1009-00007 · Skybridge Fintech Ltd · Correspondence

letter-to-htm-responding-to-first-markup.docx DOCUMENT Funds

7 / 35 ← → ✕

CALDERWOOD & HARKNESS LLP Attorneys at Law

200 South Ashbury Asset Advisors, Suite 1800 Chicago, Illinois 60604 Telephone: (312) 555-7200 Facsimile: (312) 555-7201 www.calderwoodharkness.com

October 1, 2025

VIA EMAIL AND OVERNIGHT COURIER

Douglas Krenshaw, Esq. Partner Hargrove, Tully & Cascade Insurance Brokers 1 Chase Manhattan Plaza, Suite 5500 New York, New York 10005

cc: Megan Faircloth, Esq., Senior Associate Hargrove, Tully & Cascade Insurance Brokers 1 Chase Manhattan Plaza, Suite 5500 New York, New York 10005

cc: Catherine Woo, Esq., Associate General Counsel (Technology) Meridian National Bank, National Association 600 Lexington Avenue, 40th Floor New York, New York 10022

cc: David Shimura, Esq., General Counsel Skybridge Fintech Ltd. (via email only)

Re: Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. ("Skybridge") and Meridian National Bank, National Association ("Meridian") — Response to Meridian's First Markup

Our Matter No.: 1009-00007

Dear Douglas and Megan:

I. Introduction and Acknowledgment of Receipt

Thank you for transmitting Meridian's first markup of the Master Software-as-a-Service Agreement (the "MSA"), the Order Form, the Service Level Agreement (Exhibit A, the "SLA Exhibit"), the Security Exhibit (Exhibit B, the "Security Exhibit"), the Data Processing Addendum (Exhibit C, the "DPA"), and the Acceptable Use Policy (Exhibit D, the "AUP") relating to Meridian's proposed deployment of the SkyComply™ platform. We received the complete set of redlined documents from your office on September 17, 2025, and appreciate the thoroughness and professionalism with which Meridian's comments were prepared.

We write on behalf of our client, Skybridge Fintech Ltd. ("Skybridge"), to confirm that Calderwood & Harkness has completed a comprehensive review of the markup in close consultation with Skybridge's executive, legal, and technical teams. This review has involved extensive internal discussions with Skybridge's General Counsel, David Shimura; Chief Information Security Officer, Amara Okafor; Chief Technology Officer, Marcus Holt; and Chief Financial Officer, Jonathan Kreske. Each of these individuals has contributed to the analysis of Meridian's proposed revisions within his or her respective area of expertise, and their input is reflected in the counter-positions set forth below.

We are pleased to report that Skybridge has accepted a significant number of Meridian's proposed revisions across the entire suite of transaction documents, either in their entirety or with minor clarifying modifications. A summary of the principal accepted revisions is provided in Section XI of this letter. Concurrently with the delivery of this letter, we are transmitting an annotated redline of the MSA and annotated redlines of Exhibits A through D reflecting Skybridge's responses to each of Meridian's proposed changes. We respectfully direct your attention to the redline markups for the full detail of Skybridge's responses on all provisions, including those that are not specifically addressed in this letter.

The purpose of this letter is to address the eight key open negotiation issues on which the parties' positions remain apart, and to set forth Skybridge's counter-positions with supporting rationale for each. We have endeavored to provide detailed reasoning and, where appropriate, proposed compromises that we believe reflect commercially reasonable middle ground. It is our hope that the level of detail provided herein will facilitate productive discussions and expedite resolution of the remaining open items.

As context for the discussion that follows, we note the overall commercial significance of this engagement to both parties. The MSA contemplates a total contract value of approximately $50,000,000 over a five-year initial term, encompassing the deployment of the SkyComply™ AI-driven anti-money-laundering and transaction-monitoring platform to approximately 32,000 licensed users across Meridian's retail banking, commercial banking, and wealth management divisions. Skybridge recognizes the critical importance of this platform to Meridian's regulatory compliance infrastructure and is committed to achieving a contractual framework that appropriately balances the interests of both parties. At the same time, the positions set forth below are informed by the need to maintain commercial and financial viability for Skybridge as the platform provider, which is ultimately in both parties' mutual interest.

II. Summary of Open Issues

For ease of reference, the following table identifies the eight open negotiation issues addressed in this letter, together with the relevant document section references:

Each of these issues is addressed in detail in the sections that follow.

III. Issue 1 — SLA Uptime Standard (Exhibit A, Section 2.1)

A. Meridian's Position

We understand that Meridian's markup proposes to increase the monthly platform availability commitment from 99.9% to 99.95%, in each case measured exclusive of scheduled maintenance windows and Force Majeure events as defined in the MSA.

B. Skybridge's Counter-Position

Skybridge respectfully maintains its proposed monthly uptime target of 99.9% and declines to increase the commitment to 99.95%. Skybridge's position is grounded in the following considerations:

Market Benchmarks. A 99.9% monthly uptime standard is consistent with prevailing market benchmarks for enterprise financial services SaaS platforms. Based on Skybridge's review of comparable agreements in the AML and regulatory compliance SaaS vertical — and consistent with publicly available SLA terms from leading enterprise SaaS providers serving the financial services industry — the vast majority of such agreements utilize 99.9% as the standard uptime commitment. A 99.95% commitment remains the exception rather than the rule in this market segment and is typically reserved for critical infrastructure-level services (e.g., core banking or payment processing platforms) rather than application-layer compliance solutions.

Infrastructure Provider Constraints. Skybridge's underlying infrastructure provider, Orion Cloud Services, Inc. ("Orion Cloud"), provides a platform-level infrastructure SLA of 99.95% monthly uptime. However, the SkyComply™ platform is an application layer that operates on top of Orion Cloud's infrastructure and introduces additional variables that affect availability calculations, including application updates and patch deployments, database maintenance and optimization cycles, integration middleware connecting SkyComply™ to Meridian's core banking systems, and AI model retraining processes. Committing to a pass-through of Orion Cloud's infrastructure-level uptime target at the application layer is both impracticable and commercially unreasonable, as the application-layer uptime necessarily encompasses factors beyond raw infrastructure availability.

Quantitative Impact. The differential between 99.9% and 99.95% uptime, while seemingly small in percentage terms, represents approximately 22 additional minutes of permitted downtime per month. Specifically, based on a 30-day month (43,200 total minutes):

• At 99.9% uptime: approximately 43.2 minutes of permitted downtime per month

• At 99.95% uptime: approximately 21.6 minutes of permitted downtime per month

Skybridge's historical platform availability over the trailing twelve months (October 2024 through September 2025) has exceeded 99.93%, demonstrating strong and consistent operational performance that surpasses the proposed 99.9% commitment. We are prepared to share supporting uptime data from Skybridge's monitoring platform (Pinnacle Solutions and Penrose Health IT dashboards) with Meridian's technical team upon request.

Proposed Resolution. In lieu of increasing the uptime commitment to 99.95%, Skybridge is prepared to discuss an enhanced SLA credit structure (addressed immediately below in Issue 2) that provides Meridian with meaningful financial remedies in the event uptime falls below 99.9%. We believe this approach appropriately balances Meridian's interest in strong availability performance with a realistic and achievable contractual commitment.

Accordingly, Skybridge's position is to maintain the 99.9% monthly uptime standard as set forth in the initial draft of Exhibit A, Section 2.1, with the enhanced credit structure described in Issue 2 below serving as a meaningful alternative to the increased uptime commitment.

IV. Issue 2 — SLA Credit Cap (Exhibit A, Section 3.2)

A. Meridian's Position

Meridian's markup proposes to eliminate the monthly and annual caps on SLA credits — in effect, making credits uncapped such that there would be no ceiling on the total credits Meridian could claim in any given month or year.

B. Skybridge's Counter-Position

Skybridge maintains that SLA credits must be subject to defined monthly and annual caps to preserve the economic viability of the agreement and avoid creating an unbounded financial exposure that would transform the SLA credit mechanism from a service-level incentive into an unlimited liquidated damages provision.

Skybridge proposes to retain the credit tier structure from the initial draft, as set forth below:

The proposed caps are as follows:

Monthly Credit Cap: 30% of the applicable monthly subscription fee. Based on the fee schedule in the Order Form, this equates to:

• Year 1: Maximum of approximately $317,500 per month (based on $12,700,000 annual fees ÷ 12 = $1,058,333 monthly fee × 30%)

• Years 2–5: Maximum of approximately $233,125 per month (based on $9,325,000 annual fees ÷ 12 = $777,083 monthly fee × 30%)

Annual Credit Cap: 15% of the applicable annual subscription fee, equating to:

• Year 1: Maximum of $1,905,000

• Years 2–5: Maximum of $1,398,750 per year

Skybridge's rationale for maintaining caps on SLA credits is as follows:

Purpose of SLA Credits. SLA credits in SaaS agreements are designed to function as a service-level incentive mechanism — a structured financial consequence that motivates the provider to maintain high availability — not as an open-ended liquidated damages provision. Uncapped credits would effectively convert the SLA from an incentive-based framework into an unlimited financial liability, which is inconsistent with the purpose of the SLA construct and with prevailing market practice in enterprise SaaS agreements.

Termination Remedy for Chronic Underperformance. Meridian already has a meaningful and significant remedy for chronic platform underperformance. Under the proposed credit structure, if monthly uptime falls below 98.0% in three of any consecutive six months, Meridian has the right to terminate the MSA without payment of an early termination fee. This termination right provides Meridian with a powerful contractual remedy in the event of persistent service failures, which addresses the core risk that uncapped credits are designed to mitigate.

Financial Predictability. The proposed cap structure provides significant financial incentive for Skybridge to maintain high availability, while preserving a degree of predictability for both parties in financial planning and forecasting. This predictability is particularly important given the long-term nature of the engagement (five-year initial term) and the substantial total contract value.

Proposed Compromise. In connection with Skybridge's position on Issue 1 (maintaining the 99.9% uptime standard), and as a demonstration of Skybridge's good-faith desire to reach mutually acceptable terms, Skybridge is willing to enhance the credit tier percentages modestly while maintaining the overall monthly and annual caps. Specifically, Skybridge proposes the following enhanced credit tiers:

We believe this enhanced credit structure, taken together with the retained monthly and annual caps and the chronic underperformance termination right, provides Meridian with a robust, meaningful, and commercially balanced set of remedies for service-level shortfalls.

V. Issue 3 — Data Breach Indemnification Cap (MSA, Section 12.3(b))

A. Meridian's Position

Meridian's markup proposes that Skybridge's indemnification obligation for data breaches — specifically, breaches of Skybridge's data security and confidentiality obligations resulting in the unauthorized access to, disclosure of, or exfiltration of Meridian data — be entirely uncapped, with no dollar limitation on Skybridge's indemnification exposure for such events.

B. Skybridge's Counter-Position

Skybridge proposes that the data breach indemnification obligation be subject to a cap of 2× the annual fees paid or payable by Meridian in the twelve-month period immediately preceding the event giving rise to the claim. In a steady-state year (Years 2 through 5), this equates to approximately $18,650,000 (2 × $9,325,000).

Skybridge's position on this issue is firm, and Skybridge respectfully declines to agree to uncapped data breach indemnification. The supporting rationale is set forth below.

Proportionality to Contract Economics. An uncapped data breach indemnification obligation would expose Skybridge to potentially existential liability that is wholly disproportionate to the annual economics of the agreement. To place this in perspective, Skybridge's FY 2024 EBITDA was approximately $11,700,000. An uncapped indemnification exposure could therefore exceed multiple years of Skybridge's total earnings and, depending on the magnitude of a claim, could threaten the financial viability of the company. Such an outcome would not serve Meridian's interests, as it would jeopardize the continuity of the SkyComply™ platform upon which Meridian's AML compliance operations would depend.

Market Benchmarks. The proposed 2× cap is at or above the market median for enterprise SaaS data breach indemnification caps. Based on Calderwood & Harkness's experience in negotiating comparable engagements and publicly available benchmarking data, data breach indemnification caps in enterprise financial services SaaS agreements typically range from 1× to 2× annual fees, with 2× representing the upper end of the customary range. The 2× cap proposed by Skybridge thus reflects an already elevated level of financial commitment.

Robust Security Posture. Skybridge maintains a comprehensive information security program that materially mitigates the risk of a data breach event. Key elements include:

• SOC 2 Type II Certification: Skybridge's most recent SOC 2 Type II report, dated March 15, 2025, was audited by Crestfield Cyber Advisors, Inc. and covers the Trust Services Criteria for Security, Availability, Processing Integrity, and Confidentiality. The report contained no material exceptions or qualified opinions.

• ISO 27001 Certification: Skybridge's information security management system was recertified to ISO 27001:2022 on January 22, 2025, by BSI Group, demonstrating compliance with internationally recognized information security standards.

• Encryption and Access Controls: SkyComply™ employs AES-256 encryption for data at rest and TLS 1.2 or higher for data in transit, with role-based access controls, multi-factor authentication for all administrative access, and comprehensive audit logging.

These certifications and controls provide Meridian with a high degree of assurance regarding the security of its data within the SkyComply™ environment.

Insurance Coverage. Skybridge maintains technology errors & omissions and cyber liability insurance through Coastal Assurance Corporation (Policy No. CA-TECH-2025-07831), providing $25,000,000 per occurrence and $50,000,000 aggregate coverage. This insurance program provides Meridian with a substantial additional layer of financial protection in the event of a data breach, supplementing Skybridge's direct indemnification obligation under the MSA.

Super-Cap for Data Security Obligations. As discussed in greater detail in Issue 7 below, Skybridge is prepared to agree to a separate "super-cap" for breaches of confidentiality and data security obligations that exceeds the general aggregate liability cap, specifically recognizing the heightened sensitivity of these obligations in the context of a financial services SaaS engagement. When considered together with the 2× data breach indemnification cap and the 3× proposed confidentiality/data security super-cap, Meridian will benefit from a layered and comprehensive liability framework that provides meaningful financial remedies while maintaining the commercial sustainability of the arrangement.

For all of the foregoing reasons, this represents a firm position, and Skybridge respectfully declines to agree to uncapped data breach indemnification.

VI. Issue 4 — Consequential Damages Carve-Out for Regulatory Fines (MSA, Section 11.2(b))

A. Meridian's Position

Meridian's markup seeks to carve out regulatory fines and penalties from the mutual exclusion of indirect, incidental, consequential, and punitive damages set forth in MSA Section 11.2(a). Under Meridian's proposed revision, Skybridge would be liable for regulatory fines imposed on Meridian by the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation ("FDIC"), or any other applicable regulatory body, to the extent such fines arise from or are attributable to Skybridge's breach of the MSA.

B. Skybridge's Counter-Position

Skybridge respectfully declines this requested carve-out in its entirety. This is a position of significant importance to Skybridge, and the reasons for its objection are set forth at length below.

Regulatory Accountability Resides with the Charter Holder. Regulatory fines imposed on Meridian by the OCC, the Federal Reserve, the FDIC, or other regulatory authorities are a consequence of Meridian's own regulatory obligations as a national banking association and, as applicable, a systemically important financial institution. It is Meridian — not Skybridge — that holds the national banking charter, that is subject to direct regulatory supervision and examination, and that bears primary regulatory accountability for its compliance with the Bank Secrecy Act, the USA PATRIOT Act, applicable anti-money-laundering regulations, and the Gramm-Leach-Bliley Act. While the SkyComply™ platform is designed to support Meridian's compliance efforts, the ultimate responsibility for compliance with these regulatory frameworks rests with Meridian as the regulated entity.

Unpredictable and Uncontrollable Exposure. Carving out regulatory fines from the consequential damages exclusion would create an open-ended, fundamentally unpredictable liability exposure that Skybridge cannot reasonably model, insure against, or control. The magnitude of regulatory fines is determined by regulators in their discretion based on a broad array of factors that are entirely outside of Skybridge's control and often extend well beyond the scope of any particular vendor relationship — including the nature and severity of the underlying regulatory violation, Meridian's compliance history, the adequacy of Meridian's internal controls and compliance management systems, the degree of cooperation with the regulator, the duration of the violation, the size of the institution, and systemic risk considerations. Allocating such risk to Skybridge would be fundamentally inequitable given Skybridge's inability to influence or control these determinative factors.

Existing Protections Under the MSA. The MSA already provides Meridian with robust protections that address the underlying concern motivating the requested carve-out. Specifically:

(a) Indemnification for Breaches of Law. Under MSA Section 12.3(a), Skybridge has agreed to indemnify Meridian against third-party claims arising from Skybridge's breach of applicable law, including the Gramm-Leach-Bliley Act and Bank Secrecy Act/AML regulations, to the extent applicable to Skybridge as a service provider.

(b) Representations and Warranties. Under MSA Section 9.2, Skybridge has represented and warranted that the SkyComply™ platform and Skybridge's performance under the MSA will comply with applicable laws and industry security standards, and that the platform will function in material conformity with the documentation and functional specifications.

(c) Termination Rights. Meridian has the right to terminate the MSA upon Skybridge's material breach (subject to the cure period), and upon certain regulatory trigger events, providing Meridian with the ability to exit the arrangement in the event of a significant compliance failure.

(d) Data Breach Indemnification. The data breach indemnification cap discussed in Issue 3 provides Meridian with up to approximately $18,650,000 in recoverable amounts in connection with a data security breach attributable to Skybridge.

Market Practice. Market practice in enterprise SaaS agreements with regulated financial institutions strongly disfavors regulatory fine carve-outs from consequential damages exclusions. Based on Calderwood & Harkness's experience negotiating comparable transactions and industry benchmarking data, the overwhelming majority of enterprise SaaS agreements in the financial services sector do not include carve-outs for regulatory fines. This position reflects the widely accepted principle that the regulated entity — as the charter holder — bears primary responsibility for its regulatory compliance, and that allocating regulatory fine risk to a technology vendor through a consequential damages carve-out is inconsistent with the fundamental risk allocation of the SaaS model.

Proposed Middle Ground. While Skybridge declines the regulatory fine carve-out, Skybridge recognizes Meridian's legitimate concern regarding the costs of regulatory scrutiny that may arise in connection with a Skybridge breach. As a possible middle ground, Skybridge is willing to consider language confirming that direct damages recoverable by Meridian under the general liability cap include Meridian's reasonable, documented out-of-pocket costs incurred in responding to a regulatory inquiry or examination to the extent directly caused by Skybridge's breach of the MSA, including without limitation reasonable external counsel fees, consultant fees, and document production costs. This language would not, however, encompass regulatory fines, penalties, or civil money penalties themselves, which would continue to be subject to the consequential damages exclusion.

We believe this proposed middle ground addresses Meridian's practical concerns regarding the financial impact of regulatory interactions while maintaining an appropriate and market-standard risk allocation between the parties.

VII. Issue 5 — Security Incident Notification Window (Exhibit B, Section 5.1)

A. Meridian's Position

Meridian's markup proposes that Skybridge be required to notify Meridian of any confirmed Security Incident (as defined in the Security Exhibit) affecting Meridian data within twelve (12) hours of Skybridge's discovery of the incident.

B. Skybridge's Counter-Position

Skybridge's initial draft proposed a twenty-four (24) hour notification window, measured from Skybridge's confirmation that a Security Incident involves or is reasonably likely to involve Meridian data. Skybridge continues to believe that a 24-hour window is operationally appropriate; however, in the interest of compromise, Skybridge offers the following counter-proposal.

Rationale for a Measured Notification Window. Upon detection of anomalous activity or a potential security incident, Skybridge's incident response team — led by CISO Amara Okafor and comprising members of Skybridge's Security Operations Center, engineering, and legal teams — must undertake a series of critical triage steps before meaningful notification can be provided. These steps include:

(a) Confirming whether the detected anomaly constitutes an actual security incident, as opposed to a false positive or routine operational event;

(b) Determining whether the incident actually involves or is reasonably likely to involve Meridian data, as distinct from data belonging to other Skybridge clients or Skybridge's own internal systems;

(c) Assessing the scope, severity, and nature of the incident (e.g., whether unauthorized access has occurred, whether data has been exfiltrated, whether the incident is ongoing or has been contained);

(d) Gathering preliminary facts sufficient to provide Meridian with a meaningful initial notification that includes actionable information, rather than a premature or inaccurate alert that may cause unnecessary alarm and divert Meridian's security and compliance resources.

A twelve-hour window, particularly in circumstances where an incident is discovered outside of normal business hours (e.g., a weekend or overnight), does not provide adequate time for competent triage and may result in premature notifications that fail to include the contextual information Meridian needs to assess the incident and determine its own response obligations. Skybridge's incident response procedures are designed to comply with applicable state data breach notification statutes (including the New York SHIELD Act and Illinois PIPA), none of which require notification within twelve hours, and are consistent with FFIEC IT Examination Handbook guidance on information security incident response.

Proposed Compromise. Skybridge proposes the following tiered notification framework, which we believe addresses Meridian's need for rapid notification while providing Skybridge with adequate time for competent triage:

(1) Severity 1 Incidents (Confirmed Unauthorized Access or Exfiltration): For incidents involving confirmed unauthorized access to, or confirmed or reasonably suspected exfiltration of, Meridian data ("Severity 1 Security Incidents"), Skybridge will provide telephonic or email notification to Meridian's designated security contact within twelve (12) hours of Skybridge's confirmation that the incident involves or is reasonably likely to involve Meridian data. This initial notification will include such preliminary information as is then available regarding the nature, scope, and status of the incident. A comprehensive written incident report will follow within forty-eight (48) hours of the initial notification.

(2) All Other Security Incidents: For all other confirmed Security Incidents affecting Meridian data (i.e., Security Incidents that do not constitute Severity 1 Security Incidents), Skybridge will provide written notification to Meridian within eighteen (18) hours of Skybridge's confirmation that the incident involves or is reasonably likely to involve Meridian data.

In both cases, the notification clock would commence upon Skybridge's confirmation that the incident involves or is reasonably likely to involve Meridian data, as opposed to the initial detection of anomalous activity, which may ultimately prove to be unrelated to Meridian.

We believe this tiered approach provides Meridian with the rapid notification it requires for the most serious category of security incidents, while establishing a reasonable and workable notification framework for less severe incidents. The eighteen-hour window for non-Severity 1 incidents represents a meaningful movement from Skybridge's initial 24-hour position and effectively splits the difference between the parties' respective proposals.

VIII. Issue 6 — Penetration Testing Scope (Exhibit B, Section 7.3)

A. Meridian's Position

Meridian's markup requests the right to conduct annual penetration testing of the SkyComply™ platform at Meridian's expense, encompassing both application-layer testing and infrastructure-layer testing.

B. Skybridge's Counter-Position

Skybridge's initial draft limits Meridian-initiated penetration testing to application-layer testing only, with infrastructure-layer testing requiring Skybridge's prior written consent. Skybridge maintains this position for the reasons set forth below, but proposes a compromise framework to address Meridian's legitimate security assurance interests.

Multi-Tenant Architecture Constraints. The SkyComply™ platform is hosted on Orion Cloud Services, Inc.'s infrastructure-as-a-service platform in a multi-tenant environment. Infrastructure-layer penetration testing conducted by or on behalf of a single client has the potential to affect the shared infrastructure environment and the services provided to other Skybridge clients. Uncoordinated or inadequately scoped infrastructure-layer testing could result in service disruptions, performance degradation, or unintended security impacts affecting Skybridge's broader client base, which includes financial institutions, insurance companies, and other regulated entities that depend on the uninterrupted availability of the SkyComply™ platform.

Orion Cloud Contractual Restrictions. Orion Cloud's terms of service and Acceptable Use Policy expressly restrict third-party penetration testing of its infrastructure layer without Orion Cloud's prior written authorization. Skybridge does not have the unilateral right to authorize Meridian or Meridian's designated third-party testing firm to conduct infrastructure-layer testing on Orion Cloud's platform. Granting Meridian a contractual right that Skybridge cannot itself fulfill would create an inherent conflict and a breach risk for Skybridge under its agreement with Orion Cloud.

Independent Third-Party Testing. Skybridge engages Crestfield Cyber Advisors, Inc. ("Crestfield"), a nationally recognized cybersecurity firm, to perform comprehensive annual third-party penetration testing covering both the application layer and the infrastructure layer of the SkyComply™ platform. Crestfield conducts this testing under an engagement with Skybridge that is coordinated with Orion Cloud and conducted pursuant to Orion Cloud's authorized testing protocols. The results of Crestfield's testing provide robust, independent assurance regarding the security posture of both the application and infrastructure layers of the platform.

Proposed Compromise. In recognition of Meridian's legitimate security assurance interests and the importance of transparency, Skybridge proposes the following framework:

(1) Application-Layer Penetration Testing. Meridian may conduct annual application-layer penetration tests at Meridian's expense, using Meridian's internal security team or a qualified third-party testing firm reasonably acceptable to Skybridge (such acceptance not to be unreasonably withheld, conditioned, or delayed). Such testing will be subject to the following conditions:

(a) Minimum twenty (20) business days' advance written notice to Skybridge, including identification of the testing firm (if third-party), scope of testing, and proposed testing timeline;

(b) Execution of Skybridge's standard penetration testing rules of engagement, which include scope limitations designed to prevent testing activity that could adversely affect other Skybridge customers or the stability of the production environment;

(c) Testing to be conducted during mutually agreed windows, with Skybridge providing reasonable scheduling cooperation; and

(d) Prompt sharing of test results and findings with Skybridge for remediation purposes.

(2) Infrastructure-Layer Assurance. In lieu of Meridian-initiated infrastructure-layer penetration testing, Skybridge will provide Meridian with a copy of Crestfield's most recent annual penetration test summary report, redacted only to the extent necessary to remove findings specifically related to other Skybridge clients. The summary report will include a description of testing methodology, scope, material findings, severity classifications, and remediation timelines for any identified vulnerabilities. Skybridge will use commercially reasonable efforts to deliver such report within thirty (30) days of its completion by Crestfield.

(3) Exigent Circumstances. In the event Meridian has a demonstrated, specific, and reasonable concern regarding infrastructure-layer security — for example, a credible threat notification from a federal banking regulator, law enforcement agency, or intelligence community partner — Skybridge will work in good faith to facilitate limited infrastructure-layer testing through Crestfield or another mutually agreed independent third-party testing firm, at Meridian's expense. The scope, methodology, and timing of any such testing will be mutually determined by the parties in good faith, and Skybridge will use its best efforts to obtain any required approvals from Orion Cloud in connection therewith.

We believe this tripartite framework provides Meridian with comprehensive security assurance across both the application and infrastructure layers while respecting the multi-tenant architecture constraints and Orion Cloud's contractual requirements.

IX. Issue 7 — Confidentiality/Data Security Super-Cap (MSA, Section 11.4)

A. Meridian's Position

Meridian's markup proposes that liability for breaches of confidentiality and data security obligations be entirely uncapped — that is, carved out in full from the general aggregate liability cap — with no dollar limitation whatsoever on Skybridge's liability for such breaches.

B. Skybridge's Counter-Position

Skybridge proposes a separate "super-cap" for breaches of confidentiality and data security obligations, set at 3× the annual fees paid or payable by Meridian in the twelve-month period immediately preceding the event giving rise to the claim. In a steady-state year (Years 2 through 5), this equates to approximately $27,975,000 (3 × $9,325,000).

This super-cap would apply to Skybridge's aggregate liability for all claims arising from breaches of the confidentiality and data security obligations set forth in the MSA, the Security Exhibit, and the DPA, and would be separate from and in addition to the general aggregate liability cap of 2× annual fees (approximately $18,650,000 in a steady-state year).

Skybridge's rationale for the proposed super-cap is as follows:

Heightened Protection Beyond the General Cap. The super-cap provides Meridian with significantly enhanced financial protection beyond the general aggregate liability cap, specifically recognizing the heightened sensitivity and importance of data security obligations in the context of a financial services SaaS engagement. The 3× super-cap represents a 50% increase over the general 2× aggregate cap, reflecting the elevated risk profile that both parties attribute to data security matters.

Alignment with Insurance Coverage. The 3× super-cap of approximately $27,975,000 approximately aligns with Skybridge's per-occurrence cyber liability insurance coverage of $25,000,000 through Coastal Assurance Corporation (Policy No. CA-TECH-2025-07831). This alignment provides Meridian with reasonable assurance that, in the event of a data security breach giving rise to a claim at or near the super-cap level, Skybridge has an insured source of funds available to satisfy its indemnification obligations. We note that the $50,000,000 aggregate coverage limit on the Coastal Assurance policy provides an additional cushion in the event of multiple claims.

Comprehensive Liability Framework. When taken together with the other elements of the liability framework in the MSA, the super-cap forms part of a comprehensive, multi-layered set of protections for Meridian. The complete liability framework includes:

(a) General Aggregate Liability Cap: 2× annual fees (approximately $18,650,000 in a steady-state year), applicable to all claims other than those subject to the super-cap or carved out entirely from the caps;

(b) Confidentiality/Data Security Super-Cap: 3× annual fees (approximately $27,975,000 in a steady-state year), applicable to claims arising from breaches of confidentiality and data security obligations;

(i) intellectual property indemnification obligations under MSA Section 12.2;

(ii) Liability arising from gross negligence or willful misconduct;

(iii) Skybridge's obligation to perform data export and certified deletion following termination of the MSA; and

(iv) Payment obligations under the MSA and Order Form.

This framework provides Meridian with multiple tiers of financial protection calibrated to the nature and severity of the underlying obligation, with the most sensitive areas (IP infringement, intentional conduct) remaining entirely uncapped.

Commercial Viability. An entirely uncapped exposure for confidentiality and data security breaches would be inconsistent with market practice for enterprise SaaS agreements and could have material adverse effects on Skybridge's financial viability. As noted in the discussion of Issue 3, Skybridge's FY 2024 EBITDA was approximately $11,700,000. An uncapped liability exposure for a broadly defined category of obligations such as "confidentiality and data security" could result in claims that exceed the company's total net worth, which would ultimately be contrary to Meridian's own interests in the continuity and stability of the SkyComply™ platform.

We believe the proposed 3× super-cap, in combination with the uncapped obligations identified above, provides Meridian with a commercially reasonable, market-consistent, and robust liability framework that appropriately reflects the importance of data security in this engagement.

X. Issue 8 — Additional Insured Status on Cyber Liability Policy (MSA, Section 14.2)

A. Meridian's Position

Meridian's markup requests that Meridian be named as an additional insured on (i) Skybridge's technology errors & omissions / cyber liability insurance policy (Coastal Assurance Corporation, Policy No. CA-TECH-2025-07831) and (ii) Skybridge's commercial general liability ("CGL") insurance policy.

B. Skybridge's Counter-Position

Skybridge is amenable in principle to naming Meridian as an additional insured on its commercial general liability policy and will include appropriate language to this effect in the revised draft of the MSA.

With respect to the technology E&O / cyber liability policy, Skybridge's position is more nuanced, and Skybridge has been actively engaged with its insurance carrier, Coastal Assurance Corporation, regarding the feasibility of Meridian's request. We note the following:

Market Practice. Additional insured endorsements on technology errors & omissions and cyber liability policies are less common in the market than additional insured endorsements on CGL policies. The nature of technology E&O and cyber liability coverage — which is designed to respond to claims arising from the insured's own professional services and data security practices — differs fundamentally from CGL coverage, and carriers frequently restrict or decline additional insured endorsements on such policies due to the potential for coverage disputes, moral hazard, and increased exposure.

Carrier Consultation. Skybridge has initiated discussions with Coastal Assurance Corporation regarding the feasibility, scope, and any additional premium implications associated with adding Meridian as an additional insured on the cyber liability / E&O policy. As of the date of this letter, Coastal Assurance's underwriting team is reviewing the request and has indicated that a definitive response will require approximately two to three additional weeks to complete. Skybridge anticipates providing Meridian with a definitive answer on this issue promptly upon receipt of Coastal Assurance's determination.

Proposed Alternative. In the interim, and as a potential alternative in the event that a full additional insured endorsement is not available or is subject to unacceptable conditions or premium increases, Skybridge proposes to provide Meridian with the following protections:

(a) A certificate of insurance evidencing the required coverage levels, including:

• Technology E&O / Cyber Liability: $25,000,000 per occurrence / $50,000,000 aggregate

• Commercial General Liability: $5,000,000 per occurrence / $10,000,000 aggregate

• Umbrella / Excess Liability: $10,000,000

(b) A contractual commitment in the MSA to maintain such coverage levels throughout the term of the agreement and any renewal periods;

(c) A commitment to provide Meridian with thirty (30) days' prior written notice of any material reduction in, non-renewal of, or cancellation of any required insurance coverage; and

(d) Delivery of the initial certificate of insurance within ten (10) business days of MSA execution, with annual renewal certificates to be provided within thirty (30) days of each policy renewal date.

Skybridge anticipates resolving this issue definitively within the coming weeks and will provide a supplemental response to your office once Coastal Assurance has completed its underwriting review. We ask for Meridian's patience on this particular point and assure Meridian that Skybridge is pursuing the matter diligently.

XI. Summary of Accepted Revisions

For completeness and to confirm the substantial areas of agreement between the parties, Skybridge has accepted — in whole or with minor clarifying modifications reflected in the enclosed redline — a number of Meridian's proposed revisions across the MSA and Exhibits A through D. The principal accepted revisions include, without limitation, the following:

(a) Regulatory Examination Rights. Skybridge acknowledges and accepts Meridian's proposed regulatory examination rights provision, which ensures that the OCC, the Federal Reserve, the FDIC, and other applicable federal and state regulators retain the authority to examine, audit, and obtain information from Skybridge in connection with the services provided under the MSA, consistent with the requirements of OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), the Interagency Guidance on Third-Party Relationships (June 2023), and the Bank Service Company Act, 12 U.S.C. § 1867(c). Skybridge will cooperate fully with any such regulatory examination.

(b) Data Residency. Skybridge accepts Meridian's requirement that all Meridian data processed, stored, or transmitted in connection with the SkyComply™ platform be maintained within the continental United States. Specifically, Meridian data will be hosted exclusively in Orion Cloud's US-East (Northern Virginia) and US-West (Oregon) regions, as set forth in the Security Exhibit and the DPA. No Meridian data will be transferred to, stored in, or processed from any data center located outside of the continental United States without Meridian's prior written consent.

(c) Subprocessor Approval Process. Skybridge accepts the subprocessor approval framework as proposed in Meridian's markup, pursuant to which Skybridge will provide Meridian with no fewer than thirty (30) days' advance written notice before engaging any new subprocessor to process Meridian data. Meridian will have a reasonable right to object to the proposed subprocessor, and in the event of a good-faith objection that cannot be resolved through consultation, Skybridge will refrain from engaging such subprocessor with respect to Meridian data. Orion Cloud Services, Inc. is identified as the initial approved subprocessor in the DPA.

(d) Background Check Requirements. Skybridge accepts Meridian's proposed background check requirements for all Skybridge personnel who will have access to Meridian data or Meridian systems, consistent with FFIEC guidelines. Background checks will include, at a minimum, criminal history, employment verification, and where applicable, credit history screening.

(e) Data Retention and Deletion Obligations. Skybridge accepts the post-termination data handling framework as proposed, including (i) provision to Meridian of a complete export of all Meridian data in a machine-readable format within thirty (30) days following the effective date of termination or expiration and (ii) certified destruction or deletion of all Meridian data from Skybridge's systems, including backup systems, within sixty (60) days following the effective date of termination or expiration, with written certification of destruction provided to Meridian upon completion.

(f) Audit Rights Framework. Skybridge accepts the audit rights framework as proposed by Meridian, including (i) an annual audit right exercisable upon thirty (30) business days' prior written notice, with Skybridge's then-current SOC 2 Type II report, ISO 27001 certificate, and completed Security Assessment Questionnaire satisfying routine audit requests absent a demonstrated material security concern, and (ii) the right to conduct an on-site audit upon Meridian's demonstration of a material security concern, at Meridian's expense, and subject to reasonable confidentiality protections and scope limitations.

(g) Source Code Escrow. Skybridge accepts the requirement to establish and maintain a source code escrow arrangement with Sentinel Escrow Services, Inc. (Escrow Agreement No. SCE-2025-04417), including the agreed release triggers as set forth in the markup.

(h) Quarterly Steering Committee. Skybridge accepts the governance provision requiring quarterly steering committee meetings with senior representatives from both parties to review platform performance, security posture, product roadmap, and relationship management matters.

(i) Encryption Standards. Skybridge confirms acceptance of the encryption standards as specified in the markup: AES-256 encryption for data at rest, TLS 1.2 or higher for data in transit, and a bring-your-own-key ("BYOK") integration option enabling Meridian to manage its own encryption keys through a supported key management service.

(j) Critical Incident Response Times. Skybridge accepts the incident response time commitments as proposed:

• Severity 1: 15-minute acknowledgment, 1-hour first response, 4-hour resolution target

• Severity 2: 30-minute acknowledgment, 2-hour first response, 8-hour resolution target

• Severity 3: 4-hour acknowledgment, 1 business day first response, 5 business day resolution target

(k) Dispute Resolution Framework. Skybridge accepts the dispute resolution framework as proposed, including three-tier executive escalation, a mandatory sixty (60) day mediation period administered by JAMS in New York, New York, followed by litigation in the Delaware Court of Chancery or the United States District Court for the District of Delaware, with mutual waiver of jury trial.

(l) Governing Law. Skybridge accepts the selection of the laws of the State of Delaware as the governing law, without regard to conflict of laws principles.

(m) Termination for Convenience. Skybridge accepts Meridian's right to terminate the MSA for convenience after the second anniversary of the Effective Date upon twelve (12) months' prior written notice and payment of an early termination fee equal to fifty percent (50%) of the remaining annual contract value for the then-current initial term.

These accepted revisions, taken together with the counter-positions on the eight open issues set forth above, reflect the full scope of Skybridge's responses to Meridian's first markup. The enclosed annotated redlines contain the precise proposed language for each accepted revision and counter-proposal.

XII. Proposed Path Forward

The eight issues identified in Sections III through X of this letter represent the remaining substantive gaps between the parties' positions. We are encouraged by the significant areas of agreement reflected in Section XI and believe that the remaining open issues are capable of resolution through focused and constructive negotiation.

Skybridge is committed to reaching mutually acceptable terms efficiently. As both parties are aware, the targeted project timeline calls for implementation commencement by September 15, 2025, implementation completion by February 28, 2026, and a Platform Go-Live Date of March 1, 2026. While the implementation commencement date has now passed, Skybridge's project management and technical teams have confirmed that the overall timeline remains achievable provided the MSA and related documents are executed no later than approximately mid-October 2025. Delays beyond that point may require an adjustment to the Go-Live Date, which neither party desires.

In light of these timeline considerations, we propose the following:

(1) Negotiation Call. We respectfully propose scheduling a negotiation call among outside counsel (Calderwood & Harkness and Hargrove, Tully & Marsh) together with the principals most closely involved in the transaction (David Shimura of Skybridge and Catherine Woo of Meridian) to discuss the eight open issues and seek resolution. We suggest scheduling this call within the next five (5) business days — i.e., by no later than October 8, 2025. We are available any day that week except Wednesday, October 8, and would appreciate your team's availability.

(2) Technical Discussion. Certain issues — in particular, Issue 5 (Security Incident Notification Window) and Issue 6 (Penetration Testing Scope) — may benefit from a supplemental technical discussion between Amara Okafor, Skybridge's CISO, and the designated technical representative(s) from Meridian's information security team (we understand Gerald Brannigan or Sandra Petrov may be the appropriate contacts). We are happy to coordinate such a discussion in parallel with or following the legal negotiation call, at Meridian's convenience.

(3) Revised Clean Draft. Upon resolution of the open issues, Calderwood & Harkness will promptly circulate a revised clean draft of the MSA and all Exhibits for final review. We would anticipate a three-to-five business day turnaround for preparation of the clean documents following agreement on the open points.

Finally, we wish to remind counsel that Skybridge will need to obtain the consent of Pinnacle Ridge Capital Partners, LP ("Pinnacle Ridge"), Skybridge's majority equity holder, for the transaction. The $50,000,000 total contract value exceeds the $25,000,000 contractual consent threshold established in Pinnacle Ridge's investment agreement with Skybridge. While Skybridge's management team has briefed Pinnacle Ridge on the transaction and is confident that consent will be forthcoming, the consent process requires submission of final or near-final documentation. Accordingly, we respectfully request that the parties move expeditiously toward resolution of the open issues and finalization of definitive terms, so that Skybridge may timely pursue and obtain the required investor consent without further delay to the project timeline.

XIII. Reservation of Rights

Nothing in this letter constitutes, or shall be construed as constituting, a binding agreement between Skybridge and Meridian with respect to the MSA, the Order Form, any Exhibit, or any other matter discussed herein. All terms, positions, and proposals discussed in this letter are subject to final agreement on all open issues, mutual satisfaction of all conditions, and execution and delivery of definitive documentation in form and substance satisfactory to each party and its counsel. All rights, remedies, claims, and positions of Skybridge are expressly reserved, and no waiver of any right shall be implied by any statement or proposal contained herein.

We appreciate the constructive and professional manner in which your team has engaged on this transaction, and we look forward to resolving the remaining issues promptly so that both Skybridge and Meridian can proceed with the implementation of the SkyComply™ platform. Should you wish to discuss any of the foregoing in advance of the proposed negotiation call, please do not hesitate to contact me or my colleagues Angela Fontaine or Liam Prescott at any time.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Amy Chesterton Associate 200 South Ashbury Asset Advisors, Suite 1800 Chicago, Illinois 60604 Telephone: (312) 555-7244

Email: achesterton@calderwoodharkness.com

Enclosures:

1. Annotated Redline of Master Software-as-a-Service Agreement (reflecting Skybridge's responses to Meridian's first markup)

2. Annotated Redline of Exhibit A (Service Level Agreement)

3. Annotated Redline of Exhibit B (Security Exhibit)

4. Annotated Redline of Exhibit C (Data Processing Addendum)

5. Annotated Redline of Exhibit D (Acceptable Use Policy)

cc: (via email)

Angela Fontaine, Esq., Partner, Calderwood & Harkness LLP Liam Prescott, Esq., Senior Associate, Calderwood & Harkness LLP David Shimura, Esq., General Counsel, Skybridge Fintech Ltd. Catherine Woo, Esq., Associate General Counsel (Technology), Meridian National Bank, N.A. Megan Faircloth, Esq., Senior Associate, Hargrove, Tully & Cascade Insurance Brokers

Issue No.	Issue Description	Document / Section Reference
1	SLA Uptime Standard	Exhibit A (SLA), Section 2.1
2	SLA Credit Cap	Exhibit A (SLA), Section 3.2
3	Data Breach Indemnification Cap	MSA, Section 12.3(b)
4	Consequential Damages Carve-Out for Regulatory Fines	MSA, Section 11.2(b)
5	Security Incident Notification Window	Exhibit B (Security Exhibit), Section 5.1
6	Penetration Testing Scope	Exhibit B (Security Exhibit), Section 7.3
7	Confidentiality/Data Security Super-Cap	MSA, Section 11.4
8	Additional Insured Status on Cyber Liability Policy	MSA, Section 14.2
Monthly Uptime	Credit (% of Monthly Subscription Fee)
99.9% – 99.5%	5%
99.5% – 99.0%	10%
99.0% – 98.0%	20%
Below 98.0%	30%, plus Meridian termination right if occurring in 3 of any consecutive 6 months
Monthly Uptime	Original Credit	Enhanced Credit (Proposed)
99.9% – 99.5%	5%	7.5%
99.5% – 99.0%	10%	15%
99.0% – 98.0%	20%	20% (unchanged)
Below 98.0%	30% + termination right	30% + termination right (unchanged)

CALDERWOOD & HARKNESS LLP Attorneys at Law
200 South Ashbury Asset Advisors, Suite 1800 Chicago, Illinois 60604 Telephone: (312) 555-7200 Facsimile: (312) 555-7201 www.calderwoodharkness.com
October 1, 2025
VIA EMAIL AND OVERNIGHT COURIER
Douglas Krenshaw, Esq. Partner Hargrove, Tully & Cascade Insurance Brokers 1 Chase Manhattan Plaza, Suite 5500 New York, New York 10005
cc: Megan Faircloth, Esq., Senior Associate Hargrove, Tully & Cascade Insurance Brokers 1 Chase Manhattan Plaza, Suite 5500 New York, New York 10005
cc: Catherine Woo, Esq., Associate General Counsel (Technology) Meridian National Bank, National Association 600 Lexington Avenue, 40th Floor New York, New York 10022
cc: David Shimura, Esq., General Counsel Skybridge Fintech Ltd. (via email only)
Re: Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. ("Skybridge") and Meridian National Bank, National Association ("Meridian") — Response to Meridian's First Markup
Our Matter No.: 1009-00007
Dear Douglas and Megan:
I. Introduction and Acknowledgment of Receipt
Thank you for transmitting Meridian's first markup of the Master Software-as-a-Service Agreement (the "MSA"), the Order Form, the Service Level Agreement (Exhibit A, the "SLA Exhibit"), the Security Exhibit (Exhibit B, the "Security Exhibit"), the Data Processing Addendum (Exhibit C, the "DPA"), and the Acceptable Use Policy (Exhibit D, the "AUP") relating to Meridian's proposed deployment of the SkyComply™ platform. We received the complete set of redlined documents from your office on September 17, 2025, and appreciate the thoroughness and professionalism with which Meridian's comments were prepared.
We write on behalf of our client, Skybridge Fintech Ltd. ("Skybridge"), to confirm that Calderwood & Harkness has completed a comprehensive review of the markup in close consultation with Skybridge's executive, legal, and technical teams. This review has involved extensive internal discussions with Skybridge's General Counsel, David Shimura; Chief Information Security Officer, Amara Okafor; Chief Technology Officer, Marcus Holt; and Chief Financial Officer, Jonathan Kreske. Each of these individuals has contributed to the analysis of Meridian's proposed revisions within his or her respective area of expertise, and their input is reflected in the counter-positions set forth below.
We are pleased to report that Skybridge has accepted a significant number of Meridian's proposed revisions across the entire suite of transaction documents, either in their entirety or with minor clarifying modifications. A summary of the principal accepted revisions is provided in Section XI of this letter. Concurrently with the delivery of this letter, we are transmitting an annotated redline of the MSA and annotated redlines of Exhibits A through D reflecting Skybridge's responses to each of Meridian's proposed changes. We respectfully direct your attention to the redline markups for the full detail of Skybridge's responses on all provisions, including those that are not specifically addressed in this letter.
The purpose of this letter is to address the eight key open negotiation issues on which the parties' positions remain apart, and to set forth Skybridge's counter-positions with supporting rationale for each. We have endeavored to provide detailed reasoning and, where appropriate, proposed compromises that we believe reflect commercially reasonable middle ground. It is our hope that the level of detail provided herein will facilitate productive discussions and expedite resolution of the remaining open items.
As context for the discussion that follows, we note the overall commercial significance of this engagement to both parties. The MSA contemplates a total contract value of approximately $50,000,000 over a five-year initial term, encompassing the deployment of the SkyComply™ AI-driven anti-money-laundering and transaction-monitoring platform to approximately 32,000 licensed users across Meridian's retail banking, commercial banking, and wealth management divisions. Skybridge recognizes the critical importance of this platform to Meridian's regulatory compliance infrastructure and is committed to achieving a contractual framework that appropriately balances the interests of both parties. At the same time, the positions set forth below are informed by the need to maintain commercial and financial viability for Skybridge as the platform provider, which is ultimately in both parties' mutual interest.
II. Summary of Open Issues
For ease of reference, the following table identifies the eight open negotiation issues addressed in this letter, together with the relevant document section references:
Each of these issues is addressed in detail in the sections that follow.
III. Issue 1 — SLA Uptime Standard (Exhibit A, Section 2.1)
A. Meridian's Position
We understand that Meridian's markup proposes to increase the monthly platform availability commitment from 99.9% to 99.95%, in each case measured exclusive of scheduled maintenance windows and Force Majeure events as defined in the MSA.
B. Skybridge's Counter-Position
Skybridge respectfully maintains its proposed monthly uptime target of 99.9% and declines to increase the commitment to 99.95%. Skybridge's position is grounded in the following considerations:
Market Benchmarks. A 99.9% monthly uptime standard is consistent with prevailing market benchmarks for enterprise financial services SaaS platforms. Based on Skybridge's review of comparable agreements in the AML and regulatory compliance SaaS vertical — and consistent with publicly available SLA terms from leading enterprise SaaS providers serving the financial services industry — the vast majority of such agreements utilize 99.9% as the standard uptime commitment. A 99.95% commitment remains the exception rather than the rule in this market segment and is typically reserved for critical infrastructure-level services (e.g., core banking or payment processing platforms) rather than application-layer compliance solutions.
Infrastructure Provider Constraints. Skybridge's underlying infrastructure provider, Orion Cloud Services, Inc. ("Orion Cloud"), provides a platform-level infrastructure SLA of 99.95% monthly uptime. However, the SkyComply™ platform is an application layer that operates on top of Orion Cloud's infrastructure and introduces additional variables that affect availability calculations, including application updates and patch deployments, database maintenance and optimization cycles, integration middleware connecting SkyComply™ to Meridian's core banking systems, and AI model retraining processes. Committing to a pass-through of Orion Cloud's infrastructure-level uptime target at the application layer is both impracticable and commercially unreasonable, as the application-layer uptime necessarily encompasses factors beyond raw infrastructure availability.
Quantitative Impact. The differential between 99.9% and 99.95% uptime, while seemingly small in percentage terms, represents approximately 22 additional minutes of permitted downtime per month. Specifically, based on a 30-day month (43,200 total minutes):
• At 99.9% uptime: approximately 43.2 minutes of permitted downtime per month
• At 99.95% uptime: approximately 21.6 minutes of permitted downtime per month
Skybridge's historical platform availability over the trailing twelve months (October 2024 through September 2025) has exceeded 99.93%, demonstrating strong and consistent operational performance that surpasses the proposed 99.9% commitment. We are prepared to share supporting uptime data from Skybridge's monitoring platform (Pinnacle Solutions and Penrose Health IT dashboards) with Meridian's technical team upon request.
Proposed Resolution. In lieu of increasing the uptime commitment to 99.95%, Skybridge is prepared to discuss an enhanced SLA credit structure (addressed immediately below in Issue 2) that provides Meridian with meaningful financial remedies in the event uptime falls below 99.9%. We believe this approach appropriately balances Meridian's interest in strong availability performance with a realistic and achievable contractual commitment.
Accordingly, Skybridge's position is to maintain the 99.9% monthly uptime standard as set forth in the initial draft of Exhibit A, Section 2.1, with the enhanced credit structure described in Issue 2 below serving as a meaningful alternative to the increased uptime commitment.
IV. Issue 2 — SLA Credit Cap (Exhibit A, Section 3.2)
A. Meridian's Position
Meridian's markup proposes to eliminate the monthly and annual caps on SLA credits — in effect, making credits uncapped such that there would be no ceiling on the total credits Meridian could claim in any given month or year.
B. Skybridge's Counter-Position
Skybridge maintains that SLA credits must be subject to defined monthly and annual caps to preserve the economic viability of the agreement and avoid creating an unbounded financial exposure that would transform the SLA credit mechanism from a service-level incentive into an unlimited liquidated damages provision.
Skybridge proposes to retain the credit tier structure from the initial draft, as set forth below:
The proposed caps are as follows:
Monthly Credit Cap: 30% of the applicable monthly subscription fee. Based on the fee schedule in the Order Form, this equates to:
• Year 1: Maximum of approximately $317,500 per month (based on $12,700,000 annual fees ÷ 12 = $1,058,333 monthly fee × 30%)
• Years 2–5: Maximum of approximately $233,125 per month (based on $9,325,000 annual fees ÷ 12 = $777,083 monthly fee × 30%)
Annual Credit Cap: 15% of the applicable annual subscription fee, equating to:
• Year 1: Maximum of $1,905,000
• Years 2–5: Maximum of $1,398,750 per year
Skybridge's rationale for maintaining caps on SLA credits is as follows:
Purpose of SLA Credits. SLA credits in SaaS agreements are designed to function as a service-level incentive mechanism — a structured financial consequence that motivates the provider to maintain high availability — not as an open-ended liquidated damages provision. Uncapped credits would effectively convert the SLA from an incentive-based framework into an unlimited financial liability, which is inconsistent with the purpose of the SLA construct and with prevailing market practice in enterprise SaaS agreements.
Termination Remedy for Chronic Underperformance. Meridian already has a meaningful and significant remedy for chronic platform underperformance. Under the proposed credit structure, if monthly uptime falls below 98.0% in three of any consecutive six months, Meridian has the right to terminate the MSA without payment of an early termination fee. This termination right provides Meridian with a powerful contractual remedy in the event of persistent service failures, which addresses the core risk that uncapped credits are designed to mitigate.
Financial Predictability. The proposed cap structure provides significant financial incentive for Skybridge to maintain high availability, while preserving a degree of predictability for both parties in financial planning and forecasting. This predictability is particularly important given the long-term nature of the engagement (five-year initial term) and the substantial total contract value.
Proposed Compromise. In connection with Skybridge's position on Issue 1 (maintaining the 99.9% uptime standard), and as a demonstration of Skybridge's good-faith desire to reach mutually acceptable terms, Skybridge is willing to enhance the credit tier percentages modestly while maintaining the overall monthly and annual caps. Specifically, Skybridge proposes the following enhanced credit tiers:
We believe this enhanced credit structure, taken together with the retained monthly and annual caps and the chronic underperformance termination right, provides Meridian with a robust, meaningful, and commercially balanced set of remedies for service-level shortfalls.
V. Issue 3 — Data Breach Indemnification Cap (MSA, Section 12.3(b))
A. Meridian's Position
Meridian's markup proposes that Skybridge's indemnification obligation for data breaches — specifically, breaches of Skybridge's data security and confidentiality obligations resulting in the unauthorized access to, disclosure of, or exfiltration of Meridian data — be entirely uncapped, with no dollar limitation on Skybridge's indemnification exposure for such events.
B. Skybridge's Counter-Position
Skybridge proposes that the data breach indemnification obligation be subject to a cap of 2× the annual fees paid or payable by Meridian in the twelve-month period immediately preceding the event giving rise to the claim. In a steady-state year (Years 2 through 5), this equates to approximately $18,650,000 (2 × $9,325,000).
Skybridge's position on this issue is firm, and Skybridge respectfully declines to agree to uncapped data breach indemnification. The supporting rationale is set forth below.
Proportionality to Contract Economics. An uncapped data breach indemnification obligation would expose Skybridge to potentially existential liability that is wholly disproportionate to the annual economics of the agreement. To place this in perspective, Skybridge's FY 2024 EBITDA was approximately $11,700,000. An uncapped indemnification exposure could therefore exceed multiple years of Skybridge's total earnings and, depending on the magnitude of a claim, could threaten the financial viability of the company. Such an outcome would not serve Meridian's interests, as it would jeopardize the continuity of the SkyComply™ platform upon which Meridian's AML compliance operations would depend.
Market Benchmarks. The proposed 2× cap is at or above the market median for enterprise SaaS data breach indemnification caps. Based on Calderwood & Harkness's experience in negotiating comparable engagements and publicly available benchmarking data, data breach indemnification caps in enterprise financial services SaaS agreements typically range from 1× to 2× annual fees, with 2× representing the upper end of the customary range. The 2× cap proposed by Skybridge thus reflects an already elevated level of financial commitment.
Robust Security Posture. Skybridge maintains a comprehensive information security program that materially mitigates the risk of a data breach event. Key elements include:
• SOC 2 Type II Certification: Skybridge's most recent SOC 2 Type II report, dated March 15, 2025, was audited by Crestfield Cyber Advisors, Inc. and covers the Trust Services Criteria for Security, Availability, Processing Integrity, and Confidentiality. The report contained no material exceptions or qualified opinions.
• ISO 27001 Certification: Skybridge's information security management system was recertified to ISO 27001:2022 on January 22, 2025, by BSI Group, demonstrating compliance with internationally recognized information security standards.
• Encryption and Access Controls: SkyComply™ employs AES-256 encryption for data at rest and TLS 1.2 or higher for data in transit, with role-based access controls, multi-factor authentication for all administrative access, and comprehensive audit logging.
These certifications and controls provide Meridian with a high degree of assurance regarding the security of its data within the SkyComply™ environment.
Insurance Coverage. Skybridge maintains technology errors & omissions and cyber liability insurance through Coastal Assurance Corporation (Policy No. CA-TECH-2025-07831), providing $25,000,000 per occurrence and $50,000,000 aggregate coverage. This insurance program provides Meridian with a substantial additional layer of financial protection in the event of a data breach, supplementing Skybridge's direct indemnification obligation under the MSA.
Super-Cap for Data Security Obligations. As discussed in greater detail in Issue 7 below, Skybridge is prepared to agree to a separate "super-cap" for breaches of confidentiality and data security obligations that exceeds the general aggregate liability cap, specifically recognizing the heightened sensitivity of these obligations in the context of a financial services SaaS engagement. When considered together with the 2× data breach indemnification cap and the 3× proposed confidentiality/data security super-cap, Meridian will benefit from a layered and comprehensive liability framework that provides meaningful financial remedies while maintaining the commercial sustainability of the arrangement.
For all of the foregoing reasons, this represents a firm position, and Skybridge respectfully declines to agree to uncapped data breach indemnification.
VI. Issue 4 — Consequential Damages Carve-Out for Regulatory Fines (MSA, Section 11.2(b))
A. Meridian's Position
Meridian's markup seeks to carve out regulatory fines and penalties from the mutual exclusion of indirect, incidental, consequential, and punitive damages set forth in MSA Section 11.2(a). Under Meridian's proposed revision, Skybridge would be liable for regulatory fines imposed on Meridian by the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation ("FDIC"), or any other applicable regulatory body, to the extent such fines arise from or are attributable to Skybridge's breach of the MSA.
B. Skybridge's Counter-Position
Skybridge respectfully declines this requested carve-out in its entirety. This is a position of significant importance to Skybridge, and the reasons for its objection are set forth at length below.
Regulatory Accountability Resides with the Charter Holder. Regulatory fines imposed on Meridian by the OCC, the Federal Reserve, the FDIC, or other regulatory authorities are a consequence of Meridian's own regulatory obligations as a national banking association and, as applicable, a systemically important financial institution. It is Meridian — not Skybridge — that holds the national banking charter, that is subject to direct regulatory supervision and examination, and that bears primary regulatory accountability for its compliance with the Bank Secrecy Act, the USA PATRIOT Act, applicable anti-money-laundering regulations, and the Gramm-Leach-Bliley Act. While the SkyComply™ platform is designed to support Meridian's compliance efforts, the ultimate responsibility for compliance with these regulatory frameworks rests with Meridian as the regulated entity.
Unpredictable and Uncontrollable Exposure. Carving out regulatory fines from the consequential damages exclusion would create an open-ended, fundamentally unpredictable liability exposure that Skybridge cannot reasonably model, insure against, or control. The magnitude of regulatory fines is determined by regulators in their discretion based on a broad array of factors that are entirely outside of Skybridge's control and often extend well beyond the scope of any particular vendor relationship — including the nature and severity of the underlying regulatory violation, Meridian's compliance history, the adequacy of Meridian's internal controls and compliance management systems, the degree of cooperation with the regulator, the duration of the violation, the size of the institution, and systemic risk considerations. Allocating such risk to Skybridge would be fundamentally inequitable given Skybridge's inability to influence or control these determinative factors.
Existing Protections Under the MSA. The MSA already provides Meridian with robust protections that address the underlying concern motivating the requested carve-out. Specifically:
(a) Indemnification for Breaches of Law. Under MSA Section 12.3(a), Skybridge has agreed to indemnify Meridian against third-party claims arising from Skybridge's breach of applicable law, including the Gramm-Leach-Bliley Act and Bank Secrecy Act/AML regulations, to the extent applicable to Skybridge as a service provider.
(b) Representations and Warranties. Under MSA Section 9.2, Skybridge has represented and warranted that the SkyComply™ platform and Skybridge's performance under the MSA will comply with applicable laws and industry security standards, and that the platform will function in material conformity with the documentation and functional specifications.
(c) Termination Rights. Meridian has the right to terminate the MSA upon Skybridge's material breach (subject to the cure period), and upon certain regulatory trigger events, providing Meridian with the ability to exit the arrangement in the event of a significant compliance failure.
(d) Data Breach Indemnification. The data breach indemnification cap discussed in Issue 3 provides Meridian with up to approximately $18,650,000 in recoverable amounts in connection with a data security breach attributable to Skybridge.
Market Practice. Market practice in enterprise SaaS agreements with regulated financial institutions strongly disfavors regulatory fine carve-outs from consequential damages exclusions. Based on Calderwood & Harkness's experience negotiating comparable transactions and industry benchmarking data, the overwhelming majority of enterprise SaaS agreements in the financial services sector do not include carve-outs for regulatory fines. This position reflects the widely accepted principle that the regulated entity — as the charter holder — bears primary responsibility for its regulatory compliance, and that allocating regulatory fine risk to a technology vendor through a consequential damages carve-out is inconsistent with the fundamental risk allocation of the SaaS model.
Proposed Middle Ground. While Skybridge declines the regulatory fine carve-out, Skybridge recognizes Meridian's legitimate concern regarding the costs of regulatory scrutiny that may arise in connection with a Skybridge breach. As a possible middle ground, Skybridge is willing to consider language confirming that direct damages recoverable by Meridian under the general liability cap include Meridian's reasonable, documented out-of-pocket costs incurred in responding to a regulatory inquiry or examination to the extent directly caused by Skybridge's breach of the MSA, including without limitation reasonable external counsel fees, consultant fees, and document production costs. This language would not, however, encompass regulatory fines, penalties, or civil money penalties themselves, which would continue to be subject to the consequential damages exclusion.
We believe this proposed middle ground addresses Meridian's practical concerns regarding the financial impact of regulatory interactions while maintaining an appropriate and market-standard risk allocation between the parties.
VII. Issue 5 — Security Incident Notification Window (Exhibit B, Section 5.1)
A. Meridian's Position
Meridian's markup proposes that Skybridge be required to notify Meridian of any confirmed Security Incident (as defined in the Security Exhibit) affecting Meridian data within twelve (12) hours of Skybridge's discovery of the incident.
B. Skybridge's Counter-Position
Skybridge's initial draft proposed a twenty-four (24) hour notification window, measured from Skybridge's confirmation that a Security Incident involves or is reasonably likely to involve Meridian data. Skybridge continues to believe that a 24-hour window is operationally appropriate; however, in the interest of compromise, Skybridge offers the following counter-proposal.
Rationale for a Measured Notification Window. Upon detection of anomalous activity or a potential security incident, Skybridge's incident response team — led by CISO Amara Okafor and comprising members of Skybridge's Security Operations Center, engineering, and legal teams — must undertake a series of critical triage steps before meaningful notification can be provided. These steps include:
(a) Confirming whether the detected anomaly constitutes an actual security incident, as opposed to a false positive or routine operational event;
(b) Determining whether the incident actually involves or is reasonably likely to involve Meridian data, as distinct from data belonging to other Skybridge clients or Skybridge's own internal systems;
(c) Assessing the scope, severity, and nature of the incident (e.g., whether unauthorized access has occurred, whether data has been exfiltrated, whether the incident is ongoing or has been contained);
(d) Gathering preliminary facts sufficient to provide Meridian with a meaningful initial notification that includes actionable information, rather than a premature or inaccurate alert that may cause unnecessary alarm and divert Meridian's security and compliance resources.
A twelve-hour window, particularly in circumstances where an incident is discovered outside of normal business hours (e.g., a weekend or overnight), does not provide adequate time for competent triage and may result in premature notifications that fail to include the contextual information Meridian needs to assess the incident and determine its own response obligations. Skybridge's incident response procedures are designed to comply with applicable state data breach notification statutes (including the New York SHIELD Act and Illinois PIPA), none of which require notification within twelve hours, and are consistent with FFIEC IT Examination Handbook guidance on information security incident response.
Proposed Compromise. Skybridge proposes the following tiered notification framework, which we believe addresses Meridian's need for rapid notification while providing Skybridge with adequate time for competent triage:
(1) Severity 1 Incidents (Confirmed Unauthorized Access or Exfiltration): For incidents involving confirmed unauthorized access to, or confirmed or reasonably suspected exfiltration of, Meridian data ("Severity 1 Security Incidents"), Skybridge will provide telephonic or email notification to Meridian's designated security contact within twelve (12) hours of Skybridge's confirmation that the incident involves or is reasonably likely to involve Meridian data. This initial notification will include such preliminary information as is then available regarding the nature, scope, and status of the incident. A comprehensive written incident report will follow within forty-eight (48) hours of the initial notification.
(2) All Other Security Incidents: For all other confirmed Security Incidents affecting Meridian data (i.e., Security Incidents that do not constitute Severity 1 Security Incidents), Skybridge will provide written notification to Meridian within eighteen (18) hours of Skybridge's confirmation that the incident involves or is reasonably likely to involve Meridian data.
In both cases, the notification clock would commence upon Skybridge's confirmation that the incident involves or is reasonably likely to involve Meridian data, as opposed to the initial detection of anomalous activity, which may ultimately prove to be unrelated to Meridian.
We believe this tiered approach provides Meridian with the rapid notification it requires for the most serious category of security incidents, while establishing a reasonable and workable notification framework for less severe incidents. The eighteen-hour window for non-Severity 1 incidents represents a meaningful movement from Skybridge's initial 24-hour position and effectively splits the difference between the parties' respective proposals.
VIII. Issue 6 — Penetration Testing Scope (Exhibit B, Section 7.3)
A. Meridian's Position
Meridian's markup requests the right to conduct annual penetration testing of the SkyComply™ platform at Meridian's expense, encompassing both application-layer testing and infrastructure-layer testing.
B. Skybridge's Counter-Position
Skybridge's initial draft limits Meridian-initiated penetration testing to application-layer testing only, with infrastructure-layer testing requiring Skybridge's prior written consent. Skybridge maintains this position for the reasons set forth below, but proposes a compromise framework to address Meridian's legitimate security assurance interests.
Multi-Tenant Architecture Constraints. The SkyComply™ platform is hosted on Orion Cloud Services, Inc.'s infrastructure-as-a-service platform in a multi-tenant environment. Infrastructure-layer penetration testing conducted by or on behalf of a single client has the potential to affect the shared infrastructure environment and the services provided to other Skybridge clients. Uncoordinated or inadequately scoped infrastructure-layer testing could result in service disruptions, performance degradation, or unintended security impacts affecting Skybridge's broader client base, which includes financial institutions, insurance companies, and other regulated entities that depend on the uninterrupted availability of the SkyComply™ platform.
Orion Cloud Contractual Restrictions. Orion Cloud's terms of service and Acceptable Use Policy expressly restrict third-party penetration testing of its infrastructure layer without Orion Cloud's prior written authorization. Skybridge does not have the unilateral right to authorize Meridian or Meridian's designated third-party testing firm to conduct infrastructure-layer testing on Orion Cloud's platform. Granting Meridian a contractual right that Skybridge cannot itself fulfill would create an inherent conflict and a breach risk for Skybridge under its agreement with Orion Cloud.
Independent Third-Party Testing. Skybridge engages Crestfield Cyber Advisors, Inc. ("Crestfield"), a nationally recognized cybersecurity firm, to perform comprehensive annual third-party penetration testing covering both the application layer and the infrastructure layer of the SkyComply™ platform. Crestfield conducts this testing under an engagement with Skybridge that is coordinated with Orion Cloud and conducted pursuant to Orion Cloud's authorized testing protocols. The results of Crestfield's testing provide robust, independent assurance regarding the security posture of both the application and infrastructure layers of the platform.
Proposed Compromise. In recognition of Meridian's legitimate security assurance interests and the importance of transparency, Skybridge proposes the following framework:
(1) Application-Layer Penetration Testing. Meridian may conduct annual application-layer penetration tests at Meridian's expense, using Meridian's internal security team or a qualified third-party testing firm reasonably acceptable to Skybridge (such acceptance not to be unreasonably withheld, conditioned, or delayed). Such testing will be subject to the following conditions:
(a) Minimum twenty (20) business days' advance written notice to Skybridge, including identification of the testing firm (if third-party), scope of testing, and proposed testing timeline;
(b) Execution of Skybridge's standard penetration testing rules of engagement, which include scope limitations designed to prevent testing activity that could adversely affect other Skybridge customers or the stability of the production environment;
(c) Testing to be conducted during mutually agreed windows, with Skybridge providing reasonable scheduling cooperation; and
(d) Prompt sharing of test results and findings with Skybridge for remediation purposes.
(2) Infrastructure-Layer Assurance. In lieu of Meridian-initiated infrastructure-layer penetration testing, Skybridge will provide Meridian with a copy of Crestfield's most recent annual penetration test summary report, redacted only to the extent necessary to remove findings specifically related to other Skybridge clients. The summary report will include a description of testing methodology, scope, material findings, severity classifications, and remediation timelines for any identified vulnerabilities. Skybridge will use commercially reasonable efforts to deliver such report within thirty (30) days of its completion by Crestfield.
(3) Exigent Circumstances. In the event Meridian has a demonstrated, specific, and reasonable concern regarding infrastructure-layer security — for example, a credible threat notification from a federal banking regulator, law enforcement agency, or intelligence community partner — Skybridge will work in good faith to facilitate limited infrastructure-layer testing through Crestfield or another mutually agreed independent third-party testing firm, at Meridian's expense. The scope, methodology, and timing of any such testing will be mutually determined by the parties in good faith, and Skybridge will use its best efforts to obtain any required approvals from Orion Cloud in connection therewith.
We believe this tripartite framework provides Meridian with comprehensive security assurance across both the application and infrastructure layers while respecting the multi-tenant architecture constraints and Orion Cloud's contractual requirements.
IX. Issue 7 — Confidentiality/Data Security Super-Cap (MSA, Section 11.4)
A. Meridian's Position
Meridian's markup proposes that liability for breaches of confidentiality and data security obligations be entirely uncapped — that is, carved out in full from the general aggregate liability cap — with no dollar limitation whatsoever on Skybridge's liability for such breaches.
B. Skybridge's Counter-Position
Skybridge proposes a separate "super-cap" for breaches of confidentiality and data security obligations, set at 3× the annual fees paid or payable by Meridian in the twelve-month period immediately preceding the event giving rise to the claim. In a steady-state year (Years 2 through 5), this equates to approximately $27,975,000 (3 × $9,325,000).
This super-cap would apply to Skybridge's aggregate liability for all claims arising from breaches of the confidentiality and data security obligations set forth in the MSA, the Security Exhibit, and the DPA, and would be separate from and in addition to the general aggregate liability cap of 2× annual fees (approximately $18,650,000 in a steady-state year).
Skybridge's rationale for the proposed super-cap is as follows:
Heightened Protection Beyond the General Cap. The super-cap provides Meridian with significantly enhanced financial protection beyond the general aggregate liability cap, specifically recognizing the heightened sensitivity and importance of data security obligations in the context of a financial services SaaS engagement. The 3× super-cap represents a 50% increase over the general 2× aggregate cap, reflecting the elevated risk profile that both parties attribute to data security matters.
Alignment with Insurance Coverage. The 3× super-cap of approximately $27,975,000 approximately aligns with Skybridge's per-occurrence cyber liability insurance coverage of $25,000,000 through Coastal Assurance Corporation (Policy No. CA-TECH-2025-07831). This alignment provides Meridian with reasonable assurance that, in the event of a data security breach giving rise to a claim at or near the super-cap level, Skybridge has an insured source of funds available to satisfy its indemnification obligations. We note that the $50,000,000 aggregate coverage limit on the Coastal Assurance policy provides an additional cushion in the event of multiple claims.
Comprehensive Liability Framework. When taken together with the other elements of the liability framework in the MSA, the super-cap forms part of a comprehensive, multi-layered set of protections for Meridian. The complete liability framework includes:
(a) General Aggregate Liability Cap: 2× annual fees (approximately $18,650,000 in a steady-state year), applicable to all claims other than those subject to the super-cap or carved out entirely from the caps;
(b) Confidentiality/Data Security Super-Cap: 3× annual fees (approximately $27,975,000 in a steady-state year), applicable to claims arising from breaches of confidentiality and data security obligations;
(c) Uncapped Obligations: The following categories of liability are excluded from all caps and are therefore uncapped:
(i) intellectual property indemnification obligations under MSA Section 12.2;
(ii) Liability arising from gross negligence or willful misconduct;
(iii) Skybridge's obligation to perform data export and certified deletion following termination of the MSA; and
(iv) Payment obligations under the MSA and Order Form.
This framework provides Meridian with multiple tiers of financial protection calibrated to the nature and severity of the underlying obligation, with the most sensitive areas (IP infringement, intentional conduct) remaining entirely uncapped.
Commercial Viability. An entirely uncapped exposure for confidentiality and data security breaches would be inconsistent with market practice for enterprise SaaS agreements and could have material adverse effects on Skybridge's financial viability. As noted in the discussion of Issue 3, Skybridge's FY 2024 EBITDA was approximately $11,700,000. An uncapped liability exposure for a broadly defined category of obligations such as "confidentiality and data security" could result in claims that exceed the company's total net worth, which would ultimately be contrary to Meridian's own interests in the continuity and stability of the SkyComply™ platform.
We believe the proposed 3× super-cap, in combination with the uncapped obligations identified above, provides Meridian with a commercially reasonable, market-consistent, and robust liability framework that appropriately reflects the importance of data security in this engagement.
X. Issue 8 — Additional Insured Status on Cyber Liability Policy (MSA, Section 14.2)
A. Meridian's Position
Meridian's markup requests that Meridian be named as an additional insured on (i) Skybridge's technology errors & omissions / cyber liability insurance policy (Coastal Assurance Corporation, Policy No. CA-TECH-2025-07831) and (ii) Skybridge's commercial general liability ("CGL") insurance policy.
B. Skybridge's Counter-Position
Skybridge is amenable in principle to naming Meridian as an additional insured on its commercial general liability policy and will include appropriate language to this effect in the revised draft of the MSA.
With respect to the technology E&O / cyber liability policy, Skybridge's position is more nuanced, and Skybridge has been actively engaged with its insurance carrier, Coastal Assurance Corporation, regarding the feasibility of Meridian's request. We note the following:
Market Practice. Additional insured endorsements on technology errors & omissions and cyber liability policies are less common in the market than additional insured endorsements on CGL policies. The nature of technology E&O and cyber liability coverage — which is designed to respond to claims arising from the insured's own professional services and data security practices — differs fundamentally from CGL coverage, and carriers frequently restrict or decline additional insured endorsements on such policies due to the potential for coverage disputes, moral hazard, and increased exposure.
Carrier Consultation. Skybridge has initiated discussions with Coastal Assurance Corporation regarding the feasibility, scope, and any additional premium implications associated with adding Meridian as an additional insured on the cyber liability / E&O policy. As of the date of this letter, Coastal Assurance's underwriting team is reviewing the request and has indicated that a definitive response will require approximately two to three additional weeks to complete. Skybridge anticipates providing Meridian with a definitive answer on this issue promptly upon receipt of Coastal Assurance's determination.
Proposed Alternative. In the interim, and as a potential alternative in the event that a full additional insured endorsement is not available or is subject to unacceptable conditions or premium increases, Skybridge proposes to provide Meridian with the following protections:
(a) A certificate of insurance evidencing the required coverage levels, including:
• Technology E&O / Cyber Liability: $25,000,000 per occurrence / $50,000,000 aggregate
• Commercial General Liability: $5,000,000 per occurrence / $10,000,000 aggregate
• Umbrella / Excess Liability: $10,000,000
(b) A contractual commitment in the MSA to maintain such coverage levels throughout the term of the agreement and any renewal periods;
(c) A commitment to provide Meridian with thirty (30) days' prior written notice of any material reduction in, non-renewal of, or cancellation of any required insurance coverage; and
(d) Delivery of the initial certificate of insurance within ten (10) business days of MSA execution, with annual renewal certificates to be provided within thirty (30) days of each policy renewal date.
Skybridge anticipates resolving this issue definitively within the coming weeks and will provide a supplemental response to your office once Coastal Assurance has completed its underwriting review. We ask for Meridian's patience on this particular point and assure Meridian that Skybridge is pursuing the matter diligently.
XI. Summary of Accepted Revisions
For completeness and to confirm the substantial areas of agreement between the parties, Skybridge has accepted — in whole or with minor clarifying modifications reflected in the enclosed redline — a number of Meridian's proposed revisions across the MSA and Exhibits A through D. The principal accepted revisions include, without limitation, the following:
(a) Regulatory Examination Rights. Skybridge acknowledges and accepts Meridian's proposed regulatory examination rights provision, which ensures that the OCC, the Federal Reserve, the FDIC, and other applicable federal and state regulators retain the authority to examine, audit, and obtain information from Skybridge in connection with the services provided under the MSA, consistent with the requirements of OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), the Interagency Guidance on Third-Party Relationships (June 2023), and the Bank Service Company Act, 12 U.S.C. § 1867(c). Skybridge will cooperate fully with any such regulatory examination.
(b) Data Residency. Skybridge accepts Meridian's requirement that all Meridian data processed, stored, or transmitted in connection with the SkyComply™ platform be maintained within the continental United States. Specifically, Meridian data will be hosted exclusively in Orion Cloud's US-East (Northern Virginia) and US-West (Oregon) regions, as set forth in the Security Exhibit and the DPA. No Meridian data will be transferred to, stored in, or processed from any data center located outside of the continental United States without Meridian's prior written consent.
(c) Subprocessor Approval Process. Skybridge accepts the subprocessor approval framework as proposed in Meridian's markup, pursuant to which Skybridge will provide Meridian with no fewer than thirty (30) days' advance written notice before engaging any new subprocessor to process Meridian data. Meridian will have a reasonable right to object to the proposed subprocessor, and in the event of a good-faith objection that cannot be resolved through consultation, Skybridge will refrain from engaging such subprocessor with respect to Meridian data. Orion Cloud Services, Inc. is identified as the initial approved subprocessor in the DPA.
(d) Background Check Requirements. Skybridge accepts Meridian's proposed background check requirements for all Skybridge personnel who will have access to Meridian data or Meridian systems, consistent with FFIEC guidelines. Background checks will include, at a minimum, criminal history, employment verification, and where applicable, credit history screening.
(e) Data Retention and Deletion Obligations. Skybridge accepts the post-termination data handling framework as proposed, including (i) provision to Meridian of a complete export of all Meridian data in a machine-readable format within thirty (30) days following the effective date of termination or expiration and (ii) certified destruction or deletion of all Meridian data from Skybridge's systems, including backup systems, within sixty (60) days following the effective date of termination or expiration, with written certification of destruction provided to Meridian upon completion.
(f) Audit Rights Framework. Skybridge accepts the audit rights framework as proposed by Meridian, including (i) an annual audit right exercisable upon thirty (30) business days' prior written notice, with Skybridge's then-current SOC 2 Type II report, ISO 27001 certificate, and completed Security Assessment Questionnaire satisfying routine audit requests absent a demonstrated material security concern, and (ii) the right to conduct an on-site audit upon Meridian's demonstration of a material security concern, at Meridian's expense, and subject to reasonable confidentiality protections and scope limitations.
(g) Source Code Escrow. Skybridge accepts the requirement to establish and maintain a source code escrow arrangement with Sentinel Escrow Services, Inc. (Escrow Agreement No. SCE-2025-04417), including the agreed release triggers as set forth in the markup.
(h) Quarterly Steering Committee. Skybridge accepts the governance provision requiring quarterly steering committee meetings with senior representatives from both parties to review platform performance, security posture, product roadmap, and relationship management matters.
(i) Encryption Standards. Skybridge confirms acceptance of the encryption standards as specified in the markup: AES-256 encryption for data at rest, TLS 1.2 or higher for data in transit, and a bring-your-own-key ("BYOK") integration option enabling Meridian to manage its own encryption keys through a supported key management service.
(j) Critical Incident Response Times. Skybridge accepts the incident response time commitments as proposed:
• Severity 1: 15-minute acknowledgment, 1-hour first response, 4-hour resolution target
• Severity 2: 30-minute acknowledgment, 2-hour first response, 8-hour resolution target
• Severity 3: 4-hour acknowledgment, 1 business day first response, 5 business day resolution target
(k) Dispute Resolution Framework. Skybridge accepts the dispute resolution framework as proposed, including three-tier executive escalation, a mandatory sixty (60) day mediation period administered by JAMS in New York, New York, followed by litigation in the Delaware Court of Chancery or the United States District Court for the District of Delaware, with mutual waiver of jury trial.
(l) Governing Law. Skybridge accepts the selection of the laws of the State of Delaware as the governing law, without regard to conflict of laws principles.
(m) Termination for Convenience. Skybridge accepts Meridian's right to terminate the MSA for convenience after the second anniversary of the Effective Date upon twelve (12) months' prior written notice and payment of an early termination fee equal to fifty percent (50%) of the remaining annual contract value for the then-current initial term.
These accepted revisions, taken together with the counter-positions on the eight open issues set forth above, reflect the full scope of Skybridge's responses to Meridian's first markup. The enclosed annotated redlines contain the precise proposed language for each accepted revision and counter-proposal.
XII. Proposed Path Forward
The eight issues identified in Sections III through X of this letter represent the remaining substantive gaps between the parties' positions. We are encouraged by the significant areas of agreement reflected in Section XI and believe that the remaining open issues are capable of resolution through focused and constructive negotiation.
Skybridge is committed to reaching mutually acceptable terms efficiently. As both parties are aware, the targeted project timeline calls for implementation commencement by September 15, 2025, implementation completion by February 28, 2026, and a Platform Go-Live Date of March 1, 2026. While the implementation commencement date has now passed, Skybridge's project management and technical teams have confirmed that the overall timeline remains achievable provided the MSA and related documents are executed no later than approximately mid-October 2025. Delays beyond that point may require an adjustment to the Go-Live Date, which neither party desires.
In light of these timeline considerations, we propose the following:
(1) Negotiation Call. We respectfully propose scheduling a negotiation call among outside counsel (Calderwood & Harkness and Hargrove, Tully & Marsh) together with the principals most closely involved in the transaction (David Shimura of Skybridge and Catherine Woo of Meridian) to discuss the eight open issues and seek resolution. We suggest scheduling this call within the next five (5) business days — i.e., by no later than October 8, 2025. We are available any day that week except Wednesday, October 8, and would appreciate your team's availability.
(2) Technical Discussion. Certain issues — in particular, Issue 5 (Security Incident Notification Window) and Issue 6 (Penetration Testing Scope) — may benefit from a supplemental technical discussion between Amara Okafor, Skybridge's CISO, and the designated technical representative(s) from Meridian's information security team (we understand Gerald Brannigan or Sandra Petrov may be the appropriate contacts). We are happy to coordinate such a discussion in parallel with or following the legal negotiation call, at Meridian's convenience.
(3) Revised Clean Draft. Upon resolution of the open issues, Calderwood & Harkness will promptly circulate a revised clean draft of the MSA and all Exhibits for final review. We would anticipate a three-to-five business day turnaround for preparation of the clean documents following agreement on the open points.
Finally, we wish to remind counsel that Skybridge will need to obtain the consent of Pinnacle Ridge Capital Partners, LP ("Pinnacle Ridge"), Skybridge's majority equity holder, for the transaction. The $50,000,000 total contract value exceeds the $25,000,000 contractual consent threshold established in Pinnacle Ridge's investment agreement with Skybridge. While Skybridge's management team has briefed Pinnacle Ridge on the transaction and is confident that consent will be forthcoming, the consent process requires submission of final or near-final documentation. Accordingly, we respectfully request that the parties move expeditiously toward resolution of the open issues and finalization of definitive terms, so that Skybridge may timely pursue and obtain the required investor consent without further delay to the project timeline.
XIII. Reservation of Rights
Nothing in this letter constitutes, or shall be construed as constituting, a binding agreement between Skybridge and Meridian with respect to the MSA, the Order Form, any Exhibit, or any other matter discussed herein. All terms, positions, and proposals discussed in this letter are subject to final agreement on all open issues, mutual satisfaction of all conditions, and execution and delivery of definitive documentation in form and substance satisfactory to each party and its counsel. All rights, remedies, claims, and positions of Skybridge are expressly reserved, and no waiver of any right shall be implied by any statement or proposal contained herein.
We appreciate the constructive and professional manner in which your team has engaged on this transaction, and we look forward to resolving the remaining issues promptly so that both Skybridge and Meridian can proceed with the implementation of the SkyComply™ platform. Should you wish to discuss any of the foregoing in advance of the proposed negotiation call, please do not hesitate to contact me or my colleagues Angela Fontaine or Liam Prescott at any time.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Amy Chesterton Associate 200 South Ashbury Asset Advisors, Suite 1800 Chicago, Illinois 60604 Telephone: (312) 555-7244
Email: achesterton@calderwoodharkness.com
Enclosures:
1. Annotated Redline of Master Software-as-a-Service Agreement (reflecting Skybridge's responses to Meridian's first markup)
2. Annotated Redline of Exhibit A (Service Level Agreement)
3. Annotated Redline of Exhibit B (Security Exhibit)
4. Annotated Redline of Exhibit C (Data Processing Addendum)
5. Annotated Redline of Exhibit D (Acceptable Use Policy)
cc: (via email)
Angela Fontaine, Esq., Partner, Calderwood & Harkness LLP Liam Prescott, Esq., Senior Associate, Calderwood & Harkness LLP David Shimura, Esq., General Counsel, Skybridge Fintech Ltd. Catherine Woo, Esq., Associate General Counsel (Technology), Meridian National Bank, N.A. Megan Faircloth, Esq., Senior Associate, Hargrove, Tully & Cascade Insurance Brokers
Issue No. | Issue Description | Document / Section Reference
1 | SLA Uptime Standard | Exhibit A (SLA), Section 2.1
2 | SLA Credit Cap | Exhibit A (SLA), Section 3.2
3 | Data Breach Indemnification Cap | MSA, Section 12.3(b)
4 | Consequential Damages Carve-Out for Regulatory Fines | MSA, Section 11.2(b)
5 | Security Incident Notification Window | Exhibit B (Security Exhibit), Section 5.1
6 | Penetration Testing Scope | Exhibit B (Security Exhibit), Section 7.3
7 | Confidentiality/Data Security Super-Cap | MSA, Section 11.4
8 | Additional Insured Status on Cyber Liability Policy | MSA, Section 14.2
Monthly Uptime | Credit (% of Monthly Subscription Fee)
99.9% – 99.5% | 5%
99.5% – 99.0% | 10%
99.0% – 98.0% | 20%
Below 98.0% | 30%, plus Meridian termination right if occurring in 3 of any consecutive 6 months
Monthly Uptime | Original Credit | Enhanced Credit (Proposed)
99.9% – 99.5% | 5% | 7.5%
99.5% – 99.0% | 10% | 15%
99.0% – 98.0% | 20% | 20% (unchanged)
Below 98.0% | 30% + termination right | 30% + termination right (unchanged)

CALDERWOOD & HARKNESS LLP Attorneys at Law

VIA EMAIL AND OVERNIGHT COURIER

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts