1009-00007 · Skybridge Fintech Ltd · Correspondence

letter-to-htm-transmitting-initial-draft.docx DOCUMENT Funds

8 / 35 ← → ✕

CALDERWOOD & HARKNESS LLP Attorneys at Law

200 South Ashbury Asset Advisors, Suite 1800 Chicago, Illinois 60604 Telephone: (312) 555-8400 Facsimile: (312) 555-8401 www.calderwoodharkness.com

September 5, 2025

VIA EMAIL AND FedEx

Douglas Krenshaw, Esq. Partner Hargrove, Tully & Cascade Insurance Brokers 1 Chase Manhattan Plaza, Suite 5500 New York, NY 10005

Re: Enterprise Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. and Meridian National Bank, National Association — Transmittal of Initial Draft Agreement and Exhibits

Our Matter No.: 1009-00007

Dear Douglas:

I. Introduction and Purpose

This firm represents Skybridge Fintech Ltd. ("Skybridge"), a Delaware limited liability company, in connection with the negotiation and execution of an enterprise Master Software-as-a-Service Agreement (the "MSA") with Meridian National Bank, National Association ("Meridian"). We understand that Hargrove, Tully & Cascade Insurance Brokers serves as outside counsel to Meridian in this matter, and we appreciate your engagement on behalf of Meridian in what we expect will be a collaborative and productive negotiation process.

The purpose of this letter is to transmit Skybridge's initial draft of the MSA, together with the associated exhibits and ancillary documents described more fully in Section III below, for Meridian's review and markup. We have endeavored to prepare these drafts in a manner that reflects the commercial understandings reached between the respective business teams to date, while also addressing the legal, regulatory, and operational requirements that are customary in enterprise SaaS transactions of this nature in the financial services industry.

David Shimura, General Counsel of Skybridge, has authorized the transmittal of these materials following substantive preliminary discussions between the respective business teams, including Tara Bellingham, Vice President of Enterprise Sales at Skybridge, and Luis Arriaga, Senior Vice President of Procurement & Vendor Management at Meridian. Those discussions established the core commercial parameters that are reflected in the enclosed drafts, and we believe the documentation is consistent with the framework the parties have agreed upon in principle.

II. Transaction Overview

By way of background, and to confirm the parties' mutual understanding of the transaction, the contemplated arrangement involves the following principal terms:

Platform and Scope of Services. Skybridge will license to Meridian its proprietary SkyComply™ AI-driven anti-money-laundering and transaction-monitoring platform under a five-year enterprise SaaS arrangement. SkyComply™ provides comprehensive BSA/AML compliance capabilities, including real-time transaction surveillance, suspicious activity detection and alert generation, automated regulatory filing support, customer due diligence and enhanced due diligence workflows, and risk scoring analytics. The deployment will cover approximately 32,000 named users across Meridian's retail banking, commercial banking, and wealth management divisions, including both U.S. and international operations.

Total Contract Value. The total contract value over the five-year initial term is Fifty Million Dollars ($50,000,000), reflecting a 6.72% volume discount from undiscounted aggregate fees of $53,600,000. This volume discount was negotiated in consideration of Meridian's commitment to the full enterprise deployment across all three major business divisions.

Fee Structure. Year 1 fees total $12,700,000, inclusive of: (i) platform subscription fees; (ii) one-time implementation and onboarding services fees of $3,600,000; and (iii) ongoing support and managed services fees of $1,800,000. Annual fees for Years 2 through 5 are $9,325,000 per year, reflecting the recurring platform subscription and managed services fees without the one-time implementation component.

Implementation Timeline. The implementation period is targeted to commence on September 15, 2025 and conclude on February 28, 2026, with a Platform Go-Live Date of March 1, 2026. The implementation project plan, including detailed milestones, acceptance criteria, and resource allocation requirements, will be set forth in the Order Form and the associated Statement of Work, which will be finalized during the negotiation of the definitive documentation.

Term and Renewal. The initial term of the MSA is five years from the Platform Go-Live Date, running through approximately February 28, 2031. The MSA provides for two successive one-year automatic renewal terms unless either party provides at least 180 days' written notice of non-renewal prior to the expiration of the then-current term.

Payment Terms. Subscription and managed services fees are payable quarterly in advance, net 30 days from the date of invoice. Beginning in Year 3, fees are subject to a 3.0% CPI-based annual escalator, capped at 3.5% per annum.

Certifications. Skybridge currently holds SOC 2 Type II certification (most recent report dated March 15, 2025) and ISO 27001 certification (recertified January 22, 2025), both audited and issued by Crestfield Cyber Advisors, Inc., an independent third-party cybersecurity assessment firm. Copies of both reports are available upon request and will be provided to Meridian under the terms of the Security Exhibit.

Governing Law and Venue. The MSA provides for Delaware governing law, with exclusive venue in the state or federal courts located in Wilmington, Delaware, as described in greater detail in Section 4.10 below.

III. Enclosed Documents

We are pleased to enclose the following documents in connection with this transmittal, each in clean Microsoft Word (.docx) format for ease of markup and collaborative review:

1. Master Software-as-a-Service Agreement (MSA) — Initial Draft (clean). The core agreement setting forth the terms and conditions governing the SaaS relationship between Skybridge and Meridian, including provisions addressing license grants, service delivery, representations and warranties, indemnification, limitation of liability, intellectual property ownership, confidentiality, regulatory compliance, term, renewal, termination, and general provisions.

2. Order Form — Initial Draft. The Order Form setting forth the specific commercial terms applicable to the initial deployment, including the named user count of 32,000, the fee structure described above, the implementation timeline, applicable volume discounts, and the payment schedule.

3. SLA Exhibit (Exhibit A to MSA) — Initial Draft. The service level agreement terms, including platform availability targets, measurement methodology, SLA credit tiers, scheduled maintenance windows, incident severity classifications, response and resolution targets, and escalation procedures.

4. Security Exhibit (Exhibit B to MSA) — Initial Draft. The data security and compliance terms, including encryption standards, access controls, audit rights, penetration testing protocols, security incident notification obligations, subprocessor management procedures, personnel security requirements, and ongoing compliance certifications.

5. Data Processing Addendum (Exhibit C to MSA) — Initial Draft. The data processing terms governing Skybridge's processing of Meridian data, including Non-Public Personal Information ("NPI") as defined under the Gramm-Leach-Bliley Act ("GLBA") and personally identifiable information ("PII"), data classification requirements, data residency obligations, data retention and destruction protocols, and post-termination data handling procedures.

6. Acceptable Use Policy (Exhibit D to MSA) — Initial Draft. The permitted and prohibited uses of the SkyComply™ platform by Meridian's authorized users, including restrictions on reverse engineering, unauthorized access, and use of the platform in a manner that would compromise the security or performance of the multi-tenant environment.

We note that two additional ancillary documents will follow under separate cover once finalized:

• Source Code Escrow Agreement with Sentinel Escrow Services, Inc. (Escrow Agreement No. SCE-2025-04417). This three-party agreement is currently being finalized with Sentinel and is expected to be circulated within the next seven to ten business days. We discuss the material terms of this agreement in Section 4.11 below.

• Certificate of Insurance from Coastal Assurance Corporation. The certificate is being prepared to reflect the coverage requirements set forth in the MSA and will be delivered upon finalization. We discuss the insurance terms in Section 4.9 below.

IV. Summary of Key Commercial and Legal Positions

To facilitate Meridian's review, we provide the following summary of the key commercial and legal positions reflected in the enclosed drafts. This summary is intended for convenience only and is qualified in its entirety by the terms of the enclosed documents. In the event of any inconsistency between this summary and the terms of the enclosed drafts, the terms of the enclosed drafts shall control.

4.1 Grant of License and Scope

The MSA grants Meridian a non-exclusive, non-transferable (except as expressly provided in the MSA), enterprise-wide SaaS license for Meridian's authorized use of the SkyComply™ platform during the term of the agreement. The license encompasses Meridian and its majority-owned subsidiaries that are identified on the Order Form, subject to the named user limitations set forth therein.

The initial deployment accommodates up to 32,000 named users. Incremental named users beyond the initial 32,000 may be added during the term at a rate of $275 per user per year, invoiced on a pro-rata basis from the date of activation. The volume discount applicable to the initial 32,000-user commitment does not apply to incremental users, consistent with the commercial understanding between the business teams.

The SkyComply™ platform is hosted on Orion Cloud Services, Inc. ("Orion Cloud") infrastructure. All Meridian data will be stored and processed exclusively within the continental United States, specifically within the Orion Cloud US-East (Virginia) and US-West (Oregon) regions. No Meridian data will be stored, processed, or transferred outside of these designated U.S. regions without Meridian's prior written consent.

4.2 Service Level Agreement (SLA) — Exhibit A

Exhibit A to the MSA sets forth the service level commitments applicable to the SkyComply™ platform. We highlight the following key terms for Meridian's consideration:

Platform Availability. Skybridge proposes a platform availability target of 99.9% monthly uptime, measured exclusive of scheduled maintenance windows. Scheduled maintenance windows are designated as Saturdays from 2:00 AM to 6:00 AM Eastern Time, with a maximum of four hours per week. We are aware that Meridian has indicated a preference for a 99.95% uptime commitment. Skybridge's proposed position at 99.9% reflects the standard that Skybridge can commit to on a contractual basis while accounting for the inherent dependency on its upstream infrastructure provider's SLA (Orion Cloud currently provides a 99.99% availability SLA at the infrastructure layer, but application-layer availability is necessarily subject to additional variables) and maintaining the quality and reliability guarantees that Skybridge's financial-institution clients across its customer base have come to expect. We are, however, open to discussing this point further and exploring potential structures, such as a tiered availability commitment or a graduated credit model, that may address Meridian's objectives.

SLA Credit Tiers. The SLA provides for the following service credit structure in the event that the 99.9% monthly uptime target is not met:

Credit Caps. Monthly SLA credits are capped at 30% of the monthly subscription fee, and annual SLA credits are capped at 15% of the annual subscription fee. In practical terms, this translates to a maximum monthly credit of approximately $317,500 and a maximum annual credit of approximately $1,905,000 in Year 1, and a maximum monthly credit of approximately $233,125 and a maximum annual credit of approximately $1,398,750 in Years 2 through 5.

Exclusive Remedy. SLA credits constitute Meridian's sole and exclusive remedy for Skybridge's failure to meet the uptime target, subject to Meridian's termination right described below. This formulation is standard in enterprise SaaS agreements and provides an appropriate balance between accountability for service performance and predictability of exposure.

Termination Trigger. Notwithstanding the exclusive remedy provision, Meridian retains the right to terminate the MSA if platform uptime falls below 98.0% in three of any consecutive six calendar months, upon written notice to Skybridge.

Incident Response. The SLA establishes the following incident severity classifications and corresponding response commitments:

Resolution targets represent good-faith objectives and are not guaranteed service levels. Skybridge will use commercially reasonable efforts to resolve all incidents within the targeted timeframes.

4.3 Security Terms — Exhibit B

The Security Exhibit reflects Skybridge's commitment to maintaining a robust and auditable security posture appropriate for the handling of sensitive financial data. The key provisions include:

Certifications. Skybridge will maintain SOC 2 Type II and ISO 27001 certifications throughout the term of the MSA. Both certifications are currently audited and issued by Crestfield Cyber Advisors, Inc. Skybridge will provide Meridian with updated copies of its SOC 2 Type II report and ISO 27001 certificate within 30 days of their issuance each year.

Encryption Standards. All Meridian data at rest will be encrypted using AES-256 encryption. All Meridian data in transit will be encrypted using TLS 1.2 or higher. Encryption keys will be managed through Skybridge-managed hardware security modules ("HSMs"), with a bring-your-own-key ("BYOK") option available to Meridian for customers that require independent key management. The BYOK option, if elected by Meridian, will be governed by a supplemental key management procedures document to be mutually agreed upon.

Penetration Testing. Skybridge conducts annual third-party penetration testing through its designated auditor. In addition, Meridian may conduct its own annual penetration test of the SkyComply™ platform at Meridian's expense, subject to the following conditions: (i) such testing shall be limited to application-layer testing of the SkyComply™ platform; and (ii) infrastructure-layer testing will require Skybridge's prior written consent, which shall not be unreasonably withheld but may be conditioned upon Skybridge's review and approval of the scope, methodology, and timing of such testing. This limitation is necessary to ensure the protection of the multi-tenant environment and the security and privacy of other Skybridge customers' data.

Security Incident Notification. Skybridge proposes a 24-hour notification window from the time of confirmed discovery of a Security Incident (as defined in the Security Exhibit) affecting Meridian data. This timeframe is consistent with prevailing industry practice for SaaS providers serving financial institutions and is aligned with the applicable regulatory expectations under the interagency guidance on computer-security incident notification requirements. Initial notification may be made by telephone or email, with a written incident report to follow within 72 hours of initial notification containing such information as is reasonably available at that time regarding the nature, scope, and known impact of the incident.

Audit Rights. Meridian may audit Skybridge's security controls once annually upon not less than 30 business days' prior written notice to Skybridge. Skybridge may satisfy reasonable audit requests through the delivery of its then-current SOC 2 Type II report, ISO 27001 certificate, and a supplemental Security Assessment Questionnaire completed by Skybridge's security team. On-site audits of Skybridge's facilities or its subprocessors' facilities shall be permitted only upon Meridian's demonstration of a material security concern that cannot be adequately addressed through documentary audit responses, and such on-site audits shall be conducted during normal business hours in a manner that does not unreasonably interfere with Skybridge's operations.

Subprocessor Management. Skybridge will provide Meridian with not less than 30 days' advance written notice before engaging any new subprocessor that will have access to or process Meridian data. Meridian will hold a reasonable objection right with respect to such new subprocessors. Orion Cloud Services, Inc. is identified as the initial approved subprocessor in the Security Exhibit. A complete list of current subprocessors is appended to the Security Exhibit.

Personnel Security. All Skybridge personnel with access to Meridian data will be subject to background checks consistent with the examination guidelines issued by the Federal Financial Institutions Examination Council ("FFIEC"), including criminal history, employment verification, and credit history checks as appropriate for the role.

4.4 Data Processing — Exhibit C

The Data Processing Addendum addresses Skybridge's obligations with respect to the processing of Meridian data, which the parties acknowledge includes data classified as "Confidential" and "Highly Restricted" under Meridian's internal data classification policy, as well as Non-Public Personal Information ("NPI") as defined under the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809) and personally identifiable information ("PII") under applicable state and federal privacy laws. The key provisions include:

Data Residency. All Meridian data will be stored and processed exclusively within the continental United States, in the Orion Cloud US-East (Virginia) and US-West (Oregon) regions. No Meridian data will be transferred to, accessed from, or processed in any jurisdiction outside the continental United States without Meridian's prior written consent.

Post-Termination Data Handling. Upon expiration or termination of the MSA for any reason, Skybridge will provide Meridian with a complete data export in a machine-readable, industry-standard format (e.g., JSON, CSV, or XML, as mutually agreed) within 30 calendar days of the effective date of termination. Following delivery and confirmation of receipt of the data export, Skybridge will certify the destruction of all Meridian data in its possession, custody, or control — including all copies, backups, and replicas — within 60 calendar days of the effective date of termination, with destruction performed in accordance with NIST SP 800-88 guidelines. An officer-level certification of destruction will be provided to Meridian upon completion.

4.5 Indemnification. The MSA contains mutual indemnification obligations designed to allocate risk in a manner consistent with industry practice for enterprise SaaS agreements in the financial services sector. The principal indemnification provisions are summarized as follows:

Skybridge's Indemnification Obligations. Skybridge will indemnify, defend, and hold harmless Meridian, its officers, directors, employees, and agents from and against third-party claims arising from:

(a) Third-party intellectual property infringement claims arising from Meridian's authorized use of the SkyComply™ platform in accordance with the MSA (uncapped, consistent with market standard for IP indemnities in enterprise software transactions);

(b) Skybridge's breach of its data security and confidentiality obligations under the MSA, the Security Exhibit, or the Data Processing Addendum resulting in the unauthorized access to, disclosure of, or loss of Meridian data; and

(c) Skybridge's material breach of applicable law, including without limitation the GLBA, BSA/AML regulations, and other applicable federal and state banking and financial privacy laws.

Meridian's Indemnification Obligations. Meridian will indemnify, defend, and hold harmless Skybridge, its officers, directors, employees, and agents from and against third-party claims arising from:

(a) Claims arising from Meridian's breach of the Acceptable Use Policy (Exhibit D);

(b) Claims arising from data or content provided by Meridian to Skybridge in connection with the services that infringes the intellectual property or other rights of any third party; and

Indemnification Caps. The IP indemnification obligation of Skybridge is uncapped. The data breach indemnification obligation of Skybridge is proposed at a cap of 2× the annual fees paid or payable by Meridian in the 12-month period immediately preceding the claim (approximately $18,650,000 in a steady-state year, based on Years 2–5 annual fees of $9,325,000). All other general indemnification obligations are proposed at a cap of 1× the annual fees paid or payable in the preceding 12-month period (approximately $9,325,000).

Exclusive Remedy for IP Infringement. In the event that the SkyComply™ platform or any component thereof becomes subject to an injunction or is held to infringe a third party's intellectual property rights, Skybridge may, at its option and expense: (i) procure a license for Meridian's continued use of the affected component; (ii) modify or replace the affected component to make it non-infringing while providing substantially equivalent functionality; or (iii) if neither (i) nor (ii) is commercially practicable, terminate the affected portion of the MSA and issue a pro-rata refund of any prepaid and unused fees attributable to the affected period.

4.6 Liability Caps

The MSA establishes the following limitations on liability, which are intended to provide an appropriate framework for risk allocation between the parties:

General Aggregate Liability Cap. The aggregate liability of each party under the MSA (exclusive of the uncapped items identified below) is capped at 2× the annual fees paid or payable by Meridian in the 12-month period immediately preceding the event giving rise to the claim. Based on the Years 2–5 annual fee of $9,325,000, this cap is approximately $18,650,000.

Uncapped Items. The following obligations are excluded from the general aggregate liability cap:

(a) Skybridge's IP indemnification obligations under Section 4.5(a) above;

(b) Liability arising from either party's gross negligence or willful misconduct;

(d) Meridian's payment obligations for fees due and payable under the MSA and Order Form.

Data Security Super-Cap. Liability arising from breaches of data security and confidentiality obligations (including breaches of the Security Exhibit and the Data Processing Addendum) is subject to a separate "super-cap" of 3× the annual fees paid or payable in the preceding 12-month period, or approximately $27,975,000. This elevated cap reflects the parties' recognition of the heightened sensitivity of Meridian's data and the regulatory environment in which Meridian operates.

Consequential Damages Exclusion. The MSA provides for a mutual exclusion of indirect, incidental, consequential, special, and punitive damages, subject to carve-outs for: (i) breaches of confidentiality obligations; (ii) IP indemnification obligations; and (iii) breaches of data security obligations. We note that Skybridge's proposed position does not include a carve-out from the consequential damages exclusion for regulatory fines or penalties. It is Skybridge's position that regulatory fines imposed upon Meridian by its regulators constitute consequential damages that should appropriately remain within the scope of the mutual consequential damages exclusion. We recognize that this may be a point of discussion and are prepared to address Meridian's perspective on this issue during negotiations.

4.7 Regulatory Compliance

Given Meridian's status as a national banking association supervised by the Office of the Comptroller of the Currency ("OCC"), the MSA includes express contractual provisions addressing the regulatory requirements applicable to technology service providers to federally regulated financial institutions:

Examination Rights. The MSA includes an express acknowledgment of the rights of federal banking regulators — including the OCC, the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation ("FDIC") — to examine Skybridge's services, records, and facilities to the extent required by applicable law and regulation, consistent with OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), the Interagency Guidance on Third-Party Relationships: Risk Management (issued June 6, 2023), and the Bank Service Company Act (12 U.S.C. § 1867(c)).

Bank Service Company Acknowledgment. Skybridge acknowledges its status as a "bank service company" as that term is used in the Bank Service Company Act, and the MSA includes the corresponding regulatory cooperation and record retention obligations.

4.8 Term, Renewal, and Termination

Initial Term. The initial term of the MSA is five years commencing on the Platform Go-Live Date (targeted for March 1, 2026) and continuing through approximately February 28, 2031.

Automatic Renewal. Following the initial term, the MSA will automatically renew for up to two successive one-year renewal terms, unless either party provides at least 180 days' prior written notice of non-renewal before the expiration of the then-current term.

Termination for Convenience. Meridian may terminate the MSA for convenience after the end of Year 2 of the initial term, upon not less than 12 months' prior written notice to Skybridge and payment of an early termination fee ("ETF") equal to 50% of the remaining annual contract value for the balance of the then-current term. By way of illustration, if Meridian were to exercise this right effective at the end of Year 3 (with two years remaining in the initial term), the ETF would be calculated as 50% × $9,325,000 × 2 remaining years = $9,325,000.

Termination for Cause. Either party may terminate the MSA upon the other party's material breach that remains uncured for 30 days following written notice thereof (or such longer cure period as may be specified in the MSA for specific categories of breach). The MSA also provides for immediate termination rights upon the occurrence of certain specified events, including insolvency, bankruptcy, or cessation of business operations.

4.9 Insurance. The MSA requires Skybridge to maintain the following insurance coverages throughout the term of the agreement:

• Technology Errors & Omissions / Cyber Liability Insurance: $25,000,000 per occurrence and $50,000,000 in the aggregate. This coverage is currently provided by Coastal Assurance Corporation under Policy No. CA-TECH-2025-07831, with a policy period of April 1, 2025 through March 31, 2026.

• Commercial General Liability Insurance: $5,000,000 per occurrence and $10,000,000 in the aggregate.

• Umbrella / Excess Liability Insurance: $10,000,000 in excess of the underlying CGL and other scheduled coverages.

• Workers' Compensation Insurance: At statutory limits as required by the laws of each applicable jurisdiction.

Skybridge will deliver a certificate of insurance evidencing the foregoing coverages within 10 business days of execution of the MSA, and annually thereafter throughout the term. We note that Skybridge is currently reviewing Meridian's request for additional insured status on the CGL and cyber liability policies with Coastal Assurance Corporation and will revert to Meridian's counsel once that review is complete.

4.10 Dispute Resolution

The MSA establishes a structured dispute resolution framework designed to encourage efficient resolution of disputes before the commencement of formal proceedings:

Executive Escalation. Prior to initiating any formal dispute resolution proceeding, the parties will engage in a mandatory three-tiered executive escalation process: (i) the parties' designated account managers will attempt to resolve the dispute within 10 business days; (ii) if unresolved, the matter will be escalated to VP-level executives of each party for an additional 10 business days; and (iii) if still unresolved, the matter will be escalated to the CEO-level or CIO-level executives of each party for a final 10 business days.

Mediation. If the dispute is not resolved through executive escalation, the parties will submit the dispute to mediation administered by JAMS in New York, New York, for a period of 60 days before either party may initiate litigation.

Jury Trial Waiver. The MSA provides for a mutual waiver of the right to a jury trial in any action arising under or relating to the MSA, consistent with customary practice in commercial agreements between sophisticated parties in the financial services sector.

Governing Law and Venue. As noted above, the MSA is governed by the laws of the State of Delaware (without regard to conflicts-of-law principles), with exclusive jurisdiction and venue in the state and federal courts located in Wilmington, Delaware.

4.11 Source Code Escrow

The MSA contemplates the execution of a three-party Source Code Escrow Agreement among Skybridge, Meridian, and Sentinel Escrow Services, Inc. as escrow agent (Escrow Agreement No. SCE-2025-04417). The material terms of the escrow arrangement, which will be set forth in the separate escrow agreement, are as follows:

Initial Deposit. Skybridge will make an initial deposit of the complete source code for the SkyComply™ platform, together with all build tools, documentation, and instructions necessary to compile and deploy the platform, within 30 days of execution of the MSA.

Ongoing Deposits. Skybridge will make updated deposits of the source code and related materials on a quarterly basis throughout the term of the MSA, reflecting any updates, modifications, or new releases made available to Meridian during the preceding quarter.

Release Triggers. The source code will be released to Meridian upon the occurrence of any of the following events: (i) Skybridge's insolvency or the filing of a voluntary or involuntary bankruptcy petition involving Skybridge; (ii) Skybridge's material breach of its support and maintenance obligations under the MSA that remains uncured for a period of 60 days following written notice from Meridian; or (iii) Skybridge's cessation of business operations or discontinuation of the SkyComply™ product line.

Escrow Fees. The annual escrow fees of $13,000 will be shared equally between Skybridge and Meridian, with each party responsible for $6,500 per year.

The escrow agreement is currently being finalized with Sentinel Escrow Services, Inc. and will be transmitted under separate cover within the next seven to ten business days for Meridian's review.

V. Pinnacle Ridge Capital Partners Consent

We wish to bring to your attention that Skybridge is majority-owned (62%) by Pinnacle Ridge Capital Partners, LP ("Pinnacle Ridge"), a Delaware limited partnership. Under the terms of Pinnacle Ridge's investment agreement with Skybridge, Pinnacle Ridge holds contractual consent rights over material contracts entered into by Skybridge that exceed $25,000,000 in total contract value. Because the total contract value of the contemplated MSA is $50,000,000, the execution of the MSA will require Pinnacle Ridge's prior written consent.

Pinnacle Ridge's consent is being processed concurrently with the parties' negotiation of definitive documentation, through Pinnacle Ridge's outside counsel, Alcott & Grenier LLP (Simone Alcott, Partner). Based on our discussions with Alcott & Grenier, we expect Pinnacle Ridge's consent to be obtained well in advance of the parties' targeted execution date, and this consent process should not affect or delay the timing of the parties' negotiation of the definitive MSA and ancillary documents. We will keep you apprised of the status of the consent process as appropriate.

VI. Request for Markup and Proposed Timeline

Given the complexity of the transaction and the volume of documentation involved, we respectfully request that Hargrove, Tully & Cascade Insurance Brokers provide its markup and consolidated comments on all enclosed documents within two weeks of the date of this letter — that is, by approximately September 19, 2025. We recognize that this timeline is ambitious, but we believe it is achievable given the extensive preliminary discussions between the business teams that have informed the preparation of these drafts.

We draw your attention to the fact that the parties' targeted implementation start date is September 15, 2025, and efficient negotiation and execution of the definitive documentation is important to preserving the project timeline and achieving the Platform Go-Live Date of March 1, 2026. Any delay in the execution of the MSA may necessitate a corresponding adjustment to the implementation schedule and the Go-Live Date. We are committed to working collaboratively with your firm and Meridian's internal legal team to maintain the agreed-upon timeline.

In the interest of efficient negotiation, we would be pleased to arrange a call between the deal teams and counsel at your earliest convenience to discuss any preliminary questions, areas of expected comment, or structural concerns prior to the submission of formal markups. On the Skybridge side, David Shimura (General Counsel) is available to participate in such a call, and we would suggest coordination with Catherine Woo (Associate General Counsel, Technology) on the Meridian side as appropriate.

Additionally, Skybridge's Chief Information Security Officer, Amara Okafor, and Chief Technology Officer, Marcus Holt, are available to discuss security architecture, platform infrastructure, data handling practices, and technical implementation matters directly with Meridian's Chief Information Officer, Gerald Brannigan, and Head of Financial Crimes & Compliance, Sandra Petrov, as needed. We have found that direct technical engagement between the parties' subject matter experts at the outset of the documentation process often accelerates the resolution of security and compliance-related comments and reduces the number of open issues in the legal markup.

VII. Reservation of Rights

The enclosed drafts of the MSA and ancillary documents are transmitted for negotiation purposes only and are not intended to create, nor shall they be construed as creating, any binding obligation on the part of Skybridge, Meridian, or any other party. No binding agreement between the parties shall exist unless and until a definitive agreement is executed and delivered by both Skybridge and Meridian in accordance with their respective internal approval processes and corporate governance requirements. All terms set forth in the enclosed drafts remain subject to further negotiation, and the transmission of these drafts does not constitute an offer, acceptance, or commitment by any party.

VIII. Confidentiality Notice

The enclosed documents and the contents of this letter are confidential and proprietary to Skybridge and are transmitted subject to any existing confidentiality agreement or non-disclosure agreement between Skybridge and Meridian. We respectfully request that distribution of the enclosed materials be limited to those individuals at Meridian, Hargrove, Tully & Cascade Insurance Brokers, and their respective advisors who have a direct need to know in connection with the evaluation, negotiation, and execution of the contemplated transaction.

We look forward to a productive and collaborative negotiation process and to working with you and your team to bring this transaction to a successful conclusion. Should you have any questions regarding the enclosed documents or any other aspect of this matter, please do not hesitate to contact me directly.

Sincerely,

CALDERWOOD & HARKNESS LLP

By: ________

Amy Chesterton, Partner 200 South Ashbury Asset Advisors, Suite 1800 Chicago, IL 60604 Telephone: (312) 555-8417

Email: achesterton@calderwoodharkness.com

cc: (via email)

David Shimura, General Counsel, Skybridge Fintech Ltd. Angela Fontaine, Calderwood & Harkness LLP Liam Prescott, Calderwood & Harkness LLP Catherine Woo, Associate General Counsel, Technology, Meridian National Bank, N.A. Megan Faircloth, Hargrove, Tully & Cascade Insurance Brokers

Enclosures (6):

1. Master Software-as-a-Service Agreement — Initial Draft

2. Order Form — Initial Draft

3. SLA Exhibit (Exhibit A to MSA) — Initial Draft

4. Security Exhibit (Exhibit B to MSA) — Initial Draft

5. Data Processing Addendum (Exhibit C to MSA) — Initial Draft

6. Acceptable Use Policy (Exhibit D to MSA) — Initial Draft

Monthly Uptime Percentage	SLA Credit (% of Monthly Subscription Fee)
99.9% to 99.5%	5%
Below 99.5% to 99.0%	10%
Below 99.0% to 98.0%	20%
Below 98.0%	30%
Severity Level	Description	Acknowledgment	First Response	Resolution Target
Severity 1	Platform Down (complete outage affecting all users)	15 minutes	1 hour	4 hours
Severity 2	Major Feature Impaired (core functionality degraded for a significant portion of users)	30 minutes	2 hours	8 hours
Severity 3	Minor Impact (limited functionality degradation affecting a small number of users)	4 hours	1 business day	5 business days

CALDERWOOD & HARKNESS LLP Attorneys at Law
200 South Ashbury Asset Advisors, Suite 1800 Chicago, Illinois 60604 Telephone: (312) 555-8400 Facsimile: (312) 555-8401 www.calderwoodharkness.com
September 5, 2025
VIA EMAIL AND FedEx
Douglas Krenshaw, Esq. Partner Hargrove, Tully & Cascade Insurance Brokers 1 Chase Manhattan Plaza, Suite 5500 New York, NY 10005
Re: Enterprise Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. and Meridian National Bank, National Association — Transmittal of Initial Draft Agreement and Exhibits
Our Matter No.: 1009-00007
Dear Douglas:
I. Introduction and Purpose
This firm represents Skybridge Fintech Ltd. ("Skybridge"), a Delaware limited liability company, in connection with the negotiation and execution of an enterprise Master Software-as-a-Service Agreement (the "MSA") with Meridian National Bank, National Association ("Meridian"). We understand that Hargrove, Tully & Cascade Insurance Brokers serves as outside counsel to Meridian in this matter, and we appreciate your engagement on behalf of Meridian in what we expect will be a collaborative and productive negotiation process.
The purpose of this letter is to transmit Skybridge's initial draft of the MSA, together with the associated exhibits and ancillary documents described more fully in Section III below, for Meridian's review and markup. We have endeavored to prepare these drafts in a manner that reflects the commercial understandings reached between the respective business teams to date, while also addressing the legal, regulatory, and operational requirements that are customary in enterprise SaaS transactions of this nature in the financial services industry.
David Shimura, General Counsel of Skybridge, has authorized the transmittal of these materials following substantive preliminary discussions between the respective business teams, including Tara Bellingham, Vice President of Enterprise Sales at Skybridge, and Luis Arriaga, Senior Vice President of Procurement & Vendor Management at Meridian. Those discussions established the core commercial parameters that are reflected in the enclosed drafts, and we believe the documentation is consistent with the framework the parties have agreed upon in principle.
II. Transaction Overview
By way of background, and to confirm the parties' mutual understanding of the transaction, the contemplated arrangement involves the following principal terms:
Platform and Scope of Services. Skybridge will license to Meridian its proprietary SkyComply™ AI-driven anti-money-laundering and transaction-monitoring platform under a five-year enterprise SaaS arrangement. SkyComply™ provides comprehensive BSA/AML compliance capabilities, including real-time transaction surveillance, suspicious activity detection and alert generation, automated regulatory filing support, customer due diligence and enhanced due diligence workflows, and risk scoring analytics. The deployment will cover approximately 32,000 named users across Meridian's retail banking, commercial banking, and wealth management divisions, including both U.S. and international operations.
Total Contract Value. The total contract value over the five-year initial term is Fifty Million Dollars ($50,000,000), reflecting a 6.72% volume discount from undiscounted aggregate fees of $53,600,000. This volume discount was negotiated in consideration of Meridian's commitment to the full enterprise deployment across all three major business divisions.
Fee Structure. Year 1 fees total $12,700,000, inclusive of: (i) platform subscription fees; (ii) one-time implementation and onboarding services fees of $3,600,000; and (iii) ongoing support and managed services fees of $1,800,000. Annual fees for Years 2 through 5 are $9,325,000 per year, reflecting the recurring platform subscription and managed services fees without the one-time implementation component.
Implementation Timeline. The implementation period is targeted to commence on September 15, 2025 and conclude on February 28, 2026, with a Platform Go-Live Date of March 1, 2026. The implementation project plan, including detailed milestones, acceptance criteria, and resource allocation requirements, will be set forth in the Order Form and the associated Statement of Work, which will be finalized during the negotiation of the definitive documentation.
Term and Renewal. The initial term of the MSA is five years from the Platform Go-Live Date, running through approximately February 28, 2031. The MSA provides for two successive one-year automatic renewal terms unless either party provides at least 180 days' written notice of non-renewal prior to the expiration of the then-current term.
Payment Terms. Subscription and managed services fees are payable quarterly in advance, net 30 days from the date of invoice. Beginning in Year 3, fees are subject to a 3.0% CPI-based annual escalator, capped at 3.5% per annum.
Certifications. Skybridge currently holds SOC 2 Type II certification (most recent report dated March 15, 2025) and ISO 27001 certification (recertified January 22, 2025), both audited and issued by Crestfield Cyber Advisors, Inc., an independent third-party cybersecurity assessment firm. Copies of both reports are available upon request and will be provided to Meridian under the terms of the Security Exhibit.
Governing Law and Venue. The MSA provides for Delaware governing law, with exclusive venue in the state or federal courts located in Wilmington, Delaware, as described in greater detail in Section 4.10 below.
III. Enclosed Documents
We are pleased to enclose the following documents in connection with this transmittal, each in clean Microsoft Word (.docx) format for ease of markup and collaborative review:
1. Master Software-as-a-Service Agreement (MSA) — Initial Draft (clean). The core agreement setting forth the terms and conditions governing the SaaS relationship between Skybridge and Meridian, including provisions addressing license grants, service delivery, representations and warranties, indemnification, limitation of liability, intellectual property ownership, confidentiality, regulatory compliance, term, renewal, termination, and general provisions.
2. Order Form — Initial Draft. The Order Form setting forth the specific commercial terms applicable to the initial deployment, including the named user count of 32,000, the fee structure described above, the implementation timeline, applicable volume discounts, and the payment schedule.
3. SLA Exhibit (Exhibit A to MSA) — Initial Draft. The service level agreement terms, including platform availability targets, measurement methodology, SLA credit tiers, scheduled maintenance windows, incident severity classifications, response and resolution targets, and escalation procedures.
4. Security Exhibit (Exhibit B to MSA) — Initial Draft. The data security and compliance terms, including encryption standards, access controls, audit rights, penetration testing protocols, security incident notification obligations, subprocessor management procedures, personnel security requirements, and ongoing compliance certifications.
5. Data Processing Addendum (Exhibit C to MSA) — Initial Draft. The data processing terms governing Skybridge's processing of Meridian data, including Non-Public Personal Information ("NPI") as defined under the Gramm-Leach-Bliley Act ("GLBA") and personally identifiable information ("PII"), data classification requirements, data residency obligations, data retention and destruction protocols, and post-termination data handling procedures.
6. Acceptable Use Policy (Exhibit D to MSA) — Initial Draft. The permitted and prohibited uses of the SkyComply™ platform by Meridian's authorized users, including restrictions on reverse engineering, unauthorized access, and use of the platform in a manner that would compromise the security or performance of the multi-tenant environment.
We note that two additional ancillary documents will follow under separate cover once finalized:
• Source Code Escrow Agreement with Sentinel Escrow Services, Inc. (Escrow Agreement No. SCE-2025-04417). This three-party agreement is currently being finalized with Sentinel and is expected to be circulated within the next seven to ten business days. We discuss the material terms of this agreement in Section 4.11 below.
• Certificate of Insurance from Coastal Assurance Corporation. The certificate is being prepared to reflect the coverage requirements set forth in the MSA and will be delivered upon finalization. We discuss the insurance terms in Section 4.9 below.
IV. Summary of Key Commercial and Legal Positions
To facilitate Meridian's review, we provide the following summary of the key commercial and legal positions reflected in the enclosed drafts. This summary is intended for convenience only and is qualified in its entirety by the terms of the enclosed documents. In the event of any inconsistency between this summary and the terms of the enclosed drafts, the terms of the enclosed drafts shall control.
4.1 Grant of License and Scope
The MSA grants Meridian a non-exclusive, non-transferable (except as expressly provided in the MSA), enterprise-wide SaaS license for Meridian's authorized use of the SkyComply™ platform during the term of the agreement. The license encompasses Meridian and its majority-owned subsidiaries that are identified on the Order Form, subject to the named user limitations set forth therein.
The initial deployment accommodates up to 32,000 named users. Incremental named users beyond the initial 32,000 may be added during the term at a rate of $275 per user per year, invoiced on a pro-rata basis from the date of activation. The volume discount applicable to the initial 32,000-user commitment does not apply to incremental users, consistent with the commercial understanding between the business teams.
The SkyComply™ platform is hosted on Orion Cloud Services, Inc. ("Orion Cloud") infrastructure. All Meridian data will be stored and processed exclusively within the continental United States, specifically within the Orion Cloud US-East (Virginia) and US-West (Oregon) regions. No Meridian data will be stored, processed, or transferred outside of these designated U.S. regions without Meridian's prior written consent.
4.2 Service Level Agreement (SLA) — Exhibit A
Exhibit A to the MSA sets forth the service level commitments applicable to the SkyComply™ platform. We highlight the following key terms for Meridian's consideration:
Platform Availability. Skybridge proposes a platform availability target of 99.9% monthly uptime, measured exclusive of scheduled maintenance windows. Scheduled maintenance windows are designated as Saturdays from 2:00 AM to 6:00 AM Eastern Time, with a maximum of four hours per week. We are aware that Meridian has indicated a preference for a 99.95% uptime commitment. Skybridge's proposed position at 99.9% reflects the standard that Skybridge can commit to on a contractual basis while accounting for the inherent dependency on its upstream infrastructure provider's SLA (Orion Cloud currently provides a 99.99% availability SLA at the infrastructure layer, but application-layer availability is necessarily subject to additional variables) and maintaining the quality and reliability guarantees that Skybridge's financial-institution clients across its customer base have come to expect. We are, however, open to discussing this point further and exploring potential structures, such as a tiered availability commitment or a graduated credit model, that may address Meridian's objectives.
SLA Credit Tiers. The SLA provides for the following service credit structure in the event that the 99.9% monthly uptime target is not met:
Credit Caps. Monthly SLA credits are capped at 30% of the monthly subscription fee, and annual SLA credits are capped at 15% of the annual subscription fee. In practical terms, this translates to a maximum monthly credit of approximately $317,500 and a maximum annual credit of approximately $1,905,000 in Year 1, and a maximum monthly credit of approximately $233,125 and a maximum annual credit of approximately $1,398,750 in Years 2 through 5.
Exclusive Remedy. SLA credits constitute Meridian's sole and exclusive remedy for Skybridge's failure to meet the uptime target, subject to Meridian's termination right described below. This formulation is standard in enterprise SaaS agreements and provides an appropriate balance between accountability for service performance and predictability of exposure.
Termination Trigger. Notwithstanding the exclusive remedy provision, Meridian retains the right to terminate the MSA if platform uptime falls below 98.0% in three of any consecutive six calendar months, upon written notice to Skybridge.
Incident Response. The SLA establishes the following incident severity classifications and corresponding response commitments:
Resolution targets represent good-faith objectives and are not guaranteed service levels. Skybridge will use commercially reasonable efforts to resolve all incidents within the targeted timeframes.
4.3 Security Terms — Exhibit B
The Security Exhibit reflects Skybridge's commitment to maintaining a robust and auditable security posture appropriate for the handling of sensitive financial data. The key provisions include:
Certifications. Skybridge will maintain SOC 2 Type II and ISO 27001 certifications throughout the term of the MSA. Both certifications are currently audited and issued by Crestfield Cyber Advisors, Inc. Skybridge will provide Meridian with updated copies of its SOC 2 Type II report and ISO 27001 certificate within 30 days of their issuance each year.
Encryption Standards. All Meridian data at rest will be encrypted using AES-256 encryption. All Meridian data in transit will be encrypted using TLS 1.2 or higher. Encryption keys will be managed through Skybridge-managed hardware security modules ("HSMs"), with a bring-your-own-key ("BYOK") option available to Meridian for customers that require independent key management. The BYOK option, if elected by Meridian, will be governed by a supplemental key management procedures document to be mutually agreed upon.
Penetration Testing. Skybridge conducts annual third-party penetration testing through its designated auditor. In addition, Meridian may conduct its own annual penetration test of the SkyComply™ platform at Meridian's expense, subject to the following conditions: (i) such testing shall be limited to application-layer testing of the SkyComply™ platform; and (ii) infrastructure-layer testing will require Skybridge's prior written consent, which shall not be unreasonably withheld but may be conditioned upon Skybridge's review and approval of the scope, methodology, and timing of such testing. This limitation is necessary to ensure the protection of the multi-tenant environment and the security and privacy of other Skybridge customers' data.
Security Incident Notification. Skybridge proposes a 24-hour notification window from the time of confirmed discovery of a Security Incident (as defined in the Security Exhibit) affecting Meridian data. This timeframe is consistent with prevailing industry practice for SaaS providers serving financial institutions and is aligned with the applicable regulatory expectations under the interagency guidance on computer-security incident notification requirements. Initial notification may be made by telephone or email, with a written incident report to follow within 72 hours of initial notification containing such information as is reasonably available at that time regarding the nature, scope, and known impact of the incident.
Audit Rights. Meridian may audit Skybridge's security controls once annually upon not less than 30 business days' prior written notice to Skybridge. Skybridge may satisfy reasonable audit requests through the delivery of its then-current SOC 2 Type II report, ISO 27001 certificate, and a supplemental Security Assessment Questionnaire completed by Skybridge's security team. On-site audits of Skybridge's facilities or its subprocessors' facilities shall be permitted only upon Meridian's demonstration of a material security concern that cannot be adequately addressed through documentary audit responses, and such on-site audits shall be conducted during normal business hours in a manner that does not unreasonably interfere with Skybridge's operations.
Subprocessor Management. Skybridge will provide Meridian with not less than 30 days' advance written notice before engaging any new subprocessor that will have access to or process Meridian data. Meridian will hold a reasonable objection right with respect to such new subprocessors. Orion Cloud Services, Inc. is identified as the initial approved subprocessor in the Security Exhibit. A complete list of current subprocessors is appended to the Security Exhibit.
Personnel Security. All Skybridge personnel with access to Meridian data will be subject to background checks consistent with the examination guidelines issued by the Federal Financial Institutions Examination Council ("FFIEC"), including criminal history, employment verification, and credit history checks as appropriate for the role.
4.4 Data Processing — Exhibit C
The Data Processing Addendum addresses Skybridge's obligations with respect to the processing of Meridian data, which the parties acknowledge includes data classified as "Confidential" and "Highly Restricted" under Meridian's internal data classification policy, as well as Non-Public Personal Information ("NPI") as defined under the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809) and personally identifiable information ("PII") under applicable state and federal privacy laws. The key provisions include:
Data Residency. All Meridian data will be stored and processed exclusively within the continental United States, in the Orion Cloud US-East (Virginia) and US-West (Oregon) regions. No Meridian data will be transferred to, accessed from, or processed in any jurisdiction outside the continental United States without Meridian's prior written consent.
Post-Termination Data Handling. Upon expiration or termination of the MSA for any reason, Skybridge will provide Meridian with a complete data export in a machine-readable, industry-standard format (e.g., JSON, CSV, or XML, as mutually agreed) within 30 calendar days of the effective date of termination. Following delivery and confirmation of receipt of the data export, Skybridge will certify the destruction of all Meridian data in its possession, custody, or control — including all copies, backups, and replicas — within 60 calendar days of the effective date of termination, with destruction performed in accordance with NIST SP 800-88 guidelines. An officer-level certification of destruction will be provided to Meridian upon completion.
4.5 Indemnification. The MSA contains mutual indemnification obligations designed to allocate risk in a manner consistent with industry practice for enterprise SaaS agreements in the financial services sector. The principal indemnification provisions are summarized as follows:
Skybridge's Indemnification Obligations. Skybridge will indemnify, defend, and hold harmless Meridian, its officers, directors, employees, and agents from and against third-party claims arising from:
(a) Third-party intellectual property infringement claims arising from Meridian's authorized use of the SkyComply™ platform in accordance with the MSA (uncapped, consistent with market standard for IP indemnities in enterprise software transactions);
(b) Skybridge's breach of its data security and confidentiality obligations under the MSA, the Security Exhibit, or the Data Processing Addendum resulting in the unauthorized access to, disclosure of, or loss of Meridian data; and
(c) Skybridge's material breach of applicable law, including without limitation the GLBA, BSA/AML regulations, and other applicable federal and state banking and financial privacy laws.
Meridian's Indemnification Obligations. Meridian will indemnify, defend, and hold harmless Skybridge, its officers, directors, employees, and agents from and against third-party claims arising from:
(a) Claims arising from Meridian's breach of the Acceptable Use Policy (Exhibit D);
(b) Claims arising from data or content provided by Meridian to Skybridge in connection with the services that infringes the intellectual property or other rights of any third party; and
(c) Meridian's material breach of applicable law.
Indemnification Caps. The IP indemnification obligation of Skybridge is uncapped. The data breach indemnification obligation of Skybridge is proposed at a cap of 2× the annual fees paid or payable by Meridian in the 12-month period immediately preceding the claim (approximately $18,650,000 in a steady-state year, based on Years 2–5 annual fees of $9,325,000). All other general indemnification obligations are proposed at a cap of 1× the annual fees paid or payable in the preceding 12-month period (approximately $9,325,000).
Exclusive Remedy for IP Infringement. In the event that the SkyComply™ platform or any component thereof becomes subject to an injunction or is held to infringe a third party's intellectual property rights, Skybridge may, at its option and expense: (i) procure a license for Meridian's continued use of the affected component; (ii) modify or replace the affected component to make it non-infringing while providing substantially equivalent functionality; or (iii) if neither (i) nor (ii) is commercially practicable, terminate the affected portion of the MSA and issue a pro-rata refund of any prepaid and unused fees attributable to the affected period.
4.6 Liability Caps
The MSA establishes the following limitations on liability, which are intended to provide an appropriate framework for risk allocation between the parties:
General Aggregate Liability Cap. The aggregate liability of each party under the MSA (exclusive of the uncapped items identified below) is capped at 2× the annual fees paid or payable by Meridian in the 12-month period immediately preceding the event giving rise to the claim. Based on the Years 2–5 annual fee of $9,325,000, this cap is approximately $18,650,000.
Uncapped Items. The following obligations are excluded from the general aggregate liability cap:
(a) Skybridge's IP indemnification obligations under Section 4.5(a) above;
(b) Liability arising from either party's gross negligence or willful misconduct;
(c) Skybridge's data export and deletion obligations following termination of the MSA; and
(d) Meridian's payment obligations for fees due and payable under the MSA and Order Form.
Data Security Super-Cap. Liability arising from breaches of data security and confidentiality obligations (including breaches of the Security Exhibit and the Data Processing Addendum) is subject to a separate "super-cap" of 3× the annual fees paid or payable in the preceding 12-month period, or approximately $27,975,000. This elevated cap reflects the parties' recognition of the heightened sensitivity of Meridian's data and the regulatory environment in which Meridian operates.
Consequential Damages Exclusion. The MSA provides for a mutual exclusion of indirect, incidental, consequential, special, and punitive damages, subject to carve-outs for: (i) breaches of confidentiality obligations; (ii) IP indemnification obligations; and (iii) breaches of data security obligations. We note that Skybridge's proposed position does not include a carve-out from the consequential damages exclusion for regulatory fines or penalties. It is Skybridge's position that regulatory fines imposed upon Meridian by its regulators constitute consequential damages that should appropriately remain within the scope of the mutual consequential damages exclusion. We recognize that this may be a point of discussion and are prepared to address Meridian's perspective on this issue during negotiations.
4.7 Regulatory Compliance
Given Meridian's status as a national banking association supervised by the Office of the Comptroller of the Currency ("OCC"), the MSA includes express contractual provisions addressing the regulatory requirements applicable to technology service providers to federally regulated financial institutions:
Examination Rights. The MSA includes an express acknowledgment of the rights of federal banking regulators — including the OCC, the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation ("FDIC") — to examine Skybridge's services, records, and facilities to the extent required by applicable law and regulation, consistent with OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), the Interagency Guidance on Third-Party Relationships: Risk Management (issued June 6, 2023), and the Bank Service Company Act (12 U.S.C. § 1867(c)).
Bank Service Company Acknowledgment. Skybridge acknowledges its status as a "bank service company" as that term is used in the Bank Service Company Act, and the MSA includes the corresponding regulatory cooperation and record retention obligations.
4.8 Term, Renewal, and Termination
Initial Term. The initial term of the MSA is five years commencing on the Platform Go-Live Date (targeted for March 1, 2026) and continuing through approximately February 28, 2031.
Automatic Renewal. Following the initial term, the MSA will automatically renew for up to two successive one-year renewal terms, unless either party provides at least 180 days' prior written notice of non-renewal before the expiration of the then-current term.
Termination for Convenience. Meridian may terminate the MSA for convenience after the end of Year 2 of the initial term, upon not less than 12 months' prior written notice to Skybridge and payment of an early termination fee ("ETF") equal to 50% of the remaining annual contract value for the balance of the then-current term. By way of illustration, if Meridian were to exercise this right effective at the end of Year 3 (with two years remaining in the initial term), the ETF would be calculated as 50% × $9,325,000 × 2 remaining years = $9,325,000.
Termination for Cause. Either party may terminate the MSA upon the other party's material breach that remains uncured for 30 days following written notice thereof (or such longer cure period as may be specified in the MSA for specific categories of breach). The MSA also provides for immediate termination rights upon the occurrence of certain specified events, including insolvency, bankruptcy, or cessation of business operations.
4.9 Insurance. The MSA requires Skybridge to maintain the following insurance coverages throughout the term of the agreement:
• Technology Errors & Omissions / Cyber Liability Insurance: $25,000,000 per occurrence and $50,000,000 in the aggregate. This coverage is currently provided by Coastal Assurance Corporation under Policy No. CA-TECH-2025-07831, with a policy period of April 1, 2025 through March 31, 2026.
• Commercial General Liability Insurance: $5,000,000 per occurrence and $10,000,000 in the aggregate.
• Umbrella / Excess Liability Insurance: $10,000,000 in excess of the underlying CGL and other scheduled coverages.
• Workers' Compensation Insurance: At statutory limits as required by the laws of each applicable jurisdiction.
Skybridge will deliver a certificate of insurance evidencing the foregoing coverages within 10 business days of execution of the MSA, and annually thereafter throughout the term. We note that Skybridge is currently reviewing Meridian's request for additional insured status on the CGL and cyber liability policies with Coastal Assurance Corporation and will revert to Meridian's counsel once that review is complete.
4.10 Dispute Resolution
The MSA establishes a structured dispute resolution framework designed to encourage efficient resolution of disputes before the commencement of formal proceedings:
Executive Escalation. Prior to initiating any formal dispute resolution proceeding, the parties will engage in a mandatory three-tiered executive escalation process: (i) the parties' designated account managers will attempt to resolve the dispute within 10 business days; (ii) if unresolved, the matter will be escalated to VP-level executives of each party for an additional 10 business days; and (iii) if still unresolved, the matter will be escalated to the CEO-level or CIO-level executives of each party for a final 10 business days.
Mediation. If the dispute is not resolved through executive escalation, the parties will submit the dispute to mediation administered by JAMS in New York, New York, for a period of 60 days before either party may initiate litigation.
Jury Trial Waiver. The MSA provides for a mutual waiver of the right to a jury trial in any action arising under or relating to the MSA, consistent with customary practice in commercial agreements between sophisticated parties in the financial services sector.
Governing Law and Venue. As noted above, the MSA is governed by the laws of the State of Delaware (without regard to conflicts-of-law principles), with exclusive jurisdiction and venue in the state and federal courts located in Wilmington, Delaware.
4.11 Source Code Escrow
The MSA contemplates the execution of a three-party Source Code Escrow Agreement among Skybridge, Meridian, and Sentinel Escrow Services, Inc. as escrow agent (Escrow Agreement No. SCE-2025-04417). The material terms of the escrow arrangement, which will be set forth in the separate escrow agreement, are as follows:
Initial Deposit. Skybridge will make an initial deposit of the complete source code for the SkyComply™ platform, together with all build tools, documentation, and instructions necessary to compile and deploy the platform, within 30 days of execution of the MSA.
Ongoing Deposits. Skybridge will make updated deposits of the source code and related materials on a quarterly basis throughout the term of the MSA, reflecting any updates, modifications, or new releases made available to Meridian during the preceding quarter.
Release Triggers. The source code will be released to Meridian upon the occurrence of any of the following events: (i) Skybridge's insolvency or the filing of a voluntary or involuntary bankruptcy petition involving Skybridge; (ii) Skybridge's material breach of its support and maintenance obligations under the MSA that remains uncured for a period of 60 days following written notice from Meridian; or (iii) Skybridge's cessation of business operations or discontinuation of the SkyComply™ product line.
Escrow Fees. The annual escrow fees of $13,000 will be shared equally between Skybridge and Meridian, with each party responsible for $6,500 per year.
The escrow agreement is currently being finalized with Sentinel Escrow Services, Inc. and will be transmitted under separate cover within the next seven to ten business days for Meridian's review.
V. Pinnacle Ridge Capital Partners Consent
We wish to bring to your attention that Skybridge is majority-owned (62%) by Pinnacle Ridge Capital Partners, LP ("Pinnacle Ridge"), a Delaware limited partnership. Under the terms of Pinnacle Ridge's investment agreement with Skybridge, Pinnacle Ridge holds contractual consent rights over material contracts entered into by Skybridge that exceed $25,000,000 in total contract value. Because the total contract value of the contemplated MSA is $50,000,000, the execution of the MSA will require Pinnacle Ridge's prior written consent.
Pinnacle Ridge's consent is being processed concurrently with the parties' negotiation of definitive documentation, through Pinnacle Ridge's outside counsel, Alcott & Grenier LLP (Simone Alcott, Partner). Based on our discussions with Alcott & Grenier, we expect Pinnacle Ridge's consent to be obtained well in advance of the parties' targeted execution date, and this consent process should not affect or delay the timing of the parties' negotiation of the definitive MSA and ancillary documents. We will keep you apprised of the status of the consent process as appropriate.
VI. Request for Markup and Proposed Timeline
Given the complexity of the transaction and the volume of documentation involved, we respectfully request that Hargrove, Tully & Cascade Insurance Brokers provide its markup and consolidated comments on all enclosed documents within two weeks of the date of this letter — that is, by approximately September 19, 2025. We recognize that this timeline is ambitious, but we believe it is achievable given the extensive preliminary discussions between the business teams that have informed the preparation of these drafts.
We draw your attention to the fact that the parties' targeted implementation start date is September 15, 2025, and efficient negotiation and execution of the definitive documentation is important to preserving the project timeline and achieving the Platform Go-Live Date of March 1, 2026. Any delay in the execution of the MSA may necessitate a corresponding adjustment to the implementation schedule and the Go-Live Date. We are committed to working collaboratively with your firm and Meridian's internal legal team to maintain the agreed-upon timeline.
In the interest of efficient negotiation, we would be pleased to arrange a call between the deal teams and counsel at your earliest convenience to discuss any preliminary questions, areas of expected comment, or structural concerns prior to the submission of formal markups. On the Skybridge side, David Shimura (General Counsel) is available to participate in such a call, and we would suggest coordination with Catherine Woo (Associate General Counsel, Technology) on the Meridian side as appropriate.
Additionally, Skybridge's Chief Information Security Officer, Amara Okafor, and Chief Technology Officer, Marcus Holt, are available to discuss security architecture, platform infrastructure, data handling practices, and technical implementation matters directly with Meridian's Chief Information Officer, Gerald Brannigan, and Head of Financial Crimes & Compliance, Sandra Petrov, as needed. We have found that direct technical engagement between the parties' subject matter experts at the outset of the documentation process often accelerates the resolution of security and compliance-related comments and reduces the number of open issues in the legal markup.
VII. Reservation of Rights
The enclosed drafts of the MSA and ancillary documents are transmitted for negotiation purposes only and are not intended to create, nor shall they be construed as creating, any binding obligation on the part of Skybridge, Meridian, or any other party. No binding agreement between the parties shall exist unless and until a definitive agreement is executed and delivered by both Skybridge and Meridian in accordance with their respective internal approval processes and corporate governance requirements. All terms set forth in the enclosed drafts remain subject to further negotiation, and the transmission of these drafts does not constitute an offer, acceptance, or commitment by any party.
VIII. Confidentiality Notice
The enclosed documents and the contents of this letter are confidential and proprietary to Skybridge and are transmitted subject to any existing confidentiality agreement or non-disclosure agreement between Skybridge and Meridian. We respectfully request that distribution of the enclosed materials be limited to those individuals at Meridian, Hargrove, Tully & Cascade Insurance Brokers, and their respective advisors who have a direct need to know in connection with the evaluation, negotiation, and execution of the contemplated transaction.
We look forward to a productive and collaborative negotiation process and to working with you and your team to bring this transaction to a successful conclusion. Should you have any questions regarding the enclosed documents or any other aspect of this matter, please do not hesitate to contact me directly.
Sincerely,
CALDERWOOD & HARKNESS LLP
By: ________
Amy Chesterton, Partner 200 South Ashbury Asset Advisors, Suite 1800 Chicago, IL 60604 Telephone: (312) 555-8417
Email: achesterton@calderwoodharkness.com
cc: (via email)
David Shimura, General Counsel, Skybridge Fintech Ltd. Angela Fontaine, Calderwood & Harkness LLP Liam Prescott, Calderwood & Harkness LLP Catherine Woo, Associate General Counsel, Technology, Meridian National Bank, N.A. Megan Faircloth, Hargrove, Tully & Cascade Insurance Brokers
Enclosures (6):
1. Master Software-as-a-Service Agreement — Initial Draft
2. Order Form — Initial Draft
3. SLA Exhibit (Exhibit A to MSA) — Initial Draft
4. Security Exhibit (Exhibit B to MSA) — Initial Draft
5. Data Processing Addendum (Exhibit C to MSA) — Initial Draft
6. Acceptable Use Policy (Exhibit D to MSA) — Initial Draft
Monthly Uptime Percentage | SLA Credit (% of Monthly Subscription Fee)
99.9% to 99.5% | 5%
Below 99.5% to 99.0% | 10%
Below 99.0% to 98.0% | 20%
Below 98.0% | 30%
Severity Level | Description | Acknowledgment | First Response | Resolution Target
Severity 1 | Platform Down (complete outage affecting all users) | 15 minutes | 1 hour | 4 hours
Severity 2 | Major Feature Impaired (core functionality degraded for a significant portion of users) | 30 minutes | 2 hours | 8 hours
Severity 3 | Minor Impact (limited functionality degradation affecting a small number of users) | 4 hours | 1 business day | 5 business days

CALDERWOOD & HARKNESS LLP Attorneys at Law

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts