David,
I hope this finds you well. I'm writing to provide a comprehensive status update on the negotiation of the Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. and Meridian National Bank, N.A. for the SkyComply™ platform.
As you know, we transmitted Skybridge's initial draft MSA and exhibits to Hargrove, Tully & Cascade Insurance Brokers (Meridian's outside counsel; lead partner Douglas Krenshaw, senior associate Megan Faircloth) on September 5. We have now received and thoroughly reviewed HTM's first markup on Meridian's behalf and have prepared Skybridge's counter-positions on all material points.
The purpose of this email is to: (1) summarize the eight key open negotiation issues, (2) recommend compromise positions on several of them, and (3) request your authority to present revised positions in advance of a scheduled call with Meridian's team. Given that implementation is targeted to commence on September 15 (now past) and Go-Live is set for March 1, 2026, we need to move efficiently to close out the remaining commercial and legal terms.
**DEAL PARAMETERS — BRIEF RECAP**
For context, a quick summary of the key commercial terms:
- **Total Contract Value:** $50,000,000 over a five-year initial term - **Named Users:** 32,000 for SkyComply™ - **Year 1 Fees:** $12,700,000 (includes $3,600,000 implementation fee and $1,800,000 support/managed services) - **Years 2–5 Fees:** $9,325,000/year - **Volume discount:** 6.72% applied - **Targeted Go-Live Date:** March 1, 2026; implementation period commencing September 15, 2025 - **Pinnacle Ridge Consent:** As a reminder, Pinnacle Ridge Capital Partners' consent is required for contracts exceeding $25,000,000 TCV. We are initiating that consent process in parallel with Alcott & Grenier LLP (Simone Alcott), and I am preparing the supporting materials now.
---
**ISSUE-BY-ISSUE STATUS AND RECOMMENDATIONS**
Below is a detailed breakdown of each of the eight open issues, along with our recommended positions.
---
**Issue 1: SLA Uptime Standard** — STATUS: OPEN
- **Meridian's position:** 99.95% monthly uptime. - **Skybridge's position:** 99.9% monthly uptime. - **Analysis:** Orion Cloud Services' upstream platform SLA provides 99.95% monthly uptime. Committing to 99.95% downstream to Meridian leaves Skybridge with zero margin for any application-layer latency, configuration issues, or other factors beyond Orion Cloud's infrastructure. The industry benchmark for enterprise financial services SaaS is typically 99.9%. Note that Skybridge's scheduled maintenance window (Saturdays 2:00 AM – 6:00 AM ET, 4 hours/week maximum) is already excluded from the uptime calculation. - **Recommendation:** Hold at 99.9% uptime. As a tradeoff, we recommend offering enhanced SLA credit tiers (see Issue 2 below) to make the 99.9% commitment more financially meaningful to Meridian. I have discussed this with Amara Okafor, who strongly recommends against committing to 99.95% given the zero-margin problem with Orion Cloud.
---
**Issue 2: SLA Credit Cap** — STATUS: OPEN
- **Meridian's position:** Uncapped SLA credits. - **Skybridge's position:** Monthly cap at 30% of monthly subscription fee; annual cap at 15% of annual subscription fee (maximum approximately $317,500/month and $1,905,000/year in Year 1; approximately $233,125/month and $1,398,750/year in Years 2–5). - **Meridian's additional protection:** Termination right if uptime falls below 98.0% in 3 of any consecutive 6 months (already included in Skybridge's initial draft). - **Recommendation:** Maintain the capped structure but offer to enhance the credit tiers as a compromise. Specifically, we recommend increasing the Tier 1 credit (99.9%–99.5% uptime) from 5% to 7.5% of monthly fees, and the Tier 2 credit (99.5%–99.0% uptime) from 10% to 15% of monthly fees. This makes the credits more generous while preserving predictability for Skybridge. The annual cap at 15% should remain firm. We should emphasize to HTM that the termination right at chronic underperformance provides Meridian with a meaningful exit remedy that goes well beyond credits.
---
**Issue 3: Data Breach Indemnification Cap** — STATUS: OPEN — **MOST CONTENTIOUS ISSUE**
- **Meridian's position:** Uncapped indemnification for data breaches and unauthorized disclosure of Meridian data. - **Skybridge's position:** Cap at 2× annual fees paid in the preceding 12 months (approximately $18,650,000 in steady state based on $9,325,000 annual fees). - **Analysis:** This is the most contentious remaining issue in the negotiation, and it warrants detailed treatment.
Meridian, as a systemically important financial institution with approximately $485 billion in total assets and regulated by the OCC, Federal Reserve, and FDIC, faces potentially enormous exposure from a data breach involving nonpublic personal information under GLBA and personally identifiable information more broadly. HTM's position reflects the bank's view that the licensor should bear unlimited risk for its own security failures.
However, uncapped data breach indemnification would expose Skybridge to liability that could be existential relative to its financial profile. With FY 2024 revenue of $78.3 million and EBITDA of $11.7 million, an uncapped obligation in connection with a major breach involving a SIFI counterparty could dwarf the economics of the deal and threaten the company's viability. The 2× annual fees cap (approximately $18.65 million) already represents a significant exposure — roughly 160% of Skybridge's annual EBITDA and nearly 24% of its annual revenue.
- **Recommendation:** Hold firmly at the 2× annual fees cap as the initial position. If pressed further, I recommend the following fallback: offer a data security "super-cap" at 3× annual fees (approximately $27,975,000), structured as a separate, higher cap applicable solely to breaches of confidentiality and data security obligations. This would be distinct from the general aggregate liability cap of 2× annual fees (approximately $18,650,000), which would continue to apply to all other claims. Skybridge's Coastal Assurance cyber liability policy provides $25,000,000 per occurrence and $50,000,000 aggregate coverage, which substantially backstops the 3× super-cap.
I want to flag that Jonathan Kreske should weigh in on the financial exposure analysis before we deploy the 3× fallback. **This issue requires your specific authority on whether we are authorized to present the 3× super-cap if Meridian will not accept the 2× cap.**
---
**Issue 4: Consequential Damages — Regulatory Fines Carve-Out** — STATUS: OPEN
- **Meridian's position:** Carve out regulatory fines and penalties from the mutual exclusion of consequential damages — meaning Skybridge would be liable for Meridian's regulatory fines arising from a Skybridge breach. - **Skybridge's position:** Standard mutual exclusion of indirect, incidental, consequential, and punitive damages, with existing carve-outs only for breaches of confidentiality, IP indemnification, and data security obligations. - **Analysis:** Regulatory fines imposed by the OCC, Fed, or FDIC on Meridian could be substantial and fundamentally unpredictable. Including them as a carve-out to the consequential damages exclusion — even within the liability cap framework — creates significant open-ended risk. The existing carve-outs for breaches of confidentiality and data security already provide Meridian with direct damage recovery for Skybridge's security failures. - **Recommendation:** Resist the regulatory fines carve-out. As a compromise, we should note that the data security super-cap (if deployed per Issue 3) already provides enhanced recovery for Meridian's losses from security-related breaches. Regulatory fines are, by their nature, consequential and indirect in character and should remain excluded. If Meridian insists, we could consider — as a last resort — a narrowly drawn carve-out limited to regulatory fines that are directly and solely caused by Skybridge's breach of its specific security obligations under Exhibit B, subject to the data security super-cap. I would recommend this only as a final concession and only in the context of an overall package resolution.
---
**Issue 5: Security Incident Notification Window** — STATUS: OPEN
- **Meridian's position:** 12 hours from discovery of a confirmed Security Incident affecting Meridian data. - **Skybridge's position:** 24 hours from discovery. - **Analysis:** Amara Okafor has confirmed that 24 hours is the minimum time needed for Skybridge's incident response team to conduct initial triage, confirm the scope of the incident, and prepare a meaningful notification. A 12-hour window risks premature, incomplete notifications that may cause unnecessary alarm or trigger regulatory complications for Meridian itself. - **Recommendation:** Propose an 18-hour compromise. This gives Skybridge adequate triage time while demonstrating responsiveness to Meridian's regulatory notification obligations under OCC and FFIEC guidance. Additionally, I recommend offering a tiered notification approach: Skybridge will provide an initial telephonic alert within 12 hours of discovery (even if details are incomplete and preliminary), followed by a written notification with incident details — including known scope, affected data categories, and initial remediation steps — within 18 hours. This gives Meridian early awareness for its own internal escalation while ensuring the formal written notification is substantive and accurate.
---
**Issue 6: Penetration Testing Scope** — STATUS: OPEN
- **Meridian's position:** Right to conduct annual penetration testing at Meridian's expense covering both application-layer and infrastructure-layer testing. - **Skybridge's position:** Meridian-initiated testing limited to application-layer only; infrastructure-layer testing requires Skybridge's prior written consent. - **Analysis:** Infrastructure-layer penetration testing implicates Orion Cloud Services' environment and could affect other Skybridge clients hosted on shared infrastructure. Skybridge cannot unilaterally authorize third-party testing of Orion Cloud infrastructure without Orion Cloud's consent. - **Recommendation:** Hold position on restricting Meridian-initiated testing to application-layer only. As a compromise, offer to share results of Skybridge's own annual third-party penetration test, conducted by Crestfield Cyber Advisors, Inc. (lead auditor Deepa Rajan), which covers both application and infrastructure layers. If Meridian requires additional infrastructure-layer assurance beyond the Crestfield report, we would agree to facilitate a request to Orion Cloud for coordinated testing, subject to Orion Cloud's consent and scheduling requirements. I expect this proposal can resolve the issue — the Crestfield reports are comprehensive and well-regarded. Note that sharing the Crestfield results may require Marcus Holt's sign-off (see action items below).
---
**Issue 7: Confidentiality / Data Security Super-Cap** — STATUS: OPEN
- **Meridian's position:** Uncapped liability for breaches of confidentiality and data security obligations. - **Skybridge's position:** Separate super-cap of 3× annual fees (approximately $27,975,000), above the general aggregate liability cap of 2× annual fees (approximately $18,650,000). - **Analysis:** This issue is closely linked to Issue 3 and should be presented as a package. The super-cap is designed to provide Meridian with enhanced recovery for the most sensitive category of breach while maintaining a ceiling that is manageable for Skybridge. The $27,975,000 super-cap is within the per-occurrence limit of the Coastal Assurance cyber policy ($25M per occurrence / $50M aggregate). For context, this represents nearly $28 million in potential exposure on a deal generating approximately $9.325 million in annual revenue — a ratio that reflects the seriousness with which Skybridge takes its data security obligations. IP indemnification remains uncapped as is industry standard. Gross negligence and willful misconduct also remain uncapped per the existing draft. Skybridge's data export/deletion obligations and payment obligations are also excluded from the cap. - **Recommendation:** Deploy the 3× super-cap as part of the fallback package on Issues 3 and 7, if authorized.
---
**Issue 8: Additional Insured Status on Cyber Policy** — STATUS: OPEN (Pending Coastal Assurance Response)
- **Meridian's position:** Named as additional insured on Skybridge's technology E&O / cyber liability policy (Coastal Assurance, Policy No. CA-TECH-2025-07831) and CGL policy. - **Skybridge's position:** Under review with Coastal Assurance. - **Analysis:** We have sent a preliminary inquiry to Coastal Assurance regarding the feasibility of adding Meridian as additional insured. CGL additional insured endorsements are routine and should not present an issue. Cyber policy additional insured status is less standard but is increasingly requested by major financial institution counterparties, and we have seen it granted in comparable transactions. - **Recommendation:** Likely achievable for CGL. For the cyber policy, we are awaiting Coastal Assurance's response regarding endorsement requirements and any additional premium. Note that the certificate of insurance must be delivered within 10 business days of MSA execution per the contractual requirement. We will prepare the formal certificate request letter once we have confirmation on the additional insured endorsement. I will follow up with Coastal Assurance early next week if we have not heard back.
---
**UPCOMING CALL WITH MERIDIAN**
Catherine Woo (Associate General Counsel, Technology, Meridian) and Douglas Krenshaw (HTM) have proposed a call to discuss the remaining open points. I recommend that you participate directly — a principals-level discussion between you and Catherine may be particularly effective for resolving the most contentious items, especially the data breach indemnification cap and the regulatory fines carve-out. If you prefer, Angela and I can present positions on your behalf, but given the significance of the financial exposure issues, your direct engagement would carry weight.
We should aim to schedule this call within the next week to keep the timeline on track. The implementation commencement date of September 15 has already passed, and any further delays in finalizing the MSA will compress the implementation timeline and put the March 1, 2026 Go-Live Date at risk.
---
**ACTION ITEMS — AUTHORITY REQUESTED**
David, I would appreciate your direction on the following specific points so that we can prepare the revised draft and be ready for the call with Meridian's team:
1. **SLA Credit Tiers (Issue 2):** Permission to present the enhanced SLA credit tiers (5% → 7.5% at Tier 1; 10% → 15% at Tier 2) as a tradeoff for holding firm at 99.9% uptime.
2. **Data Security Super-Cap (Issues 3 and 7):** Permission to deploy the 3× annual fees data security super-cap (~$27,975,000) as a fallback position on the data breach indemnification cap and confidentiality/data security super-cap. This is the most significant authority request.
3. **Regulatory Fines Carve-Out (Issue 4):** Guidance on whether Skybridge will consider any version of a regulatory fines carve-out from the consequential damages exclusion, even as a last resort and subject to the super-cap.
4. **Incident Notification (Issue 5):** Confirmation that the 18-hour compromise with tiered telephonic/written notification is acceptable to Skybridge's security operations team.
5. **Penetration Test Report Sharing (Issue 6):** Authorization to share Crestfield Cyber Advisors penetration test results with Meridian as part of the pen testing scope compromise. Note: this may require Marcus Holt's sign-off given the sensitivity of the reports.
I would also recommend that you loop in Jonathan Kreske on the financial exposure analysis related to the data breach indemnification cap and super-cap (Issues 3 and 7), and Amara Okafor on the security operational items (Issues 5 and 6), to the extent you haven't already.
As noted above, the Pinnacle Ridge consent process is being initiated in parallel. I am preparing the supporting materials for Simone Alcott at Alcott & Grenier LLP and will circulate a draft of the consent request for your review early next week.
---
**DOCUMENTS FOR YOUR REVIEW**
The following documents have been separately transmitted or are available in the deal room for your reference:
- Skybridge's initial draft MSA and exhibits - HTM's first markup with C&H response annotations - Deal Summary and Negotiation Strategy Memo - SLA Terms Analysis Memo - Indemnification and Liability Cap Analysis Memo
Once you approve the recommended positions, we will prepare the second revised draft of the MSA and exhibits for transmission to HTM.
---
David, I know this is a lot to digest. I'd welcome the opportunity to schedule a call with you — and Angela and Liam as needed — to walk through these issues before we engage with Meridian's team. Please let me know your availability over the next few days, and we will get something on the calendar.
Thank you for your time, and please don't hesitate to reach out with any questions in the interim.
Best regards,
**Amy Chesterton** Associate Calderwood & Harkness LLP 200 South Ashbury Asset Advisors, Suite 1800 Chicago, IL 60604 T: (312) 555-0184
---
*CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. This communication may contain information that is privileged, confidential, and exempt from disclosure under applicable law, including attorney-client privilege and attorney work product doctrine. If you are not the intended recipient, any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this email in error, please notify the sender immediately by reply email and permanently delete all copies of this message and any attachments.*