1009-00007 · Skybridge Fintech Ltd · Engagement

matter-opening-memo.docx DOCUMENT Funds

12 / 35 ← → ✕

CALDERWOOD & HARKNESS LLP 200 South Ashbury Asset Advisors, Suite 1800 Chicago, Illinois 60604

INTERNAL MEMORANDUM — CONFIDENTIAL

Matter Opening Memorandum Form: Matter Opening Memorandum Matter Number: 1009-00007 Date Opened: September 2, 2025

Prepared By: Nathan Ikeda, Working Associate Reviewed By: Angela Fontaine, Responsible Partner

MATTER OPENING MEMORANDUM SKYBRIDGE FINTECH LTD. / MERIDIAN NATIONAL BANK, N.A. ENTERPRISE SAAS AGREEMENT — SKYCOMPLY™ PLATFORM

SECTION 1: CLIENT INFORMATION

Client Full Legal Name: Skybridge Fintech Ltd.

Short Name / Acronym: Skybridge / SBF

Entity Type: Delaware limited company, converted from a Delaware limited liability company to a Delaware limited company under the Delaware Alternative Entity statute. The conversion was effectuated prior to Calderwood & Harkness's initial engagement with the client and is reflected in Skybridge's Certificate of Formation on file with the Delaware Secretary of State.

Jurisdiction of Formation: State of Delaware

Principal Office Address:

1400 Concord Pike, Suite 320 Wilmington, Delaware 19803

Primary Client Contact:

David Shimura, General Counsel Skybridge Fintech Ltd. 1400 Concord Pike, Suite 320 Wilmington, Delaware 19803

Key Client Officers and Personnel:

Industry: Fintech — Software-as-a-Service (SaaS). Skybridge develops and markets "SkyComply™," an AI-driven anti-money laundering ("AML") and transaction-monitoring platform designed for use by banking and financial services institutions. The SkyComply™ platform leverages machine-learning algorithms to detect suspicious transaction patterns, generate regulatory filings (including Suspicious Activity Reports and Currency Transaction Reports), and provide real-time compliance dashboards for financial crimes and compliance teams.

Client Background Summary: Skybridge is a growth-stage fintech SaaS company founded in 2018. The company currently employs approximately 420 individuals across its Wilmington headquarters, a satellite engineering office, and remote personnel. For fiscal year 2024, Skybridge reported revenue of approximately $78.3 million (annualized recurring revenue of approximately $78 million), EBITDA of approximately $11.7 million, a gross margin of 74%, and a net retention rate of 118%. These figures reflect strong unit economics and demonstrate meaningful customer expansion within the existing installed base. As of the date of this memorandum, Skybridge serves over 60 banking and financial services clients across the United States, ranging from community banks and credit unions to regional banking institutions.

Skybridge holds SOC 2 Type II certification, with its most recent examination report dated March 15, 2025, prepared by Crestfield Cyber Advisors, Inc. Skybridge also maintains ISO 27001 certification, which was most recently recertified on January 22, 2025, likewise by Crestfield Cyber Advisors, Inc. Both certifications are directly relevant to the contemplated transaction, as Meridian National Bank will require verification of Skybridge's information security posture as part of its third-party vendor due diligence.

Majority Owner: Pinnacle Ridge Capital Partners, LP ("PRCP"), a Delaware limited partnership. PRCP is a growth-equity fund with approximately $3.4 billion in assets under management. PRCP acquired a 62% ownership stake in Skybridge in connection with Skybridge's Series C financing round in 2021, which was completed at a $310 million pre-money valuation. PRCP's Managing Partner is Elise Drummond. Pursuant to the governing documents of Skybridge and the stockholders' agreement executed in connection with the Series C round, PRCP holds board representation through two (2) directors on Skybridge's board, as well as contractual approval rights over any contract entered into by Skybridge that exceeds $25,000,000 in total contract value. This approval right is directly relevant to the present engagement, as the contemplated MSA with Meridian National Bank carries a total contract value of $50,000,000, which exceeds PRCP's consent threshold. Coordination with PRCP and its outside counsel is addressed further in Sections 4 and 11 of this memorandum.

Financial Auditor: Hathaway & Pendleton, LLP. The lead audit partner assigned to Skybridge's account is Bruce Ogilvie. Hathaway & Pendleton's most recent audit opinion on Skybridge's financial statements, covering fiscal year 2024, was dated April 30, 2025. Skybridge's audited financial statements may be relevant to the extent Meridian requires financial diligence on Skybridge as a critical vendor.

Client Relationship History: Calderwood & Harkness LLP has represented Skybridge Fintech Ltd. since the Pinnacle Ridge investment in 2021. Over the course of this relationship, the firm has provided legal services to Skybridge across commercial, employment, and regulatory matters. Angela Fontaine has served as the primary relationship partner throughout this period and maintains direct contact with David Shimura and Priya Chandrasekaran.

SECTION 2: COUNTERPARTY INFORMATION

Counterparty Full Legal Name: Meridian National Bank, National Association

Short Name / Acronym: Meridian / MNB

Entity Type: National banking association, organized and existing under the laws of the United States pursuant to a national bank charter issued under federal law. As a national banking association, Meridian is subject to the primary regulatory supervision of the Office of the Comptroller of the Currency ("OCC").

Principal Office Address:

600 Lexington Avenue, 40th Floor New York, New York 10022

Holding Company: Meridian Financial Group, Inc., a Delaware corporation listed on the New York Stock Exchange. Meridian National Bank is a wholly owned subsidiary of Meridian Financial Group, Inc.

Total Assets: Approximately $485 billion, placing Meridian among the top-10 U.S. banks by total assets. The size and systemic significance of the counterparty materially affect the terms and regulatory posture of the contemplated transaction.

Key Counterparty Contacts:

Regulatory Status: Meridian National Bank is designated as a systemically important financial institution ("SIFI") under applicable federal law. Meridian is regulated by the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation ("FDIC"). As a SIFI, Meridian is subject to heightened prudential standards, enhanced risk management expectations, and specific regulatory guidance governing its relationships with third-party service providers, including OCC Bulletin 2013-29 and the Interagency Guidance on Third-Party Relationships issued in June 2023. These regulatory requirements will shape numerous provisions of the contemplated MSA, particularly those relating to audit rights, examination access, data security, subcontracting, and business continuity.

Counterparty's Outside Counsel:

Hargrove, Tully & Cascade Insurance Brokers 1 Chase Manhattan Plaza, Suite 5500 New York, New York 10005

Hargrove, Tully & Marsh is a full-service law firm with approximately 620 attorneys. The engagement team for Meridian in the contemplated transaction consists of:

• Douglas Krenshaw, Partner (Lead Partner)

• Megan Faircloth, Senior Associate

• Ryan Tso, Associate

Douglas Krenshaw is known in the market as a technology transactions practitioner with particular experience in bank vendor agreements and outsourcing transactions. The engagement team should anticipate sophisticated and detailed counterparty markup of the MSA and ancillary documents, reflective of institutional banking procurement practices and the regulatory requirements applicable to a SIFI.

SECTION 3: MATTER DESCRIPTION

Matter Type: Technology Transactions — Enterprise SaaS Agreement

Matter Number: 1009-00007

Short Description: Negotiation and documentation of a five-year enterprise Master Software-as-a-Service Agreement ("MSA") between Skybridge Fintech Ltd. (as Licensor) and Meridian National Bank, N.A. (as Licensee) for Skybridge's SkyComply™ AI-driven AML and transaction-monitoring platform. The MSA and its ancillary documents will govern the subscription, implementation, deployment, operation, and support of SkyComply™ across Meridian's banking operations, including retail banking, commercial banking, and wealth management divisions in both domestic and international operations.

Role of Client: Licensor / SaaS provider.

Commercial Summary:

The contemplated transaction represents one of Skybridge's largest enterprise deals to date and, if executed, will constitute the single largest contract by total contract value in the company's history. The commercial terms are summarized as follows:

The Year 1 fee of $12,700,000 reflects the sum of three components: (i) the platform subscription fee (applicable to Year 1 on a prorated or discounted basis as negotiated), (ii) a one-time implementation fee of $3,600,000 covering the configuration, customization, data migration, integration, user acceptance testing, and go-live activities set forth in the implementation plan, and (iii) a support and managed services fee of $1,800,000 for Year 1 covering Skybridge's ongoing managed services, premium support, and customer success management during the initial deployment phase.

Licensed Users: 32,000 named users across Meridian's retail banking, commercial banking, and wealth management divisions, encompassing both United States and international operations.

Initial Term: Five (5) years, commencing on the Platform Go-Live Date. The targeted Go-Live Date is March 1, 2026, which would result in an Initial Term expiring on February 28, 2031.

Implementation Period: September 15, 2025 through February 28, 2026, representing an implementation timeline of approximately 5.5 months. The implementation period will be governed by a detailed implementation plan to be incorporated into or referenced by the MSA and Order Form. Key milestones within the implementation period are expected to include environment provisioning, data migration planning, API integration, user acceptance testing, training, and a phased go-live sequence.

Governing Law: State of Delaware.

Transaction Documents to be Negotiated:

The following documents comprise the full set of transaction documents to be negotiated, drafted, and finalized in connection with this engagement:

1. Master Software-as-a-Service Agreement (MSA): The principal agreement governing the subscription, licensing, service levels, data security, intellectual property, indemnification, limitation of liability, term, termination, and other core terms of the parties' relationship.

2. Order Form: The initial order form to be executed concurrently with the MSA, setting forth the specific subscription tiers, licensed user counts, pricing, payment schedule, and implementation milestones applicable to the Meridian deployment.

3. SLA Exhibit (Exhibit A): A detailed service level agreement exhibit specifying uptime availability commitments, performance metrics, measurement methodologies, SLA credit calculations, credit cap structures, exclusions, and critical incident response and escalation procedures.

4. Security Exhibit (Exhibit B): A comprehensive data security exhibit setting forth Skybridge's technical and organizational security measures, encryption standards, access controls, vulnerability management, penetration testing obligations, security incident notification procedures, and audit and compliance frameworks.

5. Data Processing Addendum (DPA) (Exhibit C): A data processing addendum governing the processing, storage, and transmission of Meridian's data, including Gramm-Leach-Bliley Act ("GLBA") nonpublic personal information ("NPI") and personally identifiable information ("PII"), in compliance with applicable data protection laws and regulations.

6. Acceptable Use Policy (Exhibit D): An acceptable use policy setting forth the permitted and prohibited uses of the SkyComply™ platform by Meridian and its authorized users.

7. Source Code Escrow Agreement: A three-party source code escrow agreement among Skybridge, Meridian, and Sentinel Escrow Services, Inc. (Escrow Agreement No. SCE-2025-04417), providing for the deposit of SkyComply™ source code and release under specified trigger events (e.g., Skybridge insolvency, material uncured breach, or cessation of business operations).

8. Subprocessor Flow-Down Terms Addendum (Orion Cloud Services, Inc.): A subprocessor addendum or flow-down agreement addressing the data processing and security obligations that flow through from the MSA to Skybridge's cloud infrastructure provider, Orion Cloud Services, Inc., which hosts the SkyComply™ platform.

9. Certificate of Insurance Request Letter (Coastal Assurance Corporation): A formal request to Skybridge's cyber liability and errors & omissions insurer, Coastal Assurance Corporation, for the issuance of a certificate of insurance and any endorsements required by Meridian, including potential additional insured status.

10. Pinnacle Ridge Board Consent: A written board consent from Pinnacle Ridge Capital Partners, LP, authorizing Skybridge to enter into the MSA and related transaction documents, in satisfaction of PRCP's contractual approval right over contracts exceeding $25,000,000 in total contract value. The form of consent will be prepared by this engagement team and submitted to Alcott & Grenier LLP for review.

SECTION 4: SCOPE OF ENGAGEMENT

Calderwood & Harkness LLP has been engaged to represent Skybridge Fintech Ltd. in the drafting, negotiation, and finalization of the Master Software-as-a-Service Agreement, all exhibits, and all ancillary documents described in Section 3 above, from Skybridge's perspective as Licensor. The scope of this engagement encompasses the full lifecycle of the transaction from initial drafting through execution and delivery of all closing deliverables.

The engagement is governed by the engagement letter dated August 25, 2025, executed by David Shimura on behalf of Skybridge Fintech Ltd. and by Angela Fontaine on behalf of Calderwood & Harkness LLP.

4.1 Key Areas of Negotiation Focus

Based on preliminary discussions with the client team (including David Shimura, Priya Chandrasekaran, Jonathan Kreske, Marcus Holt, and Amara Okafor) and an initial review of Meridian's vendor requirements package provided on August 28, 2025, the following areas are expected to constitute the principal points of negotiation:

4.1.1 Service Level Agreement (SLA)

The SLA is expected to be a significant area of negotiation given the mission-critical nature of the SkyComply™ platform for Meridian's AML compliance operations. The key SLA negotiation points include:

(a) Uptime Standard. Skybridge's standard enterprise SLA offers 99.9% monthly uptime availability. Meridian has indicated through preliminary discussions that it will require a 99.95% monthly uptime standard, consistent with the availability levels it requires from other critical technology vendors. This represents a meaningful difference, particularly given the downstream dependency on Orion Cloud Services' infrastructure availability (discussed further in Section 11 below).

(b) SLA Credit Tiers and Caps. Skybridge's standard SLA provides for tiered service credits based on the degree to which actual uptime falls below the committed threshold. Skybridge proposes a monthly service credit cap of 30% of the applicable monthly fee and an annual service credit cap of 15% of the annual fee. Meridian is expected to seek uncapped service credits, which Skybridge's commercial team has indicated is not acceptable from a revenue-recognition and financial-planning perspective.

(c) Critical Incident Response Times. Meridian is expected to require aggressive response and resolution time commitments for Severity 1 (critical) incidents, including incidents that result in system-wide outages or data integrity issues affecting transaction-monitoring functionality. Response time definitions and escalation procedures must be aligned with Skybridge's internal incident management capabilities and existing operational commitments to other clients.

4.1.2 Data Security and Privacy

Given Meridian's regulatory profile as a SIFI and the nature of the data processed by SkyComply™ (including GLBA NPI and PII relating to Meridian's banking customers), the data security and privacy provisions are expected to be among the most heavily negotiated components of the transaction. Key issues include:

(a) Encryption Standards. Skybridge's security architecture employs AES-256 encryption for data at rest and TLS 1.2 or higher for data in transit. These standards are consistent with industry best practices and Skybridge's SOC 2 Type II and ISO 27001 certifications. We do not anticipate significant dispute on encryption standards, but Meridian may request specific language regarding encryption key management and rotation policies.

(b) Penetration Testing Scope. Skybridge's current practice is to undergo annual penetration testing at the application layer, conducted by Crestfield Cyber Advisors, Inc. Meridian has indicated that it will require penetration testing at both the application layer and the infrastructure layer, including testing of the Orion Cloud Services environment. Skybridge's position is that infrastructure-layer testing is the responsibility of Orion Cloud Services under its own security program and that Skybridge's obligations should be limited to application-layer testing. This will require careful delineation of responsibilities in the Security Exhibit.

(c) Security Incident Notification Timing. Skybridge's standard contractual commitment is to provide notification of confirmed security incidents within 24 hours of determination. Meridian has indicated that it will require notification within 12 hours, consistent with the compressed timelines that banking regulators expect SIFIs to maintain with respect to their critical third-party service providers. This gap must be evaluated in light of Skybridge's operational capacity and the notification timelines in its upstream agreements with Orion Cloud Services.

(d) Audit Rights Framework. Meridian will require the right to audit Skybridge's security controls, either directly or through its designated third-party auditors. Skybridge will seek to limit audit rights to an annual cadence, with reasonable advance notice, and to permit the sharing of SOC 2 Type II reports and ISO 27001 certifications as a substitute for or supplement to on-site audits. The audit rights framework must also accommodate examination rights of federal banking regulators, as discussed below.

(e) Subprocessor Approval. Skybridge proposes a 30-day advance written notice requirement before engaging a new subprocessor or replacing an existing subprocessor. Meridian may seek affirmative approval rights over subprocessor changes, which Skybridge's standard practice is to resist.

(f) Data Residency. Skybridge will commit to hosting all Meridian data within the continental United States. The SkyComply™ platform is hosted on Orion Cloud Services' infrastructure in two U.S. regions: US-East (Virginia) and US-West (Oregon). No data will be stored or processed outside the continental United States without Meridian's prior written consent.

(g) GLBA NPI and PII Protections. The DPA must include specific provisions addressing Skybridge's obligations with respect to GLBA NPI and PII, including restrictions on use, access controls, and breach notification obligations that comply with the requirements of the Gramm-Leach-Bliley Act and its implementing regulations.

4.1.3 Indemnification. The indemnification framework is anticipated to be a significant area of negotiation, given the scale of the transaction, the sensitivity of the data involved, and the regulatory environment in which Meridian operates. Key indemnification issues include:

(a) Structure. Skybridge proposes a mutual indemnification structure, with each party indemnifying the other against third-party claims arising from (i) breach of the agreement, (ii) infringement of third-party intellectual property rights, and (iii) data breaches attributable to the indemnifying party's acts or omissions.

(b) IP Indemnification. Skybridge's standard practice is to provide uncapped intellectual property indemnification for claims that the SkyComply™ platform infringes a third party's patents, copyrights, trade secrets, or other intellectual property rights. This is consistent with market practice for enterprise SaaS agreements and is expected to be acceptable to Meridian.

(c) Data Breach Indemnification Cap. This is expected to be a contested point. Skybridge's position is that its data breach indemnification obligation should be subject to a cap equal to two times (2×) the annual fees, or approximately $18,650,000. Meridian has indicated through preliminary discussions that it will demand uncapped data breach indemnification, reflecting the potentially unlimited regulatory exposure that Meridian could face in the event of a data breach affecting customer NPI. The engagement team will need to develop creative compromise positions, potentially including a tiered cap structure or a data security "super-cap" that exceeds the general indemnity cap.

(d) General Indemnity Cap. Skybridge proposes that general indemnification obligations (exclusive of IP and data breach indemnification) be subject to a cap equal to one times (1×) the annual fees, or approximately $9,325,000.

(e) Data Security Super-Cap. As a potential compromise on the data breach indemnification issue, Skybridge is prepared to propose a data security "super-cap" of three times (3×) the annual fees, or approximately $27,975,000, which would apply to losses arising from data security incidents and breaches. Meridian has indicated that it will demand that this category be uncapped.

4.1.4 Liability Caps

(a) Aggregate Liability Cap. Skybridge proposes an aggregate liability cap (applicable to all claims under the MSA, subject to specified carve-outs) equal to two times (2×) the annual fees, or approximately $18,650,000.

(b) Consequential Damages Exclusion. Skybridge's standard MSA includes a mutual exclusion of consequential, indirect, incidental, special, and punitive damages. Meridian is expected to seek a carve-out from this exclusion for regulatory fines, penalties, and assessments imposed on Meridian by banking regulators in connection with a data breach or compliance failure attributable to Skybridge's acts or omissions. This carve-out represents a significant economic risk to Skybridge and will require careful negotiation and potentially input from Skybridge's board and PRCP.

4.1.5 Regulatory Compliance

(a) OCC Bulletin 2013-29 and Interagency Guidance. As a critical third-party service provider to a SIFI, Skybridge must agree to contractual provisions that enable Meridian to satisfy the requirements of OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance) and the Interagency Guidance on Third-Party Relationships issued in June 2023 by the OCC, the Federal Reserve, and the FDIC. These requirements affect multiple sections of the MSA, including provisions relating to performance standards, audit rights, subcontracting, business continuity, data security, regulatory access, and termination rights.

(b) Bank Service Company Act. Skybridge qualifies as a "bank service company" within the meaning of the Bank Service Company Act, 12 U.S.C. § 1867, because it provides data processing and related technology services to a national bank. As such, Skybridge must agree to examination by federal banking regulators (including the OCC and FDIC) and must include contractual provisions reflecting this regulatory access right. The Security Exhibit and the MSA itself must contain appropriate language ensuring that Skybridge's premises, books, and records are accessible to the relevant regulators upon request.

(c) BSA/AML Compliance. Given that SkyComply™ is an AML and transaction-monitoring platform, the MSA must address compliance with the Bank Secrecy Act and applicable AML regulations. Skybridge's obligations in this regard relate primarily to the functionality, accuracy, and reliability of the platform's AML detection and reporting capabilities, and the engagement team should ensure that appropriate disclaimers and limitations of liability are included to address the inherent limitations of AI-driven compliance tools.

4.1.6 Insurance Requirements

Meridian has requested that it be named as an additional insured on Skybridge's cyber liability and errors & omissions insurance policy issued by Coastal Assurance Corporation (Policy No. CA-TECH-2025-07831). The current policy provides coverage of $25,000,000 per occurrence and $50,000,000 in the aggregate, with a policy period running from April 1, 2025 through March 31, 2026. Skybridge's engagement team will need to coordinate with Coastal Assurance Corporation to determine whether additional insured status can be accommodated under the existing policy or whether a policy endorsement is required. A certificate of insurance is to be delivered to Meridian within 10 business days of MSA execution.

4.1.7 Source Code Escrow

The transaction documents include a three-party source code escrow agreement among Skybridge (as depositor), Meridian (as beneficiary), and Sentinel Escrow Services, Inc. (as escrow agent), bearing Escrow Agreement No. SCE-2025-04417. The escrow agreement will provide for the deposit of the SkyComply™ platform source code and its release to Meridian upon the occurrence of specified trigger events, which typically include Skybridge's insolvency or bankruptcy, material uncured breach of the MSA, or cessation of business operations. The engagement team will need to negotiate the specific release conditions, the scope of the deposited materials, verification procedures, and the frequency of deposit updates.

4.2 Pinnacle Ridge Capital Partners Consent Coordination

Because the MSA's total contract value of $50,000,000 exceeds the $25,000,000 threshold established under Pinnacle Ridge Capital Partners' contractual approval right, Skybridge requires written consent from PRCP prior to execution of the MSA. The engagement team will prepare a form of written board consent for submission to PRCP and will coordinate with Alcott & Grenier LLP (Simone Alcott, Partner), which serves as PRCP's outside counsel, for review and approval of the consent and, to the extent requested, the material transaction documents. Elise Drummond, PRCP's Managing Partner, is the expected signatory on the consent document.

4.3 Reference to Engagement Letter

This engagement is governed by the engagement letter dated August 25, 2025, executed by the client and the firm. All terms and conditions set forth in the engagement letter, including the scope of representation, fee arrangements, and any limitations on the scope of the engagement, are incorporated by reference.

SECTION 5: ENGAGEMENT TEAM

The following attorneys have been assigned to this matter:

Team Role Descriptions:

Angela Fontaine (Responsible Partner) serves as the responsible partner on this engagement. Ms. Fontaine provides overall engagement oversight and client relationship management. Ms. Fontaine has served as Skybridge's primary relationship partner at Calderwood & Harkness since the firm's initial engagement with the client in 2021 and maintains direct relationships with David Shimura (General Counsel) and Priya Chandrasekaran (CEO). While Ms. Fontaine's primary practice is in the firm's Real Estate group, she has been cross-staffed to this engagement for continuity of the client relationship and will have final authority on all engagement-level decisions.

Renata Vasquez (Billing Partner) manages the billing and financial aspects of the engagement, including monthly invoice preparation, time entry review, and budgetary monitoring. Ms. Vasquez serves as the billing partner for Skybridge across all matters staffed at the firm.

Liam Prescott (Of Counsel, Technology Transactions) serves as the senior advisor on this engagement, providing subject-matter expertise on technology licensing, SaaS deal terms, data security provisions, and regulatory compliance issues specific to bank vendor agreements. Mr. Prescott is a member of the firm's Technology Transactions practice group and brings extensive experience in the negotiation of enterprise SaaS agreements with financial institution counterparties. Mr. Prescott will review all drafts of the MSA, the Security Exhibit, the DPA, and the SLA Exhibit prior to circulation to the counterparty and will participate in key negotiation sessions.

Amy Chesterton (Lead Associate) serves as the lead drafter and negotiator on all transaction documents. Ms. Chesterton is formally a member of the firm's Bankruptcy & Restructuring group but has been assigned to this engagement based on her technology transactions experience, including prior work on SaaS licensing agreements, data processing addenda, and vendor management agreements. Ms. Chesterton will prepare all initial drafts, manage the markup and redline process, and serve as the primary point of contact for Catherine Woo and her team at Hargrove, Tully & Marsh during the negotiation process.

Nathan Ikeda (Working Associate) provides supporting drafting, legal research, and due diligence. Mr. Ikeda is a member of the firm's Bankruptcy & Restructuring group and has been assigned to this engagement based on his technology transactions experience and his familiarity with the Skybridge client relationship. Mr. Ikeda's responsibilities include initial research on regulatory requirements, preparation of the source code escrow agreement, preparation of the Pinnacle Ridge board consent, and conflict check administration.

SECTION 6: ESTIMATED FEES AND BILLING ARRANGEMENTS

Estimated Total Fees: $275,000 – $375,000

The fee estimate range reflects the anticipated scope of work based on the number and complexity of the transaction documents to be negotiated, the number of counterparty markup rounds expected (typically three to five for an enterprise SaaS agreement of this scale with a SIFI counterparty), and the level of regulatory compliance analysis required. The lower end of the range assumes a standard negotiation trajectory with moderate complexity and resolution of key commercial and legal issues within three rounds of markup. The upper end of the range accounts for the possibility of protracted negotiations, particularly with respect to the data security and indemnification provisions, additional regulatory compliance analysis, and coordination with PRCP and its counsel.

Billing Arrangement: Time and materials billing at the standard hourly rates set forth in Section 5 above. Invoices will be prepared and submitted on a monthly basis. Payment is due net 30 days from the date of each invoice.

Matter Number for All Billing: 1009-00007. All time entries, disbursements, and out-of-pocket expenses associated with this engagement are to be recorded under this matter number.

Client Billing Contact: David Shimura, General Counsel, Skybridge Fintech Ltd., 1400 Concord Pike, Suite 320, Wilmington, Delaware 19803.

Note on Fee Estimate Revisions: The fee estimate set forth above assumes standard negotiation complexity for an enterprise SaaS transaction of this type. If protracted negotiations, unanticipated regulatory issues, or material scope changes arise during the course of the engagement, the fee estimate may be revised upward with the prior approval of the client. Any such revision will be communicated to David Shimura in writing before additional fees are incurred outside the original estimate range.

SECTION 7: KEY OPEN NEGOTIATION ISSUES (AS OF MATTER OPENING)

As of the date of this memorandum, the following negotiation issues have been identified as open based on preliminary discussions between the parties and a review of Meridian's initial term sheet and vendor requirements package. This summary is intended to provide a snapshot of the negotiation landscape at the time of matter opening and will be updated as negotiations progress.

Commentary on Key Issues:

Issue 1 — SLA Uptime Standard. The 5-basis-point gap between Skybridge's proposed 99.9% and Meridian's demanded 99.95% is commercially meaningful. At scale, 99.9% monthly uptime permits approximately 43 minutes of downtime per month, while 99.95% permits approximately 22 minutes. The gap is further complicated by the upstream dependency on Orion Cloud Services' own SLA, which provides 99.95% uptime. If Skybridge were to commit to 99.95%, it would effectively eliminate the operational buffer between its upstream and downstream SLA commitments. The engagement team will need to evaluate whether Skybridge can operationally support a 99.95% commitment and, if so, whether enhanced SLA credit protections are required.

Issue 3 — Data Breach Indemnity Cap. This issue represents the most significant economic risk in the negotiation. Meridian's demand for uncapped data breach indemnification reflects its concern about potentially unlimited regulatory exposure in the event of a breach affecting customer NPI. Skybridge's proposed cap of 2× annual fees (~$18,650,000) is consistent with market practice for enterprise SaaS vendors but may be insufficient for a counterparty of Meridian's size and regulatory profile. The data security super-cap of 3× annual fees (~$27,975,000) has been identified as a potential middle-ground position, but Meridian's initial stance suggests that uncapped indemnification is a priority.

Issue 4 — Consequential Damages for Regulatory Fines. Meridian's request for a carve-out from the consequential damages exclusion for regulatory fines is increasingly common in bank vendor agreements, particularly with SIFI counterparties. However, it represents a potentially open-ended exposure for Skybridge, as regulatory fines can be substantial and unpredictable. The engagement team will evaluate whether a compromise can be reached, such as subjecting the carve-out to the data security super-cap.

Issue 5 — Security Incident Notification Window. The 12-hour gap between the parties' positions on incident notification reflects the tension between regulatory expectations on the bank side and operational feasibility on the vendor side. The engagement team will need to assess Skybridge's incident response capabilities and evaluate whether a 12-hour commitment is achievable, potentially with qualifications (e.g., 12 hours from confirmation of a security incident, rather than from initial detection of suspicious activity).

SECTION 8: KEY THIRD PARTIES

The following third parties have been identified as relevant to the contemplated transaction:

Notes on Key Third Parties:

The engagement team should note that Orion Cloud Services, Inc. is a critical dependency for the SkyComply™ platform's availability and security posture. The Subprocessor Flow-Down Terms Addendum to be negotiated as part of this transaction will ensure that Orion Cloud Services is subject to contractual obligations that are at least as protective as those that Skybridge undertakes to Meridian in the MSA and the Security Exhibit. The engagement team will need to review Skybridge's existing agreement with Orion Cloud Services to confirm the scope and adequacy of Orion's security and availability commitments.

JAMS has been identified as the mediation administrator under the dispute resolution provisions of the MSA. The MSA is expected to include a mandatory mediation step prior to the initiation of any litigation or arbitration, with JAMS serving as the administering body and New York, New York as the venue for mediation proceedings.

SECTION 9: KEY DATES AND TIMELINE

The following dates and milestones are relevant to this engagement:

Negotiation Timeline Notes: The parties have expressed a mutual desire to finalize the MSA and ancillary documents in time for the targeted implementation start date of September 15, 2025. This leaves approximately two weeks from the date of matter opening for initial draft preparation and circulation. The engagement team should aim to circulate the initial Skybridge draft of the MSA, Order Form, and all exhibits to Hargrove, Tully & Marsh no later than September 8, 2025, to allow for one week of counterparty review before the implementation start date.

SECTION 10: CONFLICT CHECK CONFIRMATION

A separate Conflict Check Memorandum has been prepared by Nathan Ikeda and reviewed by Angela Fontaine in accordance with the firm's conflict check policies and procedures. The conflict check was run against the following parties and entities:

• Meridian National Bank, National Association

• Meridian Financial Group, Inc.

• Pinnacle Ridge Capital Partners, LP

• Hargrove, Tully & Cascade Insurance Brokers

• Alcott & Grenier LLP

• Crestfield Cyber Advisors, Inc.

• Orion Cloud Services, Inc.

• Coastal Assurance Corporation

• Sentinel Escrow Services, Inc.

• Hathaway & Pendleton, LLP

• All identified individual contacts and officers of the above entities

Result: No conflicts of interest were identified. The engagement has been approved by the firm's conflicts committee in accordance with the firm's standard procedures. The Conflict Check Memorandum is on file with the firm's General Counsel's Office and is referenced herein by incorporation.

SECTION 11: SPECIAL CONSIDERATIONS AND NOTES

The following special considerations and notes are relevant to this engagement and should be reviewed by all members of the engagement team:

11.1 Pinnacle Ridge Capital Partners Consent Requirement

Because the MSA's total contract value of $50,000,000 exceeds the $25,000,000 threshold established under Pinnacle Ridge Capital Partners' contractual approval rights (as set forth in the stockholders' agreement executed in connection with Skybridge's Series C financing), Skybridge is required to obtain written consent from PRCP prior to the execution of the MSA and related transaction documents. This consent requirement applies to the total contract value of the arrangement, including all subscription fees, implementation fees, and managed services fees.

The engagement team will prepare a form of written consent for Elise Drummond's signature on behalf of PRCP. The consent document, together with a summary of the material terms of the MSA and ancillary documents, will be submitted to Alcott & Grenier LLP (Simone Alcott, Partner) for review on behalf of PRCP. The engagement team should anticipate that PRCP and its counsel may request access to the full suite of transaction documents and may provide substantive comments, particularly with respect to the indemnification framework, liability cap structure, and any provisions that could result in material financial exposure to Skybridge.

Timing is a key consideration for the PRCP consent process. The engagement team should aim to provide PRCP and its counsel with a substantially final draft of the transaction documents no later than three weeks prior to the anticipated execution date, to allow adequate time for review, comment, and execution of the consent.

11.2 Regulatory Sensitivity

Meridian National Bank is a systemically important financial institution subject to the regulatory supervision of the OCC, the Federal Reserve, and the FDIC. The MSA and ancillary documents must be structured to satisfy the requirements of the following regulatory frameworks:

(a) OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance). This bulletin sets forth the OCC's expectations for national banks' management of third-party relationships, including critical activities such as technology services. The MSA must include provisions addressing performance standards, the right to audit, access to information, confidentiality, business resumption and contingency planning, subcontracting, regulatory access, indemnification, dispute resolution, and termination rights.

(b) Interagency Guidance on Third-Party Relationships (June 2023). The June 2023 interagency guidance, issued jointly by the OCC, the Federal Reserve, and the FDIC, updated and harmonized the three agencies' expectations for the management of third-party relationships by banking organizations. The guidance is broadly consistent with OCC Bulletin 2013-29 but provides additional detail on risk management throughout the lifecycle of third-party relationships, including planning, due diligence, contract negotiation, ongoing monitoring, and termination.

(c) Bank Service Company Act (12 U.S.C. § 1867). Skybridge qualifies as a "bank service company" under the Bank Service Company Act because it provides data processing and related technology services to a national bank. As such, Skybridge is subject to examination by federal banking regulators, including the OCC and the FDIC. The MSA must include provisions expressly granting the applicable federal banking regulators the right to examine Skybridge's operations, books, records, and premises with respect to the services provided to Meridian. Skybridge must cooperate with any such examination and must not impede regulatory access.

(d) BSA/AML Compliance. Given that SkyComply™ is an AML and transaction-monitoring platform, the engagement team must ensure that the MSA includes appropriate provisions addressing BSA/AML compliance, including Skybridge's obligations to maintain the accuracy and functionality of the platform's detection and reporting capabilities and Meridian's responsibilities as the regulated institution with ultimate compliance accountability.

11.3 upstream SLA Dependency

Skybridge's ability to meet its SLA commitments to Meridian is dependent in significant part on the availability and performance of the upstream cloud infrastructure provided by Orion Cloud Services, Inc. Orion Cloud Services provides a 99.95% monthly uptime SLA under its infrastructure-as-a-service agreement with Skybridge. Skybridge's proposed 99.9% monthly uptime SLA for Meridian provides a 5-basis-point buffer between the upstream commitment from Orion and the downstream commitment to Meridian.

If Meridian's demand for a 99.95% uptime standard is accepted, this buffer would be eliminated, and Skybridge's ability to meet its SLA commitment to Meridian would be entirely dependent on Orion Cloud Services' performance with no margin for Skybridge's own application-layer downtime. The engagement team should flag this dependency for Marcus Holt (CTO) and Amara Okafor (CISO) and should evaluate whether enhancements to the upstream agreement with Orion Cloud Services are necessary or available before committing to a 99.95% downstream SLA.

11.4 Insurance Coordination

Meridian's request for additional insured status on Skybridge's cyber liability and errors & omissions insurance policy (Coastal Assurance Corporation, Policy No. CA-TECH-2025-07831) requires coordination with the insurer. The engagement team should note the following:

• The current policy provides $25,000,000 per occurrence and $50,000,000 in the aggregate.

• The current policy period runs from April 1, 2025 through March 31, 2026.

• A certificate of insurance is required to be delivered to Meridian within 10 business days of MSA execution.

• The engagement team should coordinate with Jonathan Kreske (CFO) and Skybridge's insurance broker to determine whether Coastal Assurance Corporation will accommodate additional insured status for Meridian under the existing policy or whether a policy endorsement is required, and what additional premium, if any, would be incurred.

• The engagement team should also note that the Coastal Assurance policy renewal date of March 31, 2026 falls shortly after the targeted Go-Live Date of March 1, 2026. Skybridge must ensure continuous insurance coverage and delivery of updated certificates and endorsements to Meridian upon renewal.

11.5 Staffing Note

The engagement team for this matter is cross-staffed from multiple practice groups within the firm. This staffing approach reflects the interdisciplinary nature of the engagement and the firm's commitment to bringing the most appropriate expertise to bear on each aspect of the transaction:

• Liam Prescott (Of Counsel, Technology Transactions) provides primary subject-matter expertise on SaaS licensing, technology deal terms, data security provisions, and the regulatory aspects of bank vendor agreements. Mr. Prescott's involvement ensures that the transaction documents reflect current market practice and regulatory expectations.

• Angela Fontaine (Partner, Real Estate) is cross-staffed to this engagement for client relationship continuity and overall engagement oversight, given her longstanding relationship with Skybridge's leadership team.

• Amy Chesterton and Nathan Ikeda (both from the Bankruptcy & Restructuring group) have been assigned based on their technology transactions experience gained through prior matters at the firm. Their familiarity with enterprise software agreements, data processing frameworks, and commercial negotiations makes them well-suited for the lead drafting and supporting roles on this engagement.

11.6 Matter Status

Matter Status as of September 2, 2025: ACTIVE

This matter is open and active. The engagement team should proceed with initial drafting of the MSA and ancillary documents, with a target circulation date to Hargrove, Tully & Cascade Insurance Brokers of no later than September 8, 2025.

END OF MATTER OPENING MEMORANDUM

This memorandum is an internal document of Calderwood & Harkness LLP prepared for the purpose of documenting the opening of Matter No. 1009-00007. This memorandum is confidential and is protected by the attorney-client privilege and the work product doctrine. It is not intended for distribution to any person outside of Calderwood & Harkness LLP without the prior written consent of the responsible partner. Receipt of this memorandum by any person outside of the firm does not constitute a waiver of any applicable privilege or protection.

PREPARED BY:

________________________________________

Nathan Ikeda Working Associate Calderwood & Harkness LLP

Date: September 2, 2025

REVIEWED AND APPROVED BY:

________________________________________

Angela Fontaine Responsible Partner Calderwood & Harkness LLP

Date: ________

Title	Name
Chief Executive Officer	Priya Chandrasekaran
Chief Financial Officer	Jonathan Kreske
Chief Technology Officer	Marcus Holt
Chief Information Security Officer	Amara Okafor
VP, Enterprise Sales	Tara Bellingham
General Counsel	David Shimura
Name	Title	Role in Transaction
Gerald Brannigan	Chief Information Officer	Executive Sponsor (bank side)
Sandra Petrov	Head of Financial Crimes & Compliance	Functional stakeholder; end-user of SkyComply™
Luis Arriaga	SVP, Procurement & Vendor Management	Day-to-day relationship lead; commercial negotiations
Catherine Woo	Associate General Counsel (Technology)	Legal lead for Meridian
Commercial Term	Detail
Total Contract Value (TCV)	$50,000,000 over five (5) years
Annual Contract Value (ACV)	$10,000,000 per year (undiscounted)
Year 1 Fees (post-discount, rounded)	$12,700,000
Years 2–5 Annual Fees	$9,325,000 per year
Gross Undiscounted TCV	$53,600,000
Volume discount Applied	6.72% off gross undiscounted TCV
Team Member	Role	Practice Group	Billing Rate
Angela Fontaine	Responsible Partner	Real Estate (cross-staffed for client relationship management)	$1,150/hr
Renata Vasquez	Billing Partner	Labor & Employment	$1,075/hr
Liam Prescott	Of Counsel (Technology Transactions)	Technology Transactions	$975/hr
Amy Chesterton	Lead Associate	Bankruptcy & Restructuring (assigned for transactional support given technology transactions experience)	$725/hr
Nathan Ikeda	Working Associate	Bankruptcy & Restructuring	$625/hr

No.	Issue	Skybridge Position	Meridian Position	Status
1	SLA Uptime Standard	99.9% monthly uptime	99.95% monthly uptime	OPEN
2	SLA Credit Cap	15% annual cap (30% monthly cap)	Uncapped credits	OPEN
3	Data Breach Indemnity Cap	2× annual fees (~$18,650,000)	Uncapped	OPEN
4	Consequential Damages for Regulatory Fines	No carve-out from mutual consequential damages exclusion	Carve-out for regulatory fines	OPEN
5	Security Incident Notification Window	24 hours	12 hours	OPEN
6	Penetration Testing Scope	Application-layer only	Infrastructure + application-layer	OPEN
7	Confidentiality/Data Security Super-Cap	3× annual fees (~$27,975,000)	Uncapped	OPEN
8	Additional Insured Status on Cyber Policy	Under review with Coastal Assurance	Requested by Meridian	OPEN
Entity	Role	Key Contact(s)
Hargrove, Tully & Cascade Insurance Brokers	Outside counsel to Meridian National Bank, N.A.	Douglas Krenshaw, Partner; Megan Faircloth, Senior Associate; Ryan Tso, Associate
Alcott & Grenier LLP	Outside counsel to Pinnacle Ridge Capital Partners, LP (consent review and transaction document review)	Simone Alcott, Partner
Crestfield Cyber Advisors, Inc.	Independent security auditor for Skybridge; prepared SOC 2 Type II examination report (dated March 15, 2025) and ISO 27001 recertification (dated January 22, 2025)	Deepa Rajan, Lead Auditor; Winston Lam, CEO
Orion Cloud Services, Inc.	Cloud infrastructure-as-a-service (IaaS) provider; hosts the SkyComply™ platform in U.S.-East (Virginia) and U.S.-West (Oregon) regions	N/A
Coastal Assurance Corporation	Cyber liability and errors & omissions insurer for Skybridge; Policy No. CA-TECH-2025-07831 ($25M per occurrence / $50M aggregate; policy period: April 1, 2025 – March 31, 2026)	N/A
Sentinel Escrow Services, Inc.	Source code escrow agent; to serve as escrow agent under three-party source code escrow agreement (Escrow Agreement No. SCE-2025-04417)	N/A
Hathaway & Pendleton, LLP	Independent financial auditor for Skybridge; most recent audit opinion dated April 30, 2025 for FY 2024	Bruce Ogilvie, Lead Audit Partner
JAMS	Mediation administrator for dispute resolution proceedings; venue: New York, New York	N/A
Date	Event / Milestone
August 25, 2025	Engagement letter executed between Calderwood & Harkness LLP and Skybridge Fintech Ltd.
September 2, 2025	Matter opened; Matter Opening Memorandum prepared and filed
September 15, 2025	Targeted start of implementation period under the MSA; initial drafts of MSA and Order Form targeted for circulation to Meridian's counsel prior to or concurrent with this date
February 28, 2026	Targeted end of implementation period; user acceptance testing, training, and go-live preparation to be completed by this date
March 1, 2026	Targeted Platform Go-Live Date; commencement of Initial Term of the MSA
February 28, 2031	End of Initial Term (five years from Go-Live Date)

April 1, 2025 – March 31, 2026

CALDERWOOD & HARKNESS LLP 200 South Ashbury Asset Advisors, Suite 1800 Chicago, Illinois 60604
INTERNAL MEMORANDUM — CONFIDENTIAL
Matter Opening Memorandum Form: Matter Opening Memorandum Matter Number: 1009-00007 Date Opened: September 2, 2025
Prepared By: Nathan Ikeda, Working Associate Reviewed By: Angela Fontaine, Responsible Partner
MATTER OPENING MEMORANDUM SKYBRIDGE FINTECH LTD. / MERIDIAN NATIONAL BANK, N.A. ENTERPRISE SAAS AGREEMENT — SKYCOMPLY™ PLATFORM
SECTION 1: CLIENT INFORMATION
Client Full Legal Name: Skybridge Fintech Ltd.
Short Name / Acronym: Skybridge / SBF
Entity Type: Delaware limited company, converted from a Delaware limited liability company to a Delaware limited company under the Delaware Alternative Entity statute. The conversion was effectuated prior to Calderwood & Harkness's initial engagement with the client and is reflected in Skybridge's Certificate of Formation on file with the Delaware Secretary of State.
Jurisdiction of Formation: State of Delaware
Principal Office Address:
1400 Concord Pike, Suite 320 Wilmington, Delaware 19803
Primary Client Contact:
David Shimura, General Counsel Skybridge Fintech Ltd. 1400 Concord Pike, Suite 320 Wilmington, Delaware 19803
Key Client Officers and Personnel:
Industry: Fintech — Software-as-a-Service (SaaS). Skybridge develops and markets "SkyComply™," an AI-driven anti-money laundering ("AML") and transaction-monitoring platform designed for use by banking and financial services institutions. The SkyComply™ platform leverages machine-learning algorithms to detect suspicious transaction patterns, generate regulatory filings (including Suspicious Activity Reports and Currency Transaction Reports), and provide real-time compliance dashboards for financial crimes and compliance teams.
Client Background Summary: Skybridge is a growth-stage fintech SaaS company founded in 2018. The company currently employs approximately 420 individuals across its Wilmington headquarters, a satellite engineering office, and remote personnel. For fiscal year 2024, Skybridge reported revenue of approximately $78.3 million (annualized recurring revenue of approximately $78 million), EBITDA of approximately $11.7 million, a gross margin of 74%, and a net retention rate of 118%. These figures reflect strong unit economics and demonstrate meaningful customer expansion within the existing installed base. As of the date of this memorandum, Skybridge serves over 60 banking and financial services clients across the United States, ranging from community banks and credit unions to regional banking institutions.
Skybridge holds SOC 2 Type II certification, with its most recent examination report dated March 15, 2025, prepared by Crestfield Cyber Advisors, Inc. Skybridge also maintains ISO 27001 certification, which was most recently recertified on January 22, 2025, likewise by Crestfield Cyber Advisors, Inc. Both certifications are directly relevant to the contemplated transaction, as Meridian National Bank will require verification of Skybridge's information security posture as part of its third-party vendor due diligence.
Majority Owner: Pinnacle Ridge Capital Partners, LP ("PRCP"), a Delaware limited partnership. PRCP is a growth-equity fund with approximately $3.4 billion in assets under management. PRCP acquired a 62% ownership stake in Skybridge in connection with Skybridge's Series C financing round in 2021, which was completed at a $310 million pre-money valuation. PRCP's Managing Partner is Elise Drummond. Pursuant to the governing documents of Skybridge and the stockholders' agreement executed in connection with the Series C round, PRCP holds board representation through two (2) directors on Skybridge's board, as well as contractual approval rights over any contract entered into by Skybridge that exceeds $25,000,000 in total contract value. This approval right is directly relevant to the present engagement, as the contemplated MSA with Meridian National Bank carries a total contract value of $50,000,000, which exceeds PRCP's consent threshold. Coordination with PRCP and its outside counsel is addressed further in Sections 4 and 11 of this memorandum.
Financial Auditor: Hathaway & Pendleton, LLP. The lead audit partner assigned to Skybridge's account is Bruce Ogilvie. Hathaway & Pendleton's most recent audit opinion on Skybridge's financial statements, covering fiscal year 2024, was dated April 30, 2025. Skybridge's audited financial statements may be relevant to the extent Meridian requires financial diligence on Skybridge as a critical vendor.
Client Relationship History: Calderwood & Harkness LLP has represented Skybridge Fintech Ltd. since the Pinnacle Ridge investment in 2021. Over the course of this relationship, the firm has provided legal services to Skybridge across commercial, employment, and regulatory matters. Angela Fontaine has served as the primary relationship partner throughout this period and maintains direct contact with David Shimura and Priya Chandrasekaran.
SECTION 2: COUNTERPARTY INFORMATION
Counterparty Full Legal Name: Meridian National Bank, National Association
Short Name / Acronym: Meridian / MNB
Entity Type: National banking association, organized and existing under the laws of the United States pursuant to a national bank charter issued under federal law. As a national banking association, Meridian is subject to the primary regulatory supervision of the Office of the Comptroller of the Currency ("OCC").
Principal Office Address:
600 Lexington Avenue, 40th Floor New York, New York 10022
Holding Company: Meridian Financial Group, Inc., a Delaware corporation listed on the New York Stock Exchange. Meridian National Bank is a wholly owned subsidiary of Meridian Financial Group, Inc.
Total Assets: Approximately $485 billion, placing Meridian among the top-10 U.S. banks by total assets. The size and systemic significance of the counterparty materially affect the terms and regulatory posture of the contemplated transaction.
Key Counterparty Contacts:
Regulatory Status: Meridian National Bank is designated as a systemically important financial institution ("SIFI") under applicable federal law. Meridian is regulated by the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation ("FDIC"). As a SIFI, Meridian is subject to heightened prudential standards, enhanced risk management expectations, and specific regulatory guidance governing its relationships with third-party service providers, including OCC Bulletin 2013-29 and the Interagency Guidance on Third-Party Relationships issued in June 2023. These regulatory requirements will shape numerous provisions of the contemplated MSA, particularly those relating to audit rights, examination access, data security, subcontracting, and business continuity.
Counterparty's Outside Counsel:
Hargrove, Tully & Cascade Insurance Brokers 1 Chase Manhattan Plaza, Suite 5500 New York, New York 10005
Hargrove, Tully & Marsh is a full-service law firm with approximately 620 attorneys. The engagement team for Meridian in the contemplated transaction consists of:
•  Douglas Krenshaw, Partner (Lead Partner)
•  Megan Faircloth, Senior Associate
•  Ryan Tso, Associate
Douglas Krenshaw is known in the market as a technology transactions practitioner with particular experience in bank vendor agreements and outsourcing transactions. The engagement team should anticipate sophisticated and detailed counterparty markup of the MSA and ancillary documents, reflective of institutional banking procurement practices and the regulatory requirements applicable to a SIFI.
SECTION 3: MATTER DESCRIPTION
Matter Type: Technology Transactions — Enterprise SaaS Agreement
Matter Number: 1009-00007
Short Description: Negotiation and documentation of a five-year enterprise Master Software-as-a-Service Agreement ("MSA") between Skybridge Fintech Ltd. (as Licensor) and Meridian National Bank, N.A. (as Licensee) for Skybridge's SkyComply™ AI-driven AML and transaction-monitoring platform. The MSA and its ancillary documents will govern the subscription, implementation, deployment, operation, and support of SkyComply™ across Meridian's banking operations, including retail banking, commercial banking, and wealth management divisions in both domestic and international operations.
Role of Client: Licensor / SaaS provider.
Commercial Summary:
The contemplated transaction represents one of Skybridge's largest enterprise deals to date and, if executed, will constitute the single largest contract by total contract value in the company's history. The commercial terms are summarized as follows:
The Year 1 fee of $12,700,000 reflects the sum of three components: (i) the platform subscription fee (applicable to Year 1 on a prorated or discounted basis as negotiated), (ii) a one-time implementation fee of $3,600,000 covering the configuration, customization, data migration, integration, user acceptance testing, and go-live activities set forth in the implementation plan, and (iii) a support and managed services fee of $1,800,000 for Year 1 covering Skybridge's ongoing managed services, premium support, and customer success management during the initial deployment phase.
Licensed Users: 32,000 named users across Meridian's retail banking, commercial banking, and wealth management divisions, encompassing both United States and international operations.
Initial Term: Five (5) years, commencing on the Platform Go-Live Date. The targeted Go-Live Date is March 1, 2026, which would result in an Initial Term expiring on February 28, 2031.
Implementation Period: September 15, 2025 through February 28, 2026, representing an implementation timeline of approximately 5.5 months. The implementation period will be governed by a detailed implementation plan to be incorporated into or referenced by the MSA and Order Form. Key milestones within the implementation period are expected to include environment provisioning, data migration planning, API integration, user acceptance testing, training, and a phased go-live sequence.
Governing Law: State of Delaware.
Transaction Documents to be Negotiated:
The following documents comprise the full set of transaction documents to be negotiated, drafted, and finalized in connection with this engagement:
1.  Master Software-as-a-Service Agreement (MSA): The principal agreement governing the subscription, licensing, service levels, data security, intellectual property, indemnification, limitation of liability, term, termination, and other core terms of the parties' relationship.
2.  Order Form: The initial order form to be executed concurrently with the MSA, setting forth the specific subscription tiers, licensed user counts, pricing, payment schedule, and implementation milestones applicable to the Meridian deployment.
3.  SLA Exhibit (Exhibit A): A detailed service level agreement exhibit specifying uptime availability commitments, performance metrics, measurement methodologies, SLA credit calculations, credit cap structures, exclusions, and critical incident response and escalation procedures.
4.  Security Exhibit (Exhibit B): A comprehensive data security exhibit setting forth Skybridge's technical and organizational security measures, encryption standards, access controls, vulnerability management, penetration testing obligations, security incident notification procedures, and audit and compliance frameworks.
5.  Data Processing Addendum (DPA) (Exhibit C): A data processing addendum governing the processing, storage, and transmission of Meridian's data, including Gramm-Leach-Bliley Act ("GLBA") nonpublic personal information ("NPI") and personally identifiable information ("PII"), in compliance with applicable data protection laws and regulations.
6.  Acceptable Use Policy (Exhibit D): An acceptable use policy setting forth the permitted and prohibited uses of the SkyComply™ platform by Meridian and its authorized users.
7.  Source Code Escrow Agreement: A three-party source code escrow agreement among Skybridge, Meridian, and Sentinel Escrow Services, Inc. (Escrow Agreement No. SCE-2025-04417), providing for the deposit of SkyComply™ source code and release under specified trigger events (e.g., Skybridge insolvency, material uncured breach, or cessation of business operations).
8.  Subprocessor Flow-Down Terms Addendum (Orion Cloud Services, Inc.): A subprocessor addendum or flow-down agreement addressing the data processing and security obligations that flow through from the MSA to Skybridge's cloud infrastructure provider, Orion Cloud Services, Inc., which hosts the SkyComply™ platform.
9.  Certificate of Insurance Request Letter (Coastal Assurance Corporation): A formal request to Skybridge's cyber liability and errors & omissions insurer, Coastal Assurance Corporation, for the issuance of a certificate of insurance and any endorsements required by Meridian, including potential additional insured status.
10.  Pinnacle Ridge Board Consent: A written board consent from Pinnacle Ridge Capital Partners, LP, authorizing Skybridge to enter into the MSA and related transaction documents, in satisfaction of PRCP's contractual approval right over contracts exceeding $25,000,000 in total contract value. The form of consent will be prepared by this engagement team and submitted to Alcott & Grenier LLP for review.
SECTION 4: SCOPE OF ENGAGEMENT
Calderwood & Harkness LLP has been engaged to represent Skybridge Fintech Ltd. in the drafting, negotiation, and finalization of the Master Software-as-a-Service Agreement, all exhibits, and all ancillary documents described in Section 3 above, from Skybridge's perspective as Licensor. The scope of this engagement encompasses the full lifecycle of the transaction from initial drafting through execution and delivery of all closing deliverables.
The engagement is governed by the engagement letter dated August 25, 2025, executed by David Shimura on behalf of Skybridge Fintech Ltd. and by Angela Fontaine on behalf of Calderwood & Harkness LLP.
4.1 Key Areas of Negotiation Focus
Based on preliminary discussions with the client team (including David Shimura, Priya Chandrasekaran, Jonathan Kreske, Marcus Holt, and Amara Okafor) and an initial review of Meridian's vendor requirements package provided on August 28, 2025, the following areas are expected to constitute the principal points of negotiation:
4.1.1 Service Level Agreement (SLA)
The SLA is expected to be a significant area of negotiation given the mission-critical nature of the SkyComply™ platform for Meridian's AML compliance operations. The key SLA negotiation points include:
(a) Uptime Standard. Skybridge's standard enterprise SLA offers 99.9% monthly uptime availability. Meridian has indicated through preliminary discussions that it will require a 99.95% monthly uptime standard, consistent with the availability levels it requires from other critical technology vendors. This represents a meaningful difference, particularly given the downstream dependency on Orion Cloud Services' infrastructure availability (discussed further in Section 11 below).
(b) SLA Credit Tiers and Caps. Skybridge's standard SLA provides for tiered service credits based on the degree to which actual uptime falls below the committed threshold. Skybridge proposes a monthly service credit cap of 30% of the applicable monthly fee and an annual service credit cap of 15% of the annual fee. Meridian is expected to seek uncapped service credits, which Skybridge's commercial team has indicated is not acceptable from a revenue-recognition and financial-planning perspective.
(c) Critical Incident Response Times. Meridian is expected to require aggressive response and resolution time commitments for Severity 1 (critical) incidents, including incidents that result in system-wide outages or data integrity issues affecting transaction-monitoring functionality. Response time definitions and escalation procedures must be aligned with Skybridge's internal incident management capabilities and existing operational commitments to other clients.
4.1.2 Data Security and Privacy
Given Meridian's regulatory profile as a SIFI and the nature of the data processed by SkyComply™ (including GLBA NPI and PII relating to Meridian's banking customers), the data security and privacy provisions are expected to be among the most heavily negotiated components of the transaction. Key issues include:
(a) Encryption Standards. Skybridge's security architecture employs AES-256 encryption for data at rest and TLS 1.2 or higher for data in transit. These standards are consistent with industry best practices and Skybridge's SOC 2 Type II and ISO 27001 certifications. We do not anticipate significant dispute on encryption standards, but Meridian may request specific language regarding encryption key management and rotation policies.
(b) Penetration Testing Scope. Skybridge's current practice is to undergo annual penetration testing at the application layer, conducted by Crestfield Cyber Advisors, Inc. Meridian has indicated that it will require penetration testing at both the application layer and the infrastructure layer, including testing of the Orion Cloud Services environment. Skybridge's position is that infrastructure-layer testing is the responsibility of Orion Cloud Services under its own security program and that Skybridge's obligations should be limited to application-layer testing. This will require careful delineation of responsibilities in the Security Exhibit.
(c) Security Incident Notification Timing. Skybridge's standard contractual commitment is to provide notification of confirmed security incidents within 24 hours of determination. Meridian has indicated that it will require notification within 12 hours, consistent with the compressed timelines that banking regulators expect SIFIs to maintain with respect to their critical third-party service providers. This gap must be evaluated in light of Skybridge's operational capacity and the notification timelines in its upstream agreements with Orion Cloud Services.
(d) Audit Rights Framework. Meridian will require the right to audit Skybridge's security controls, either directly or through its designated third-party auditors. Skybridge will seek to limit audit rights to an annual cadence, with reasonable advance notice, and to permit the sharing of SOC 2 Type II reports and ISO 27001 certifications as a substitute for or supplement to on-site audits. The audit rights framework must also accommodate examination rights of federal banking regulators, as discussed below.
(e) Subprocessor Approval. Skybridge proposes a 30-day advance written notice requirement before engaging a new subprocessor or replacing an existing subprocessor. Meridian may seek affirmative approval rights over subprocessor changes, which Skybridge's standard practice is to resist.
(f) Data Residency. Skybridge will commit to hosting all Meridian data within the continental United States. The SkyComply™ platform is hosted on Orion Cloud Services' infrastructure in two U.S. regions: US-East (Virginia) and US-West (Oregon). No data will be stored or processed outside the continental United States without Meridian's prior written consent.
(g) GLBA NPI and PII Protections. The DPA must include specific provisions addressing Skybridge's obligations with respect to GLBA NPI and PII, including restrictions on use, access controls, and breach notification obligations that comply with the requirements of the Gramm-Leach-Bliley Act and its implementing regulations.
4.1.3 Indemnification.  The indemnification framework is anticipated to be a significant area of negotiation, given the scale of the transaction, the sensitivity of the data involved, and the regulatory environment in which Meridian operates. Key indemnification issues include:
(a) Structure. Skybridge proposes a mutual indemnification structure, with each party indemnifying the other against third-party claims arising from (i) breach of the agreement, (ii) infringement of third-party intellectual property rights, and (iii) data breaches attributable to the indemnifying party's acts or omissions.
(b) IP Indemnification. Skybridge's standard practice is to provide uncapped intellectual property indemnification for claims that the SkyComply™ platform infringes a third party's patents, copyrights, trade secrets, or other intellectual property rights. This is consistent with market practice for enterprise SaaS agreements and is expected to be acceptable to Meridian.
(c) Data Breach Indemnification Cap. This is expected to be a contested point. Skybridge's position is that its data breach indemnification obligation should be subject to a cap equal to two times (2×) the annual fees, or approximately $18,650,000. Meridian has indicated through preliminary discussions that it will demand uncapped data breach indemnification, reflecting the potentially unlimited regulatory exposure that Meridian could face in the event of a data breach affecting customer NPI. The engagement team will need to develop creative compromise positions, potentially including a tiered cap structure or a data security "super-cap" that exceeds the general indemnity cap.
(d) General Indemnity Cap. Skybridge proposes that general indemnification obligations (exclusive of IP and data breach indemnification) be subject to a cap equal to one times (1×) the annual fees, or approximately $9,325,000.
(e) Data Security Super-Cap. As a potential compromise on the data breach indemnification issue, Skybridge is prepared to propose a data security "super-cap" of three times (3×) the annual fees, or approximately $27,975,000, which would apply to losses arising from data security incidents and breaches. Meridian has indicated that it will demand that this category be uncapped.
4.1.4 Liability Caps
(a) Aggregate Liability Cap. Skybridge proposes an aggregate liability cap (applicable to all claims under the MSA, subject to specified carve-outs) equal to two times (2×) the annual fees, or approximately $18,650,000.
(b) Consequential Damages Exclusion. Skybridge's standard MSA includes a mutual exclusion of consequential, indirect, incidental, special, and punitive damages. Meridian is expected to seek a carve-out from this exclusion for regulatory fines, penalties, and assessments imposed on Meridian by banking regulators in connection with a data breach or compliance failure attributable to Skybridge's acts or omissions. This carve-out represents a significant economic risk to Skybridge and will require careful negotiation and potentially input from Skybridge's board and PRCP.
4.1.5 Regulatory Compliance
(a) OCC Bulletin 2013-29 and Interagency Guidance. As a critical third-party service provider to a SIFI, Skybridge must agree to contractual provisions that enable Meridian to satisfy the requirements of OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance) and the Interagency Guidance on Third-Party Relationships issued in June 2023 by the OCC, the Federal Reserve, and the FDIC. These requirements affect multiple sections of the MSA, including provisions relating to performance standards, audit rights, subcontracting, business continuity, data security, regulatory access, and termination rights.
(b) Bank Service Company Act. Skybridge qualifies as a "bank service company" within the meaning of the Bank Service Company Act, 12 U.S.C. § 1867, because it provides data processing and related technology services to a national bank. As such, Skybridge must agree to examination by federal banking regulators (including the OCC and FDIC) and must include contractual provisions reflecting this regulatory access right. The Security Exhibit and the MSA itself must contain appropriate language ensuring that Skybridge's premises, books, and records are accessible to the relevant regulators upon request.
(c) BSA/AML Compliance. Given that SkyComply™ is an AML and transaction-monitoring platform, the MSA must address compliance with the Bank Secrecy Act and applicable AML regulations. Skybridge's obligations in this regard relate primarily to the functionality, accuracy, and reliability of the platform's AML detection and reporting capabilities, and the engagement team should ensure that appropriate disclaimers and limitations of liability are included to address the inherent limitations of AI-driven compliance tools.
4.1.6 Insurance Requirements
Meridian has requested that it be named as an additional insured on Skybridge's cyber liability and errors & omissions insurance policy issued by Coastal Assurance Corporation (Policy No. CA-TECH-2025-07831). The current policy provides coverage of $25,000,000 per occurrence and $50,000,000 in the aggregate, with a policy period running from April 1, 2025 through March 31, 2026. Skybridge's engagement team will need to coordinate with Coastal Assurance Corporation to determine whether additional insured status can be accommodated under the existing policy or whether a policy endorsement is required. A certificate of insurance is to be delivered to Meridian within 10 business days of MSA execution.
4.1.7 Source Code Escrow
The transaction documents include a three-party source code escrow agreement among Skybridge (as depositor), Meridian (as beneficiary), and Sentinel Escrow Services, Inc. (as escrow agent), bearing Escrow Agreement No. SCE-2025-04417. The escrow agreement will provide for the deposit of the SkyComply™ platform source code and its release to Meridian upon the occurrence of specified trigger events, which typically include Skybridge's insolvency or bankruptcy, material uncured breach of the MSA, or cessation of business operations. The engagement team will need to negotiate the specific release conditions, the scope of the deposited materials, verification procedures, and the frequency of deposit updates.
4.2 Pinnacle Ridge Capital Partners Consent Coordination
Because the MSA's total contract value of $50,000,000 exceeds the $25,000,000 threshold established under Pinnacle Ridge Capital Partners' contractual approval right, Skybridge requires written consent from PRCP prior to execution of the MSA. The engagement team will prepare a form of written board consent for submission to PRCP and will coordinate with Alcott & Grenier LLP (Simone Alcott, Partner), which serves as PRCP's outside counsel, for review and approval of the consent and, to the extent requested, the material transaction documents. Elise Drummond, PRCP's Managing Partner, is the expected signatory on the consent document.
4.3 Reference to Engagement Letter
This engagement is governed by the engagement letter dated August 25, 2025, executed by the client and the firm. All terms and conditions set forth in the engagement letter, including the scope of representation, fee arrangements, and any limitations on the scope of the engagement, are incorporated by reference.
SECTION 5: ENGAGEMENT TEAM
The following attorneys have been assigned to this matter:
Team Role Descriptions:
Angela Fontaine (Responsible Partner) serves as the responsible partner on this engagement. Ms. Fontaine provides overall engagement oversight and client relationship management. Ms. Fontaine has served as Skybridge's primary relationship partner at Calderwood & Harkness since the firm's initial engagement with the client in 2021 and maintains direct relationships with David Shimura (General Counsel) and Priya Chandrasekaran (CEO). While Ms. Fontaine's primary practice is in the firm's Real Estate group, she has been cross-staffed to this engagement for continuity of the client relationship and will have final authority on all engagement-level decisions.
Renata Vasquez (Billing Partner) manages the billing and financial aspects of the engagement, including monthly invoice preparation, time entry review, and budgetary monitoring. Ms. Vasquez serves as the billing partner for Skybridge across all matters staffed at the firm.
Liam Prescott (Of Counsel, Technology Transactions) serves as the senior advisor on this engagement, providing subject-matter expertise on technology licensing, SaaS deal terms, data security provisions, and regulatory compliance issues specific to bank vendor agreements. Mr. Prescott is a member of the firm's Technology Transactions practice group and brings extensive experience in the negotiation of enterprise SaaS agreements with financial institution counterparties. Mr. Prescott will review all drafts of the MSA, the Security Exhibit, the DPA, and the SLA Exhibit prior to circulation to the counterparty and will participate in key negotiation sessions.
Amy Chesterton (Lead Associate) serves as the lead drafter and negotiator on all transaction documents. Ms. Chesterton is formally a member of the firm's Bankruptcy & Restructuring group but has been assigned to this engagement based on her technology transactions experience, including prior work on SaaS licensing agreements, data processing addenda, and vendor management agreements. Ms. Chesterton will prepare all initial drafts, manage the markup and redline process, and serve as the primary point of contact for Catherine Woo and her team at Hargrove, Tully & Marsh during the negotiation process.
Nathan Ikeda (Working Associate) provides supporting drafting, legal research, and due diligence. Mr. Ikeda is a member of the firm's Bankruptcy & Restructuring group and has been assigned to this engagement based on his technology transactions experience and his familiarity with the Skybridge client relationship. Mr. Ikeda's responsibilities include initial research on regulatory requirements, preparation of the source code escrow agreement, preparation of the Pinnacle Ridge board consent, and conflict check administration.
SECTION 6: ESTIMATED FEES AND BILLING ARRANGEMENTS
Estimated Total Fees: $275,000 – $375,000
The fee estimate range reflects the anticipated scope of work based on the number and complexity of the transaction documents to be negotiated, the number of counterparty markup rounds expected (typically three to five for an enterprise SaaS agreement of this scale with a SIFI counterparty), and the level of regulatory compliance analysis required. The lower end of the range assumes a standard negotiation trajectory with moderate complexity and resolution of key commercial and legal issues within three rounds of markup. The upper end of the range accounts for the possibility of protracted negotiations, particularly with respect to the data security and indemnification provisions, additional regulatory compliance analysis, and coordination with PRCP and its counsel.
Billing Arrangement: Time and materials billing at the standard hourly rates set forth in Section 5 above. Invoices will be prepared and submitted on a monthly basis. Payment is due net 30 days from the date of each invoice.
Matter Number for All Billing: 1009-00007. All time entries, disbursements, and out-of-pocket expenses associated with this engagement are to be recorded under this matter number.
Client Billing Contact: David Shimura, General Counsel, Skybridge Fintech Ltd., 1400 Concord Pike, Suite 320, Wilmington, Delaware 19803.
Note on Fee Estimate Revisions: The fee estimate set forth above assumes standard negotiation complexity for an enterprise SaaS transaction of this type. If protracted negotiations, unanticipated regulatory issues, or material scope changes arise during the course of the engagement, the fee estimate may be revised upward with the prior approval of the client. Any such revision will be communicated to David Shimura in writing before additional fees are incurred outside the original estimate range.
SECTION 7: KEY OPEN NEGOTIATION ISSUES (AS OF MATTER OPENING)
As of the date of this memorandum, the following negotiation issues have been identified as open based on preliminary discussions between the parties and a review of Meridian's initial term sheet and vendor requirements package. This summary is intended to provide a snapshot of the negotiation landscape at the time of matter opening and will be updated as negotiations progress.
Commentary on Key Issues:
Issue 1 — SLA Uptime Standard. The 5-basis-point gap between Skybridge's proposed 99.9% and Meridian's demanded 99.95% is commercially meaningful. At scale, 99.9% monthly uptime permits approximately 43 minutes of downtime per month, while 99.95% permits approximately 22 minutes. The gap is further complicated by the upstream dependency on Orion Cloud Services' own SLA, which provides 99.95% uptime. If Skybridge were to commit to 99.95%, it would effectively eliminate the operational buffer between its upstream and downstream SLA commitments. The engagement team will need to evaluate whether Skybridge can operationally support a 99.95% commitment and, if so, whether enhanced SLA credit protections are required.
Issue 3 — Data Breach Indemnity Cap. This issue represents the most significant economic risk in the negotiation. Meridian's demand for uncapped data breach indemnification reflects its concern about potentially unlimited regulatory exposure in the event of a breach affecting customer NPI. Skybridge's proposed cap of 2× annual fees (~$18,650,000) is consistent with market practice for enterprise SaaS vendors but may be insufficient for a counterparty of Meridian's size and regulatory profile. The data security super-cap of 3× annual fees (~$27,975,000) has been identified as a potential middle-ground position, but Meridian's initial stance suggests that uncapped indemnification is a priority.
Issue 4 — Consequential Damages for Regulatory Fines. Meridian's request for a carve-out from the consequential damages exclusion for regulatory fines is increasingly common in bank vendor agreements, particularly with SIFI counterparties. However, it represents a potentially open-ended exposure for Skybridge, as regulatory fines can be substantial and unpredictable. The engagement team will evaluate whether a compromise can be reached, such as subjecting the carve-out to the data security super-cap.
Issue 5 — Security Incident Notification Window. The 12-hour gap between the parties' positions on incident notification reflects the tension between regulatory expectations on the bank side and operational feasibility on the vendor side. The engagement team will need to assess Skybridge's incident response capabilities and evaluate whether a 12-hour commitment is achievable, potentially with qualifications (e.g., 12 hours from confirmation of a security incident, rather than from initial detection of suspicious activity).
SECTION 8: KEY THIRD PARTIES
The following third parties have been identified as relevant to the contemplated transaction:
Notes on Key Third Parties:
The engagement team should note that Orion Cloud Services, Inc. is a critical dependency for the SkyComply™ platform's availability and security posture. The Subprocessor Flow-Down Terms Addendum to be negotiated as part of this transaction will ensure that Orion Cloud Services is subject to contractual obligations that are at least as protective as those that Skybridge undertakes to Meridian in the MSA and the Security Exhibit. The engagement team will need to review Skybridge's existing agreement with Orion Cloud Services to confirm the scope and adequacy of Orion's security and availability commitments.
JAMS has been identified as the mediation administrator under the dispute resolution provisions of the MSA. The MSA is expected to include a mandatory mediation step prior to the initiation of any litigation or arbitration, with JAMS serving as the administering body and New York, New York as the venue for mediation proceedings.
SECTION 9: KEY DATES AND TIMELINE
The following dates and milestones are relevant to this engagement:
Negotiation Timeline Notes: The parties have expressed a mutual desire to finalize the MSA and ancillary documents in time for the targeted implementation start date of September 15, 2025. This leaves approximately two weeks from the date of matter opening for initial draft preparation and circulation. The engagement team should aim to circulate the initial Skybridge draft of the MSA, Order Form, and all exhibits to Hargrove, Tully & Marsh no later than September 8, 2025, to allow for one week of counterparty review before the implementation start date.
SECTION 10: CONFLICT CHECK CONFIRMATION
A separate Conflict Check Memorandum has been prepared by Nathan Ikeda and reviewed by Angela Fontaine in accordance with the firm's conflict check policies and procedures. The conflict check was run against the following parties and entities:
•  Meridian National Bank, National Association
•  Meridian Financial Group, Inc.
•  Pinnacle Ridge Capital Partners, LP
•  Hargrove, Tully & Cascade Insurance Brokers
•  Alcott & Grenier LLP
•  Crestfield Cyber Advisors, Inc.
•  Orion Cloud Services, Inc.
•  Coastal Assurance Corporation
•  Sentinel Escrow Services, Inc.
•  Hathaway & Pendleton, LLP
•  All identified individual contacts and officers of the above entities
Result: No conflicts of interest were identified. The engagement has been approved by the firm's conflicts committee in accordance with the firm's standard procedures. The Conflict Check Memorandum is on file with the firm's General Counsel's Office and is referenced herein by incorporation.
SECTION 11: SPECIAL CONSIDERATIONS AND NOTES
The following special considerations and notes are relevant to this engagement and should be reviewed by all members of the engagement team:
11.1 Pinnacle Ridge Capital Partners Consent Requirement
Because the MSA's total contract value of $50,000,000 exceeds the $25,000,000 threshold established under Pinnacle Ridge Capital Partners' contractual approval rights (as set forth in the stockholders' agreement executed in connection with Skybridge's Series C financing), Skybridge is required to obtain written consent from PRCP prior to the execution of the MSA and related transaction documents. This consent requirement applies to the total contract value of the arrangement, including all subscription fees, implementation fees, and managed services fees.
The engagement team will prepare a form of written consent for Elise Drummond's signature on behalf of PRCP. The consent document, together with a summary of the material terms of the MSA and ancillary documents, will be submitted to Alcott & Grenier LLP (Simone Alcott, Partner) for review on behalf of PRCP. The engagement team should anticipate that PRCP and its counsel may request access to the full suite of transaction documents and may provide substantive comments, particularly with respect to the indemnification framework, liability cap structure, and any provisions that could result in material financial exposure to Skybridge.
Timing is a key consideration for the PRCP consent process. The engagement team should aim to provide PRCP and its counsel with a substantially final draft of the transaction documents no later than three weeks prior to the anticipated execution date, to allow adequate time for review, comment, and execution of the consent.
11.2 Regulatory Sensitivity
Meridian National Bank is a systemically important financial institution subject to the regulatory supervision of the OCC, the Federal Reserve, and the FDIC. The MSA and ancillary documents must be structured to satisfy the requirements of the following regulatory frameworks:
(a) OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance). This bulletin sets forth the OCC's expectations for national banks' management of third-party relationships, including critical activities such as technology services. The MSA must include provisions addressing performance standards, the right to audit, access to information, confidentiality, business resumption and contingency planning, subcontracting, regulatory access, indemnification, dispute resolution, and termination rights.
(b) Interagency Guidance on Third-Party Relationships (June 2023). The June 2023 interagency guidance, issued jointly by the OCC, the Federal Reserve, and the FDIC, updated and harmonized the three agencies' expectations for the management of third-party relationships by banking organizations. The guidance is broadly consistent with OCC Bulletin 2013-29 but provides additional detail on risk management throughout the lifecycle of third-party relationships, including planning, due diligence, contract negotiation, ongoing monitoring, and termination.
(c) Bank Service Company Act (12 U.S.C. § 1867). Skybridge qualifies as a "bank service company" under the Bank Service Company Act because it provides data processing and related technology services to a national bank. As such, Skybridge is subject to examination by federal banking regulators, including the OCC and the FDIC. The MSA must include provisions expressly granting the applicable federal banking regulators the right to examine Skybridge's operations, books, records, and premises with respect to the services provided to Meridian. Skybridge must cooperate with any such examination and must not impede regulatory access.
(d) BSA/AML Compliance. Given that SkyComply™ is an AML and transaction-monitoring platform, the engagement team must ensure that the MSA includes appropriate provisions addressing BSA/AML compliance, including Skybridge's obligations to maintain the accuracy and functionality of the platform's detection and reporting capabilities and Meridian's responsibilities as the regulated institution with ultimate compliance accountability.
11.3 upstream SLA Dependency
Skybridge's ability to meet its SLA commitments to Meridian is dependent in significant part on the availability and performance of the upstream cloud infrastructure provided by Orion Cloud Services, Inc. Orion Cloud Services provides a 99.95% monthly uptime SLA under its infrastructure-as-a-service agreement with Skybridge. Skybridge's proposed 99.9% monthly uptime SLA for Meridian provides a 5-basis-point buffer between the upstream commitment from Orion and the downstream commitment to Meridian.
If Meridian's demand for a 99.95% uptime standard is accepted, this buffer would be eliminated, and Skybridge's ability to meet its SLA commitment to Meridian would be entirely dependent on Orion Cloud Services' performance with no margin for Skybridge's own application-layer downtime. The engagement team should flag this dependency for Marcus Holt (CTO) and Amara Okafor (CISO) and should evaluate whether enhancements to the upstream agreement with Orion Cloud Services are necessary or available before committing to a 99.95% downstream SLA.
11.4 Insurance Coordination
Meridian's request for additional insured status on Skybridge's cyber liability and errors & omissions insurance policy (Coastal Assurance Corporation, Policy No. CA-TECH-2025-07831) requires coordination with the insurer. The engagement team should note the following:
•  The current policy provides $25,000,000 per occurrence and $50,000,000 in the aggregate.
•  The current policy period runs from April 1, 2025 through March 31, 2026.
•  A certificate of insurance is required to be delivered to Meridian within 10 business days of MSA execution.
•  The engagement team should coordinate with Jonathan Kreske (CFO) and Skybridge's insurance broker to determine whether Coastal Assurance Corporation will accommodate additional insured status for Meridian under the existing policy or whether a policy endorsement is required, and what additional premium, if any, would be incurred.
•  The engagement team should also note that the Coastal Assurance policy renewal date of March 31, 2026 falls shortly after the targeted Go-Live Date of March 1, 2026. Skybridge must ensure continuous insurance coverage and delivery of updated certificates and endorsements to Meridian upon renewal.
11.5 Staffing Note
The engagement team for this matter is cross-staffed from multiple practice groups within the firm. This staffing approach reflects the interdisciplinary nature of the engagement and the firm's commitment to bringing the most appropriate expertise to bear on each aspect of the transaction:
•  Liam Prescott (Of Counsel, Technology Transactions) provides primary subject-matter expertise on SaaS licensing, technology deal terms, data security provisions, and the regulatory aspects of bank vendor agreements. Mr. Prescott's involvement ensures that the transaction documents reflect current market practice and regulatory expectations.
•  Angela Fontaine (Partner, Real Estate) is cross-staffed to this engagement for client relationship continuity and overall engagement oversight, given her longstanding relationship with Skybridge's leadership team.
•  Amy Chesterton and Nathan Ikeda (both from the Bankruptcy & Restructuring group) have been assigned based on their technology transactions experience gained through prior matters at the firm. Their familiarity with enterprise software agreements, data processing frameworks, and commercial negotiations makes them well-suited for the lead drafting and supporting roles on this engagement.
11.6 Matter Status
Matter Status as of September 2, 2025: ACTIVE
This matter is open and active. The engagement team should proceed with initial drafting of the MSA and ancillary documents, with a target circulation date to Hargrove, Tully & Cascade Insurance Brokers of no later than September 8, 2025.
END OF MATTER OPENING MEMORANDUM
This memorandum is an internal document of Calderwood & Harkness LLP prepared for the purpose of documenting the opening of Matter No. 1009-00007. This memorandum is confidential and is protected by the attorney-client privilege and the work product doctrine. It is not intended for distribution to any person outside of Calderwood & Harkness LLP without the prior written consent of the responsible partner. Receipt of this memorandum by any person outside of the firm does not constitute a waiver of any applicable privilege or protection.
PREPARED BY:
________________________________________
Nathan Ikeda Working Associate Calderwood & Harkness LLP
Date: September 2, 2025
REVIEWED AND APPROVED BY:
________________________________________
Angela Fontaine Responsible Partner Calderwood & Harkness LLP
Date: ________
Title | Name
Chief Executive Officer | Priya Chandrasekaran
Chief Financial Officer | Jonathan Kreske
Chief Technology Officer | Marcus Holt
Chief Information Security Officer | Amara Okafor
VP, Enterprise Sales | Tara Bellingham
General Counsel | David Shimura
Name | Title | Role in Transaction
Gerald Brannigan | Chief Information Officer | Executive Sponsor (bank side)
Sandra Petrov | Head of Financial Crimes & Compliance | Functional stakeholder; end-user of SkyComply™
Luis Arriaga | SVP, Procurement & Vendor Management | Day-to-day relationship lead; commercial negotiations
Catherine Woo | Associate General Counsel (Technology) | Legal lead for Meridian
Commercial Term | Detail
Total Contract Value (TCV) | $50,000,000 over five (5) years
Annual Contract Value (ACV) | $10,000,000 per year (undiscounted)
Year 1 Fees (post-discount, rounded) | $12,700,000
Years 2–5 Annual Fees | $9,325,000 per year
Gross Undiscounted TCV | $53,600,000
Volume discount Applied | 6.72% off gross undiscounted TCV
Team Member | Role | Practice Group | Billing Rate
Angela Fontaine | Responsible Partner | Real Estate (cross-staffed for client relationship management) | $1,150/hr
Renata Vasquez | Billing Partner | Labor & Employment | $1,075/hr
Liam Prescott | Of Counsel (Technology Transactions) | Technology Transactions | $975/hr
Amy Chesterton | Lead Associate | Bankruptcy & Restructuring (assigned for transactional support given technology transactions experience) | $725/hr
Nathan Ikeda | Working Associate | Bankruptcy & Restructuring | $625/hr
No. | Issue | Skybridge Position | Meridian Position | Status
1 | SLA Uptime Standard | 99.9% monthly uptime | 99.95% monthly uptime | OPEN
2 | SLA Credit Cap | 15% annual cap (30% monthly cap) | Uncapped credits | OPEN
3 | Data Breach Indemnity Cap | 2× annual fees (~$18,650,000) | Uncapped | OPEN
4 | Consequential Damages for Regulatory Fines | No carve-out from mutual consequential damages exclusion | Carve-out for regulatory fines | OPEN
5 | Security Incident Notification Window | 24 hours | 12 hours | OPEN
6 | Penetration Testing Scope | Application-layer only | Infrastructure + application-layer | OPEN
7 | Confidentiality/Data Security Super-Cap | 3× annual fees (~$27,975,000) | Uncapped | OPEN
8 | Additional Insured Status on Cyber Policy | Under review with Coastal Assurance | Requested by Meridian | OPEN
Entity | Role | Key Contact(s)
Hargrove, Tully & Cascade Insurance Brokers | Outside counsel to Meridian National Bank, N.A. | Douglas Krenshaw, Partner; Megan Faircloth, Senior Associate; Ryan Tso, Associate
Alcott & Grenier LLP | Outside counsel to Pinnacle Ridge Capital Partners, LP (consent review and transaction document review) | Simone Alcott, Partner
Crestfield Cyber Advisors, Inc. | Independent security auditor for Skybridge; prepared SOC 2 Type II examination report (dated March 15, 2025) and ISO 27001 recertification (dated January 22, 2025) | Deepa Rajan, Lead Auditor; Winston Lam, CEO
Orion Cloud Services, Inc. | Cloud infrastructure-as-a-service (IaaS) provider; hosts the SkyComply™ platform in U.S.-East (Virginia) and U.S.-West (Oregon) regions | N/A
Coastal Assurance Corporation | Cyber liability and errors & omissions insurer for Skybridge; Policy No. CA-TECH-2025-07831 ($25M per occurrence / $50M aggregate; policy period: April 1, 2025 – March 31, 2026) | N/A
Sentinel Escrow Services, Inc. | Source code escrow agent; to serve as escrow agent under three-party source code escrow agreement (Escrow Agreement No. SCE-2025-04417) | N/A
Hathaway & Pendleton, LLP | Independent financial auditor for Skybridge; most recent audit opinion dated April 30, 2025 for FY 2024 | Bruce Ogilvie, Lead Audit Partner
JAMS | Mediation administrator for dispute resolution proceedings; venue: New York, New York | N/A
Date | Event / Milestone
August 25, 2025 | Engagement letter executed between Calderwood & Harkness LLP and Skybridge Fintech Ltd.
September 2, 2025 | Matter opened; Matter Opening Memorandum prepared and filed
September 15, 2025 | Targeted start of implementation period under the MSA; initial drafts of MSA and Order Form targeted for circulation to Meridian's counsel prior to or concurrent with this date
February 28, 2026 | Targeted end of implementation period; user acceptance testing, training, and go-live preparation to be completed by this date
March 1, 2026 | Targeted Platform Go-Live Date; commencement of Initial Term of the MSA
February 28, 2031 | End of Initial Term (five years from Go-Live Date)
April 1, 2025 – March 31, 2026 | Current policy period for Coastal Assurance Corporation cyber liability/E&O insurance policy (Policy No. CA-TECH-2025-07831); the engagement team should note that the policy renewal date of March 31, 2026 falls shortly after the targeted Go-Live Date, and Skybridge will need to ensure continuous coverage and deliver an updated certificate of insurance to Meridian upon renewal