1009-00007 · Skybridge Fintech Ltd · Memos & Analysis

data-security-privacy-memo.docx DOCUMENT Funds

13 / 35 ← → ✕

MEMORANDUM

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

TO: Amy Chesterton, Lead Associate Angela Fontaine, Responsible Partner Liam Prescott, Of Counsel

FROM: Nathan Ikeda, Associate

DATE: September 12, 2025

RE: Data Security and Privacy Requirements — Skybridge Fintech Ltd. / Meridian National Bank, N.A. Enterprise SaaS Agreement (SkyComply™ Platform)

MATTER NO.: 1009-00007

I. Executive Summary

The purpose of this memorandum is to analyze the data security and privacy requirements applicable to the proposed Master Software-as-a-Service Agreement (the "MSA") between Skybridge Fintech Ltd. ("Skybridge" or "Licensor") and Meridian National Bank, N.A. ("Meridian" or "Licensee") for the deployment of SkyComply™, Skybridge's AI-driven anti-money laundering ("AML") and transaction-monitoring platform (the "Platform"). This memorandum is prepared in connection with our representation of Skybridge in the negotiation and documentation of the MSA and its ancillary agreements, including the Data Processing Addendum ("DPA," designated as Exhibit C to the MSA) and the Security Exhibit (Exhibit B to the MSA).

Parties. Skybridge Fintech Ltd. is a Delaware limited company headquartered at 1400 Concord Pike, Suite 320, Wilmington, DE 19803. Skybridge is the licensor and service provider under the proposed MSA. Meridian National Bank, N.A. is a national banking association chartered under the National Bank Act, with its principal offices located at 600 Lexington Avenue, 40th Floor, New York, NY 10022. Meridian is a top-10 U.S. bank by total assets, with approximately $485 billion in consolidated assets as of its most recent quarterly filing. Meridian is a systemically important financial institution ("SIFI") regulated by the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System (the "Federal Reserve"), and the Federal Deposit Insurance Corporation ("FDIC"). Meridian's parent holding company is Meridian Financial Group, Inc., a publicly traded Delaware corporation listed on the New York Stock Exchange.

Transaction Overview. The proposed transaction is a five-year enterprise SaaS deployment with a total contract value ("TCV") of approximately $50,000,000 (approximately $10,000,000 in annual fees, though the fee structure includes tiered pricing that results in slight variation across the contract years). The Platform will serve approximately 32,000 named users across Meridian's retail banking, commercial banking, and wealth management divisions. The deployment contemplates Meridian's use of the SkyComply™ Platform for automated AML screening, real-time transaction monitoring, suspicious activity report generation and management, customer due diligence and enhanced due diligence processes, beneficial ownership tracking, and related Bank Secrecy Act ("BSA") compliance functions.

Data Security and Privacy Significance. Because the SkyComply™ Platform processes financial transaction data, customer information (including personally identifiable information and non-public personal information), and suspicious activity reporting data, the engagement implicates stringent federal and state data security and privacy requirements, as well as contractual security obligations commensurate with Meridian's regulatory posture as a SIFI. The sensitivity of the data processed by SkyComply™ is further heightened by the fact that the Platform handles suspicious activity reports and related financial crimes data, which are subject to strict confidentiality requirements under the BSA and its implementing regulations.

Scope of This Memorandum. This memo addresses the following core areas:

1. GLBA and NPI requirements;

2. State data breach notification laws;

3. Encryption standards;

4. Data residency restrictions;

5. Subprocessor approval obligations;

6. Security incident notification timing;

7. Audit rights framework;

8. Data retention and deletion requirements; and

9. Background check requirements.

In addition, the memorandum identifies and analyzes the key negotiation points between Skybridge and Meridian with respect to data security and privacy provisions. Meridian is represented in this transaction by Hargrove, Tully & Cascade Insurance Brokers, led by partner Douglas Krenshaw, with senior associate Megan Faircloth and associate Ryan Tso. We have received and reviewed two rounds of marked drafts of the DPA and Security Exhibit from opposing counsel, and the analysis herein reflects the current state of negotiations as of the date of this memorandum.

In the course of preparing this memorandum, Skybridge's Chief Information Security Officer, Amara Okafor, and Chief Technology Officer, Marcus Holt, have been consulted on technical and operational capabilities, including Skybridge's incident response protocols, encryption infrastructure, subprocessor management practices, and audit facilitation processes. Their input is reflected in the operational feasibility assessments throughout this memorandum.

This memorandum should be read in conjunction with the companion memoranda on SLA terms, indemnification and liability caps, regulatory compliance, and insurance coverage, which address related but distinct issues arising from the proposed MSA.

II. Background and Data Classification

A. Nature of Data Processed

Under the proposed MSA, the SkyComply™ Platform will process substantial volumes of Meridian's customer data in connection with AML screening, transaction monitoring, and BSA compliance operations. The nature and sensitivity of this data is central to the data security and privacy analysis set forth in the remainder of this memorandum.

Based on the technical architecture documentation provided by Marcus Holt and the data flow diagrams reviewed during the due diligence process, the categories of data that SkyComply™ will process include, without limitation, the following:

• Customer Identifying Information: Customer names, addresses, dates of birth, Social Security numbers, tax identification numbers, government-issued identification numbers, and telephone numbers and email addresses associated with customer accounts.

• Account Information: Account numbers, account types, account opening and closing dates, account balances, and account ownership structures (including joint accounts and fiduciary accounts).

• Transaction Records: Detailed records of financial transactions processed through Meridian's banking systems, including wire transfers, ACH transactions, check clearing data, debit and credit card transactions, cash deposits and withdrawals, and international remittances.

• Suspicious Activity Reports (SARs): Draft and filed SARs, supporting documentation and narrative fields, and related investigative case files maintained within the Platform.

• Beneficial Ownership Data: Information regarding the beneficial owners of legal entity customers, as required under the Customer Due Diligence Rule (31 C.F.R. § 1010.230), including ownership percentages, control relationships, and identification documentation.

• Know Your Customer (KYC) Documentation: Customer due diligence and enhanced due diligence documentation, including copies of identification documents, risk rating assessments, and ongoing monitoring records.

• Financial Crimes Data: Watchlist screening results, sanctions screening data, politically exposed person ("PEP") screening data, adverse media screening results, and related risk scoring outputs generated by the Platform's AI-driven analytics engine.

Meridian has classified the data to be handled by Skybridge under two tiers of Meridian's internal data classification policy (as documented in Meridian's Information Security Policy, Version 7.2, dated February 2025, a copy of which was provided to us under the mutual NDA). The relevant tiers are "Confidential" (Tier 2), which covers general customer information, account data, and transaction records, and "Highly Restricted" (Tier 1), which covers SARs, SAR-related data, beneficial ownership data, and Social Security numbers. Meridian's data classification policy imposes progressively more stringent handling, access control, encryption, and disposal requirements for each tier, with Highly Restricted data subject to the most rigorous protections.

Importantly, the data processed by SkyComply™ includes Non-Public Personal Information ("NPI") as defined under the Gramm-Leach-Bliley Act ("GLBA"), 15 U.S.C. §§ 6801–6809, and personally identifiable information ("PII") under various state privacy and data breach notification laws. As discussed in greater detail in Sections III and IV below, the NPI and PII classification of this data triggers specific federal and state regulatory requirements that must be reflected in the MSA, DPA, and Security Exhibit.

B. Regulatory Posture of Meridian

Meridian's regulatory posture as a national banking association and a SIFI is a critical factor in the data security and privacy requirements applicable to the proposed MSA. The following regulatory frameworks are directly relevant:

GLBA and Interagency Guidelines. As a national banking association, Meridian is subject to the GLBA Safeguards Rule (16 C.F.R. Part 314), as implemented through the Interagency Guidelines Establishing Information Security Standards (12 C.F.R. Part 30, Appendix B, for national banks). These guidelines require Meridian to develop, implement, and maintain a comprehensive information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the institution, the nature and scope of its activities, and the sensitivity of the customer information at issue. Critically, the Interagency Guidelines require financial institutions to exercise appropriate due diligence and oversight of their third-party service providers, including by requiring contractual provisions that obligate such service providers to implement appropriate security measures.

OCC Guidance on Third-Party Relationships. Meridian is subject to OCC Bulletin 2013-29 ("Third-Party Relationships: Risk Management Guidance") and the updated Interagency Guidance on Third-Party Relationships: Risk Management, issued jointly by the OCC, Federal Reserve, and FDIC in June 2023 (the "Interagency Guidance"). This guidance establishes a comprehensive framework for banks' management of third-party relationships, including requirements for due diligence, contract negotiation, ongoing monitoring, and termination planning. The guidance specifically addresses the risks associated with third-party access to customer information and requires banks to include robust data security, confidentiality, incident notification, audit, and subcontracting provisions in their agreements with third-party service providers. Because SkyComply™ processes highly sensitive financial crimes and customer data, Meridian's relationship with Skybridge will be classified as a "critical activity" under the Interagency Guidance, triggering the most rigorous risk management requirements.

Bank Service Company Act. Under the Bank Service Company Act, 12 U.S.C. § 1867(c), the services performed by Skybridge for Meridian are subject to examination by federal banking regulators, including the OCC, Federal Reserve, and FDIC, to the same extent as if Skybridge's services were being performed by Meridian itself. This statutory examination authority is non-waivable and must be acknowledged in the MSA. The practical significance of this provision is that federal banking regulators may examine Skybridge's operations, security controls, and records at any time in connection with their supervision of Meridian, and the MSA must not contain any provision that would impede or restrict such examination.

Key Meridian Personnel. Sandra Petrov, Meridian's Head of Financial Crimes & Compliance, is the key compliance stakeholder on the bank side and has been actively involved in defining the security and compliance requirements for the SkyComply™ deployment. Catherine Woo, Associate General Counsel (Technology), is the internal legal lead on the bank side and has been coordinating with Douglas Krenshaw and his team at Hargrove, Tully & Cascade Insurance Brokers on contract negotiation. Both Sandra Petrov and Catherine Woo have participated in the due diligence sessions and have provided detailed written comments on the DPA and Security Exhibit.

C. Skybridge's Current Security Posture

An understanding of Skybridge's current security posture is essential context for evaluating the appropriateness and feasibility of the contractual security commitments under negotiation. Based on our review of Skybridge's security documentation and our consultations with Amara Okafor and Marcus Holt, the following summarizes Skybridge's current posture:

SOC 2 Type II Certification. Skybridge holds a current SOC 2 Type II audit report dated March 15, 2025, performed by Crestfield Cyber Advisors, Inc. ("Crestfield"), an independent Delaware corporation specializing in cybersecurity audit and assurance services. The lead auditor was Deepa Rajan; the CEO of Crestfield is Winston Lam. Crestfield maintains its principal office at 222 West Adams Street, Suite 1200, Chicago, IL 60606. The SOC 2 Type II report covers the Trust Services Criteria of security, availability, processing integrity, confidentiality, and privacy. The audit period covered in the most recent report is January 1, 2024, through December 31, 2024. Crestfield identified no material exceptions or qualified findings in the report.

ISO 27001 Certification. Skybridge holds ISO 27001 certification, with the most recent recertification dated January 22, 2025, also performed by Crestfield. Annual surveillance audits are conducted to maintain the certification. The scope of certification covers Skybridge's information security management system as it pertains to the design, development, hosting, and support of the SkyComply™ Platform and related services.

Company Profile. Skybridge has approximately 420 employees. In fiscal year 2024, Skybridge reported revenue of approximately $78.3 million. Skybridge serves over 60 banking and financial services clients, ranging from regional community banks to large national and multinational financial institutions. This client base provides relevant context for evaluating market-standard contractual terms: Skybridge must balance the security requirements of individual clients against the need to maintain a consistent and operationally feasible security program across its entire client portfolio.

Cloud Infrastructure. Skybridge hosts the SkyComply™ Platform on infrastructure provided by Orion Cloud Services, Inc. ("Orion Cloud"), a Delaware corporation headquartered at 4500 Great America Parkway, Santa Clara, CA 95054. Orion Cloud is a leading infrastructure-as-a-service ("IaaS") provider. The Platform is deployed across Orion Cloud's US-East (Virginia) and US-West (Oregon) regions. Orion Cloud maintains its own SOC 2 Type II certification, ISO 27001 certification, and FedRAMP authorization. The relationship between Skybridge and Orion Cloud is governed by an infrastructure services agreement that includes data security, confidentiality, and data residency provisions, which are addressed in greater detail in Sections VI and VII of this memorandum.

Cyber Liability Insurance. Skybridge maintains cyber liability insurance coverage through Coastal Assurance Corporation, under Policy No. CA-TECH-2025-07831. The policy provides coverage of $25 million per occurrence and $50 million in the aggregate, with a policy period of April 1, 2025, through March 31, 2026. The adequacy of this coverage relative to Meridian's contractual insurance requirements is addressed in the companion Insurance Coverage Gap Analysis Memo.

III. GLBA and Non-Public Personal Information Requirements

A. Statutory Framework

The Gramm-Leach-Bliley Act, Title V, Subtitle A (15 U.S.C. §§ 6801–6809) establishes the fundamental federal framework for the protection of consumer financial information. Section 6801(b) directs federal banking agencies and other relevant regulators to establish appropriate standards for financial institutions to protect the security and confidentiality of customers' nonpublic personal information, to protect against anticipated threats to the security or integrity of such information, and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.

The term "Non-Public Personal Information" or "NPI" is defined under Regulation P (12 C.F.R. Part 1016), promulgated by the Consumer Financial Protection Bureau, to include any personally identifiable financial information (i) provided by a consumer to a financial institution, (ii) resulting from any transaction with the consumer or any service performed for the consumer, or (iii) otherwise obtained by the financial institution. NPI includes, for example, account numbers, income information, Social Security numbers provided in connection with a financial transaction, account balances, transaction history, and any list, description, or other grouping of consumers derived using any NPI that is not publicly available. The definition is intentionally broad and encompasses virtually all of the customer data categories that SkyComply™ will process on behalf of Meridian.

The Safeguards Rule, as applicable to national banks through the Interagency Guidelines Establishing Information Security Standards (12 C.F.R. Part 30, Appendix B), requires each financial institution to develop, implement, and maintain a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to the size, complexity, and nature of the institution's operations. The key elements of a compliant information security program under the Interagency Guidelines include: (i) designation of one or more employees to coordinate the program; (ii) identification and assessment of risks to customer information; (iii) design and implementation of safeguards to control identified risks, including access controls, encryption, and environmental controls; (iv) regular testing and monitoring of safeguards; (v) oversight of service providers, including due diligence and contractual requirements; and (vi) adjustment of the program to reflect changes in technology, the sensitivity of customer information, and internal or external threats.

The Interagency Guidelines specifically require financial institutions to exercise appropriate due diligence in selecting their service providers and to require their service providers by contract to implement appropriate measures designed to meet the objectives of the Interagency Guidelines. This requirement is the direct statutory and regulatory basis for the contractual security obligations that must be included in the MSA and DPA.

B. Implications for the MSA

Skybridge, as a service provider receiving NPI from Meridian, must contractually commit to maintaining an information security program that meets or exceeds the standards established under the Interagency Guidelines. This commitment is not merely a "nice-to-have" contractual protection — it is a regulatory requirement imposed on Meridian and, by extension, on Meridian's third-party service providers. Failure to include adequate contractual security provisions could expose Meridian to regulatory criticism or enforcement action, and could undermine Skybridge's ability to serve other regulated financial institution clients.

The MSA and the Data Processing Addendum (Exhibit C) must include the following provisions, at minimum:

(a) Safeguards Obligation. Skybridge's obligation to implement and maintain administrative, technical, and physical safeguards appropriate to the nature and scope of its activities with respect to Meridian data, including NPI, and consistent with the Interagency Guidelines Establishing Information Security Standards.

(b) Incident Reporting. Skybridge's obligation to promptly report to Meridian any security incident involving NPI, including unauthorized access, acquisition, use, or disclosure of Meridian data. The specific timing and procedural requirements for incident notification are addressed in detail in Section VIII of this memorandum.

(c) Audit Rights. Meridian's right to audit Skybridge's information security program, either directly or through the delivery of independent audit reports and certifications. The audit rights framework is addressed in detail in Section IX of this memorandum.

(d) Confidentiality. Skybridge's obligation to maintain the confidentiality of Meridian data, including NPI, and to limit the use of such data to the purposes specified in the MSA.

(e) Access Controls. Skybridge's obligation to implement role-based access controls, multi-factor authentication, and least-privilege principles to limit access to Meridian data to authorized personnel with a demonstrated need to access such data in connection with the performance of services.

(f) Employee Training. Skybridge's obligation to provide regular training to its personnel on information security, data handling, and privacy practices relevant to the services performed for Meridian.

We recommend the following contractual language for inclusion in the representations and warranties section of the MSA:

"Skybridge represents and warrants that it maintains an information security program designed to protect the security, confidentiality, and integrity of Customer Data, including Non-Public Personal Information, consistent with the Interagency Guidelines Establishing Information Security Standards (12 C.F.R. Part 30, Appendix B) and industry standards for financial services SaaS providers. Skybridge further represents and warrants that it is in material compliance with the requirements of the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809) and its implementing regulations as applicable to Skybridge's role as a service provider to financial institutions."

Additionally, the representations and warranties should include that Skybridge is in material compliance with BSA/AML regulations applicable to its operations as a technology service provider, and that the Platform, as delivered, will not contain any malicious code, backdoor, virus, worm, Trojan horse, or other harmful component designed to disrupt, disable, or otherwise impair the functioning of the Platform or to permit unauthorized access to Meridian data.

C. BSA/AML-Specific Considerations

The BSA/AML-specific nature of the SkyComply™ Platform introduces a layer of regulatory risk that is distinct from the data security and privacy risks that would attach to a general-purpose SaaS platform. Because SkyComply™ is itself a BSA/AML compliance tool — used by Meridian to fulfill its regulatory obligations under the BSA, the USA PATRIOT Act, and related regulations — any regulatory finding against the Platform, such as a determination that the Platform's screening algorithms fail to adequately identify suspicious transactions or that the Platform's SAR-generation capabilities are deficient, could have direct and material regulatory consequences for Meridian. In a worst-case scenario, a regulatory deficiency in the Platform could contribute to a BSA/AML consent order or civil money penalty against Meridian.

Accordingly, the MSA should include the following provisions specific to BSA/AML compliance:

(a) Platform Compliance. Skybridge's obligation to maintain the SkyComply™ Platform in compliance with applicable BSA/AML regulations, including the requirements of 31 U.S.C. §§ 5311–5332 and the implementing regulations promulgated by the Financial Crimes Enforcement Network ("FinCEN"), as they apply to the functionality and capabilities of the Platform.

(b) Regulatory Action Notification. Skybridge's obligation to promptly notify Meridian of any material regulatory action, investigation, finding, or enforcement proceeding affecting the SkyComply™ Platform or Skybridge's ability to provide the services contemplated by the MSA. This notification obligation should extend to formal and informal supervisory actions, consent orders, civil money penalties, and any communication from a regulatory agency indicating that the Platform may be deficient in any material respect.

(c) Termination Right. Meridian has requested a termination right triggered by any material regulatory finding against the Platform. This request is being addressed in the context of the broader termination provisions under negotiation. From a data security and privacy perspective, we note that such a termination right intersects with the post-termination data retention, export, and deletion obligations discussed in Section X of this memorandum, and the termination provisions should be drafted to ensure that Meridian's data rights are fully preserved in the event of an early termination triggered by a regulatory finding.

We recommend that the BSA/AML compliance representations be carefully drafted to apply only to the Platform's functionality and capabilities as described in the documentation and specifications, and not as a guarantee that the Platform will detect all instances of money laundering or other financial crimes — a standard that no AML technology platform can meet and that would expose Skybridge to unacceptable liability. The distinction between the Platform's compliance with applicable regulatory requirements and the outcomes achieved through the use of the Platform should be clearly articulated in the MSA.

IV. State Data Breach Notification Laws

A. Applicability

All 50 states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have enacted data breach notification laws that require entities to notify affected individuals (and, in many cases, state regulators and consumer reporting agencies) when a breach of security results in the unauthorized access to or acquisition of personal information. Given that Meridian operates retail banking, commercial banking, and wealth management divisions across the United States, a security incident involving Meridian customer data processed by Skybridge could trigger notification obligations in multiple jurisdictions simultaneously. The operational complexity and cost of a multi-jurisdictional breach notification — including the analysis of differing definitions of "personal information," differing notification triggers, differing notification timelines, and differing content requirements — underscore the importance of robust contractual provisions governing Skybridge's breach notification obligations and cooperation requirements.

A detailed 50-state survey of breach notification law requirements is attached hereto as Attachment A. The discussion below highlights the jurisdictions with the most stringent or otherwise noteworthy requirements.

B. New York Considerations

New York is of particular significance because it is the location of Meridian's principal office and because of the heightened cybersecurity regulatory environment in the state.

NY SHIELD Act. The Stop Hacks and Improve Electronic Data Security Act (the "SHIELD Act"), codified at N.Y. General Business Law § 899-aa, expanded New York's data breach notification requirements in several important respects. The SHIELD Act broadened the definition of "private information" to include, in addition to the traditional categories (e.g., Social Security numbers, driver's license numbers, and financial account numbers in combination with security codes or passwords), biometric information, email addresses in combination with passwords or security questions and answers, and account numbers or credit or debit card numbers that can be used independently to access a financial account (i.e., without requiring an additional security code). The SHIELD Act also imposes an affirmative obligation on any person or business that owns or licenses computerized data that includes private information of a resident of New York to implement and maintain "reasonable safeguards" to protect the security, confidentiality, and integrity of the private information.

23 NYCRR Part 500 (NYDFS Cybersecurity Regulation). The New York Department of Financial Services ("NYDFS") Cybersecurity Regulation, 23 NYCRR Part 500, imposes comprehensive cybersecurity requirements on covered entities, including banks, insurance companies, and other financial services institutions licensed, registered, or otherwise regulated by NYDFS. As a national bank, Meridian's primary regulator is the OCC, and OCC preemption principles may limit the direct applicability of 23 NYCRR Part 500 to Meridian. However, in practice, Meridian's vendor management standards and contractual requirements are likely to incorporate NYDFS-equivalent requirements regardless of the preemption analysis, for several reasons: (i) Meridian may have affiliates regulated by NYDFS; (ii) Meridian's risk management framework may adopt 23 NYCRR Part 500 as an internal benchmark; and (iii) Meridian's regulators at the OCC may view compliance with 23 NYCRR Part 500 as indicative of sound security practices. The NYDFS Cybersecurity Regulation includes requirements for third-party service provider security policies (Section 500.11), which require covered entities to implement policies and procedures designed to ensure the security of information systems and nonpublic information accessible to, or held by, third-party service providers, including minimum cybersecurity practices to be met by third-party service providers, due diligence processes, and periodic assessment of third-party service providers.

C. Contractual Implications

The state data breach notification landscape has the following implications for the DPA and related contractual provisions:

Cooperation Requirements. The DPA should require Skybridge to cooperate fully with Meridian in connection with any breach notification obligations triggered by a security incident involving Meridian data. This cooperation should include, at minimum: (i) providing Meridian with all information in Skybridge's possession that is necessary for Meridian to assess its notification obligations under applicable state laws; (ii) assisting Meridian in determining the scope of affected data, the identities of affected individuals, and the jurisdictions in which notification may be required; (iii) coordinating with Meridian on the timing and content of notifications; and (iv) cooperating with Meridian's communications with state regulators, law enforcement, and consumer reporting agencies.

Cost Allocation. The DPA should address the allocation of costs associated with breach notification. Where a breach results from Skybridge's failure to comply with its contractual security obligations under the MSA, DPA, or Security Exhibit, Skybridge should bear the reasonable costs of breach notification, including the costs of preparing and distributing notification letters, establishing and operating call centers, providing credit monitoring and identity theft protection services to affected individuals, and any fines or penalties imposed by state regulators. This cost allocation provision is closely connected to the data breach indemnification provisions currently under negotiation between the parties. As noted in the Executive Summary, Skybridge's current position is to cap data breach indemnification at 2× annual fees (approximately $18,650,000), while Meridian demands uncapped indemnification for data breaches. This indemnification issue is addressed in detail in the companion Indemnification and Liability Cap Analysis Memo and is not resolved in this memorandum.

Incident Response Plan. We recommend including a requirement in the DPA or Security Exhibit that Skybridge maintain a written incident response plan consistent with the NIST Cybersecurity Framework (NIST CSF) standards. The incident response plan should address: (i) preparation and planning; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident activity, including lessons learned and remediation. The plan should be tested at least annually through tabletop exercises or simulated incident response drills. Amara Okafor has confirmed that Skybridge maintains an incident response plan that is consistent with the NIST CSF and that tabletop exercises are conducted semi-annually.

V. Encryption Standards

A. Data at Rest

All Meridian data stored within the SkyComply™ Platform must be encrypted at rest using AES-256 (Advanced Encryption Standard with a 256-bit key length). AES-256 is the current industry-standard encryption algorithm for data at rest in financial services and other high-security environments. AES-256 is a symmetric-key encryption algorithm approved by the National Institute of Standards and Technology ("NIST") as part of Federal Information Processing Standard ("FIPS") Publication 197 and is compliant with FIPS 140-2 and FIPS 140-3 standards when implemented through FIPS-validated cryptographic modules.

Skybridge's current encryption posture on the Orion Cloud infrastructure utilizes AES-256 encryption for all data at rest, including data stored in databases, object storage, file systems, and backup media. Marcus Holt has confirmed that this encryption is implemented through FIPS 140-2 validated cryptographic modules provided by the Orion Cloud platform. Accordingly, the AES-256 requirement is consistent with Skybridge's existing technical capabilities and does not require any infrastructure changes.

The Security Exhibit (Exhibit B) should specify AES-256 as the minimum encryption standard for all Meridian data at rest, with an explicit reference to the use of FIPS 140-2/140-3 validated cryptographic modules. The provision should also require that encryption at rest extends to all copies of Meridian data, including primary data stores, replicas, backups, archives, and disaster recovery copies.

B. Data in Transit

All Meridian data transmitted over networks must be encrypted in transit using Transport Layer Security ("TLS") version 1.2 or higher. TLS 1.3, which provides enhanced security features including improved cipher suites and reduced handshake latency, should be specified as the preferred protocol where supported by the communicating systems. The Security Exhibit should explicitly prohibit the use of deprecated or insecure protocols, including SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1, all of which contain known vulnerabilities that have been exploited in documented attacks (e.g., POODLE, BEAST, and CRIME attacks).

The TLS encryption requirement applies to all data flows involving Meridian data, including:

(i) Communications between Meridian end users and the SkyComply™ Platform (i.e., browser-to-application traffic);

(ii) Communications between SkyComply™ application servers and databases within the Orion Cloud infrastructure (i.e., internal platform communications);

(iii) Communications between SkyComply™ and any integrated third-party systems, including Meridian's core banking systems, SWIFT messaging infrastructure, and any other systems from which the Platform receives data or to which it transmits results; and

(iv) Communications between SkyComply™ and any monitoring, logging, or analytics systems operated by Skybridge in connection with the services.

Skybridge's current infrastructure supports TLS 1.2 as the minimum protocol version, with TLS 1.3 enabled on the majority of endpoints. Marcus Holt has confirmed that full TLS 1.3 support across all endpoints is on the engineering roadmap and is expected to be completed by Q1 2026. The Security Exhibit should reflect TLS 1.2 as the contractual minimum with a commitment to transition to TLS 1.3 as the minimum standard within a defined timeframe.

C. Key Management

Effective encryption is dependent not only on the encryption algorithm and key length but also on the security of the cryptographic key management infrastructure. Skybridge will manage encryption keys using hardware security modules ("HSMs"), which are dedicated, tamper-resistant hardware devices designed to securely generate, store, and manage cryptographic keys. The use of HSMs provides a higher level of key security than software-based key management solutions because the keys never leave the secure hardware boundary of the HSM.

Meridian has requested the option for bring-your-own-key ("BYOK") integration, which would allow Meridian to maintain control over the cryptographic keys used to encrypt its data within the SkyComply™ Platform. Under a BYOK model, Meridian would generate and manage the master encryption keys using its own key management infrastructure, and those keys would be imported into the SkyComply™ Platform for use in encrypting and decrypting Meridian data. BYOK provides Meridian with an additional layer of control over its data, because Skybridge would not have independent access to the master encryption keys and therefore could not decrypt Meridian data without Meridian's cooperation.

We recommend the following approach for the Security Exhibit:

(a) Default Configuration. HSM-based key management by Skybridge will be the default configuration. Skybridge will manage all encryption keys in accordance with industry best practices and NIST SP 800-57 (Recommendation for Key Management). Key rotation will be performed at least annually, and keys will be retired and destroyed in accordance with documented procedures.

(b) BYOK Option. BYOK will be available to Meridian as an optional configuration, at Meridian's election. If Meridian elects the BYOK option, any additional integration work required to implement BYOK will be performed at Meridian's expense under a separate statement of work or as otherwise specified in the applicable Order Form.

(c) BYOK Implementation Timeline. The timeline for BYOK implementation, if elected by Meridian, should be addressed in the Order Form or a subsequent statement of work. Marcus Holt has estimated that BYOK integration for a client of Meridian's scale would require approximately 8–12 weeks of engineering work following mutual agreement on technical specifications.

D. Recommendations for the Security Exhibit

Based on the foregoing analysis, we recommend that the Security Exhibit (Exhibit B) include the following encryption-related provisions:

1. AES-256 at Rest. Specification of AES-256 encryption as the minimum standard for all Meridian data at rest, implemented through FIPS 140-2/140-3 validated cryptographic modules, covering all data stores including primary databases, replicas, backups, archives, and disaster recovery copies.

2. TLS 1.2+ in Transit. Specification of TLS 1.2 as the minimum protocol version for all Meridian data in transit, with TLS 1.3 as the preferred protocol. Express prohibition of SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1.

3. HSM-Based Key Management. Specification of HSM-based key management as the default, with BYOK available as an optional configuration at Meridian's election and expense.

4. Technology Evolution Clause. Inclusion of a forward-looking provision requiring Skybridge to update encryption standards if stronger standards become industry-required or if current standards are identified as materially compromised. This provision should specifically contemplate the potential future adoption of post-quantum cryptographic standards (e.g., NIST's recently finalized post-quantum cryptographic algorithms, including CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures) and should require Skybridge to develop and implement a transition plan within a reasonable timeframe following the adoption of such standards as industry requirements.

5. No Downgrade Without Consent. Express provision that Skybridge will not reduce the strength of encryption applied to Meridian data below the contractual minimums specified in the Security Exhibit without Meridian's prior written consent.

VI. Data Residency Restrictions

A. Contractual Requirement

Meridian has required, and Skybridge has agreed in principle, that all Meridian data must be stored and processed exclusively within the continental United States. This requirement reflects Meridian's regulatory obligations, institutional risk management policies, and the sensitive nature of the financial crimes and customer data processed by SkyComply™. The data residency restriction is intended to ensure that Meridian data remains subject to U.S. legal protections and within the jurisdictional reach of U.S. regulators and courts, and to mitigate risks associated with cross-border data transfers, including differing privacy and data protection regimes, potential foreign government access to data, and operational complexity.

Specifically, the data residency requirement limits the storage and processing of Meridian data to two approved Orion Cloud regions: US-East (Virginia) and US-West (Oregon). No Meridian data may be transferred to, accessed from, or stored in any other Orion Cloud region, or in any location outside the continental United States, without Meridian's prior written consent. This restriction applies to all categories of Meridian data, including production data, test data derived from production data, backup data, archived data, and disaster recovery data.

The data residency requirement should be documented in the DPA and in the Security Exhibit, with specific reference to the approved Orion Cloud regions. The provision should include a representation by Skybridge that, as of the effective date of the MSA, all Meridian data is and will continue to be stored and processed exclusively within the approved Orion Cloud regions, and that Skybridge will not change the data residency location without providing Meridian with at least 90 days' prior written notice and obtaining Meridian's written consent.

B. Orion Cloud Infrastructure

Orion Cloud Services, Inc. is the underlying IaaS provider for the SkyComply™ Platform. As such, the data residency commitments made by Skybridge to Meridian must be supported by corresponding commitments from Orion Cloud to Skybridge. The mechanism for ensuring this flow-down is Skybridge's infrastructure services agreement with Orion Cloud, which must include data residency provisions that are at least as restrictive as the data residency provisions in the MSA and DPA.

We have reviewed the relevant provisions of the Skybridge-Orion Cloud infrastructure services agreement (dated October 1, 2023, as amended through Amendment No. 3, dated May 15, 2025) and can confirm that the agreement includes a data residency provision permitting Skybridge to designate the Orion Cloud regions in which its customer data is stored and processed, and requiring Orion Cloud to honor those designations. The agreement does not, however, include a blanket prohibition on data transfers outside the designated regions — transfers may occur in connection with platform maintenance, support operations, and certain automated processes (e.g., content delivery network caching) unless specifically excluded. Marcus Holt has confirmed that Skybridge has configured the Orion Cloud deployment for SkyComply™ to restrict data storage and processing to the US-East and US-West regions, and that content delivery network caching has been disabled for data classified as customer data.

The DPA should include a Subprocessor Flow-Down Terms Addendum that documents the data residency commitments as they flow down from the MSA to Skybridge's agreement with Orion Cloud, including the specific Orion Cloud regions approved for Meridian data. This addendum should also document Orion Cloud's security certifications, SLA commitments (noting that Orion Cloud's platform SLA provides for 99.95% monthly uptime), and the mechanisms through which Skybridge ensures Orion Cloud's compliance with the data residency requirements.

C. Access Restrictions

In addition to restrictions on the physical location of data storage and processing, the data residency framework should address restrictions on remote access to Meridian data by Skybridge personnel located outside the continental United States. Even if all Meridian data is stored and processed within the approved Orion Cloud regions, remote access by Skybridge personnel from international locations could raise regulatory concerns, create jurisdictional complications, and potentially subject Meridian data to foreign government interception or legal process.

We recommend that the DPA include a provision prohibiting access to Meridian data from any location outside the continental United States by any Skybridge employee, contractor, or subprocessor personnel, unless specifically authorized in advance and in writing by Meridian. This restriction should apply regardless of whether the access involves the download or extraction of data, or merely the viewing of data on screen or in dashboards.

Skybridge's current operations are predominantly U.S.-based, with approximately 420 employees and its headquarters in Wilmington, Delaware. Amara Okafor has confirmed that all personnel with access to customer data environments are currently located within the continental United States. However, the access restriction should be contractually codified to account for potential future changes in Skybridge's workforce model, including the possibility of remote work arrangements, offshore development teams, or the engagement of international subcontractors. The contractual provision provides Meridian with assurance that data residency protections will be maintained regardless of changes in Skybridge's operational footprint.

D. Disaster Recovery and Business Continuity

The data residency restrictions must also extend to Skybridge's disaster recovery ("DR") and business continuity ("BC") infrastructure for Meridian data. All DR/BC systems, including backup data stores, secondary processing environments, and failover infrastructure, must reside within the continental United States and within the approved Orion Cloud regions (US-East Virginia and US-West Oregon).

Failover between the US-East and US-West regions is acceptable and, indeed, is the designed DR architecture for SkyComply™. In the event of a regional outage or other disruption affecting one Orion Cloud region, the Platform is designed to fail over to the other approved region automatically, with a target recovery time objective ("RTO") of four hours and a recovery point objective ("RPO") of one hour. Failover to any non-U.S. Orion Cloud region — or to any other non-U.S. infrastructure — is not permitted, even in an emergency, without Meridian's prior written consent.

The DR/BC provisions in the DPA and Security Exhibit should clearly document the approved failover architecture, including the specific Orion Cloud regions, RTO/RPO targets, and the prohibition on failover to non-U.S. locations. The provisions should also require Skybridge to conduct DR testing at least annually and to provide Meridian with a summary of DR test results upon request.

VII. Subprocessor Approval Obligations

A. Framework

The DPA should establish a comprehensive framework governing Skybridge's use of subprocessors — i.e., third-party entities engaged by Skybridge that will have access to or process Meridian data in connection with the services. The subprocessor approval framework serves two principal purposes: (i) it provides Meridian with visibility into and control over the entities that access its data, consistent with the Interagency Guidance on Third-Party Relationships and Meridian's own vendor risk management policies; and (ii) it ensures that all entities in the data processing chain are subject to security and confidentiality obligations at least as protective as those imposed on Skybridge under the MSA and DPA.

The key elements of the subprocessor approval framework are as follows:

Advance Notice. Skybridge must provide Meridian with at least 30 calendar days' advance written notice before engaging any new subprocessor that will have access to or process Meridian data. The notice must include the identity of the proposed subprocessor, a description of the services to be performed, the categories of Meridian data to which the subprocessor will have access, the location(s) from which the subprocessor will access or process the data, and a summary of the subprocessor's security certifications and practices.

Reasonable Objection Right. Meridian shall have the right to object to the engagement of a proposed subprocessor on reasonable grounds related to data security, privacy, regulatory compliance, or other legitimate risk management concerns. If Meridian objects, Skybridge must either (a) refrain from engaging the proposed subprocessor with respect to Meridian data, or (b) implement measures reasonably designed to address Meridian's objections to Meridian's reasonable satisfaction. If Skybridge is unable to resolve Meridian's objections within a specified period (we recommend 30 calendar days from the date of Meridian's objection), Meridian may exercise a termination right with respect to the affected services, subject to a reasonable wind-down period and the data export and deletion obligations described in Section X.

Current Approved Subprocessor. Orion Cloud Services, Inc. is identified in the DPA as the initial and primary approved subprocessor as of the effective date of the MSA. The engagement of Orion Cloud is pre-approved by Meridian, and the specific terms applicable to Orion Cloud's role are documented in the Subprocessor Flow-Down Terms Addendum attached to the DPA.

B. Orion Cloud-Specific Provisions

Given the central role of Orion Cloud in the delivery of the SkyComply™ Platform, the DPA and the Subprocessor Flow-Down Terms Addendum should include detailed provisions addressing Orion Cloud's role, responsibilities, and security posture. Specifically, the following should be documented:

(a) Role Description. A description of Orion Cloud's role as the IaaS provider for the SkyComply™ Platform, including the specific services provided (compute, storage, networking, security services).

(b) Security Certifications. Documentation of Orion Cloud's security certifications, including its SOC 2 Type II report, ISO 27001 certification, and FedRAMP authorization status.

(c) Data Residency. Confirmation of the approved Orion Cloud regions (US-East Virginia and US-West Oregon) and the data residency restrictions applicable to Meridian data within the Orion Cloud environment.

(d) SLA Commitments. Documentation of Orion Cloud's platform SLA commitments, including the 99.95% monthly uptime commitment, and the flow-down of these commitments to the SkyComply™ service level obligations. The SLA flow-down analysis is addressed in detail in the companion SLA Terms Analysis Memo.

(e) Flow-Down Obligations. Confirmation that Skybridge's agreement with Orion Cloud imposes data security, confidentiality, data residency, and incident notification obligations on Orion Cloud that are at least as protective as those imposed on Skybridge under the MSA and DPA.

C. Additional Subprocessor Requirements

Beyond the notice and objection framework described above, the DPA should impose the following requirements on all subprocessors engaged by Skybridge in connection with the Meridian engagement:

1. Security Standards. All subprocessors must maintain security standards that are materially equivalent to those required of Skybridge under the Security Exhibit (Exhibit B). This includes, at minimum, encryption standards (AES-256 at rest, TLS 1.2+ in transit), access controls, incident response capabilities, and employee background check requirements.

2. Data Residency. All subprocessors must comply with the data residency restrictions applicable to Meridian data, including the requirement that all Meridian data be stored and processed exclusively within the continental United States within the approved Orion Cloud regions (or, for non-hosting subprocessors, within the continental United States).

3. Confidentiality. All subprocessors must be bound by confidentiality obligations at least as protective as those imposed on Skybridge under the MSA.

4. Accountability. Skybridge remains fully responsible to Meridian for all acts and omissions of its subprocessors with respect to Meridian data. The DPA should include a clear statement that the engagement of subprocessors does not relieve Skybridge of any of its obligations under the MSA, DPA, or Security Exhibit. This is a critical provision from Meridian's perspective, as it ensures that Meridian's contractual remedies are available against Skybridge regardless of whether a breach of obligations is attributable to Skybridge directly or to one of its subprocessors.

D. Regulatory Dimension

The subprocessor approval framework is directly informed by the regulatory guidance applicable to Meridian's management of third-party relationships. Under OCC Bulletin 2013-29 and the Interagency Guidance on Third-Party Relationships, banks are expected to manage the risks associated with subcontracting by their third-party service providers — a concept sometimes referred to as "fourth-party risk." The guidance recognizes that a bank's risk exposure does not diminish simply because a third-party service provider engages subcontractors to perform all or part of the contracted services. Banks must understand and manage the concentration risk, operational risk, and compliance risk introduced by subcontracting arrangements.

To comply with this guidance, Meridian will require the following contractual protections:

• The right to receive advance notice of and object to new subprocessors, as described above.

• The right to receive and review the list of all subprocessors with access to Meridian data at any time. Skybridge should maintain a register of all subprocessors with access to Meridian data, including the subprocessor's name, location, services performed, and security certifications. This register should be made available to Meridian upon request and should be updated promptly upon any changes.

• The right to terminate the MSA (or affected services) if Skybridge engages a subprocessor over Meridian's reasonable objection.

• Assurance that Skybridge's agreements with its subprocessors include provisions permitting Meridian (or its regulators) to access the subprocessor's records and facilities as necessary for audit or regulatory examination purposes.

VIII. Security Incident Notification Timing

A. The Dispute

The timing of security incident notification is one of the eight key open negotiation issues between Skybridge and Meridian. The parties' positions are as follows:

• Skybridge Position: Skybridge will notify Meridian of any confirmed Security Incident affecting Meridian data within 24 hours of the point at which Skybridge's incident response team confirms that such an incident has occurred and that Meridian data has been or is reasonably likely to have been affected.

• Meridian Demand: Meridian requires notification within 12 hours of discovery of a Security Incident affecting Meridian data.

The gap between the parties' positions reflects differing priorities: Meridian seeks the earliest possible notification to enable its own incident response and regulatory notification processes, while Skybridge seeks to ensure that notifications are sufficiently informed and accurate to be operationally useful, rather than premature and potentially misleading.

B. Market Analysis

To contextualize the parties' respective positions, we have conducted a market analysis based on publicly available data, published industry surveys, and our firm's proprietary transaction database.

Industry Benchmarks. Among enterprise financial services SaaS agreements, notification timelines for confirmed security incidents typically range from 24 to 72 hours. A 24-hour notification requirement is at the aggressive end of current market practice and is typically seen in agreements with large financial institution clients where the service provider processes highly sensitive data. A 12-hour requirement is extremely aggressive and is typically seen only in agreements with the most systemically critical counterparties (e.g., central banks, clearing houses, or government agencies with national security functions). In our review of comparable transactions, we have not identified a 12-hour notification requirement in any enterprise financial services SaaS agreement in Calderwood & Harkness LLP's deal database from the past three years.

Regulatory References. No applicable federal banking regulation mandates a specific notification timeline for vendor-to-bank incident notifications. OCC Bulletin 2013-29 requires banks to have contracts providing for "timely" notification of security incidents by their service providers, but does not define "timely" with a specific hour threshold. The NYDFS Cybersecurity Regulation (23 NYCRR § 500.17) requires covered entities to notify NYDFS within 72 hours of a cybersecurity event that is reportable. The EU General Data Protection Regulation ("GDPR"), Article 33, which is not directly applicable to this transaction but is often cited as an international benchmark, requires notification of a personal data breach to the supervisory authority within 72 hours of the controller becoming aware of the breach. The 24-hour standard proposed by Skybridge is substantially more aggressive than the 72-hour regulatory benchmarks.

Skybridge Client Base. Among Skybridge's existing portfolio of over 60 banking and financial services clients, 24-hour notification from confirmation of a security incident is the standard contractual commitment. Amara Okafor has confirmed that no existing Skybridge client has a 12-hour notification requirement. Accepting a 12-hour requirement for Meridian could create pressure from other clients to match the timeline, which would have significant operational implications for Skybridge's incident response program.

C. Operational Feasibility

The operational feasibility of the requested 12-hour notification timeline has been assessed in consultation with Amara Okafor. The key considerations are as follows:

Incident Response Timeline. Skybridge's incident response program is designed to achieve initial detection and acknowledgment of a potential security event within minutes to hours, depending on the nature of the event (automated alerts vs. manual detection). Following initial detection, the incident response team performs triage and preliminary analysis to determine the nature, scope, and severity of the event. For events that potentially involve customer data, the team then performs a more detailed investigation to identify which customers, if any, have been affected, and to assess the nature and extent of the data involved.

Amara Okafor has confirmed that the incident response team can typically achieve initial acknowledgment and triage within several hours of detection. However, a confirmed assessment of whether Meridian data has been specifically affected — as opposed to a general determination that a security event has occurred somewhere in the environment — may take longer than 12 hours, depending on the nature and scope of the incident. Complex incidents involving sophisticated threat actors, lateral movement across systems, or large-scale data exfiltration may require extensive forensic analysis before Skybridge can confirm with reasonable certainty which customer data sets have been affected.

Risk of Premature Notification. A 12-hour notification requirement could result in premature, incomplete, or inaccurate notifications. In the early hours of an incident investigation, the available information is often limited and rapidly evolving. A notification sent within 12 hours of initial discovery might state only that a security event has be

MEMORANDUM
PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
TO: Amy Chesterton, Lead Associate Angela Fontaine, Responsible Partner Liam Prescott, Of Counsel
FROM: Nathan Ikeda, Associate
DATE: September 12, 2025
RE: Data Security and Privacy Requirements — Skybridge Fintech Ltd. / Meridian National Bank, N.A. Enterprise SaaS Agreement (SkyComply™ Platform)
MATTER NO.: 1009-00007
I. Executive Summary
The purpose of this memorandum is to analyze the data security and privacy requirements applicable to the proposed Master Software-as-a-Service Agreement (the "MSA") between Skybridge Fintech Ltd. ("Skybridge" or "Licensor") and Meridian National Bank, N.A. ("Meridian" or "Licensee") for the deployment of SkyComply™, Skybridge's AI-driven anti-money laundering ("AML") and transaction-monitoring platform (the "Platform"). This memorandum is prepared in connection with our representation of Skybridge in the negotiation and documentation of the MSA and its ancillary agreements, including the Data Processing Addendum ("DPA," designated as Exhibit C to the MSA) and the Security Exhibit (Exhibit B to the MSA).
Parties. Skybridge Fintech Ltd. is a Delaware limited company headquartered at 1400 Concord Pike, Suite 320, Wilmington, DE 19803. Skybridge is the licensor and service provider under the proposed MSA. Meridian National Bank, N.A. is a national banking association chartered under the National Bank Act, with its principal offices located at 600 Lexington Avenue, 40th Floor, New York, NY 10022. Meridian is a top-10 U.S. bank by total assets, with approximately $485 billion in consolidated assets as of its most recent quarterly filing. Meridian is a systemically important financial institution ("SIFI") regulated by the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System (the "Federal Reserve"), and the Federal Deposit Insurance Corporation ("FDIC"). Meridian's parent holding company is Meridian Financial Group, Inc., a publicly traded Delaware corporation listed on the New York Stock Exchange.
Transaction Overview. The proposed transaction is a five-year enterprise SaaS deployment with a total contract value ("TCV") of approximately $50,000,000 (approximately $10,000,000 in annual fees, though the fee structure includes tiered pricing that results in slight variation across the contract years). The Platform will serve approximately 32,000 named users across Meridian's retail banking, commercial banking, and wealth management divisions. The deployment contemplates Meridian's use of the SkyComply™ Platform for automated AML screening, real-time transaction monitoring, suspicious activity report generation and management, customer due diligence and enhanced due diligence processes, beneficial ownership tracking, and related Bank Secrecy Act ("BSA") compliance functions.
Data Security and Privacy Significance. Because the SkyComply™ Platform processes financial transaction data, customer information (including personally identifiable information and non-public personal information), and suspicious activity reporting data, the engagement implicates stringent federal and state data security and privacy requirements, as well as contractual security obligations commensurate with Meridian's regulatory posture as a SIFI. The sensitivity of the data processed by SkyComply™ is further heightened by the fact that the Platform handles suspicious activity reports and related financial crimes data, which are subject to strict confidentiality requirements under the BSA and its implementing regulations.
Scope of This Memorandum. This memo addresses the following core areas:
1. GLBA and NPI requirements;
2. State data breach notification laws;
3. Encryption standards;
4. Data residency restrictions;
5. Subprocessor approval obligations;
6. Security incident notification timing;
7. Audit rights framework;
8. Data retention and deletion requirements; and
9. Background check requirements.
In addition, the memorandum identifies and analyzes the key negotiation points between Skybridge and Meridian with respect to data security and privacy provisions. Meridian is represented in this transaction by Hargrove, Tully & Cascade Insurance Brokers, led by partner Douglas Krenshaw, with senior associate Megan Faircloth and associate Ryan Tso. We have received and reviewed two rounds of marked drafts of the DPA and Security Exhibit from opposing counsel, and the analysis herein reflects the current state of negotiations as of the date of this memorandum.
In the course of preparing this memorandum, Skybridge's Chief Information Security Officer, Amara Okafor, and Chief Technology Officer, Marcus Holt, have been consulted on technical and operational capabilities, including Skybridge's incident response protocols, encryption infrastructure, subprocessor management practices, and audit facilitation processes. Their input is reflected in the operational feasibility assessments throughout this memorandum.
This memorandum should be read in conjunction with the companion memoranda on SLA terms, indemnification and liability caps, regulatory compliance, and insurance coverage, which address related but distinct issues arising from the proposed MSA.
II. Background and Data Classification
A. Nature of Data Processed
Under the proposed MSA, the SkyComply™ Platform will process substantial volumes of Meridian's customer data in connection with AML screening, transaction monitoring, and BSA compliance operations. The nature and sensitivity of this data is central to the data security and privacy analysis set forth in the remainder of this memorandum.
Based on the technical architecture documentation provided by Marcus Holt and the data flow diagrams reviewed during the due diligence process, the categories of data that SkyComply™ will process include, without limitation, the following:
• Customer Identifying Information: Customer names, addresses, dates of birth, Social Security numbers, tax identification numbers, government-issued identification numbers, and telephone numbers and email addresses associated with customer accounts.
• Account Information: Account numbers, account types, account opening and closing dates, account balances, and account ownership structures (including joint accounts and fiduciary accounts).
• Transaction Records: Detailed records of financial transactions processed through Meridian's banking systems, including wire transfers, ACH transactions, check clearing data, debit and credit card transactions, cash deposits and withdrawals, and international remittances.
• Suspicious Activity Reports (SARs): Draft and filed SARs, supporting documentation and narrative fields, and related investigative case files maintained within the Platform.
• Beneficial Ownership Data: Information regarding the beneficial owners of legal entity customers, as required under the Customer Due Diligence Rule (31 C.F.R. § 1010.230), including ownership percentages, control relationships, and identification documentation.
• Know Your Customer (KYC) Documentation: Customer due diligence and enhanced due diligence documentation, including copies of identification documents, risk rating assessments, and ongoing monitoring records.
• Financial Crimes Data: Watchlist screening results, sanctions screening data, politically exposed person ("PEP") screening data, adverse media screening results, and related risk scoring outputs generated by the Platform's AI-driven analytics engine.
Meridian has classified the data to be handled by Skybridge under two tiers of Meridian's internal data classification policy (as documented in Meridian's Information Security Policy, Version 7.2, dated February 2025, a copy of which was provided to us under the mutual NDA). The relevant tiers are "Confidential" (Tier 2), which covers general customer information, account data, and transaction records, and "Highly Restricted" (Tier 1), which covers SARs, SAR-related data, beneficial ownership data, and Social Security numbers. Meridian's data classification policy imposes progressively more stringent handling, access control, encryption, and disposal requirements for each tier, with Highly Restricted data subject to the most rigorous protections.
Importantly, the data processed by SkyComply™ includes Non-Public Personal Information ("NPI") as defined under the Gramm-Leach-Bliley Act ("GLBA"), 15 U.S.C. §§ 6801–6809, and personally identifiable information ("PII") under various state privacy and data breach notification laws. As discussed in greater detail in Sections III and IV below, the NPI and PII classification of this data triggers specific federal and state regulatory requirements that must be reflected in the MSA, DPA, and Security Exhibit.
B. Regulatory Posture of Meridian
Meridian's regulatory posture as a national banking association and a SIFI is a critical factor in the data security and privacy requirements applicable to the proposed MSA. The following regulatory frameworks are directly relevant:
GLBA and Interagency Guidelines. As a national banking association, Meridian is subject to the GLBA Safeguards Rule (16 C.F.R. Part 314), as implemented through the Interagency Guidelines Establishing Information Security Standards (12 C.F.R. Part 30, Appendix B, for national banks). These guidelines require Meridian to develop, implement, and maintain a comprehensive information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the institution, the nature and scope of its activities, and the sensitivity of the customer information at issue. Critically, the Interagency Guidelines require financial institutions to exercise appropriate due diligence and oversight of their third-party service providers, including by requiring contractual provisions that obligate such service providers to implement appropriate security measures.
OCC Guidance on Third-Party Relationships. Meridian is subject to OCC Bulletin 2013-29 ("Third-Party Relationships: Risk Management Guidance") and the updated Interagency Guidance on Third-Party Relationships: Risk Management, issued jointly by the OCC, Federal Reserve, and FDIC in June 2023 (the "Interagency Guidance"). This guidance establishes a comprehensive framework for banks' management of third-party relationships, including requirements for due diligence, contract negotiation, ongoing monitoring, and termination planning. The guidance specifically addresses the risks associated with third-party access to customer information and requires banks to include robust data security, confidentiality, incident notification, audit, and subcontracting provisions in their agreements with third-party service providers. Because SkyComply™ processes highly sensitive financial crimes and customer data, Meridian's relationship with Skybridge will be classified as a "critical activity" under the Interagency Guidance, triggering the most rigorous risk management requirements.
Bank Service Company Act. Under the Bank Service Company Act, 12 U.S.C. § 1867(c), the services performed by Skybridge for Meridian are subject to examination by federal banking regulators, including the OCC, Federal Reserve, and FDIC, to the same extent as if Skybridge's services were being performed by Meridian itself. This statutory examination authority is non-waivable and must be acknowledged in the MSA. The practical significance of this provision is that federal banking regulators may examine Skybridge's operations, security controls, and records at any time in connection with their supervision of Meridian, and the MSA must not contain any provision that would impede or restrict such examination.
Key Meridian Personnel. Sandra Petrov, Meridian's Head of Financial Crimes & Compliance, is the key compliance stakeholder on the bank side and has been actively involved in defining the security and compliance requirements for the SkyComply™ deployment. Catherine Woo, Associate General Counsel (Technology), is the internal legal lead on the bank side and has been coordinating with Douglas Krenshaw and his team at Hargrove, Tully & Cascade Insurance Brokers on contract negotiation. Both Sandra Petrov and Catherine Woo have participated in the due diligence sessions and have provided detailed written comments on the DPA and Security Exhibit.
C. Skybridge's Current Security Posture
An understanding of Skybridge's current security posture is essential context for evaluating the appropriateness and feasibility of the contractual security commitments under negotiation. Based on our review of Skybridge's security documentation and our consultations with Amara Okafor and Marcus Holt, the following summarizes Skybridge's current posture:
SOC 2 Type II Certification. Skybridge holds a current SOC 2 Type II audit report dated March 15, 2025, performed by Crestfield Cyber Advisors, Inc. ("Crestfield"), an independent Delaware corporation specializing in cybersecurity audit and assurance services. The lead auditor was Deepa Rajan; the CEO of Crestfield is Winston Lam. Crestfield maintains its principal office at 222 West Adams Street, Suite 1200, Chicago, IL 60606. The SOC 2 Type II report covers the Trust Services Criteria of security, availability, processing integrity, confidentiality, and privacy. The audit period covered in the most recent report is January 1, 2024, through December 31, 2024. Crestfield identified no material exceptions or qualified findings in the report.
ISO 27001 Certification. Skybridge holds ISO 27001 certification, with the most recent recertification dated January 22, 2025, also performed by Crestfield. Annual surveillance audits are conducted to maintain the certification. The scope of certification covers Skybridge's information security management system as it pertains to the design, development, hosting, and support of the SkyComply™ Platform and related services.
Company Profile. Skybridge has approximately 420 employees. In fiscal year 2024, Skybridge reported revenue of approximately $78.3 million. Skybridge serves over 60 banking and financial services clients, ranging from regional community banks to large national and multinational financial institutions. This client base provides relevant context for evaluating market-standard contractual terms: Skybridge must balance the security requirements of individual clients against the need to maintain a consistent and operationally feasible security program across its entire client portfolio.
Cloud Infrastructure. Skybridge hosts the SkyComply™ Platform on infrastructure provided by Orion Cloud Services, Inc. ("Orion Cloud"), a Delaware corporation headquartered at 4500 Great America Parkway, Santa Clara, CA 95054. Orion Cloud is a leading infrastructure-as-a-service ("IaaS") provider. The Platform is deployed across Orion Cloud's US-East (Virginia) and US-West (Oregon) regions. Orion Cloud maintains its own SOC 2 Type II certification, ISO 27001 certification, and FedRAMP authorization. The relationship between Skybridge and Orion Cloud is governed by an infrastructure services agreement that includes data security, confidentiality, and data residency provisions, which are addressed in greater detail in Sections VI and VII of this memorandum.
Cyber Liability Insurance. Skybridge maintains cyber liability insurance coverage through Coastal Assurance Corporation, under Policy No. CA-TECH-2025-07831. The policy provides coverage of $25 million per occurrence and $50 million in the aggregate, with a policy period of April 1, 2025, through March 31, 2026. The adequacy of this coverage relative to Meridian's contractual insurance requirements is addressed in the companion Insurance Coverage Gap Analysis Memo.
III. GLBA and Non-Public Personal Information Requirements
A. Statutory Framework
The Gramm-Leach-Bliley Act, Title V, Subtitle A (15 U.S.C. §§ 6801–6809) establishes the fundamental federal framework for the protection of consumer financial information. Section 6801(b) directs federal banking agencies and other relevant regulators to establish appropriate standards for financial institutions to protect the security and confidentiality of customers' nonpublic personal information, to protect against anticipated threats to the security or integrity of such information, and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.
The term "Non-Public Personal Information" or "NPI" is defined under Regulation P (12 C.F.R. Part 1016), promulgated by the Consumer Financial Protection Bureau, to include any personally identifiable financial information (i) provided by a consumer to a financial institution, (ii) resulting from any transaction with the consumer or any service performed for the consumer, or (iii) otherwise obtained by the financial institution. NPI includes, for example, account numbers, income information, Social Security numbers provided in connection with a financial transaction, account balances, transaction history, and any list, description, or other grouping of consumers derived using any NPI that is not publicly available. The definition is intentionally broad and encompasses virtually all of the customer data categories that SkyComply™ will process on behalf of Meridian.
The Safeguards Rule, as applicable to national banks through the Interagency Guidelines Establishing Information Security Standards (12 C.F.R. Part 30, Appendix B), requires each financial institution to develop, implement, and maintain a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to the size, complexity, and nature of the institution's operations. The key elements of a compliant information security program under the Interagency Guidelines include: (i) designation of one or more employees to coordinate the program; (ii) identification and assessment of risks to customer information; (iii) design and implementation of safeguards to control identified risks, including access controls, encryption, and environmental controls; (iv) regular testing and monitoring of safeguards; (v) oversight of service providers, including due diligence and contractual requirements; and (vi) adjustment of the program to reflect changes in technology, the sensitivity of customer information, and internal or external threats.
The Interagency Guidelines specifically require financial institutions to exercise appropriate due diligence in selecting their service providers and to require their service providers by contract to implement appropriate measures designed to meet the objectives of the Interagency Guidelines. This requirement is the direct statutory and regulatory basis for the contractual security obligations that must be included in the MSA and DPA.
B. Implications for the MSA
Skybridge, as a service provider receiving NPI from Meridian, must contractually commit to maintaining an information security program that meets or exceeds the standards established under the Interagency Guidelines. This commitment is not merely a "nice-to-have" contractual protection — it is a regulatory requirement imposed on Meridian and, by extension, on Meridian's third-party service providers. Failure to include adequate contractual security provisions could expose Meridian to regulatory criticism or enforcement action, and could undermine Skybridge's ability to serve other regulated financial institution clients.
The MSA and the Data Processing Addendum (Exhibit C) must include the following provisions, at minimum:
(a) Safeguards Obligation. Skybridge's obligation to implement and maintain administrative, technical, and physical safeguards appropriate to the nature and scope of its activities with respect to Meridian data, including NPI, and consistent with the Interagency Guidelines Establishing Information Security Standards.
(b) Incident Reporting. Skybridge's obligation to promptly report to Meridian any security incident involving NPI, including unauthorized access, acquisition, use, or disclosure of Meridian data. The specific timing and procedural requirements for incident notification are addressed in detail in Section VIII of this memorandum.
(c) Audit Rights. Meridian's right to audit Skybridge's information security program, either directly or through the delivery of independent audit reports and certifications. The audit rights framework is addressed in detail in Section IX of this memorandum.
(d) Confidentiality. Skybridge's obligation to maintain the confidentiality of Meridian data, including NPI, and to limit the use of such data to the purposes specified in the MSA.
(e) Access Controls. Skybridge's obligation to implement role-based access controls, multi-factor authentication, and least-privilege principles to limit access to Meridian data to authorized personnel with a demonstrated need to access such data in connection with the performance of services.
(f) Employee Training. Skybridge's obligation to provide regular training to its personnel on information security, data handling, and privacy practices relevant to the services performed for Meridian.
We recommend the following contractual language for inclusion in the representations and warranties section of the MSA:
"Skybridge represents and warrants that it maintains an information security program designed to protect the security, confidentiality, and integrity of Customer Data, including Non-Public Personal Information, consistent with the Interagency Guidelines Establishing Information Security Standards (12 C.F.R. Part 30, Appendix B) and industry standards for financial services SaaS providers. Skybridge further represents and warrants that it is in material compliance with the requirements of the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809) and its implementing regulations as applicable to Skybridge's role as a service provider to financial institutions."
Additionally, the representations and warranties should include that Skybridge is in material compliance with BSA/AML regulations applicable to its operations as a technology service provider, and that the Platform, as delivered, will not contain any malicious code, backdoor, virus, worm, Trojan horse, or other harmful component designed to disrupt, disable, or otherwise impair the functioning of the Platform or to permit unauthorized access to Meridian data.
C. BSA/AML-Specific Considerations
The BSA/AML-specific nature of the SkyComply™ Platform introduces a layer of regulatory risk that is distinct from the data security and privacy risks that would attach to a general-purpose SaaS platform. Because SkyComply™ is itself a BSA/AML compliance tool — used by Meridian to fulfill its regulatory obligations under the BSA, the USA PATRIOT Act, and related regulations — any regulatory finding against the Platform, such as a determination that the Platform's screening algorithms fail to adequately identify suspicious transactions or that the Platform's SAR-generation capabilities are deficient, could have direct and material regulatory consequences for Meridian. In a worst-case scenario, a regulatory deficiency in the Platform could contribute to a BSA/AML consent order or civil money penalty against Meridian.
Accordingly, the MSA should include the following provisions specific to BSA/AML compliance:
(a) Platform Compliance. Skybridge's obligation to maintain the SkyComply™ Platform in compliance with applicable BSA/AML regulations, including the requirements of 31 U.S.C. §§ 5311–5332 and the implementing regulations promulgated by the Financial Crimes Enforcement Network ("FinCEN"), as they apply to the functionality and capabilities of the Platform.
(b) Regulatory Action Notification. Skybridge's obligation to promptly notify Meridian of any material regulatory action, investigation, finding, or enforcement proceeding affecting the SkyComply™ Platform or Skybridge's ability to provide the services contemplated by the MSA. This notification obligation should extend to formal and informal supervisory actions, consent orders, civil money penalties, and any communication from a regulatory agency indicating that the Platform may be deficient in any material respect.
(c) Termination Right. Meridian has requested a termination right triggered by any material regulatory finding against the Platform. This request is being addressed in the context of the broader termination provisions under negotiation. From a data security and privacy perspective, we note that such a termination right intersects with the post-termination data retention, export, and deletion obligations discussed in Section X of this memorandum, and the termination provisions should be drafted to ensure that Meridian's data rights are fully preserved in the event of an early termination triggered by a regulatory finding.
We recommend that the BSA/AML compliance representations be carefully drafted to apply only to the Platform's functionality and capabilities as described in the documentation and specifications, and not as a guarantee that the Platform will detect all instances of money laundering or other financial crimes — a standard that no AML technology platform can meet and that would expose Skybridge to unacceptable liability. The distinction between the Platform's compliance with applicable regulatory requirements and the outcomes achieved through the use of the Platform should be clearly articulated in the MSA.
IV. State Data Breach Notification Laws
A. Applicability
All 50 states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have enacted data breach notification laws that require entities to notify affected individuals (and, in many cases, state regulators and consumer reporting agencies) when a breach of security results in the unauthorized access to or acquisition of personal information. Given that Meridian operates retail banking, commercial banking, and wealth management divisions across the United States, a security incident involving Meridian customer data processed by Skybridge could trigger notification obligations in multiple jurisdictions simultaneously. The operational complexity and cost of a multi-jurisdictional breach notification — including the analysis of differing definitions of "personal information," differing notification triggers, differing notification timelines, and differing content requirements — underscore the importance of robust contractual provisions governing Skybridge's breach notification obligations and cooperation requirements.
A detailed 50-state survey of breach notification law requirements is attached hereto as Attachment A. The discussion below highlights the jurisdictions with the most stringent or otherwise noteworthy requirements.
B. New York Considerations
New York is of particular significance because it is the location of Meridian's principal office and because of the heightened cybersecurity regulatory environment in the state.
NY SHIELD Act. The Stop Hacks and Improve Electronic Data Security Act (the "SHIELD Act"), codified at N.Y. General Business Law § 899-aa, expanded New York's data breach notification requirements in several important respects. The SHIELD Act broadened the definition of "private information" to include, in addition to the traditional categories (e.g., Social Security numbers, driver's license numbers, and financial account numbers in combination with security codes or passwords), biometric information, email addresses in combination with passwords or security questions and answers, and account numbers or credit or debit card numbers that can be used independently to access a financial account (i.e., without requiring an additional security code). The SHIELD Act also imposes an affirmative obligation on any person or business that owns or licenses computerized data that includes private information of a resident of New York to implement and maintain "reasonable safeguards" to protect the security, confidentiality, and integrity of the private information.
23 NYCRR Part 500 (NYDFS Cybersecurity Regulation). The New York Department of Financial Services ("NYDFS") Cybersecurity Regulation, 23 NYCRR Part 500, imposes comprehensive cybersecurity requirements on covered entities, including banks, insurance companies, and other financial services institutions licensed, registered, or otherwise regulated by NYDFS. As a national bank, Meridian's primary regulator is the OCC, and OCC preemption principles may limit the direct applicability of 23 NYCRR Part 500 to Meridian. However, in practice, Meridian's vendor management standards and contractual requirements are likely to incorporate NYDFS-equivalent requirements regardless of the preemption analysis, for several reasons: (i) Meridian may have affiliates regulated by NYDFS; (ii) Meridian's risk management framework may adopt 23 NYCRR Part 500 as an internal benchmark; and (iii) Meridian's regulators at the OCC may view compliance with 23 NYCRR Part 500 as indicative of sound security practices. The NYDFS Cybersecurity Regulation includes requirements for third-party service provider security policies (Section 500.11), which require covered entities to implement policies and procedures designed to ensure the security of information systems and nonpublic information accessible to, or held by, third-party service providers, including minimum cybersecurity practices to be met by third-party service providers, due diligence processes, and periodic assessment of third-party service providers.
C. Contractual Implications
The state data breach notification landscape has the following implications for the DPA and related contractual provisions:
Cooperation Requirements. The DPA should require Skybridge to cooperate fully with Meridian in connection with any breach notification obligations triggered by a security incident involving Meridian data. This cooperation should include, at minimum: (i) providing Meridian with all information in Skybridge's possession that is necessary for Meridian to assess its notification obligations under applicable state laws; (ii) assisting Meridian in determining the scope of affected data, the identities of affected individuals, and the jurisdictions in which notification may be required; (iii) coordinating with Meridian on the timing and content of notifications; and (iv) cooperating with Meridian's communications with state regulators, law enforcement, and consumer reporting agencies.
Cost Allocation. The DPA should address the allocation of costs associated with breach notification. Where a breach results from Skybridge's failure to comply with its contractual security obligations under the MSA, DPA, or Security Exhibit, Skybridge should bear the reasonable costs of breach notification, including the costs of preparing and distributing notification letters, establishing and operating call centers, providing credit monitoring and identity theft protection services to affected individuals, and any fines or penalties imposed by state regulators. This cost allocation provision is closely connected to the data breach indemnification provisions currently under negotiation between the parties. As noted in the Executive Summary, Skybridge's current position is to cap data breach indemnification at 2× annual fees (approximately $18,650,000), while Meridian demands uncapped indemnification for data breaches. This indemnification issue is addressed in detail in the companion Indemnification and Liability Cap Analysis Memo and is not resolved in this memorandum.
Incident Response Plan. We recommend including a requirement in the DPA or Security Exhibit that Skybridge maintain a written incident response plan consistent with the NIST Cybersecurity Framework (NIST CSF) standards. The incident response plan should address: (i) preparation and planning; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident activity, including lessons learned and remediation. The plan should be tested at least annually through tabletop exercises or simulated incident response drills. Amara Okafor has confirmed that Skybridge maintains an incident response plan that is consistent with the NIST CSF and that tabletop exercises are conducted semi-annually.
V. Encryption Standards
A. Data at Rest
All Meridian data stored within the SkyComply™ Platform must be encrypted at rest using AES-256 (Advanced Encryption Standard with a 256-bit key length). AES-256 is the current industry-standard encryption algorithm for data at rest in financial services and other high-security environments. AES-256 is a symmetric-key encryption algorithm approved by the National Institute of Standards and Technology ("NIST") as part of Federal Information Processing Standard ("FIPS") Publication 197 and is compliant with FIPS 140-2 and FIPS 140-3 standards when implemented through FIPS-validated cryptographic modules.
Skybridge's current encryption posture on the Orion Cloud infrastructure utilizes AES-256 encryption for all data at rest, including data stored in databases, object storage, file systems, and backup media. Marcus Holt has confirmed that this encryption is implemented through FIPS 140-2 validated cryptographic modules provided by the Orion Cloud platform. Accordingly, the AES-256 requirement is consistent with Skybridge's existing technical capabilities and does not require any infrastructure changes.
The Security Exhibit (Exhibit B) should specify AES-256 as the minimum encryption standard for all Meridian data at rest, with an explicit reference to the use of FIPS 140-2/140-3 validated cryptographic modules. The provision should also require that encryption at rest extends to all copies of Meridian data, including primary data stores, replicas, backups, archives, and disaster recovery copies.
B. Data in Transit
All Meridian data transmitted over networks must be encrypted in transit using Transport Layer Security ("TLS") version 1.2 or higher. TLS 1.3, which provides enhanced security features including improved cipher suites and reduced handshake latency, should be specified as the preferred protocol where supported by the communicating systems. The Security Exhibit should explicitly prohibit the use of deprecated or insecure protocols, including SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1, all of which contain known vulnerabilities that have been exploited in documented attacks (e.g., POODLE, BEAST, and CRIME attacks).
The TLS encryption requirement applies to all data flows involving Meridian data, including:
(i) Communications between Meridian end users and the SkyComply™ Platform (i.e., browser-to-application traffic);
(ii) Communications between SkyComply™ application servers and databases within the Orion Cloud infrastructure (i.e., internal platform communications);
(iii) Communications between SkyComply™ and any integrated third-party systems, including Meridian's core banking systems, SWIFT messaging infrastructure, and any other systems from which the Platform receives data or to which it transmits results; and
(iv) Communications between SkyComply™ and any monitoring, logging, or analytics systems operated by Skybridge in connection with the services.
Skybridge's current infrastructure supports TLS 1.2 as the minimum protocol version, with TLS 1.3 enabled on the majority of endpoints. Marcus Holt has confirmed that full TLS 1.3 support across all endpoints is on the engineering roadmap and is expected to be completed by Q1 2026. The Security Exhibit should reflect TLS 1.2 as the contractual minimum with a commitment to transition to TLS 1.3 as the minimum standard within a defined timeframe.
C. Key Management
Effective encryption is dependent not only on the encryption algorithm and key length but also on the security of the cryptographic key management infrastructure. Skybridge will manage encryption keys using hardware security modules ("HSMs"), which are dedicated, tamper-resistant hardware devices designed to securely generate, store, and manage cryptographic keys. The use of HSMs provides a higher level of key security than software-based key management solutions because the keys never leave the secure hardware boundary of the HSM.
Meridian has requested the option for bring-your-own-key ("BYOK") integration, which would allow Meridian to maintain control over the cryptographic keys used to encrypt its data within the SkyComply™ Platform. Under a BYOK model, Meridian would generate and manage the master encryption keys using its own key management infrastructure, and those keys would be imported into the SkyComply™ Platform for use in encrypting and decrypting Meridian data. BYOK provides Meridian with an additional layer of control over its data, because Skybridge would not have independent access to the master encryption keys and therefore could not decrypt Meridian data without Meridian's cooperation.
We recommend the following approach for the Security Exhibit:
(a) Default Configuration. HSM-based key management by Skybridge will be the default configuration. Skybridge will manage all encryption keys in accordance with industry best practices and NIST SP 800-57 (Recommendation for Key Management). Key rotation will be performed at least annually, and keys will be retired and destroyed in accordance with documented procedures.
(b) BYOK Option. BYOK will be available to Meridian as an optional configuration, at Meridian's election. If Meridian elects the BYOK option, any additional integration work required to implement BYOK will be performed at Meridian's expense under a separate statement of work or as otherwise specified in the applicable Order Form.
(c) BYOK Implementation Timeline. The timeline for BYOK implementation, if elected by Meridian, should be addressed in the Order Form or a subsequent statement of work. Marcus Holt has estimated that BYOK integration for a client of Meridian's scale would require approximately 8–12 weeks of engineering work following mutual agreement on technical specifications.
D. Recommendations for the Security Exhibit
Based on the foregoing analysis, we recommend that the Security Exhibit (Exhibit B) include the following encryption-related provisions:
1. AES-256 at Rest. Specification of AES-256 encryption as the minimum standard for all Meridian data at rest, implemented through FIPS 140-2/140-3 validated cryptographic modules, covering all data stores including primary databases, replicas, backups, archives, and disaster recovery copies.
2. TLS 1.2+ in Transit. Specification of TLS 1.2 as the minimum protocol version for all Meridian data in transit, with TLS 1.3 as the preferred protocol. Express prohibition of SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1.
3. HSM-Based Key Management. Specification of HSM-based key management as the default, with BYOK available as an optional configuration at Meridian's election and expense.
4. Technology Evolution Clause. Inclusion of a forward-looking provision requiring Skybridge to update encryption standards if stronger standards become industry-required or if current standards are identified as materially compromised. This provision should specifically contemplate the potential future adoption of post-quantum cryptographic standards (e.g., NIST's recently finalized post-quantum cryptographic algorithms, including CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures) and should require Skybridge to develop and implement a transition plan within a reasonable timeframe following the adoption of such standards as industry requirements.
5. No Downgrade Without Consent. Express provision that Skybridge will not reduce the strength of encryption applied to Meridian data below the contractual minimums specified in the Security Exhibit without Meridian's prior written consent.
VI. Data Residency Restrictions
A. Contractual Requirement
Meridian has required, and Skybridge has agreed in principle, that all Meridian data must be stored and processed exclusively within the continental United States. This requirement reflects Meridian's regulatory obligations, institutional risk management policies, and the sensitive nature of the financial crimes and customer data processed by SkyComply™. The data residency restriction is intended to ensure that Meridian data remains subject to U.S. legal protections and within the jurisdictional reach of U.S. regulators and courts, and to mitigate risks associated with cross-border data transfers, including differing privacy and data protection regimes, potential foreign government access to data, and operational complexity.
Specifically, the data residency requirement limits the storage and processing of Meridian data to two approved Orion Cloud regions: US-East (Virginia) and US-West (Oregon). No Meridian data may be transferred to, accessed from, or stored in any other Orion Cloud region, or in any location outside the continental United States, without Meridian's prior written consent. This restriction applies to all categories of Meridian data, including production data, test data derived from production data, backup data, archived data, and disaster recovery data.
The data residency requirement should be documented in the DPA and in the Security Exhibit, with specific reference to the approved Orion Cloud regions. The provision should include a representation by Skybridge that, as of the effective date of the MSA, all Meridian data is and will continue to be stored and processed exclusively within the approved Orion Cloud regions, and that Skybridge will not change the data residency location without providing Meridian with at least 90 days' prior written notice and obtaining Meridian's written consent.
B. Orion Cloud Infrastructure
Orion Cloud Services, Inc. is the underlying IaaS provider for the SkyComply™ Platform. As such, the data residency commitments made by Skybridge to Meridian must be supported by corresponding commitments from Orion Cloud to Skybridge. The mechanism for ensuring this flow-down is Skybridge's infrastructure services agreement with Orion Cloud, which must include data residency provisions that are at least as restrictive as the data residency provisions in the MSA and DPA.
We have reviewed the relevant provisions of the Skybridge-Orion Cloud infrastructure services agreement (dated October 1, 2023, as amended through Amendment No. 3, dated May 15, 2025) and can confirm that the agreement includes a data residency provision permitting Skybridge to designate the Orion Cloud regions in which its customer data is stored and processed, and requiring Orion Cloud to honor those designations. The agreement does not, however, include a blanket prohibition on data transfers outside the designated regions — transfers may occur in connection with platform maintenance, support operations, and certain automated processes (e.g., content delivery network caching) unless specifically excluded. Marcus Holt has confirmed that Skybridge has configured the Orion Cloud deployment for SkyComply™ to restrict data storage and processing to the US-East and US-West regions, and that content delivery network caching has been disabled for data classified as customer data.
The DPA should include a Subprocessor Flow-Down Terms Addendum that documents the data residency commitments as they flow down from the MSA to Skybridge's agreement with Orion Cloud, including the specific Orion Cloud regions approved for Meridian data. This addendum should also document Orion Cloud's security certifications, SLA commitments (noting that Orion Cloud's platform SLA provides for 99.95% monthly uptime), and the mechanisms through which Skybridge ensures Orion Cloud's compliance with the data residency requirements.
C. Access Restrictions
In addition to restrictions on the physical location of data storage and processing, the data residency framework should address restrictions on remote access to Meridian data by Skybridge personnel located outside the continental United States. Even if all Meridian data is stored and processed within the approved Orion Cloud regions, remote access by Skybridge personnel from international locations could raise regulatory concerns, create jurisdictional complications, and potentially subject Meridian data to foreign government interception or legal process.
We recommend that the DPA include a provision prohibiting access to Meridian data from any location outside the continental United States by any Skybridge employee, contractor, or subprocessor personnel, unless specifically authorized in advance and in writing by Meridian. This restriction should apply regardless of whether the access involves the download or extraction of data, or merely the viewing of data on screen or in dashboards.
Skybridge's current operations are predominantly U.S.-based, with approximately 420 employees and its headquarters in Wilmington, Delaware. Amara Okafor has confirmed that all personnel with access to customer data environments are currently located within the continental United States. However, the access restriction should be contractually codified to account for potential future changes in Skybridge's workforce model, including the possibility of remote work arrangements, offshore development teams, or the engagement of international subcontractors. The contractual provision provides Meridian with assurance that data residency protections will be maintained regardless of changes in Skybridge's operational footprint.
D. Disaster Recovery and Business Continuity
The data residency restrictions must also extend to Skybridge's disaster recovery ("DR") and business continuity ("BC") infrastructure for Meridian data. All DR/BC systems, including backup data stores, secondary processing environments, and failover infrastructure, must reside within the continental United States and within the approved Orion Cloud regions (US-East Virginia and US-West Oregon).
Failover between the US-East and US-West regions is acceptable and, indeed, is the designed DR architecture for SkyComply™. In the event of a regional outage or other disruption affecting one Orion Cloud region, the Platform is designed to fail over to the other approved region automatically, with a target recovery time objective ("RTO") of four hours and a recovery point objective ("RPO") of one hour. Failover to any non-U.S. Orion Cloud region — or to any other non-U.S. infrastructure — is not permitted, even in an emergency, without Meridian's prior written consent.
The DR/BC provisions in the DPA and Security Exhibit should clearly document the approved failover architecture, including the specific Orion Cloud regions, RTO/RPO targets, and the prohibition on failover to non-U.S. locations. The provisions should also require Skybridge to conduct DR testing at least annually and to provide Meridian with a summary of DR test results upon request.
VII. Subprocessor Approval Obligations
A. Framework
The DPA should establish a comprehensive framework governing Skybridge's use of subprocessors — i.e., third-party entities engaged by Skybridge that will have access to or process Meridian data in connection with the services. The subprocessor approval framework serves two principal purposes: (i) it provides Meridian with visibility into and control over the entities that access its data, consistent with the Interagency Guidance on Third-Party Relationships and Meridian's own vendor risk management policies; and (ii) it ensures that all entities in the data processing chain are subject to security and confidentiality obligations at least as protective as those imposed on Skybridge under the MSA and DPA.
The key elements of the subprocessor approval framework are as follows:
Advance Notice. Skybridge must provide Meridian with at least 30 calendar days' advance written notice before engaging any new subprocessor that will have access to or process Meridian data. The notice must include the identity of the proposed subprocessor, a description of the services to be performed, the categories of Meridian data to which the subprocessor will have access, the location(s) from which the subprocessor will access or process the data, and a summary of the subprocessor's security certifications and practices.
Reasonable Objection Right. Meridian shall have the right to object to the engagement of a proposed subprocessor on reasonable grounds related to data security, privacy, regulatory compliance, or other legitimate risk management concerns. If Meridian objects, Skybridge must either (a) refrain from engaging the proposed subprocessor with respect to Meridian data, or (b) implement measures reasonably designed to address Meridian's objections to Meridian's reasonable satisfaction. If Skybridge is unable to resolve Meridian's objections within a specified period (we recommend 30 calendar days from the date of Meridian's objection), Meridian may exercise a termination right with respect to the affected services, subject to a reasonable wind-down period and the data export and deletion obligations described in Section X.
Current Approved Subprocessor. Orion Cloud Services, Inc. is identified in the DPA as the initial and primary approved subprocessor as of the effective date of the MSA. The engagement of Orion Cloud is pre-approved by Meridian, and the specific terms applicable to Orion Cloud's role are documented in the Subprocessor Flow-Down Terms Addendum attached to the DPA.
B. Orion Cloud-Specific Provisions
Given the central role of Orion Cloud in the delivery of the SkyComply™ Platform, the DPA and the Subprocessor Flow-Down Terms Addendum should include detailed provisions addressing Orion Cloud's role, responsibilities, and security posture. Specifically, the following should be documented:
(a) Role Description. A description of Orion Cloud's role as the IaaS provider for the SkyComply™ Platform, including the specific services provided (compute, storage, networking, security services).
(b) Security Certifications. Documentation of Orion Cloud's security certifications, including its SOC 2 Type II report, ISO 27001 certification, and FedRAMP authorization status.
(c) Data Residency. Confirmation of the approved Orion Cloud regions (US-East Virginia and US-West Oregon) and the data residency restrictions applicable to Meridian data within the Orion Cloud environment.
(d) SLA Commitments. Documentation of Orion Cloud's platform SLA commitments, including the 99.95% monthly uptime commitment, and the flow-down of these commitments to the SkyComply™ service level obligations. The SLA flow-down analysis is addressed in detail in the companion SLA Terms Analysis Memo.
(e) Flow-Down Obligations. Confirmation that Skybridge's agreement with Orion Cloud imposes data security, confidentiality, data residency, and incident notification obligations on Orion Cloud that are at least as protective as those imposed on Skybridge under the MSA and DPA.
C. Additional Subprocessor Requirements
Beyond the notice and objection framework described above, the DPA should impose the following requirements on all subprocessors engaged by Skybridge in connection with the Meridian engagement:
1. Security Standards. All subprocessors must maintain security standards that are materially equivalent to those required of Skybridge under the Security Exhibit (Exhibit B). This includes, at minimum, encryption standards (AES-256 at rest, TLS 1.2+ in transit), access controls, incident response capabilities, and employee background check requirements.
2. Data Residency. All subprocessors must comply with the data residency restrictions applicable to Meridian data, including the requirement that all Meridian data be stored and processed exclusively within the continental United States within the approved Orion Cloud regions (or, for non-hosting subprocessors, within the continental United States).
3. Confidentiality. All subprocessors must be bound by confidentiality obligations at least as protective as those imposed on Skybridge under the MSA.
4. Accountability. Skybridge remains fully responsible to Meridian for all acts and omissions of its subprocessors with respect to Meridian data. The DPA should include a clear statement that the engagement of subprocessors does not relieve Skybridge of any of its obligations under the MSA, DPA, or Security Exhibit. This is a critical provision from Meridian's perspective, as it ensures that Meridian's contractual remedies are available against Skybridge regardless of whether a breach of obligations is attributable to Skybridge directly or to one of its subprocessors.
D. Regulatory Dimension
The subprocessor approval framework is directly informed by the regulatory guidance applicable to Meridian's management of third-party relationships. Under OCC Bulletin 2013-29 and the Interagency Guidance on Third-Party Relationships, banks are expected to manage the risks associated with subcontracting by their third-party service providers — a concept sometimes referred to as "fourth-party risk." The guidance recognizes that a bank's risk exposure does not diminish simply because a third-party service provider engages subcontractors to perform all or part of the contracted services. Banks must understand and manage the concentration risk, operational risk, and compliance risk introduced by subcontracting arrangements.
To comply with this guidance, Meridian will require the following contractual protections:
• The right to receive advance notice of and object to new subprocessors, as described above.
• The right to receive and review the list of all subprocessors with access to Meridian data at any time. Skybridge should maintain a register of all subprocessors with access to Meridian data, including the subprocessor's name, location, services performed, and security certifications. This register should be made available to Meridian upon request and should be updated promptly upon any changes.
• The right to terminate the MSA (or affected services) if Skybridge engages a subprocessor over Meridian's reasonable objection.
• Assurance that Skybridge's agreements with its subprocessors include provisions permitting Meridian (or its regulators) to access the subprocessor's records and facilities as necessary for audit or regulatory examination purposes.
VIII. Security Incident Notification Timing
A. The Dispute
The timing of security incident notification is one of the eight key open negotiation issues between Skybridge and Meridian. The parties' positions are as follows:
• Skybridge Position: Skybridge will notify Meridian of any confirmed Security Incident affecting Meridian data within 24 hours of the point at which Skybridge's incident response team confirms that such an incident has occurred and that Meridian data has been or is reasonably likely to have been affected.
• Meridian Demand: Meridian requires notification within 12 hours of discovery of a Security Incident affecting Meridian data.
The gap between the parties' positions reflects differing priorities: Meridian seeks the earliest possible notification to enable its own incident response and regulatory notification processes, while Skybridge seeks to ensure that notifications are sufficiently informed and accurate to be operationally useful, rather than premature and potentially misleading.
B. Market Analysis
To contextualize the parties' respective positions, we have conducted a market analysis based on publicly available data, published industry surveys, and our firm's proprietary transaction database.
Industry Benchmarks. Among enterprise financial services SaaS agreements, notification timelines for confirmed security incidents typically range from 24 to 72 hours. A 24-hour notification requirement is at the aggressive end of current market practice and is typically seen in agreements with large financial institution clients where the service provider processes highly sensitive data. A 12-hour requirement is extremely aggressive and is typically seen only in agreements with the most systemically critical counterparties (e.g., central banks, clearing houses, or government agencies with national security functions). In our review of comparable transactions, we have not identified a 12-hour notification requirement in any enterprise financial services SaaS agreement in Calderwood & Harkness LLP's deal database from the past three years.
Regulatory References. No applicable federal banking regulation mandates a specific notification timeline for vendor-to-bank incident notifications. OCC Bulletin 2013-29 requires banks to have contracts providing for "timely" notification of security incidents by their service providers, but does not define "timely" with a specific hour threshold. The NYDFS Cybersecurity Regulation (23 NYCRR § 500.17) requires covered entities to notify NYDFS within 72 hours of a cybersecurity event that is reportable. The EU General Data Protection Regulation ("GDPR"), Article 33, which is not directly applicable to this transaction but is often cited as an international benchmark, requires notification of a personal data breach to the supervisory authority within 72 hours of the controller becoming aware of the breach. The 24-hour standard proposed by Skybridge is substantially more aggressive than the 72-hour regulatory benchmarks.
Skybridge Client Base. Among Skybridge's existing portfolio of over 60 banking and financial services clients, 24-hour notification from confirmation of a security incident is the standard contractual commitment. Amara Okafor has confirmed that no existing Skybridge client has a 12-hour notification requirement. Accepting a 12-hour requirement for Meridian could create pressure from other clients to match the timeline, which would have significant operational implications for Skybridge's incident response program.
C. Operational Feasibility
The operational feasibility of the requested 12-hour notification timeline has been assessed in consultation with Amara Okafor. The key considerations are as follows:
Incident Response Timeline. Skybridge's incident response program is designed to achieve initial detection and acknowledgment of a potential security event within minutes to hours, depending on the nature of the event (automated alerts vs. manual detection). Following initial detection, the incident response team performs triage and preliminary analysis to determine the nature, scope, and severity of the event. For events that potentially involve customer data, the team then performs a more detailed investigation to identify which customers, if any, have been affected, and to assess the nature and extent of the data involved.
Amara Okafor has confirmed that the incident response team can typically achieve initial acknowledgment and triage within several hours of detection. However, a confirmed assessment of whether Meridian data has been specifically affected — as opposed to a general determination that a security event has occurred somewhere in the environment — may take longer than 12 hours, depending on the nature and scope of the incident. Complex incidents involving sophisticated threat actors, lateral movement across systems, or large-scale data exfiltration may require extensive forensic analysis before Skybridge can confirm with reasonable certainty which customer data sets have been affected.
Risk of Premature Notification. A 12-hour notification requirement could result in premature, incomplete, or inaccurate notifications. In the early hours of an incident investigation, the available information is often limited and rapidly evolving. A notification sent within 12 hours of initial discovery might state only that a security event has be

MEMORANDUM

MATTER NO.: 1009-00007

Record

Parties

Dates

Amounts