("Skybridge" or "SBF"), as Licensor, and Meridian National Bank, National Association ("Meridian" or "MNB"), as Licensee, for the deployment of Skybridge's AI-driven anti-money-laundering and transaction-monitoring platform, SkyComply™ (the "Transaction"). The purpose of this memorandum is to provide a comprehensive record of the negotiation outcomes, final document terms, closing deliverables, post-closing obligations, and relevant third-party relationships associated with the Transaction.
Calderwood & Harkness LLP ("C&H") represented Skybridge as outside counsel in negotiating and documenting the Transaction. Meridian was represented by its outside counsel, Hargrove, Tully & Cascade Insurance Brokers ("HTM"), led by Douglas Krenshaw. The negotiation process commenced in early September 2025 and proceeded through multiple rounds of drafting and mark-up exchanges, culminating in the closing described herein.
The Transaction is structured as a five-year Master Software-as-a-Service Agreement (the "MSA") with a total contract value ("TCV") of Fifty Million Dollars ($50,000,000). The MSA is accompanied by an Order Form setting forth specific commercial terms and pricing, four incorporated exhibits (a Service Level Agreement Exhibit, a Security Exhibit, a Data Processing Addendum, and an Acceptable Use Policy), and a three-party Source Code Escrow Agreement among Skybridge, Meridian, and Sentinel Escrow Services, Inc. as Escrow Agent.
At closing, all documents were duly executed and delivered by the respective parties, and all conditions precedent to closing were satisfied, including the written consent of Pinnacle Ridge Capital Partners, LP ("PRCP"), Skybridge's majority owner, which holds contractual approval rights over contracts exceeding $25,000,000 in total value. The parties are now proceeding to the implementation phase, with a targeted commencement date of September 15, 2025 and a targeted Platform Go-Live Date of March 1, 2026.
This memorandum is organized as follows: Section II identifies the parties and their key personnel; Section III describes the transaction structure and agreement architecture; Section IV details the key commercial terms; Section V presents the final resolution of major negotiated issues; Sections VI through IX address the source code escrow, majority owner consent, executed documents, and post-closing obligations, respectively; and Section X summarizes the C&H engagement. A cross-reference to the separate Closing Checklist is included as Appendix A.
II. PARTIES TO THE TRANSACTION
A. Skybridge Fintech Ltd. (Licensor / Client)
Full Legal Name: Skybridge Fintech Ltd.
Entity Type: Delaware limited company (alternative entity organized under the Delaware Limited Liability Company Act and subsequently converted to a limited company under the Delaware Alternative Entity statute, Title 6, Chapter 17 of the Delaware Code)
Jurisdiction of Formation: State of Delaware
Headquarters: 1400 Concord Pike, Suite 320, Wilmington, DE 19803
The following individuals served as primary contacts and decision-makers for Skybridge throughout the negotiation and closing of the Transaction:
Company Background: Skybridge is a growth-stage fintech SaaS company founded in 2018, currently employing approximately 420 individuals. For fiscal year 2024, Skybridge reported audited revenue of $78.3 million (audited by Hathaway & Pendleton, LLP; unqualified audit opinion dated April 30, 2025, led by Audit Partner Bruce Ogilvie), EBITDA of $11.7 million, a gross margin of 74%, and a net retention rate of 118%. Skybridge's annualized recurring revenue ("ARR") stands at approximately $78 million. The company currently serves over 60 banking and financial services clients across the United States and internationally.
Skybridge holds a SOC 2 Type II certification, as evidenced by a report issued by Crestfield Cyber Advisors, Inc. dated March 15, 2025, and an ISO 27001 certification, as evidenced by a recertification issued by Crestfield dated January 22, 2025. Both certifications were material to Meridian's vendor due diligence process and are referenced extensively in the Security Exhibit attached to the MSA.
Majority Owner: Pinnacle Ridge Capital Partners, LP ("PRCP"), a Delaware limited partnership operating as a growth-equity fund with approximately $3.4 billion in assets under management. PRCP's Managing Partner is Elise Drummond. PRCP holds a 62% ownership stake in Skybridge, acquired in connection with a 2021 Series C equity financing round at a pre-money valuation of $310 million. Pursuant to the terms of Skybridge's operating agreement and certain side letter arrangements, PRCP holds board representation through two designated directors and maintains approval rights over any contract entered into by Skybridge with a total value exceeding $25,000,000. As the TCV of the MSA with Meridian is $50,000,000, PRCP consent was required and obtained as described in Section VII below.
B. Meridian National Bank, National Association (Licensee / Counterparty)
Full Legal Name: Meridian National Bank, National Association
Entity Type: National banking association, chartered under the National Bank Act and operating pursuant to a national bank charter issued by the Office of the Comptroller of the Currency ("OCC")
Jurisdiction: Chartered under federal law; principal office located in the State of New York
Headquarters: 600 Lexington Avenue, 40th Floor, New York, NY 10022
Holding Company: Meridian Financial Group, Inc. ("MFG"), a publicly traded Delaware corporation listed on the New York Stock Exchange (NYSE: MFG)
Total Assets: Approximately $485 billion, placing Meridian among the top ten U.S. banks by total assets
Regulatory Status: Meridian is designated as a systemically important financial institution ("SIFI") and is subject to supervision and regulation by the OCC, the Board of Governors of the Federal Reserve System (the "Federal Reserve"), and the Federal Deposit Insurance Corporation (the "FDIC"). Meridian's regulatory status was a significant factor in the negotiation of various terms of the MSA, including the regulatory compliance provisions, audit rights, security requirements, and the Bank Service Company Act acknowledgments described in detail below.
The following individuals served as primary contacts and decision-makers for Meridian throughout the Transaction:
Deployment Scope: The MSA contemplates the replacement of Meridian's existing legacy AML platform with the SkyComply™ platform across Meridian's retail banking, commercial banking, and wealth management divisions. The initial deployment will encompass approximately 32,000 licensed users across Meridian's U.S. and international operations, making this one of the largest single SkyComply™ deployments to date.
C. Outside Counsel
Skybridge's Counsel — Calderwood & Harkness LLP
200 South Ashbury Asset Advisors, Suite 1800 Chicago, IL 60604
Angela Fontaine served as the responsible partner and senior advisor on all material negotiation points, including the indemnification caps, liability framework, and consequential damages carve-outs. Liam Prescott, who specializes in technology transactions involving regulated financial institutions, provided subject-matter guidance on the regulatory compliance provisions, the source code escrow structure, and the SLA framework. Amy Chesterton served as the lead associate responsible for day-to-day drafting, mark-up exchanges, and client coordination. Nathan Ikeda supported the engagement with drafting assistance, document management, and preparation of the Closing Checklist.
Meridian's Counsel — Hargrove, Tully & Cascade Insurance Brokers
1 Chase Manhattan Plaza, Suite 5500 New York, NY 10005
Douglas Krenshaw served as Meridian's lead outside counsel. HTM's negotiation posture was consistent with institutional bank-side expectations, reflecting heightened requirements around data security, regulatory compliance, audit rights, and uncapped liability exposure for data-related breaches. Megan Faircloth was the primary day-to-day contact for mark-up exchanges and served as lead drafter on several bank-side provisions.
Pinnacle Ridge's Counsel (Consent Review) — Alcott & Grenier LLP
1001 Pennsylvania Avenue NW, Suite 700 Washington, DC 20004
Simone Alcott reviewed the form of written consent on behalf of PRCP to confirm that PRCP's entry into the consent did not impose any additional obligations on the fund, and that the terms of the MSA were consistent with PRCP's investment parameters and governance expectations. The consent process was completed efficiently; Ms. Alcott's principal concern related to the aggregate liability cap and its adequacy relative to the TCV, which was addressed to her satisfaction after review of the final liability framework.
III. TRANSACTION OVERVIEW AND AGREEMENT STRUCTURE
A. Transaction Summary
The table below summarizes the key structural parameters of the Transaction:
SkyComply™ is Skybridge's flagship enterprise platform, which leverages artificial intelligence and machine learning models to perform real-time transaction monitoring, suspicious activity detection, customer due diligence and enhanced due diligence screening, sanctions screening, and regulatory reporting in connection with the Bank Secrecy Act ("BSA"), the USA PATRIOT Act, and related anti-money-laundering regulations. The platform is deployed on a multi-tenant cloud architecture hosted by Orion Cloud Services, Inc. with dedicated data residency within the continental United States for regulated financial institution clients.
The Transaction represents a significant strategic win for Skybridge, constituting the company's largest single contract to date by TCV and establishing a flagship relationship with a top-10 U.S. bank. It also represents a meaningful expansion of Skybridge's presence in the large-bank segment of the financial services industry.
B. Agreement Structure
The Transaction is documented through the following suite of agreements, each of which was executed and delivered at closing or, in the case of certain exhibits, was executed as part of and incorporated by reference into the MSA:
1. Master Software-as-a-Service Agreement ("MSA") — the principal agreement governing the license grant, service obligations, commercial relationship, and legal framework between the parties. The MSA contains 27 articles and incorporates the Order Form and all exhibits by reference.
2. Order Form — attached to and incorporated by reference into the MSA, setting forth the specific commercial terms for the initial deployment, including licensed user counts, fee calculations, payment schedule, implementation milestones, and incremental user pricing. The Order Form is structured as a standalone document executed by both parties for ease of amendment in the event of future scope changes.
3. Exhibit A — Service Level Agreement Exhibit ("SLA Exhibit") — sets forth uptime commitments, credit structures, exclusions, measurement methodology, maintenance windows, incident severity classifications, and response time targets.
4. Exhibit B — Security Exhibit — specifies the security controls, certifications, encryption standards, data residency requirements, penetration testing obligations, security incident notification procedures, audit rights, subprocessor approval processes, background check requirements, and data retention and deletion obligations applicable to Skybridge's hosting and processing of Meridian data.
5. Exhibit C — Data Processing Addendum ("DPA") — addresses data processing obligations under the Gramm-Leach-Bliley Act ("GLBA"), applicable state data privacy laws, and any international data protection regimes that may apply to Meridian's international operations. The DPA designates Skybridge as a "service provider" (and, for GLBA purposes, a processor of nonpublic personal information) and establishes data processing instructions, subprocessor obligations, and cross-border data transfer restrictions.
6. Exhibit D — Acceptable Use Policy ("AUP") — establishes the acceptable use parameters for Meridian's access to and use of the SkyComply™ platform, including prohibited activities, user responsibility provisions, and the basis for Meridian's indemnification obligations under the MSA with respect to claims arising from breach of the AUP.
7. Source Code Escrow Agreement — a three-party agreement among Skybridge (as Depositor), Meridian (as Beneficiary), and Sentinel Escrow Services, Inc. (as Escrow Agent). The agreement is identified as Escrow Agreement Number SCE-2025-04417 and governs the deposit, maintenance, verification, and conditional release of the SkyComply™ source code and related build materials. The Escrow Agreement is a standalone instrument executed by all three parties and is not formally an exhibit to the MSA, though the MSA contains a cross-reference to it and conditions certain closing obligations upon its execution.
IV. KEY COMMERCIAL TERMS
A. Fee Structure and Pricing
The commercial terms of the Transaction were negotiated to reflect both the scale of the Meridian deployment and the strategic importance of the relationship for Skybridge. The fee structure is set forth in the Order Form and is summarized as follows:
Licensed Users: 32,000 named users initially. The named-user licensing model requires each individual who accesses the SkyComply™ platform to be assigned a unique user license. User licenses are non-transferable between individuals but may be reassigned upon cessation of a prior user's access.
Platform Subscription Fee (Pre-discount): $8,200,000 per year, calculated as 32,000 users at a per-user rate of $256.25 per user per year. This rate represents a negotiated discount from Skybridge's standard list price of $300 per user per year, reflecting Meridian's volume commitment.
Implementation & Onboarding Services (Year 1 Only): $3,600,000. This is a one-time fee covering the configuration, customization, data migration, integration, testing, and user training services required to bring SkyComply™ to a production-ready state for Meridian's environment. The implementation services are governed by the implementation plan referenced in the MSA and are expected to be performed during the Implementation Period (September 15, 2025 through February 28, 2026).
Ongoing Support & Managed Services: $1,800,000 per year (Years 1 through 5). This fee covers Skybridge's provision of ongoing technical support, platform maintenance, software updates, and dedicated managed services personnel for the Meridian account.
Gross Undiscounted TCV Calculation:
Volume discount: The parties agreed to a volume discount applied across the total contract value, resulting in a net TCV of $50,000,000. The effective discount rate is approximately 6.72%, calculated as ($53,600,000 − $50,000,000) ÷ $53,600,000.
Year 1 Fees (Post-discount): $12,700,000 (as set forth in the Order Form, reflecting the application of the volume discount primarily to the Year 1 implementation and subscription components).
Years 2–5 Annual Fees: $9,325,000 per year, calculated as ($50,000,000 − $12,700,000) ÷ 4 = $9,325,000. The annual fee for Years 2 through 5 is inclusive of the platform subscription fee and the ongoing support and managed services fee, as adjusted by the volume discount.
Incremental User Rate: $275 per user per year for any named users added in excess of the initial 32,000 user allotment. The incremental user rate is not subject to the volume discount and will be invoiced quarterly in arrears based on the number of additional users provisioned during the applicable quarter.
Annual Escalator: Beginning in Year 3, the annual fees are subject to a 3.0% CPI-based escalation, calculated based on the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, as published by the Bureau of Labor Statistics. The escalator is capped at 3.5% per year. If CPI-U increases by less than 3.0% in a given measurement period, the escalation rate will default to the actual CPI-U increase. If CPI-U is negative, no reduction will apply (i.e., fees are subject to a floor of 0% escalation in any given year). This escalation provision was the subject of moderate negotiation; Meridian initially sought a 2.0% cap and Skybridge proposed 4.0%. The 3.0% rate with a 3.5% cap represents a reasonable compromise that protects Skybridge against inflationary cost increases while providing Meridian with predictable budgeting parameters.
Payment Terms: All fees are payable quarterly in advance. Skybridge will issue invoices at least fifteen (15) days prior to the commencement of each calendar quarter, and payment is due within thirty (30) days of the invoice date (net 30). Late payments accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law. The quarterly in-advance billing structure provides Skybridge with favorable cash flow characteristics consistent with SaaS industry norms.
B. Term and Renewal
Initial Term: The initial term of the MSA is five (5) years, commencing on the Platform Go-Live Date (targeted for March 1, 2026) and continuing through February 28, 2031 (the "Initial Term"). The commencement of the Initial Term is tied to the Go-Live Date rather than the execution date, recognizing that Meridian's full use of the platform will not begin until the implementation services have been completed and the platform is in a production-ready state.
Renewal: Following expiration of the Initial Term, the MSA will automatically renew for two (2) successive one-year renewal terms (each, a "Renewal Term"), unless either party provides the other with written notice of non-renewal at least one hundred eighty (180) days prior to the expiration of the then-current term. This structure provides Meridian with a maximum potential contractual relationship of seven (7) years (the five-year Initial Term plus two one-year Renewal Terms) while ensuring that neither party is locked into the relationship beyond the Initial Term without an affirmative decision not to exercise the non-renewal right.
Termination for Convenience by Meridian: Meridian may terminate the MSA for convenience at any time after the second anniversary of the Platform Go-Live Date (i.e., after March 1, 2028), provided that Meridian delivers twelve (12) months' prior written notice of termination and pays an early termination fee ("ETF"). The ETF is equal to fifty percent (50%) of the remaining Annual Contract Value ("ACV") for the then-current term. By way of illustration:
• If Meridian terminates effective at the end of Year 3 (March 1, 2029), the ETF would equal 50% × $9,325,000 × 2 remaining years = $9,325,000.
• If Meridian terminates effective at the end of Year 4 (March 1, 2030), the ETF would equal 50% × $9,325,000 × 1 remaining year = $4,662,500.
The ETF structure was negotiated as a compromise between Meridian's desire for termination flexibility (reflecting the possibility of a change in strategic direction, regulatory mandate, or technology evolution) and Skybridge's need for revenue certainty and protection of its investment in implementation and onboarding. The twelve-month notice period provides Skybridge with adequate time to plan for the revenue impact and to reallocate resources accordingly.
V. KEY NEGOTIATED TERMS — FINAL RESOLUTION OF OPEN ISSUES
This Section presents the final resolution of the principal issues that were subject to extended negotiation between the parties. Each subsection identifies the initial positions of the respective parties, the negotiation dynamics, and the final agreed position reflected in the executed documents. These issues were discussed over the course of approximately six weeks of active negotiation, involving multiple in-person sessions and video conferences among the legal teams, as well as a principal-to-principal call between David Shimura and Catherine Woo to resolve the data breach indemnity cap impasse described below.
A. SLA Uptime Standard
Meridian's Initial Position: 99.95% monthly uptime. This is a bank-standard requirement for mission-critical platforms, and HTM cited the regulatory expectations under OCC Bulletin 2013-29 and the Interagency Guidance on Third-Party Relationships as support for this position.
Skybridge's Initial Position: 99.9% monthly uptime. Skybridge maintained that 99.9% is the industry standard for enterprise SaaS platforms and that committing to 99.95% would effectively require Skybridge to guarantee performance beyond its direct control, including upstream infrastructure dependencies.
Final Agreed Position: The parties agreed on a 99.9% monthly uptime commitment, measured on a calendar-month basis exclusive of scheduled maintenance windows. Scheduled maintenance windows are defined as Saturdays from 2:00 AM to 6:00 AM Eastern Time, with a maximum of four (4) hours of scheduled maintenance per week. Uptime is calculated using the following formula:
Uptime Percentage = ((Total Minutes in Calendar Month − Downtime Minutes) ÷ Total Minutes in Calendar Month) × 100
where "Downtime Minutes" excludes (a) scheduled maintenance windows, (b) force majeure events, (c) downtime caused by Meridian's systems or networks, and (d) downtime resulting from Meridian's failure to implement recommended platform updates within the applicable remediation window.
The compromise was achieved by coupling the 99.9% uptime standard with an enhanced credit structure (described in Section V.B below) and the inclusion of a Meridian termination right triggered by persistent underperformance. Skybridge noted to Meridian that Orion Cloud Services, Inc., Skybridge's upstream IaaS provider, provides a 99.95% monthly uptime SLA for the infrastructure layer, thereby providing a meaningful buffer above the 99.9% commitment to Meridian and reducing the practical likelihood that Skybridge would fall below the committed threshold due to infrastructure-related outages.
B. SLA Credit Structure
The SLA credit structure was among the more heavily negotiated commercial terms. The final credit tiers are as follows:
Monthly Credit Cap: 30% of the monthly subscription fee. Based on the Year 1 annual subscription fee component of the total Year 1 fee, this equates to a maximum monthly credit of approximately $317,500 in Year 1. For Years 2 through 5, the maximum monthly credit is approximately $233,125 (based on an annual fee of $9,325,000, divided by 12, multiplied by 30%).
Annual Credit Cap: 15% of the annual subscription fee. This equates to a maximum annual credit of approximately $1,905,000 in Year 1 and approximately $1,398,750 in Years 2 through 5.
Meridian's Initial Position: HTM originally proposed uncapped SLA credits — that is, Meridian would receive dollar-for-dollar credits for all downtime without any monthly or annual ceiling. This position was consistent with Meridian's view that SkyComply™ is a mission-critical platform and that the financial consequences of downtime (including regulatory risk, operational disruption, and reputational harm) could significantly exceed any capped credit amount.
Skybridge's Initial Position: Skybridge initially proposed a simpler two-tier credit structure with a monthly cap of 15% and an annual cap of 10%.
Final Resolution: The final credit structure reflects a compromise that balances Meridian's need for meaningful financial protection with Skybridge's need to limit its maximum credit exposure in any given period. The critical concession from Skybridge's perspective was the inclusion of the termination right for persistent underperformance — specifically, Meridian's right to terminate the MSA if uptime falls below 98.0% in three (3) of any consecutive six (6) months. This termination right serves as Meridian's primary bank-side protection against chronic service degradation and was viewed by HTM as an adequate substitute for uncapped financial credits. From Skybridge's perspective, the termination right was preferable to uncapped credits because it limits Skybridge's ongoing financial exposure while creating a strong performance incentive (i.e., the risk of losing the entire $50 million contract).
C. Critical Incident Response Times
The final incident response time commitments, as set forth in the SLA Exhibit, are as follows:
Severity classification is determined by Meridian in the first instance, subject to Skybridge's reasonable right to propose reclassification through the incident management process. The resolution targets are targets rather than guaranteed resolution times, but a pattern of failure to meet resolution targets may be raised in the quarterly Steering Committee meeting and, if persistent, may constitute grounds for escalation under the dispute resolution procedures.
D. Indemnification. Indemnification was among the most heavily negotiated areas of the MSA and involved extensive discussion between counsel on both sides. The final indemnification framework is structured as a mutual indemnification, with asymmetric obligations reflecting the differing risk profiles of the parties.
Skybridge's Indemnification Obligations (in favor of Meridian):
(a) IP Infringement Indemnity. Skybridge will defend, indemnify, and hold harmless Meridian from and against any third-party claims alleging that Meridian's authorized use of the SkyComply™ platform infringes any U.S. patent, copyright, trademark, or trade secret. The IP infringement indemnity is uncapped, which is consistent with industry standard practice for enterprise SaaS agreements.
(b) Data Breach Indemnity. Skybridge will defend, indemnify, and hold harmless Meridian from and against any third-party claims arising from a breach of Skybridge's data security and confidentiality obligations under the MSA, Security Exhibit, and DPA that results in the unauthorized access, disclosure, or exfiltration of Meridian data.
(c) Legal Compliance Indemnity. Skybridge will defend, indemnify, and hold harmless Meridian from and against any third-party claims arising from Skybridge's material breach of applicable law, including the Gramm-Leach-Bliley Act, BSA/AML regulations, and applicable state data breach notification laws.
Meridian's Indemnification Obligations (in favor of Skybridge):
(a) Claims arising from Meridian's breach of the Acceptable Use Policy.
(b) Claims arising from data or content provided by Meridian to the SkyComply™ platform that infringes the intellectual property or other rights of any third party.
(c) Claims arising from Meridian's material breach of applicable law.
IP Indemnity Cap: Uncapped. This is consistent with industry standard practice and was not a point of significant negotiation.
Data Breach Indemnity Cap — Final Resolution:
The data breach indemnity cap was the single most contentious issue in the negotiation and required multiple rounds of discussion, including a principal-to-principal call between David Shimura and Catherine Woo, as well as direct involvement by Angela Fontaine and Douglas Krenshaw.
Meridian's Initial Position: Uncapped data breach indemnification. HTM argued that Meridian, as a SIFI regulated by federal banking agencies, faces potentially catastrophic exposure in the event of a data breach involving its AML systems, including regulatory fines, enforcement actions, class action litigation, and reputational harm. HTM maintained that Skybridge, as the party with sole custody and control of Meridian's data within the SkyComply™ platform, should bear uncapped responsibility for the consequences of a breach attributable to Skybridge's failures.
Skybridge's Initial Position: A cap of 2× annual fees, or approximately $18,650,000 (based on steady-state annual fees of $9,325,000). Skybridge argued that an uncapped indemnity for data breach claims was commercially unreasonable for a SaaS provider and inconsistent with Skybridge's insurable risk profile.
Final Agreed Position: After extensive negotiation, the parties agreed to a data breach indemnity cap of 3× annual fees paid or payable in the twelve (12) months preceding the event giving rise to the claim. Based on the steady-state annual fees of $9,325,000, this equates to an approximate cap of $27,975,000. In reaching this compromise, C&H emphasized (a) the adequacy of Skybridge's cyber liability insurance coverage ($25 million per occurrence / $50 million aggregate), (b) the robust security controls specified in the Security Exhibit, (c) Skybridge's SOC 2 Type II and ISO 27001 certifications, and (d) the 18-hour security incident notification obligation (discussed below), which provides Meridian with early notice to mitigate damages. HTM accepted the 3× cap on the condition that the data breach indemnity cap would be treated as a separate "super-cap" that applies independently of and in addition to the general aggregate liability cap (rather than being subsumed within it). This means that Skybridge's maximum data breach indemnity exposure of approximately $27,975,000 is in addition to, and not counted against, the 2× aggregate liability cap of approximately $18,650,000 discussed in Section V.E below.
General Indemnity Cap: For all indemnification obligations other than the IP indemnity (uncapped) and the data breach indemnity (3× super-cap), each party's indemnification liability is capped at 1× the annual fees paid or payable in the twelve (12) month period preceding the event giving rise to the claim, or approximately $9,325,000.
IP Infringement Exclusive Remedy: In addition to the indemnification obligation, the MSA provides that Skybridge's exclusive remedy options in the event of an IP infringement claim are as follows:
(a) Procure from the claimant a license or other right for Meridian to continue using the affected components of the SkyComply™ platform;
(b) Modify the platform (including through re-engineering, substitution, or workaround) to render it non-infringing without materially diminishing its functionality; or
(c) If neither option (a) nor option (b) is commercially practicable within a reasonable period, terminate the affected portion of the subscription and refund to Meridian any pre-paid fees on a pro rata basis for the unused portion of the then-current term.
E. Liability Caps
Aggregate Liability Cap: Each party's total aggregate liability under the MSA (exclusive of the Uncapped Items described below) is capped at 2× the annual fees paid or payable in the twelve (12) months preceding the event giving rise to the claim. Based on the steady-state annual fees of $9,325,000, this equates to an approximate aggregate liability cap of $18,650,000.
Exclusions from Cap (Uncapped Items): The following categories of liability are excluded from the aggregate liability cap and are not subject to any dollar limitation:
(a) Skybridge's IP infringement indemnification obligations;
(b) Liability arising from gross negligence or willful misconduct by either party;
(c) Skybridge's obligations with respect to post-termination data export and certified destruction (Section VI.F of the Security Exhibit); and
(d) Payment obligations (i.e., Meridian's obligation to pay fees and Skybridge's obligation to remit SLA credits and refunds).
Confidentiality/Data Security Super-Cap — Final Resolution:
Skybridge's Initial Position: 3× annual fees (approximately $27,975,000) as a combined super-cap for all confidentiality and data security liabilities, inclusive of the data breach indemnity.
Meridian's Initial Position: Uncapped liability for all confidentiality and data security breaches, consistent with its position on the data breach indemnity cap.
Final Agreed Position: The parties agreed to a confidentiality/data security super-cap of 3× annual fees (approximately $27,975,000), which applies to all direct claims, losses, and liabilities arising from breaches of the confidentiality and data security provisions of the MSA, Security Exhibit, and DPA (including but not limited to the data breach indemnity obligations). As noted in Section V.D above, this 3× super-cap operates independently of and in addition to the 2× general aggregate liability cap. Accordingly, Skybridge's maximum combined exposure under the MSA (exclusive of uncapped items) is the sum of the 2× aggregate cap ($18,650,000) plus the 3× data security super-cap ($27,975,000), or approximately $46,625,000 in total — though it bears noting that these two caps apply to separate and non-overlapping categories of claims.
Consequential Damages — Final Resolution:
The MSA includes a mutual exclusion of indirect, incidental, consequential, special, and punitive damages, subject to specific carve-outs. The consequential damages exclusion applies to both parties equally.
Carve-Outs from Consequential Damages Exclusion: The following categories of liability are carved out from the mutual consequential damages exclusion, meaning that either party may recover consequential damages in connection with:
(a) Breaches of the confidentiality obligations set forth in Article 11 of the MSA;
(b) IP infringement indemnification obligations under Article 14 of the MSA; and
(c) Breaches of the data security obligations set forth in the Security Exhibit and the DPA.
Regulatory Fines Carve-Out — Final Resolution:
Meridian's initial position, advanced by HTM, sought a full carve-out of regulatory fines and penalties from the consequential damages exclusion. HTM argued that regulatory fines imposed on Meridian by federal banking regulators (OCC, Federal Reserve, or FDIC) as a direct result of Skybridge's failure to maintain the SkyComply™ platform in compliance with BSA/AML requirements are a foreseeable and direct consequence of such failure, and should not be subject to the consequential damages bar. HTM further argued that the treatment of regulatory fines as "consequential damages" would effectively immunize Skybridge from liability for one of the most significant categories of harm that Meridian could suffer as a result of a platform failure.
Skybridge, through C&H, resisted the full carve-out on the grounds that (a) regulatory fines are quintessentially consequential in nature — they arise from the regulator's response to an underlying issue, not from the breach itself; (b) a full carve-out would expose Skybridge to potentially unlimited liability for matters outside its control, as regulatory fines are determined by the regulator in its sole discretion; and (c) the carve-out could fundamentally undermine the liability cap framework by creating an end-run around the agreed-upon caps.
After several rounds of negotiation, the parties reached the following compromise: regulatory fines imposed directly on Meridian by the OCC, the Federal Reserve, or the FDIC as a direct and proximate result of a material failure of the SkyComply™ platform that is attributable solely to Skybridge's breach of its obligations under the MSA are carved out from the consequential damages exclusion, but such fines are subject to the 3× data security/confidentiality super-cap (approximately $27,975,000) and are not uncapped. This resolution was acceptable to both sides: Meridian obtained the substantive protection of being able to pursue recovery of regulatory fines attributable to Skybridge failures, while Skybridge obtained the critical protection of having such recovery subject to the 3× super-cap rather than being unlimited. The standard of "attributable solely to Skybridge's breach" establishes a high causation threshold that limits the scope of this carve-out to situations where the regulatory fine is directly traceable to a Skybridge platform failure, rather than to broader compliance deficiencies within Meridian's own operations.
F. Security Provisions
Given Meridian's status as a SIFI and the sensitivity of the AML and transaction-monitoring data that will be processed through the SkyComply™ platform, the security provisions of the MSA were negotiated with exceptional rigor. The final security framework is documented primarily in the Security Exhibit (Exhibit B) and the DPA (Exhibit C), with additional cross-references in the MSA.
Security Certifications: Skybridge is required to maintain, at its sole cost and expense, current SOC 2 Type II certification (audited annually) and ISO 27001 certification (triennial recertification with annual surveillance audits) for the duration of the MSA. Skybridge's current certifications were issued by Crestfield Cyber Advisors, Inc., with the most recent SOC 2 Type II report dated March 15, 2025 and the most recent ISO 27001 recertification dated January 22, 2025. Failure to maintain either certification constitutes a material breach of the MSA, subject to a 30-day cure period.
Encryption Standards: All Meridian data at rest within the SkyComply™ environment must be encrypted using AES-256 encryption. All Meridian data in transit must be protected using TLS 1.2 or higher. Encryption keys are managed through Skybridge-managed hardware security modules ("HSMs"), with a bring-your-own-key ("BYOK") option available to Meridian. Meridian indicated during negotiations that it intends to evaluate the BYOK option during the implementation period and may elect to implement BYOK for certain categories of sensitive data.
Data Residency: All Meridian data must be stored and processed exclusively within the continental United States. The SkyComply™ platform is hosted on Orion Cloud Services, Inc. infrastructure in the US-East (Virginia) and US-West (Oregon) regions. No Meridian data may be transferred to, processed in, or accessible from any location outside the continental United States without Meridian's prior written consent. This restriction extends to Skybridge personnel access — no Skybridge employee or contractor located outside the United States may access Meridian data through the platform.
Penetration Testing — Final Resolution:
Skybridge's Initial Position: Skybridge proposed an annual third-party penetration test conducted by Crestfield Cyber Advisors, Inc. (or another mutually agreed qualified firm), with the results shared with Meridian in summary form. With respect to Meridian-initiated penetration tests, Skybridge proposed that such tests be limited to the application layer only (i.e., testing of the SkyComply™ application and APIs) and not extend to the underlying infrastructure layer managed by Orion Cloud Services.
Meridian's Initial Position: HTM, on instructions from Meridian's CISO and compliance teams, insisted on the right to conduct both infrastructure-layer and application-layer penetration testing, arguing that Meridian's regulatory obligations require end-to-end assurance of the security posture of critical third-party systems.
Final Agreed Position: The parties reached the following compromise: (a) Skybridge will engage Crestfield Cyber Advisors, Inc. (or another firm from a mutually approved list of not fewer than three qualified firms) to conduct a comprehensive annual penetration test covering both the application layer and the infrastructure layer, with the full results report delivered to Meridian within ten (10) business days of completion; (b) Meridian may, at its own expense, conduct one additional application-layer penetration test per year using a qualified third-party firm approved by Skybridge (such approval not to be unreasonably withheld), upon not less than twenty (20) business days' prior written notice and subject to reasonable coordination with Skybridge to avoid disruption to production operations; and (c) Meridian-initiated infrastructure-layer testing is not permitted as a standalone exercise, but Meridian may participate as an observer in Skybridge's annual infrastructure-layer test conducted by Crestfield, with the right to submit specific test scenarios for inclusion. This compromise was facilitated by Amara Okafor's agreement to enhance the scope and transparency of the annual Crestfield-led test, which addressed the substance of Meridian's concern without granting Meridian direct infrastructure-layer testing access that could implicate Orion Cloud Services' terms of service.
Security Incident Notification — Final Resolution:
Skybridge's Initial Position: Skybridge proposed a 24-hour notification window, measured from the time Skybridge first becomes aware of a confirmed or reasonably suspected security incident involving Meridian data.
Meridian's Initial Position: Meridian requested a 12-hour notification window, citing OCC expectations for timely notification to banking institutions by critical service providers and the need for Meridian to activate its own incident response protocols in a timely manner.
Final Agreed Position: The parties agreed to an 18-hour notification window, measured from the time Skybridge's incident response team first confirms or reasonably suspects that a security incident has occurred that involves or may involve unauthorized access to, disclosure of, or exfiltration of Meridian data. The 18-hour window was recommended by C&H during negotiations as a practical compromise that provides Meridian with substantially faster notification than the industry-standard 24 to 72 hours, while giving Skybridge's incident response team sufficient time to conduct a preliminary assessment and provide a meaningful initial notification (rather than a premature and potentially misleading alert). The notification must include, at a minimum: (i) the date and time of discovery; (ii) the nature of the incident; (iii) the categories of data potentially affected; (iv) the remediation steps being taken; and (v) a designated point of contact for ongoing communications. Skybridge must provide follow-up reports every four (4) hours until the incident is resolved or contained.
Audit Rights: Meridian may audit Skybridge's security controls, policies, and procedures once per calendar year, upon not less than thirty (30) business days' prior written notice. Skybridge may satisfy the audit requirement by delivering its most recent SOC 2 Type II report, ISO 27001 certificate, and a completed supplemental Security Assessment Questionnaire (the form of which is attached to the Security Exhibit). On-site audits of Skybridge's facilities and the Orion Cloud Services data center are permitted only upon a demonstrated material security concern — defined as (a) a confirmed security incident involving Meridian data, (b) a material finding in the most recent SOC 2 Type II report or ISO 27001 audit, or (c) a directive from Meridian's primary federal banking regulator requiring on-site examination. The costs of audits are borne by Meridian, except that audit costs incurred in connection with a confirmed security incident attributable to Skybridge are borne by Skybridge.
Subprocessor Approvals: Skybridge must provide Meridian with not less than thirty (30) days' advance written notice before engaging any new subprocessor that will have access to, or process, Meridian data. Meridian has a reasonable objection right, exercisable within fifteen (15) days of receipt of the notice. If Meridian objects on reasonable grounds and the parties are unable to resolve the objection within thirty (30) days, Meridian may terminate the affected data processing activity and receive a pro-rata refund of pre-paid fees attributable to the affected service component. Orion Cloud Services, Inc. is identified in the DPA as an initial approved subprocessor, and Skybridge's engagement of Orion is deemed consented to by Meridian as of the Effective Date.
Background Checks: All Skybridge personnel (including employees, contractors, and subcontractors) who will have access to Meridian data or to the production environment of the SkyComply™ platform must undergo background checks consistent with the guidelines established by the Federal Financial Institutions Examination Council ("FFIEC"). Background checks must be completed and documented prior to access provisioning. Skybridge will maintain records of all background checks and will certify compliance upon Meridian's reasonable request.
Data Retention & Deletion: Upon termination or expiration of the MSA, Skybridge will make all Meridian data available for export in a machine-readable format (CSV, JSON, or XML, at Meridian's election) within thirty (30) days of the effective date of termination. Meridian will have a thirty-day period to download and verify the exported data. Following the completion of the export period (or sixty (60) days after the effective date of termination, whichever is earlier), Skybridge will certify in writing the complete destruction of all Meridian data from its production, backup, and disaster recovery systems, using NIST SP 800-88 compliant data sanitization methods. Skybridge's Chief Information Security Officer (currently Amara Okafor) will execute the destruction certification.
G. Regulatory Compliance Provisions
Given Meridian's status as a federally regulated SIFI and the critical nature of the AML and transaction-monitoring services provided by SkyComply™, the MSA contains a comprehensive suite of regulatory compliance provisions, negotiated in close coordination with HTM and reflecting the requirements of applicable federal banking guidance.
OCC Bulletin 2013-29 and Interagency Guidance Compliance. The MSA was drafted to comply with the requirements of OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance) and the Interagency Guidance on Third-Party Relationships: Risk Management, issued jointly by the OCC, the Federal Reserve, and the FDIC in June 2023. These guidance documents impose enhanced due diligence, contractual, and ongoing monitoring requirements on banking organizations in connection with relationships with third-party service providers, particularly those providing critical activities. The SkyComply™ platform constitutes a "critical activity" under the Interagency Guidance, as it supports Meridian's compliance with BSA/AML regulations. The MSA includes specific provisions addressing each of the key contractual elements identified in OCC Bulletin 2013-29, including scope of services, performance measures, audit rights, confidentiality and data security, business continuity, indemnification, insurance, dispute resolution, subcontracting, and termination rights.
Bank Service Company Act Acknowledgment. Skybridge has acknowledged in the MSA that it is a "bank service company" or "servicer" within the meaning of the Bank Service Company Act, 12 U.S.C. § 1867(c), by virtue of its provision of data processing and related services to Meridian. As a result, Skybridge agreed that the OCC, the Federal Reserve, and the FDIC have the authority to examine Skybridge's services, records, and facilities to the same extent as if the services were being performed by Meridian itself. The MSA includes a specific covenant that Skybridge will cooperate with any such examination and will not impede or delay any examination by a federal banking regulator. This provision was essential to Meridian's regulatory compliance posture and was the subject of minimal negotiation, as Skybridge has accepted similar provisions in its agreements with other banking clients.
BSA/AML Regulatory Compliance. The MSA includes provisions specific to the BSA/AML functionality of the SkyComply™ platform, including a representation by Skybridge that the platform's transaction-monitoring models, suspicious activity detection algorithms, and regulatory reporting capabilities are designed and maintained in material compliance with applicable BSA/AML regulations and FinCEN guidance. In the event that a material regulatory finding is issued against the SkyComply™ platform by a federal banking regulator (whether in connection with an examination of Skybridge or an examination of Meridian), Meridian will have the right to terminate the MSA upon sixty (60) days' written notice, without payment of an early termination fee, if Skybridge fails to remediate the finding within ninety (90) days. This termination right provides Meridian with essential regulatory risk mitigation while providing Skybridge with a reasonable remediation period.
H. Insurance Requirements
The MSA requires Skybridge to maintain the following minimum insurance coverages for the duration of the agreement:
Skybridge's Current Cyber Policy: Skybridge currently maintains a Technology E&O and Cyber Liability policy issued by Coastal Assurance Corporation, a Connecticut stock insurance corporation, under Policy No. CA-TECH-2025-07831. The policy provides coverage of $25,000,000 per occurrence and $50,000,000 in the aggregate, with a policy period of April 1, 2025 through March 31, 2026. The policy covers third-party claims arising from data breaches, network security failures, privacy violations, and technology errors and omissions, and includes coverage for regulatory defense costs and fines (where insurable under applicable law). The policy meets or exceeds the MSA's minimum insurance requirements.
Additional Insured Status — Final Resolution:
Meridian requested that it be added as an additional insured under both Skybridge's CGL policy and Skybridge's Cyber Liability policy. This is a common bank-side request in enterprise technology agreements, as additional insured status provides Meridian with a direct right to claim under Skybridge's policies in the event of a covered loss.
C&H coordinated with Jonathan Kreske (CFO) and Skybridge's insurance broker to review the request with Coastal Assurance Corporation. Coastal Assurance confirmed that Meridian could be added as an additional insured under the CGL policy by endorsement, at no additional premium. With respect to the Cyber Liability policy, Coastal Assurance indicated that its standard policy form does not permit the addition of additional insureds but does include a "vendor's customer" coverage extension that provides Meridian with direct notice rights and certain subrogation protections. After further negotiation between HTM and Skybridge's broker, the parties agreed to the following arrangement: (a) Meridian will be added as an additional insured under the CGL policy by endorsement; and (b) Meridian will be designated as a "vendor's customer" under the Cyber Liability policy, with direct 30-day notice of cancellation or material reduction in coverage. This arrangement was acceptable to Meridian, as the "vendor's customer" designation provides the functional equivalent of additional insured status for the claim scenarios most relevant to the MSA.
Certificate of Insurance: Skybridge is required to deliver a Certificate of Insurance evidencing all required coverages and the additional insured / vendor's customer designations within ten (10) business days of execution of the MSA and annually thereafter upon each policy renewal.
I. Representations and Warranties
Representations and Warranties by Skybridge:
(a) The SkyComply™ platform will perform materially in accordance with the Documentation provided to Meridian, which includes all user guides, technical specifications, API documentation, and release notes made available through the platform's online documentation portal;
(b) All professional services (including implementation, onboarding, support, and managed services) will be performed in a professional and workmanlike manner, consistent with generally accepted industry standards for enterprise SaaS providers serving financial institutions;
(c) Skybridge has all necessary rights, licenses, and authorizations to grant the license and provide the services contemplated by the MSA, and the grant of such license does not violate any third-party agreement or right;
(d) The SkyComply™ platform, as delivered by Skybridge, does not contain any malicious code, including viruses, worms, Trojan horses, ransomware, or any other code designed to disrupt, disable, or harm the platform or Meridian's systems;
(e) Skybridge is in material compliance with all applicable laws, regulations, and industry standards relevant to the provision of the services, including the Gramm-Leach-Bliley Act, BSA/AML regulations, applicable state data breach notification laws, and applicable export control regulations; and
(f) Skybridge's security practices, as described in the Security Exhibit, meet or exceed industry standards for financial services SaaS providers, as evidenced by Skybridge's current SOC 2 Type II and ISO 27001 certifications.
Representations and Warranties by Meridian:
(a) Meridian has all necessary corporate power and authority to enter into the MSA and to perform its obligations thereunder, and the execution and delivery of the MSA have been duly authorized by all necessary corporate action; and
(b) Meridian's use of the SkyComply™ platform will be in compliance with the Acceptable Use Policy and all applicable laws and regulations.
Warranty Period: The warranty for implementation services extends for twelve (12) months from the Platform Go-Live Date. The warranty for the platform subscription is ongoing during the term of the MSA — that is, the representations regarding platform performance, absence of malicious code, security practices, and legal compliance apply on a continuing basis throughout the Initial Term and any Renewal Terms.
J. Dispute Resolution
The MSA establishes a tiered dispute resolution mechanism designed to encourage resolution of disputes at the lowest possible level before resorting to formal proceedings:
Escalation Path:
Level 1 — Account Managers. Any dispute arising under the MSA must first be referred to the designated account managers (Tara Bellingham for Skybridge and Luis Arriaga for Meridian) for resolution. The account managers shall have five (5) business days from the date of referral to resolve the dispute through good-faith negotiation.
Level 2 — VP-Level Executives. If the dispute is not resolved at Level 1, it shall be escalated to the VP-level executives designated by each party. The VP-level executives shall have ten (10) business days to resolve the dispute.
Level 3 — CEO/CIO Level. If the dispute remains unresolved after Level 2, it shall be escalated to the CEO of Skybridge (Priya Chandrasekaran) and the CIO of Meridian (Gerald Brannigan), or their designees at the C-suite or equivalent level. The CEO/CIO-level executives shall have fifteen (15) business days to resolve the dispute.
Mediation: If the dispute is not resolved through the three-tier escalation process described above, the parties must submit the dispute to mandatory mediation before either party may initiate litigation. Mediation will be administered by JAMS (Judicial Arbitration and Mediation Services) and will take place in New York, New York. The mediation period is sixty (60) days from the date the mediation demand is filed with JAMS. Each party will bear its own costs in connection with the mediation, and the parties will share equally the fees and expenses of the mediator. The mediation is non-binding; if mediation does not result in a settlement, either party may proceed to litigation.
Venue: Any litigation arising out of or relating to the MSA shall be brought exclusively in the state or federal courts located in Wilmington, Delaware — specifically, the Delaware Court of Chancery or, if the Court of Chancery declines jurisdiction, the Superior Court of the State of Delaware, or the United States District Court for the District of Delaware. Both parties consent to personal jurisdiction in these courts and waive any objection to venue.
Jury Waiver: Both parties mutually and irrevocably waive any right to trial by jury in any action, proceeding, or counterclaim arising out of or relating to the MSA. This waiver was prominently disclosed in the MSA and initialed by both signatories.
K. Governance and Relationship Management
Steering Committee: The MSA establishes a joint Steering Committee composed of senior representatives from both Skybridge and Meridian. The Steering Committee will meet quarterly (or more frequently by mutual agreement) to review platform performance, SLA metrics, upcoming product roadmap items, security posture, and any open issues or escalated matters. The Steering Committee is advisory in nature and does not have the authority to amend the terms of the MSA. Minutes of each Steering Committee meeting will be jointly prepared and circulated within ten (10) business days of the meeting.
Skybridge Account Executive: Tara Bellingham, VP, Enterprise Sales, will serve as the designated Account Executive for the Meridian relationship. Ms. Bellingham will serve as the primary commercial point of contact and will participate in all Steering Committee meetings.
Meridian Relationship Lead: Luis Arriaga, SVP, Procurement & Vendor Management, will serve as the designated relationship lead for Meridian. Mr. Arriaga will coordinate internal stakeholders, serve as the primary commercial point of contact for Skybridge, and manage the ongoing vendor oversight process consistent with Meridian's third-party risk management program.
VI. SOURCE CODE ESCROW
To address Meridian's business continuity concerns and to provide assurance of continued platform access in the event of certain adverse events affecting Skybridge, the parties entered into a three-party Source Code Escrow Agreement with the following terms:
Escrow Agent: Sentinel Escrow Services, Inc., 100 Wilshire Boulevard, Suite 950, Santa Monica, CA 90401
Escrow Agreement Number: SCE-2025-04417
Depositor: Skybridge Fintech Ltd.
Beneficiary: Meridian National Bank, National Association