1009-00007 · Skybridge Fintech Ltd · Correspondence

letter-to-htm-transmitting-revised-msa.docx DOCUMENT Funds

9 / 35 ← → ✕

CALDERWOOD & HARKNESS LLP Attorneys at Law

200 South Ashbury Asset Advisors, Suite 1800 Chicago, Illinois 60604 Telephone: (312) 555-7400 Facsimile: (312) 555-7401 www.calderwoodharkness.com

October 29, 2025

VIA EMAIL AND OVERNIGHT DELIVERY

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

Douglas Krenshaw, Esq. Partner Hargrove, Tully & Cascade Insurance Brokers 1 Chase Manhattan Plaza, Suite 5500 New York, NY 10005

Re: Skybridge Fintech Ltd. / Meridian National Bank, N.A. — Enterprise Master Software-as-a-Service Agreement for SkyComply™ Platform; Transmittal of Second Revised Draft MSA and Revised Exhibits

Matter Reference: 1009-00007

Dear Douglas:

I. Purpose of This Letter

We refer to our prior correspondence in this matter, including our transmittal of Skybridge Fintech Ltd.'s ("Skybridge") initial draft Master Software-as-a-Service Agreement dated August 22, 2025, and our response letter dated October 3, 2025, addressing the first markup submitted by your firm on behalf of Meridian National Bank, National Association ("Meridian"). We appreciate the thorough and thoughtful comments your team provided in that markup, as well as the productive discussions that followed.

On behalf of our client, Skybridge Fintech Ltd., we are writing to transmit the following revised documents, which reflect the current state of the parties' negotiations and incorporate the resolutions reached during the negotiation sessions held on October 10, October 17, and October 22–23, 2025:

(1) The Second Revised Draft of the Master Software-as-a-Service Agreement ("MSA") between Skybridge Fintech Ltd., a Delaware corporation ("Licensor"), and Meridian National Bank, National Association, a national banking association organized under the laws of the United States ("Licensee");

(2) The Revised Service Level Agreement Exhibit (Exhibit A to the MSA);

(3) The Revised Security Exhibit (Exhibit B to the MSA); and

(4) The Execution-Ready Data Processing Addendum (Exhibit C to the MSA).

Please note that the Order Form and the Acceptable Use Policy (Exhibit D to the MSA) remain in substantially the form previously circulated to your office on October 3, 2025. As no material changes to those documents were requested in your first markup or during subsequent negotiation sessions, we have not retransmitted them with this package. Should Meridian wish to revisit any provisions in the Order Form or Acceptable Use Policy, we remain available to discuss.

For your convenience, we have enclosed both clean copies and redlined versions of each document. The redlines are marked against the first revised versions that were exchanged between the parties following your firm's initial markup. We trust this format will facilitate your review and enable Meridian's team to readily identify all changes incorporated in this round of revisions.

II. Summary of Agreed and Resolved Points

Before turning to the remaining open items, we wish to express our sincere appreciation for the constructive and professional engagement demonstrated by your firm and by Meridian's internal team throughout these negotiations. In particular, we note the valuable contributions of Catherine Woo, Associate General Counsel, Technology, and Luis Arriaga, SVP, Procurement & Vendor Management, whose practical insights and collaborative approach have been instrumental in resolving a significant number of complex issues in an efficient manner.

Set forth below is a summary of the key provisions on which the parties have reached agreement, as reflected in the second revised draft of the MSA and the revised exhibits enclosed herewith. This summary is intended to serve as a reference guide and is not intended to modify, supersede, or limit the terms of the MSA itself. In the event of any inconsistency between this summary and the language of the MSA, the MSA controls.

A. Commercial Terms and Order Form

The parties have agreed upon the following commercial terms, which are reflected in the Order Form and the applicable provisions of the MSA:

• Total Contract Value: $50,000,000 over the five-year initial term of the Agreement.

• Annual Fee Structure: Year 1 fees of $12,700,000 (reflecting the implementation period and associated professional services), and Years 2 through 5 at $9,325,000 per year. These figures reflect the agreed 6.72% volume discount applied to the standard per-user pricing schedule.

• Named Users: 32,000 named users licensed under the initial Order Form. Incremental users beyond this allocation shall be licensed at a rate of $275 per user per year, subject to the terms and conditions of the MSA.

• Implementation Period: September 15, 2025 through February 28, 2026, with a targeted Platform Go-Live Date of March 1, 2026. Milestone deliverables and acceptance criteria for the implementation period are set forth in the Statement of Work incorporated into the Order Form.

• Payment Terms: Quarterly-in-advance invoicing, with payment due net 30 days from the date of invoice.

• Annual Escalator: A 3.0% CPI-based annual escalator shall apply beginning in Year 3 of the initial term, capped at a maximum of 3.5% per annum. The escalator shall be calculated based on the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, as published by the Bureau of Labor Statistics.

• Termination for Convenience: Meridian shall have the right to terminate the MSA for convenience after Year 2 of the initial term upon not less than 12 months' prior written notice to Skybridge, subject to payment of an early termination fee equal to 50% of the remaining Annual Contract Value for the unexpired portion of the then-current term.

B. Term and Renewal

The MSA provides for a five-year initial term commencing on the Go-Live Date (currently targeted for March 1, 2026) and expiring on February 28, 2031. The initial term shall be followed by two successive one-year automatic renewal terms (the first renewal period from March 1, 2031 through February 28, 2032, and the second from March 1, 2032 through February 28, 2033), unless either party provides the other with not less than 180 days' prior written notice of its election not to renew. The parties have agreed upon these provisions without modification.

C. Representations and Warranties

The mutual representations and warranties set forth in Section 8 of the MSA have been agreed in substantially the form proposed in Skybridge's initial draft, with minor conforming edits to align terminology with Meridian's standard contractual definitions. Key elements include:

• A 12-month warranty period running from the Go-Live Date with respect to implementation services, and an ongoing warranty during the subscription term with respect to the SkyComply™ platform subscription.

• Skybridge's representations and warranties that: (i) the SkyComply™ platform will perform materially in accordance with the Documentation; (ii) all professional services will be performed in a professional and workmanlike manner consistent with generally accepted industry standards; (iii) Skybridge has all rights necessary to grant the licenses contemplated by the MSA; (iv) the platform will be free from malicious code, including viruses, worms, Trojan horses, and similar harmful components; (v) Skybridge will comply with all applicable laws, rules, and regulations in the performance of its obligations; and (vi) Skybridge's security practices and controls will meet or exceed industry standards applicable to financial services SaaS providers, including without limitation those standards set forth in the FFIEC IT Examination Handbook and NIST Cybersecurity Framework.

• Meridian's representations and warranties regarding its authority to enter into the MSA, its compliance with the Acceptable Use Policy, and its responsibility for the accuracy and legality of data and content uploaded to the platform by Meridian and its authorized users.

D. IP Indemnification

Skybridge's intellectual property indemnification obligation has been agreed as uncapped, consistent with prevailing industry standards for enterprise SaaS agreements in the financial services sector. Skybridge will defend, indemnify, and hold harmless Meridian and its affiliates, officers, directors, employees, and agents from and against any third-party claims alleging that Meridian's authorized use of the SkyComply™ platform infringes or misappropriates any patent, copyright, trademark, trade secret, or other intellectual property right of a third party.

The exclusive remedy for intellectual property infringement has been agreed as follows: upon receipt of a claim or upon Skybridge's reasonable determination that a claim is likely, Skybridge shall, at its sole option and expense, (i) procure for Meridian the right to continue using the affected portion of the platform, (ii) modify or replace the affected portion of the platform so that it becomes non-infringing while maintaining substantially equivalent functionality, or (iii) if neither of the foregoing options is commercially practicable, terminate the affected portion of the subscription and provide Meridian with a pro-rata refund of prepaid fees attributable to the terminated portion for the remainder of the then-current term.

Meridian's reciprocal indemnification obligation for claims arising from data or content provided by Meridian or its authorized users, as well as claims arising from Meridian's breach of the Acceptable Use Policy, has been agreed without further modification.

E. General Indemnification Cap

General indemnification obligations of each party (other than those arising from IP indemnification and data breach obligations, which are addressed separately) are capped at 1× the annual fees paid or payable by Meridian in the 12-month period immediately preceding the event giving rise to the claim. In a steady-state year (Years 2 through 5), this cap would be approximately $9,325,000.

F. Aggregate Liability Cap

Each party's total aggregate liability under the MSA (exclusive of the uncapped items identified in Section 11.4 of the MSA) is capped at 2× the annual fees paid or payable by Meridian in the 12-month period immediately preceding the event giving rise to the claim. In a steady-state year, this cap would be approximately $18,650,000.

The parties have further agreed upon a mutual exclusion of indirect, incidental, consequential, special, and punitive damages, with negotiated carve-outs preserving recovery of such damages for: (i) breaches of either party's confidentiality obligations under Section 9 of the MSA, and (ii) obligations arising under the IP indemnification provisions of Section 10.1. Additional carve-outs relating to data breach indemnification and regulatory fines remain open and are addressed in Section III below.

G. Regulatory Examination Rights

The MSA includes a contractual acknowledgment that Skybridge, in its capacity as a provider of services to Meridian, constitutes a "Bank Service Company" within the meaning of 12 U.S.C. § 1867(c)(1) (the Bank Service Company Act) and is therefore subject to examination by federal banking regulators, including the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation ("FDIC"). Skybridge has agreed to cooperate fully with any such examination and to provide regulators with timely access to records, personnel, and facilities as required by law.

The regulatory examination provisions have been drafted to align with the guidance set forth in OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), as updated, and the Interagency Guidance on Third-Party Relationships: Risk Management published in June 2023. Skybridge has further agreed that the MSA shall not be construed to restrict, limit, or otherwise interfere with the authority of federal banking regulators to examine, audit, or require information from Skybridge in connection with services provided to Meridian.

H. Source Code Escrow

The parties have agreed in principle to a three-party Source Code Escrow Agreement with Sentinel Escrow Services, Inc. as the designated escrow agent (Escrow Agreement No. SCE-2025-04417). The key terms of the escrow arrangement are as follows:

• Initial Deposit: Within 30 calendar days following execution of the MSA, Skybridge shall deposit with Sentinel Escrow Services, Inc. a complete copy of the then-current source code for the SkyComply™ platform, together with all build instructions, compilation scripts, and related documentation necessary for a reasonably skilled software developer to compile, build, and deploy the platform.

• Update Cadence: Skybridge shall update the escrow deposit on a quarterly basis (within 15 business days following the end of each calendar quarter) to reflect the then-current version of the source code.

• Release Triggers: The source code materials shall be released to Meridian upon the occurrence of any of the following verified release conditions: (i) the filing of a petition in bankruptcy by or against Skybridge, the appointment of a receiver or trustee, or the occurrence of a similar insolvency event; (ii) a material breach by Skybridge of its support and maintenance obligations under the MSA that remains uncured for a period of 60 days following written notice; or (iii) the cessation of Skybridge's business operations.

• Escrow Fees: Annual escrow agent fees of $13,000, to be split equally between Skybridge and Meridian ($6,500 per party per annum).

The form of the Source Code Escrow Agreement is being finalized directly with Sentinel Escrow Services, Inc. and will be circulated separately for your review and Meridian's execution.

I. Subprocessor Approval Process

The DPA (Exhibit C) and the Security Exhibit (Exhibit B) include an agreed subprocessor approval mechanism requiring Skybridge to provide Meridian with not less than 30 days' advance written notice prior to engaging any new subprocessor that will have access to, or process, Meridian data. Meridian retains a reasonable objection right, exercisable within the 30-day notice period, provided that any objection must be based on reasonable, documented data security or regulatory compliance concerns.

Orion Cloud Services, Inc. has been identified and approved by Meridian as the initial subprocessor for infrastructure-as-a-service ("IaaS") hosting. All Meridian data hosted by Orion Cloud Services shall reside exclusively in the US-East (Virginia) and US-West (Oregon) regions, as further discussed below.

J. Data Residency

The parties have agreed, without modification, that all Meridian data shall be stored and processed exclusively within the continental United States. Specifically, the SkyComply™ platform infrastructure for Meridian's instance will be deployed across Orion Cloud Services' US-East (Northern Virginia) and US-West (Oregon) data center regions. No Meridian data shall be transferred, stored, processed, or accessed from facilities located outside the continental United States without Meridian's prior written consent.

K. Encryption Standards

The Security Exhibit (Exhibit B) reflects the parties' agreement on the following encryption standards:

• Data at Rest: AES-256 encryption for all Meridian data at rest, including database storage, file storage, backup media, and archival systems.

• Data in Transit: TLS 1.2 or higher for all Meridian data in transit, including data transmitted between Meridian end-users and the SkyComply™ platform, between components of the platform architecture, and between the platform and any authorized integrations.

• BYOK Integration: Skybridge shall support a bring-your-own-key ("BYOK") integration option, enabling Meridian to manage and control its own encryption keys through Meridian's designated key management infrastructure. Technical specifications for the BYOK integration are set forth in Appendix B-2 to the Security Exhibit.

L. Data Retention and Deletion

The parties have agreed upon the following post-termination data handling procedures:

• Data Export: Following the effective date of termination or expiration of the MSA, Skybridge shall make all Meridian data available for export in a machine-readable, industry-standard format (JSON, CSV, or XML, at Meridian's election) for a period of 30 calendar days.

• Certified Destruction: Within 60 calendar days following the expiration of the 30-day export period, Skybridge shall permanently destroy all copies of Meridian data in its possession or control, including data stored on backup media, and shall provide Meridian with a written certification of destruction signed by Skybridge's Chief Information Security Officer.

M. Background Checks

Skybridge has agreed that all Skybridge personnel (including employees, contractors, and subcontractor personnel) who will have access to Meridian data, Meridian systems, or Meridian facilities in connection with the performance of Skybridge's obligations under the MSA shall be subject to background checks consistent with the guidelines set forth in the FFIEC IT Examination Handbook, including criminal history, employment verification, and credit history checks. Background check results shall be maintained by Skybridge and shall be available for Meridian's review upon reasonable request.

N. Governance and Dispute Resolution

The MSA includes a comprehensive governance framework and tiered dispute resolution mechanism, as follows:

• Quarterly Steering Committee: The parties shall establish a joint Steering Committee comprised of senior representatives from each party's organization. The Steering Committee shall convene quarterly (or more frequently upon mutual agreement) to review platform performance, discuss strategic initiatives, address operational issues, and oversee the overall relationship between the parties.

• Executive Escalation Path: Disputes shall be subject to a three-tier executive escalation process: (i) Level 1 — designated account managers from each party shall attempt to resolve the dispute within 5 business days; (ii) Level 2 — if unresolved, the matter shall be escalated to VP-level executives from each party for resolution within 10 business days; and (iii) Level 3 — if still unresolved, the matter shall be escalated to CEO/CIO-level executives (or their designees) for resolution within 15 business days.

• Mediation: If the dispute is not resolved through the executive escalation process, the parties shall submit the dispute to mandatory mediation administered by JAMS in New York, New York, for a period of 60 calendar days before either party may initiate litigation.

• Governing Law and Venue: The MSA shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles. Any litigation arising out of or relating to the MSA shall be brought exclusively in the Delaware Court of Chancery, or if the Delaware Court of Chancery declines jurisdiction, in the United States District Court for the District of Delaware.

• Jury Trial Waiver: The parties have agreed to a mutual waiver of the right to a jury trial in any action or proceeding arising out of or relating to the MSA.

O. Insurance. The MSA includes agreed insurance coverage thresholds, as follows:

• Commercial General Liability: $5,000,000 per occurrence / $10,000,000 aggregate.

• Technology Errors & Omissions / Cyber Liability: $25,000,000 per occurrence / $50,000,000 aggregate.

• Workers' Compensation: Statutory limits as required by applicable law.

• Umbrella/Excess Liability: $10,000,000.

Skybridge shall deliver to Meridian a Certificate of Insurance evidencing the required coverages within 10 business days of MSA execution and annually thereafter throughout the term. We note for your reference that Skybridge's current Technology E&O / Cyber Liability policy, issued by Coastal Assurance Corporation (Policy No. CA-TECH-2025-07831, with limits of $25,000,000 per occurrence and $50,000,000 aggregate, policy period April 1, 2025 through March 31, 2026), currently meets or exceeds the agreed E&O / Cyber Liability coverage thresholds. The question of additional insured status on this policy remains open and is discussed in Section III.H below.

P. Data Processing Addendum

The Data Processing Addendum (Exhibit C to the MSA) is enclosed herewith in execution-ready form. All terms of the DPA have been finalized between the parties, including the data classification schedule (distinguishing between Confidential data and Highly Restricted data), the processing instructions and permitted purposes, the handling protocols for GLBA nonpublic personal information ("NPI") and personally identifiable information ("PII"), and the restrictions on cross-border data transfers. As noted above, the DPA incorporates the agreed subprocessor approval process and data residency requirements.

III. Remaining Open Points Requiring Final Resolution

While the parties have made substantial progress in aligning on the terms of the MSA, certain material provisions remain open and are the subject of continued negotiation. These items are identified by bracketed text or annotated comments in the second revised draft of the MSA and the revised exhibits. We set forth below each open point, together with Skybridge's current position, our understanding of Meridian's position, and, where applicable, Skybridge's proposed compromises.

We urge the parties to resolve these remaining items promptly so that the MSA can proceed to execution in accordance with the implementation timeline.

A. SLA Uptime Standard (Exhibit A)

Meridian's Position: Meridian has requested a monthly uptime commitment of 99.95%, measured across the applicable measurement period.

Skybridge's Position: Skybridge proposes a monthly uptime commitment of 99.9%, measured exclusive of scheduled maintenance windows. Scheduled maintenance windows are defined in the revised SLA Exhibit as Saturdays from 2:00 AM to 6:00 AM Eastern Time, with not less than 5 business days' advance notice for any additional maintenance windows.

Discussion: As we have explained in prior discussions, Skybridge's upstream infrastructure provider, Orion Cloud Services, Inc., commits to 99.95% platform uptime at the infrastructure layer. Skybridge cannot prudently commit to the same uptime threshold at the application layer, given the additional variables introduced by application-layer processing, API integrations, database operations, and other components that sit above the infrastructure tier. Passing through the infrastructure-level SLA to the application-level commitment would create an unmanageable risk profile for Skybridge, as any application-layer incident — even one not attributable to infrastructure failure — would trigger SLA credits.

To bridge the gap between the parties' positions, Skybridge has proposed enhanced SLA credit tiers that provide Meridian with meaningful financial remedies in the event of downtime. Specifically, if the parties agree upon a 99.9% monthly uptime commitment, Skybridge will commit to the following improved credit structure:

In addition, the parties have agreed that Meridian shall have the right to terminate the MSA if monthly uptime falls below 98.0% in any 3 months out of any consecutive 6-month rolling period. This termination right provides Meridian with a meaningful exit mechanism in the event of persistent underperformance, regardless of the resolution of the uptime percentage debate.

This point remains bracketed in the revised SLA Exhibit at Section 2.1, with both the 99.95% and 99.9% formulations presented as alternative text for the parties' consideration.

B. SLA Credit Cap (Exhibit A)

Meridian's Position: Meridian has requested that SLA credits be uncapped — that is, that there be no ceiling on the aggregate amount of service level credits that may accrue in any given month or year.

Skybridge's Position: Skybridge proposes a monthly credit cap of 30% of the monthly subscription fee, equating to a maximum monthly credit of approximately $317,500 in Year 1 and approximately $233,125 in Years 2 through 5. Additionally, Skybridge proposes an annual credit cap of 15% of the annual subscription fee, equating to a maximum annual credit of approximately $1,905,000 in Year 1 and approximately $1,398,750 in Years 2 through 5.

Discussion: An uncapped SLA credit structure would effectively convert the service level commitment into an unlimited penalty provision, under which Skybridge's aggregate credit exposure in any given year could, in theory, exceed the total annual subscription fee. This outcome is fundamentally inconsistent with the risk allocation reflected in the MSA's aggregate liability cap and would undermine the commercial viability of the engagement for Skybridge. The proposed monthly and annual caps are consistent with prevailing market norms for enterprise financial services SaaS agreements, as reflected in benchmark data from industry surveys and Skybridge's prior engagements with similarly situated financial institution clients.

We respectfully submit that the combination of the proposed credit caps, the enhanced credit tiers described in Section III.A above, and the agreed chronic underperformance termination right provides Meridian with a robust and commercially reasonable set of remedies for uptime shortfalls.

This point remains bracketed in the revised SLA Exhibit at Section 3.2.

C. Data Breach Indemnification Cap (MSA)

Meridian's Position: Meridian has requested that Skybridge's indemnification obligation for data security breaches (i.e., breaches involving unauthorized access to, acquisition of, or disclosure of Meridian data) be uncapped.

Skybridge's Position: Skybridge proposes that its data breach indemnification obligation be capped at 2× the annual fees paid or payable by Meridian in the 12-month period immediately preceding the event giving rise to the claim. In a steady-state year, this cap would be approximately $18,650,000.

Discussion: Skybridge recognizes the critical importance of data security to Meridian and the significant regulatory and reputational consequences that may arise from a data security incident. However, an uncapped data breach indemnification obligation represents an existential risk to Skybridge and is inconsistent with the overall risk allocation framework negotiated by the parties. We note that the proposed 2× annual fee cap, when combined with Skybridge's robust Technology E&O / Cyber Liability insurance coverage through Coastal Assurance Corporation (Policy No. CA-TECH-2025-07831, providing $25,000,000 per occurrence and $50,000,000 aggregate coverage), affords Meridian substantial financial protection in the event of a data security incident. The insurance coverage alone provides Meridian with access to resources significantly exceeding the proposed contractual cap.

We view this as the most significant remaining commercial issue between the parties. We believe that resolution of this point, together with the related issues of the confidentiality/data security super-cap (Section III.D below) and the consequential damages carve-out for regulatory fines (Section III.E below), should be addressed holistically during the principals' call proposed in Section IV of this letter.

This point remains bracketed in the MSA at Section 10.3.

D. Confidentiality / Data Security Super-Cap (MSA)

This issue is closely related to the data breach indemnification cap discussed in Section III.C above.

Skybridge's Position: As a further accommodation to Meridian's concerns, Skybridge has proposed a separate "super-cap" applicable to breaches of Skybridge's confidentiality obligations and data security obligations under the MSA. Under this proposal, Skybridge's aggregate liability for such breaches would be capped at 3× the annual fees paid or payable in the 12-month period preceding the event giving rise to the claim, equating to approximately $27,975,000 in a steady-state year. This super-cap would apply in lieu of the general aggregate liability cap of 2× annual fees for claims falling within its scope.

Meridian's Position: Meridian maintains its position that liability for breaches of confidentiality and data security obligations should be uncapped.

Discussion: The proposed super-cap of 3× annual fees exceeds the per-occurrence liability limit found in many comparable enterprise SaaS agreements in the financial services sector and provides meaningful differentiation from the general aggregate liability cap. This tiered approach reflects Skybridge's acknowledgment that data security breaches warrant enhanced financial remedies, while preserving a definitive outer boundary on Skybridge's exposure that is necessary for prudent business planning and risk management. We believe this structure, coupled with the insurance protections described above, represents a balanced and commercially reasonable approach.

This point remains bracketed in the MSA at Section 11.3.

E. Consequential Damages Carve-Out for Regulatory Fines (MSA)

Meridian's Position: Meridian seeks to carve out regulatory fines and penalties imposed by federal or state banking regulators from the mutual exclusion of indirect, incidental, consequential, special, and punitive damages set forth in Section 11.2 of the MSA. Under Meridian's proposal, such fines and penalties would be recoverable by Meridian from Skybridge to the extent arising from Skybridge's acts or omissions, without regard to the consequential damages exclusion.

Skybridge's Position: Skybridge maintains that regulatory fines and penalties imposed on Meridian by banking regulators are consequential in nature and should remain within the scope of the general exclusion of consequential damages. Skybridge is not the regulated entity; Meridian, as a national bank, is the entity directly subject to regulatory supervision and enforcement by the OCC, Federal Reserve, and FDIC. Imposing unlimited exposure to fines levied against Meridian by its own regulators would effectively require Skybridge to assume the risk of regulatory outcomes that are influenced by a wide range of factors beyond Skybridge's control, including Meridian's own compliance programs, internal controls, examination history, and remediation efforts.

Proposed Compromise: Skybridge has proposed a limited and carefully circumscribed compromise on this point. Under Skybridge's proposal, regulatory fines and penalties that are directly and proximately caused by a proven material breach of Skybridge's security obligations under the MSA (and that are not attributable, in whole or in part, to Meridian's own acts, omissions, or failure to comply with its obligations under the MSA) would be eligible for recovery by Meridian, but would be subject to the data security super-cap described in Section III.D above (i.e., 3× annual fees, approximately $27,975,000 in a steady-state year), rather than being uncapped.

We believe this compromise strikes an appropriate balance: it provides Meridian with a meaningful right of recovery for regulatory fines that are squarely attributable to Skybridge's security failures, while ensuring that Skybridge does not bear unlimited exposure to the full spectrum of regulatory actions that may be taken against Meridian. We look forward to discussing this proposal further during the principals' call.

This point remains bracketed in the MSA at Section 11.2(c).

F. Security Incident Notification Window (Exhibit B)

Meridian's Position: Meridian has requested a notification window of 12 hours from discovery of a confirmed Security Incident affecting Meridian data.

Skybridge's Position: Skybridge initially proposed a notification window of 24 hours from discovery.

Proposed Compromise: In the revised Security Exhibit enclosed herewith, Skybridge has proposed a tiered notification structure as a compromise:

• Severity 1 and Severity 2 Incidents (as defined in the Security Exhibit): 18 hours from discovery of a confirmed Security Incident affecting Meridian data.

• Severity 3 Incidents: 24 hours from discovery.

This tiered approach is designed to balance Meridian's legitimate interest in prompt notification with the practical need for Skybridge's incident response team — led by Chief Information Security Officer Amara Okafor — to conduct a meaningful initial assessment and triage before issuing formal notification. An overly compressed notification window for lower-severity incidents risks generating premature or incomplete notifications that may cause unnecessary alarm and divert resources from the actual incident response effort. The proposed 18-hour window for high-severity incidents represents a meaningful concession from Skybridge's original 24-hour position while remaining operationally feasible.

This point is reflected in bracketed alternative text in the revised Security Exhibit at Section 5.2.

G. Penetration Testing Scope (Exhibit B)

Meridian's Position: Meridian seeks the contractual right to conduct both infrastructure-layer and application-layer penetration testing of the SkyComply™ platform at Meridian's expense, using Meridian's own designated testing firm.

Skybridge's Position: Skybridge agrees that Meridian may conduct application-layer penetration testing at Meridian's expense, subject to reasonable scheduling coordination and adherence to Skybridge's standard rules of engagement for penetration testing. However, Skybridge's position is that Meridian-initiated penetration testing at the infrastructure layer must be subject to Skybridge's prior written consent, which may be withheld in Skybridge's reasonable discretion. This limitation arises from two independent concerns: (i) the SkyComply™ platform operates on a multi-tenant architecture, and infrastructure-layer testing by one customer's designated firm could potentially impact the availability, performance, or security of the platform for other customers; and (ii) Orion Cloud Services, Inc.'s hosting terms of service impose specific restrictions on customer-initiated penetration testing at the infrastructure layer, and Skybridge must ensure compliance with those contractual obligations.

Proposed Compromise: To address Meridian's legitimate interest in obtaining assurance regarding the security posture of the infrastructure layer, Skybridge has proposed the following alternative: infrastructure-layer penetration testing may be conducted by Crestfield Cyber Advisors, Inc. — Skybridge's independent third-party security auditor (lead auditor: Deepa Rajan, CISSP, CISM) — at Meridian's expense, with the full results of such testing shared directly with Meridian. This approach provides Meridian with the substantive assurance it seeks while mitigating the multi-tenant risks and contractual complications associated with direct Meridian-conducted infrastructure testing.

Additionally, the parties have agreed that Skybridge shall engage a qualified third-party firm to conduct annual penetration testing (covering both application and infrastructure layers) at Skybridge's expense, with executive summary results shared with Meridian. This annual testing obligation is reflected in the revised Security Exhibit without brackets.

The scope of Meridian-directed infrastructure-layer testing remains bracketed in the revised Security Exhibit at Section 7.3.

H. Additional Insured Status on Cyber Policy (MSA)

Meridian's Position: Meridian requests that it be named as an additional insured on Skybridge's Technology E&O / Cyber Liability policy and Commercial General Liability policy.

Skybridge's Position: Skybridge is currently reviewing this request with its insurance carrier, Coastal Assurance Corporation, to determine whether an additional insured endorsement is available under the existing Technology E&O / Cyber Liability policy (Policy No. CA-TECH-2025-07831) and the Commercial General Liability policy. Skybridge expects to be able to confirm the availability of the endorsement — or, if the endorsement is not available, to propose an acceptable alternative, such as a waiver of subrogation in favor of Meridian — within the coming business days.

This point is flagged in the MSA at Section 13.2 but is not bracketed, as Skybridge anticipates resolution pending confirmation from Coastal Assurance Corporation. We will communicate directly with your office and Meridian's team as soon as we have received a definitive response from the carrier.

IV. Proposed Process for Final Resolution

As reflected above, only eight discrete points remain open between the parties. We note that several of these points are interrelated and may be most effectively resolved as a package: specifically, the data breach indemnification cap (Section III.C), the confidentiality/data security super-cap (Section III.D), and the consequential damages carve-out for regulatory fines (Section III.E) form a closely interconnected cluster of liability allocation issues that lend themselves to a holistic, global resolution.

Accordingly, Skybridge proposes a principals' call between David Shimura, General Counsel of Skybridge, and Catherine Woo, Associate General Counsel, Technology, of Meridian, with outside counsel from both Calderwood & Harkness and Hargrove, Tully & Marsh participating, to discuss and resolve the remaining open issues on a comprehensive, global basis. We believe that a direct conversation between the principals, informed by the detailed positions set forth in this letter, offers the most efficient path to final resolution.

We would suggest scheduling this call within the next five to seven business days — ideally during the week of November 3, 2025. We recognize that multiple stakeholders must be coordinated and are prepared to accommodate Meridian's scheduling preferences to the extent practicable.

We note that the targeted implementation commencement date of September 15, 2025, as set forth in the Order Form, underscores the urgency of achieving MSA execution. Both parties have expressed a strong desire to close the transaction expeditiously so that implementation workstreams can proceed without further delay. While certain preliminary implementation activities may be initiated under a letter of intent or pre-execution work authorization, Skybridge's project management team has indicated that the full-scope implementation program cannot be launched until the MSA and all exhibits are fully executed.

In the interest of full transparency, we wish to advise you that Skybridge is concurrently advancing the following parallel workstreams in anticipation of MSA execution:

(a) Source Code Escrow Agreement: Skybridge is finalizing the form of the three-party Source Code Escrow Agreement with Sentinel Escrow Services, Inc. (Escrow Agreement No. SCE-2025-04417). We anticipate that a substantially final draft will be circulated to your office within the next 10 business days.

(b) Pinnacle Ridge Capital Partners Consent: Pinnacle Ridge Capital Partners, LP holds a 62% ownership stake in Skybridge Fintech Ltd. and retains contractual consent rights over agreements with a total contract value exceeding $25,000,000. The near-final MSA is being submitted to Alcott & Grenier LLP (counsel to Pinnacle Ridge) for review and consent. Skybridge anticipates that the consent process will be completed promptly following resolution of the remaining open items. We do not anticipate that the Pinnacle Ridge consent process will delay execution.

(c) Certificate of Insurance: Skybridge has submitted a request to Coastal Assurance Corporation for the Certificate of Insurance required under the MSA, as well as a request for confirmation regarding the additional insured endorsement referenced in Section III.H above. We expect to receive the Certificate and carrier response within the coming business days.

We are confident that the parties can resolve the remaining open issues efficiently and proceed to execution of the MSA and all exhibits in the near term.

V. Enclosed Documents Index

We enclose the following documents with this letter:

1. Second Revised Draft — Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. and Meridian National Bank, National Association (clean copy and redlined copy marked against the first revised draft dated October 3, 2025).

2. Revised SLA Exhibit (Exhibit A to MSA) (clean copy and redlined copy marked against the first revised version dated October 3, 2025).

3. Revised Security Exhibit (Exhibit B to MSA) (clean copy and redlined copy marked against the first revised version dated October 3, 2025).

4. Data Processing Addendum (Exhibit C to MSA) — Execution-Ready Version (clean copy only; all terms have been finalized and no redline is necessary).

Please note that the Order Form, the Acceptable Use Policy (Exhibit D), and the Source Code Escrow Agreement are not included in this transmittal and will be circulated separately as each is finalized. As noted above, the Order Form and Acceptable Use Policy remain in the form previously circulated, and the Source Code Escrow Agreement is being finalized with Sentinel Escrow Services, Inc.

VI. Closing

We hope that the enclosed revised documents and this summary of the current state of negotiations will facilitate your team's review and enable us to reach final agreement on the remaining open points. We remain available to discuss any questions, comments, or counterproposals regarding the enclosed drafts at your convenience or at Meridian's convenience.

We would ask that you or Megan Faircloth contact either the undersigned or Liam Prescott, Of Counsel (lprescott@calderwoodharkness.com; direct: (312) 555-7418), at your earliest convenience to coordinate scheduling of the principals' call described above. We are mindful of the parties' shared interest in bringing this transaction to a timely close and look forward to working with you and your team to achieve that objective.

Nothing contained in this letter or the enclosed documents shall be deemed a waiver of any rights, remedies, or defenses of Skybridge Fintech Ltd. under applicable law or otherwise, all of which are expressly reserved.

Thank you for your continued professionalism and collaboration throughout this process. We look forward to hearing from you.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Amy Chesterton, Associate Direct: (312) 555-7422

Email: achesterton@calderwoodharkness.com

cc: (via email)

Angela Fontaine, Esq. — Calderwood & Harkness LLP Liam Prescott, Esq. — Calderwood & Harkness LLP David Shimura, Esq. — General Counsel, Skybridge Fintech Ltd. Tara Bellingham — VP, Enterprise Sales, Skybridge Fintech Ltd. Megan Faircloth, Esq. — Hargrove, Tully & Cascade Insurance Brokers Ryan Tso, Esq. — Hargrove, Tully & Cascade Insurance Brokers

Enclosures: As listed above (4 documents; clean and redlined versions as noted)

Monthly Uptime Percentage	Service Level Credit (% of Monthly Fee)
99.9% – 99.5%	5%
Below 99.5% – 99.0%	10%
Below 99.0% – 98.0%	20%
Below 98.0%	30%

CALDERWOOD & HARKNESS LLP Attorneys at Law
200 South Ashbury Asset Advisors, Suite 1800 Chicago, Illinois 60604 Telephone: (312) 555-7400 Facsimile: (312) 555-7401 www.calderwoodharkness.com
October 29, 2025
VIA EMAIL AND OVERNIGHT DELIVERY
PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
Douglas Krenshaw, Esq. Partner Hargrove, Tully & Cascade Insurance Brokers 1 Chase Manhattan Plaza, Suite 5500 New York, NY 10005
Re: Skybridge Fintech Ltd. / Meridian National Bank, N.A. — Enterprise Master Software-as-a-Service Agreement for SkyComply™ Platform; Transmittal of Second Revised Draft MSA and Revised Exhibits
Matter Reference: 1009-00007
Dear Douglas:
I. Purpose of This Letter
We refer to our prior correspondence in this matter, including our transmittal of Skybridge Fintech Ltd.'s ("Skybridge") initial draft Master Software-as-a-Service Agreement dated August 22, 2025, and our response letter dated October 3, 2025, addressing the first markup submitted by your firm on behalf of Meridian National Bank, National Association ("Meridian"). We appreciate the thorough and thoughtful comments your team provided in that markup, as well as the productive discussions that followed.
On behalf of our client, Skybridge Fintech Ltd., we are writing to transmit the following revised documents, which reflect the current state of the parties' negotiations and incorporate the resolutions reached during the negotiation sessions held on October 10, October 17, and October 22–23, 2025:
(1) The Second Revised Draft of the Master Software-as-a-Service Agreement ("MSA") between Skybridge Fintech Ltd., a Delaware corporation ("Licensor"), and Meridian National Bank, National Association, a national banking association organized under the laws of the United States ("Licensee");
(2) The Revised Service Level Agreement Exhibit (Exhibit A to the MSA);
(3) The Revised Security Exhibit (Exhibit B to the MSA); and
(4) The Execution-Ready Data Processing Addendum (Exhibit C to the MSA).
Please note that the Order Form and the Acceptable Use Policy (Exhibit D to the MSA) remain in substantially the form previously circulated to your office on October 3, 2025. As no material changes to those documents were requested in your first markup or during subsequent negotiation sessions, we have not retransmitted them with this package. Should Meridian wish to revisit any provisions in the Order Form or Acceptable Use Policy, we remain available to discuss.
For your convenience, we have enclosed both clean copies and redlined versions of each document. The redlines are marked against the first revised versions that were exchanged between the parties following your firm's initial markup. We trust this format will facilitate your review and enable Meridian's team to readily identify all changes incorporated in this round of revisions.
II. Summary of Agreed and Resolved Points
Before turning to the remaining open items, we wish to express our sincere appreciation for the constructive and professional engagement demonstrated by your firm and by Meridian's internal team throughout these negotiations. In particular, we note the valuable contributions of Catherine Woo, Associate General Counsel, Technology, and Luis Arriaga, SVP, Procurement & Vendor Management, whose practical insights and collaborative approach have been instrumental in resolving a significant number of complex issues in an efficient manner.
Set forth below is a summary of the key provisions on which the parties have reached agreement, as reflected in the second revised draft of the MSA and the revised exhibits enclosed herewith. This summary is intended to serve as a reference guide and is not intended to modify, supersede, or limit the terms of the MSA itself. In the event of any inconsistency between this summary and the language of the MSA, the MSA controls.
A. Commercial Terms and Order Form
The parties have agreed upon the following commercial terms, which are reflected in the Order Form and the applicable provisions of the MSA:
• Total Contract Value: $50,000,000 over the five-year initial term of the Agreement.
• Annual Fee Structure: Year 1 fees of $12,700,000 (reflecting the implementation period and associated professional services), and Years 2 through 5 at $9,325,000 per year. These figures reflect the agreed 6.72% volume discount applied to the standard per-user pricing schedule.
• Named Users: 32,000 named users licensed under the initial Order Form. Incremental users beyond this allocation shall be licensed at a rate of $275 per user per year, subject to the terms and conditions of the MSA.
• Implementation Period: September 15, 2025 through February 28, 2026, with a targeted Platform Go-Live Date of March 1, 2026. Milestone deliverables and acceptance criteria for the implementation period are set forth in the Statement of Work incorporated into the Order Form.
• Payment Terms: Quarterly-in-advance invoicing, with payment due net 30 days from the date of invoice.
• Annual Escalator: A 3.0% CPI-based annual escalator shall apply beginning in Year 3 of the initial term, capped at a maximum of 3.5% per annum. The escalator shall be calculated based on the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, as published by the Bureau of Labor Statistics.
• Termination for Convenience: Meridian shall have the right to terminate the MSA for convenience after Year 2 of the initial term upon not less than 12 months' prior written notice to Skybridge, subject to payment of an early termination fee equal to 50% of the remaining Annual Contract Value for the unexpired portion of the then-current term.
B. Term and Renewal
The MSA provides for a five-year initial term commencing on the Go-Live Date (currently targeted for March 1, 2026) and expiring on February 28, 2031. The initial term shall be followed by two successive one-year automatic renewal terms (the first renewal period from March 1, 2031 through February 28, 2032, and the second from March 1, 2032 through February 28, 2033), unless either party provides the other with not less than 180 days' prior written notice of its election not to renew. The parties have agreed upon these provisions without modification.
C. Representations and Warranties
The mutual representations and warranties set forth in Section 8 of the MSA have been agreed in substantially the form proposed in Skybridge's initial draft, with minor conforming edits to align terminology with Meridian's standard contractual definitions. Key elements include:
• A 12-month warranty period running from the Go-Live Date with respect to implementation services, and an ongoing warranty during the subscription term with respect to the SkyComply™ platform subscription.
• Skybridge's representations and warranties that: (i) the SkyComply™ platform will perform materially in accordance with the Documentation; (ii) all professional services will be performed in a professional and workmanlike manner consistent with generally accepted industry standards; (iii) Skybridge has all rights necessary to grant the licenses contemplated by the MSA; (iv) the platform will be free from malicious code, including viruses, worms, Trojan horses, and similar harmful components; (v) Skybridge will comply with all applicable laws, rules, and regulations in the performance of its obligations; and (vi) Skybridge's security practices and controls will meet or exceed industry standards applicable to financial services SaaS providers, including without limitation those standards set forth in the FFIEC IT Examination Handbook and NIST Cybersecurity Framework.
• Meridian's representations and warranties regarding its authority to enter into the MSA, its compliance with the Acceptable Use Policy, and its responsibility for the accuracy and legality of data and content uploaded to the platform by Meridian and its authorized users.
D. IP Indemnification
Skybridge's intellectual property indemnification obligation has been agreed as uncapped, consistent with prevailing industry standards for enterprise SaaS agreements in the financial services sector. Skybridge will defend, indemnify, and hold harmless Meridian and its affiliates, officers, directors, employees, and agents from and against any third-party claims alleging that Meridian's authorized use of the SkyComply™ platform infringes or misappropriates any patent, copyright, trademark, trade secret, or other intellectual property right of a third party.
The exclusive remedy for intellectual property infringement has been agreed as follows: upon receipt of a claim or upon Skybridge's reasonable determination that a claim is likely, Skybridge shall, at its sole option and expense, (i) procure for Meridian the right to continue using the affected portion of the platform, (ii) modify or replace the affected portion of the platform so that it becomes non-infringing while maintaining substantially equivalent functionality, or (iii) if neither of the foregoing options is commercially practicable, terminate the affected portion of the subscription and provide Meridian with a pro-rata refund of prepaid fees attributable to the terminated portion for the remainder of the then-current term.
Meridian's reciprocal indemnification obligation for claims arising from data or content provided by Meridian or its authorized users, as well as claims arising from Meridian's breach of the Acceptable Use Policy, has been agreed without further modification.
E. General Indemnification Cap
General indemnification obligations of each party (other than those arising from IP indemnification and data breach obligations, which are addressed separately) are capped at 1× the annual fees paid or payable by Meridian in the 12-month period immediately preceding the event giving rise to the claim. In a steady-state year (Years 2 through 5), this cap would be approximately $9,325,000.
F. Aggregate Liability Cap
Each party's total aggregate liability under the MSA (exclusive of the uncapped items identified in Section 11.4 of the MSA) is capped at 2× the annual fees paid or payable by Meridian in the 12-month period immediately preceding the event giving rise to the claim. In a steady-state year, this cap would be approximately $18,650,000.
The parties have further agreed upon a mutual exclusion of indirect, incidental, consequential, special, and punitive damages, with negotiated carve-outs preserving recovery of such damages for: (i) breaches of either party's confidentiality obligations under Section 9 of the MSA, and (ii) obligations arising under the IP indemnification provisions of Section 10.1. Additional carve-outs relating to data breach indemnification and regulatory fines remain open and are addressed in Section III below.
G. Regulatory Examination Rights
The MSA includes a contractual acknowledgment that Skybridge, in its capacity as a provider of services to Meridian, constitutes a "Bank Service Company" within the meaning of 12 U.S.C. § 1867(c)(1) (the Bank Service Company Act) and is therefore subject to examination by federal banking regulators, including the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation ("FDIC"). Skybridge has agreed to cooperate fully with any such examination and to provide regulators with timely access to records, personnel, and facilities as required by law.
The regulatory examination provisions have been drafted to align with the guidance set forth in OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), as updated, and the Interagency Guidance on Third-Party Relationships: Risk Management published in June 2023. Skybridge has further agreed that the MSA shall not be construed to restrict, limit, or otherwise interfere with the authority of federal banking regulators to examine, audit, or require information from Skybridge in connection with services provided to Meridian.
H. Source Code Escrow
The parties have agreed in principle to a three-party Source Code Escrow Agreement with Sentinel Escrow Services, Inc. as the designated escrow agent (Escrow Agreement No. SCE-2025-04417). The key terms of the escrow arrangement are as follows:
• Initial Deposit: Within 30 calendar days following execution of the MSA, Skybridge shall deposit with Sentinel Escrow Services, Inc. a complete copy of the then-current source code for the SkyComply™ platform, together with all build instructions, compilation scripts, and related documentation necessary for a reasonably skilled software developer to compile, build, and deploy the platform.
• Update Cadence: Skybridge shall update the escrow deposit on a quarterly basis (within 15 business days following the end of each calendar quarter) to reflect the then-current version of the source code.
• Release Triggers: The source code materials shall be released to Meridian upon the occurrence of any of the following verified release conditions: (i) the filing of a petition in bankruptcy by or against Skybridge, the appointment of a receiver or trustee, or the occurrence of a similar insolvency event; (ii) a material breach by Skybridge of its support and maintenance obligations under the MSA that remains uncured for a period of 60 days following written notice; or (iii) the cessation of Skybridge's business operations.
• Escrow Fees: Annual escrow agent fees of $13,000, to be split equally between Skybridge and Meridian ($6,500 per party per annum).
The form of the Source Code Escrow Agreement is being finalized directly with Sentinel Escrow Services, Inc. and will be circulated separately for your review and Meridian's execution.
I. Subprocessor Approval Process
The DPA (Exhibit C) and the Security Exhibit (Exhibit B) include an agreed subprocessor approval mechanism requiring Skybridge to provide Meridian with not less than 30 days' advance written notice prior to engaging any new subprocessor that will have access to, or process, Meridian data. Meridian retains a reasonable objection right, exercisable within the 30-day notice period, provided that any objection must be based on reasonable, documented data security or regulatory compliance concerns.
Orion Cloud Services, Inc. has been identified and approved by Meridian as the initial subprocessor for infrastructure-as-a-service ("IaaS") hosting. All Meridian data hosted by Orion Cloud Services shall reside exclusively in the US-East (Virginia) and US-West (Oregon) regions, as further discussed below.
J. Data Residency
The parties have agreed, without modification, that all Meridian data shall be stored and processed exclusively within the continental United States. Specifically, the SkyComply™ platform infrastructure for Meridian's instance will be deployed across Orion Cloud Services' US-East (Northern Virginia) and US-West (Oregon) data center regions. No Meridian data shall be transferred, stored, processed, or accessed from facilities located outside the continental United States without Meridian's prior written consent.
K. Encryption Standards
The Security Exhibit (Exhibit B) reflects the parties' agreement on the following encryption standards:
• Data at Rest: AES-256 encryption for all Meridian data at rest, including database storage, file storage, backup media, and archival systems.
• Data in Transit: TLS 1.2 or higher for all Meridian data in transit, including data transmitted between Meridian end-users and the SkyComply™ platform, between components of the platform architecture, and between the platform and any authorized integrations.
• BYOK Integration: Skybridge shall support a bring-your-own-key ("BYOK") integration option, enabling Meridian to manage and control its own encryption keys through Meridian's designated key management infrastructure. Technical specifications for the BYOK integration are set forth in Appendix B-2 to the Security Exhibit.
L. Data Retention and Deletion
The parties have agreed upon the following post-termination data handling procedures:
• Data Export: Following the effective date of termination or expiration of the MSA, Skybridge shall make all Meridian data available for export in a machine-readable, industry-standard format (JSON, CSV, or XML, at Meridian's election) for a period of 30 calendar days.
• Certified Destruction: Within 60 calendar days following the expiration of the 30-day export period, Skybridge shall permanently destroy all copies of Meridian data in its possession or control, including data stored on backup media, and shall provide Meridian with a written certification of destruction signed by Skybridge's Chief Information Security Officer.
M. Background Checks
Skybridge has agreed that all Skybridge personnel (including employees, contractors, and subcontractor personnel) who will have access to Meridian data, Meridian systems, or Meridian facilities in connection with the performance of Skybridge's obligations under the MSA shall be subject to background checks consistent with the guidelines set forth in the FFIEC IT Examination Handbook, including criminal history, employment verification, and credit history checks. Background check results shall be maintained by Skybridge and shall be available for Meridian's review upon reasonable request.
N. Governance and Dispute Resolution
The MSA includes a comprehensive governance framework and tiered dispute resolution mechanism, as follows:
• Quarterly Steering Committee: The parties shall establish a joint Steering Committee comprised of senior representatives from each party's organization. The Steering Committee shall convene quarterly (or more frequently upon mutual agreement) to review platform performance, discuss strategic initiatives, address operational issues, and oversee the overall relationship between the parties.
• Executive Escalation Path: Disputes shall be subject to a three-tier executive escalation process: (i) Level 1 — designated account managers from each party shall attempt to resolve the dispute within 5 business days; (ii) Level 2 — if unresolved, the matter shall be escalated to VP-level executives from each party for resolution within 10 business days; and (iii) Level 3 — if still unresolved, the matter shall be escalated to CEO/CIO-level executives (or their designees) for resolution within 15 business days.
• Mediation: If the dispute is not resolved through the executive escalation process, the parties shall submit the dispute to mandatory mediation administered by JAMS in New York, New York, for a period of 60 calendar days before either party may initiate litigation.
• Governing Law and Venue: The MSA shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles. Any litigation arising out of or relating to the MSA shall be brought exclusively in the Delaware Court of Chancery, or if the Delaware Court of Chancery declines jurisdiction, in the United States District Court for the District of Delaware.
• Jury Trial Waiver: The parties have agreed to a mutual waiver of the right to a jury trial in any action or proceeding arising out of or relating to the MSA.
O. Insurance. The MSA includes agreed insurance coverage thresholds, as follows:
• Commercial General Liability: $5,000,000 per occurrence / $10,000,000 aggregate.
• Technology Errors & Omissions / Cyber Liability: $25,000,000 per occurrence / $50,000,000 aggregate.
• Workers' Compensation: Statutory limits as required by applicable law.
• Umbrella/Excess Liability: $10,000,000.
Skybridge shall deliver to Meridian a Certificate of Insurance evidencing the required coverages within 10 business days of MSA execution and annually thereafter throughout the term. We note for your reference that Skybridge's current Technology E&O / Cyber Liability policy, issued by Coastal Assurance Corporation (Policy No. CA-TECH-2025-07831, with limits of $25,000,000 per occurrence and $50,000,000 aggregate, policy period April 1, 2025 through March 31, 2026), currently meets or exceeds the agreed E&O / Cyber Liability coverage thresholds. The question of additional insured status on this policy remains open and is discussed in Section III.H below.
P. Data Processing Addendum
The Data Processing Addendum (Exhibit C to the MSA) is enclosed herewith in execution-ready form. All terms of the DPA have been finalized between the parties, including the data classification schedule (distinguishing between Confidential data and Highly Restricted data), the processing instructions and permitted purposes, the handling protocols for GLBA nonpublic personal information ("NPI") and personally identifiable information ("PII"), and the restrictions on cross-border data transfers. As noted above, the DPA incorporates the agreed subprocessor approval process and data residency requirements.
III. Remaining Open Points Requiring Final Resolution
While the parties have made substantial progress in aligning on the terms of the MSA, certain material provisions remain open and are the subject of continued negotiation. These items are identified by bracketed text or annotated comments in the second revised draft of the MSA and the revised exhibits. We set forth below each open point, together with Skybridge's current position, our understanding of Meridian's position, and, where applicable, Skybridge's proposed compromises.
We urge the parties to resolve these remaining items promptly so that the MSA can proceed to execution in accordance with the implementation timeline.
A. SLA Uptime Standard (Exhibit A)
Meridian's Position: Meridian has requested a monthly uptime commitment of 99.95%, measured across the applicable measurement period.
Skybridge's Position: Skybridge proposes a monthly uptime commitment of 99.9%, measured exclusive of scheduled maintenance windows. Scheduled maintenance windows are defined in the revised SLA Exhibit as Saturdays from 2:00 AM to 6:00 AM Eastern Time, with not less than 5 business days' advance notice for any additional maintenance windows.
Discussion: As we have explained in prior discussions, Skybridge's upstream infrastructure provider, Orion Cloud Services, Inc., commits to 99.95% platform uptime at the infrastructure layer. Skybridge cannot prudently commit to the same uptime threshold at the application layer, given the additional variables introduced by application-layer processing, API integrations, database operations, and other components that sit above the infrastructure tier. Passing through the infrastructure-level SLA to the application-level commitment would create an unmanageable risk profile for Skybridge, as any application-layer incident — even one not attributable to infrastructure failure — would trigger SLA credits.
To bridge the gap between the parties' positions, Skybridge has proposed enhanced SLA credit tiers that provide Meridian with meaningful financial remedies in the event of downtime. Specifically, if the parties agree upon a 99.9% monthly uptime commitment, Skybridge will commit to the following improved credit structure:
In addition, the parties have agreed that Meridian shall have the right to terminate the MSA if monthly uptime falls below 98.0% in any 3 months out of any consecutive 6-month rolling period. This termination right provides Meridian with a meaningful exit mechanism in the event of persistent underperformance, regardless of the resolution of the uptime percentage debate.
This point remains bracketed in the revised SLA Exhibit at Section 2.1, with both the 99.95% and 99.9% formulations presented as alternative text for the parties' consideration.
B. SLA Credit Cap (Exhibit A)
Meridian's Position: Meridian has requested that SLA credits be uncapped — that is, that there be no ceiling on the aggregate amount of service level credits that may accrue in any given month or year.
Skybridge's Position: Skybridge proposes a monthly credit cap of 30% of the monthly subscription fee, equating to a maximum monthly credit of approximately $317,500 in Year 1 and approximately $233,125 in Years 2 through 5. Additionally, Skybridge proposes an annual credit cap of 15% of the annual subscription fee, equating to a maximum annual credit of approximately $1,905,000 in Year 1 and approximately $1,398,750 in Years 2 through 5.
Discussion: An uncapped SLA credit structure would effectively convert the service level commitment into an unlimited penalty provision, under which Skybridge's aggregate credit exposure in any given year could, in theory, exceed the total annual subscription fee. This outcome is fundamentally inconsistent with the risk allocation reflected in the MSA's aggregate liability cap and would undermine the commercial viability of the engagement for Skybridge. The proposed monthly and annual caps are consistent with prevailing market norms for enterprise financial services SaaS agreements, as reflected in benchmark data from industry surveys and Skybridge's prior engagements with similarly situated financial institution clients.
We respectfully submit that the combination of the proposed credit caps, the enhanced credit tiers described in Section III.A above, and the agreed chronic underperformance termination right provides Meridian with a robust and commercially reasonable set of remedies for uptime shortfalls.
This point remains bracketed in the revised SLA Exhibit at Section 3.2.
C. Data Breach Indemnification Cap (MSA)
Meridian's Position: Meridian has requested that Skybridge's indemnification obligation for data security breaches (i.e., breaches involving unauthorized access to, acquisition of, or disclosure of Meridian data) be uncapped.
Skybridge's Position: Skybridge proposes that its data breach indemnification obligation be capped at 2× the annual fees paid or payable by Meridian in the 12-month period immediately preceding the event giving rise to the claim. In a steady-state year, this cap would be approximately $18,650,000.
Discussion: Skybridge recognizes the critical importance of data security to Meridian and the significant regulatory and reputational consequences that may arise from a data security incident. However, an uncapped data breach indemnification obligation represents an existential risk to Skybridge and is inconsistent with the overall risk allocation framework negotiated by the parties. We note that the proposed 2× annual fee cap, when combined with Skybridge's robust Technology E&O / Cyber Liability insurance coverage through Coastal Assurance Corporation (Policy No. CA-TECH-2025-07831, providing $25,000,000 per occurrence and $50,000,000 aggregate coverage), affords Meridian substantial financial protection in the event of a data security incident. The insurance coverage alone provides Meridian with access to resources significantly exceeding the proposed contractual cap.
We view this as the most significant remaining commercial issue between the parties. We believe that resolution of this point, together with the related issues of the confidentiality/data security super-cap (Section III.D below) and the consequential damages carve-out for regulatory fines (Section III.E below), should be addressed holistically during the principals' call proposed in Section IV of this letter.
This point remains bracketed in the MSA at Section 10.3.
D. Confidentiality / Data Security Super-Cap (MSA)
This issue is closely related to the data breach indemnification cap discussed in Section III.C above.
Skybridge's Position: As a further accommodation to Meridian's concerns, Skybridge has proposed a separate "super-cap" applicable to breaches of Skybridge's confidentiality obligations and data security obligations under the MSA. Under this proposal, Skybridge's aggregate liability for such breaches would be capped at 3× the annual fees paid or payable in the 12-month period preceding the event giving rise to the claim, equating to approximately $27,975,000 in a steady-state year. This super-cap would apply in lieu of the general aggregate liability cap of 2× annual fees for claims falling within its scope.
Meridian's Position: Meridian maintains its position that liability for breaches of confidentiality and data security obligations should be uncapped.
Discussion: The proposed super-cap of 3× annual fees exceeds the per-occurrence liability limit found in many comparable enterprise SaaS agreements in the financial services sector and provides meaningful differentiation from the general aggregate liability cap. This tiered approach reflects Skybridge's acknowledgment that data security breaches warrant enhanced financial remedies, while preserving a definitive outer boundary on Skybridge's exposure that is necessary for prudent business planning and risk management. We believe this structure, coupled with the insurance protections described above, represents a balanced and commercially reasonable approach.
This point remains bracketed in the MSA at Section 11.3.
E. Consequential Damages Carve-Out for Regulatory Fines (MSA)
Meridian's Position: Meridian seeks to carve out regulatory fines and penalties imposed by federal or state banking regulators from the mutual exclusion of indirect, incidental, consequential, special, and punitive damages set forth in Section 11.2 of the MSA. Under Meridian's proposal, such fines and penalties would be recoverable by Meridian from Skybridge to the extent arising from Skybridge's acts or omissions, without regard to the consequential damages exclusion.
Skybridge's Position: Skybridge maintains that regulatory fines and penalties imposed on Meridian by banking regulators are consequential in nature and should remain within the scope of the general exclusion of consequential damages. Skybridge is not the regulated entity; Meridian, as a national bank, is the entity directly subject to regulatory supervision and enforcement by the OCC, Federal Reserve, and FDIC. Imposing unlimited exposure to fines levied against Meridian by its own regulators would effectively require Skybridge to assume the risk of regulatory outcomes that are influenced by a wide range of factors beyond Skybridge's control, including Meridian's own compliance programs, internal controls, examination history, and remediation efforts.
Proposed Compromise: Skybridge has proposed a limited and carefully circumscribed compromise on this point. Under Skybridge's proposal, regulatory fines and penalties that are directly and proximately caused by a proven material breach of Skybridge's security obligations under the MSA (and that are not attributable, in whole or in part, to Meridian's own acts, omissions, or failure to comply with its obligations under the MSA) would be eligible for recovery by Meridian, but would be subject to the data security super-cap described in Section III.D above (i.e., 3× annual fees, approximately $27,975,000 in a steady-state year), rather than being uncapped.
We believe this compromise strikes an appropriate balance: it provides Meridian with a meaningful right of recovery for regulatory fines that are squarely attributable to Skybridge's security failures, while ensuring that Skybridge does not bear unlimited exposure to the full spectrum of regulatory actions that may be taken against Meridian. We look forward to discussing this proposal further during the principals' call.
This point remains bracketed in the MSA at Section 11.2(c).
F. Security Incident Notification Window (Exhibit B)
Meridian's Position: Meridian has requested a notification window of 12 hours from discovery of a confirmed Security Incident affecting Meridian data.
Skybridge's Position: Skybridge initially proposed a notification window of 24 hours from discovery.
Proposed Compromise: In the revised Security Exhibit enclosed herewith, Skybridge has proposed a tiered notification structure as a compromise:
• Severity 1 and Severity 2 Incidents (as defined in the Security Exhibit): 18 hours from discovery of a confirmed Security Incident affecting Meridian data.
• Severity 3 Incidents: 24 hours from discovery.
This tiered approach is designed to balance Meridian's legitimate interest in prompt notification with the practical need for Skybridge's incident response team — led by Chief Information Security Officer Amara Okafor — to conduct a meaningful initial assessment and triage before issuing formal notification. An overly compressed notification window for lower-severity incidents risks generating premature or incomplete notifications that may cause unnecessary alarm and divert resources from the actual incident response effort. The proposed 18-hour window for high-severity incidents represents a meaningful concession from Skybridge's original 24-hour position while remaining operationally feasible.
This point is reflected in bracketed alternative text in the revised Security Exhibit at Section 5.2.
G. Penetration Testing Scope (Exhibit B)
Meridian's Position: Meridian seeks the contractual right to conduct both infrastructure-layer and application-layer penetration testing of the SkyComply™ platform at Meridian's expense, using Meridian's own designated testing firm.
Skybridge's Position: Skybridge agrees that Meridian may conduct application-layer penetration testing at Meridian's expense, subject to reasonable scheduling coordination and adherence to Skybridge's standard rules of engagement for penetration testing. However, Skybridge's position is that Meridian-initiated penetration testing at the infrastructure layer must be subject to Skybridge's prior written consent, which may be withheld in Skybridge's reasonable discretion. This limitation arises from two independent concerns: (i) the SkyComply™ platform operates on a multi-tenant architecture, and infrastructure-layer testing by one customer's designated firm could potentially impact the availability, performance, or security of the platform for other customers; and (ii) Orion Cloud Services, Inc.'s hosting terms of service impose specific restrictions on customer-initiated penetration testing at the infrastructure layer, and Skybridge must ensure compliance with those contractual obligations.
Proposed Compromise: To address Meridian's legitimate interest in obtaining assurance regarding the security posture of the infrastructure layer, Skybridge has proposed the following alternative: infrastructure-layer penetration testing may be conducted by Crestfield Cyber Advisors, Inc. — Skybridge's independent third-party security auditor (lead auditor: Deepa Rajan, CISSP, CISM) — at Meridian's expense, with the full results of such testing shared directly with Meridian. This approach provides Meridian with the substantive assurance it seeks while mitigating the multi-tenant risks and contractual complications associated with direct Meridian-conducted infrastructure testing.
Additionally, the parties have agreed that Skybridge shall engage a qualified third-party firm to conduct annual penetration testing (covering both application and infrastructure layers) at Skybridge's expense, with executive summary results shared with Meridian. This annual testing obligation is reflected in the revised Security Exhibit without brackets.
The scope of Meridian-directed infrastructure-layer testing remains bracketed in the revised Security Exhibit at Section 7.3.
H. Additional Insured Status on Cyber Policy (MSA)
Meridian's Position: Meridian requests that it be named as an additional insured on Skybridge's Technology E&O / Cyber Liability policy and Commercial General Liability policy.
Skybridge's Position: Skybridge is currently reviewing this request with its insurance carrier, Coastal Assurance Corporation, to determine whether an additional insured endorsement is available under the existing Technology E&O / Cyber Liability policy (Policy No. CA-TECH-2025-07831) and the Commercial General Liability policy. Skybridge expects to be able to confirm the availability of the endorsement — or, if the endorsement is not available, to propose an acceptable alternative, such as a waiver of subrogation in favor of Meridian — within the coming business days.
This point is flagged in the MSA at Section 13.2 but is not bracketed, as Skybridge anticipates resolution pending confirmation from Coastal Assurance Corporation. We will communicate directly with your office and Meridian's team as soon as we have received a definitive response from the carrier.
IV. Proposed Process for Final Resolution
As reflected above, only eight discrete points remain open between the parties. We note that several of these points are interrelated and may be most effectively resolved as a package: specifically, the data breach indemnification cap (Section III.C), the confidentiality/data security super-cap (Section III.D), and the consequential damages carve-out for regulatory fines (Section III.E) form a closely interconnected cluster of liability allocation issues that lend themselves to a holistic, global resolution.
Accordingly, Skybridge proposes a principals' call between David Shimura, General Counsel of Skybridge, and Catherine Woo, Associate General Counsel, Technology, of Meridian, with outside counsel from both Calderwood & Harkness and Hargrove, Tully & Marsh participating, to discuss and resolve the remaining open issues on a comprehensive, global basis. We believe that a direct conversation between the principals, informed by the detailed positions set forth in this letter, offers the most efficient path to final resolution.
We would suggest scheduling this call within the next five to seven business days — ideally during the week of November 3, 2025. We recognize that multiple stakeholders must be coordinated and are prepared to accommodate Meridian's scheduling preferences to the extent practicable.
We note that the targeted implementation commencement date of September 15, 2025, as set forth in the Order Form, underscores the urgency of achieving MSA execution. Both parties have expressed a strong desire to close the transaction expeditiously so that implementation workstreams can proceed without further delay. While certain preliminary implementation activities may be initiated under a letter of intent or pre-execution work authorization, Skybridge's project management team has indicated that the full-scope implementation program cannot be launched until the MSA and all exhibits are fully executed.
In the interest of full transparency, we wish to advise you that Skybridge is concurrently advancing the following parallel workstreams in anticipation of MSA execution:
(a) Source Code Escrow Agreement: Skybridge is finalizing the form of the three-party Source Code Escrow Agreement with Sentinel Escrow Services, Inc. (Escrow Agreement No. SCE-2025-04417). We anticipate that a substantially final draft will be circulated to your office within the next 10 business days.
(b) Pinnacle Ridge Capital Partners Consent: Pinnacle Ridge Capital Partners, LP holds a 62% ownership stake in Skybridge Fintech Ltd. and retains contractual consent rights over agreements with a total contract value exceeding $25,000,000. The near-final MSA is being submitted to Alcott & Grenier LLP (counsel to Pinnacle Ridge) for review and consent. Skybridge anticipates that the consent process will be completed promptly following resolution of the remaining open items. We do not anticipate that the Pinnacle Ridge consent process will delay execution.
(c) Certificate of Insurance: Skybridge has submitted a request to Coastal Assurance Corporation for the Certificate of Insurance required under the MSA, as well as a request for confirmation regarding the additional insured endorsement referenced in Section III.H above. We expect to receive the Certificate and carrier response within the coming business days.
We are confident that the parties can resolve the remaining open issues efficiently and proceed to execution of the MSA and all exhibits in the near term.
V. Enclosed Documents Index
We enclose the following documents with this letter:
1. Second Revised Draft — Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. and Meridian National Bank, National Association (clean copy and redlined copy marked against the first revised draft dated October 3, 2025).
2. Revised SLA Exhibit (Exhibit A to MSA) (clean copy and redlined copy marked against the first revised version dated October 3, 2025).
3. Revised Security Exhibit (Exhibit B to MSA) (clean copy and redlined copy marked against the first revised version dated October 3, 2025).
4. Data Processing Addendum (Exhibit C to MSA) — Execution-Ready Version (clean copy only; all terms have been finalized and no redline is necessary).
Please note that the Order Form, the Acceptable Use Policy (Exhibit D), and the Source Code Escrow Agreement are not included in this transmittal and will be circulated separately as each is finalized. As noted above, the Order Form and Acceptable Use Policy remain in the form previously circulated, and the Source Code Escrow Agreement is being finalized with Sentinel Escrow Services, Inc.
VI. Closing
We hope that the enclosed revised documents and this summary of the current state of negotiations will facilitate your team's review and enable us to reach final agreement on the remaining open points. We remain available to discuss any questions, comments, or counterproposals regarding the enclosed drafts at your convenience or at Meridian's convenience.
We would ask that you or Megan Faircloth contact either the undersigned or Liam Prescott, Of Counsel (lprescott@calderwoodharkness.com; direct: (312) 555-7418), at your earliest convenience to coordinate scheduling of the principals' call described above. We are mindful of the parties' shared interest in bringing this transaction to a timely close and look forward to working with you and your team to achieve that objective.
Nothing contained in this letter or the enclosed documents shall be deemed a waiver of any rights, remedies, or defenses of Skybridge Fintech Ltd. under applicable law or otherwise, all of which are expressly reserved.
Thank you for your continued professionalism and collaboration throughout this process. We look forward to hearing from you.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Amy Chesterton, Associate Direct: (312) 555-7422
Email: achesterton@calderwoodharkness.com
cc: (via email)
Angela Fontaine, Esq. — Calderwood & Harkness LLP Liam Prescott, Esq. — Calderwood & Harkness LLP David Shimura, Esq. — General Counsel, Skybridge Fintech Ltd. Tara Bellingham — VP, Enterprise Sales, Skybridge Fintech Ltd. Megan Faircloth, Esq. — Hargrove, Tully & Cascade Insurance Brokers Ryan Tso, Esq. — Hargrove, Tully & Cascade Insurance Brokers
Enclosures: As listed above (4 documents; clean and redlined versions as noted)
Monthly Uptime Percentage | Service Level Credit (% of Monthly Fee)
99.9% – 99.5% | 5%
Below 99.5% – 99.0% | 10%
Below 99.0% – 98.0% | 20%
Below 98.0% | 30%

CALDERWOOD & HARKNESS LLP Attorneys at Law

VIA EMAIL AND OVERNIGHT DELIVERY

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts