1009-00007 · Skybridge Fintech Ltd · Memos & Analysis

deal-summary-negotiation-strategy-memo.docx DOCUMENT Funds

14 / 35 ← → ✕

MEMORANDUM

PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT / ATTORNEY-CLIENT COMMUNICATION

TO: Angela Fontaine, Responsible Partner Liam Prescott, Of Counsel (Technology Transactions)

FROM: Amy Chesterton, Lead Associate

DATE: September 3, 2025

RE: Deal Summary and Negotiation Strategy — Skybridge Fintech Ltd. / Meridian National Bank, N.A. Enterprise SaaS Agreement

MATTER NO.: 1009-00007

CC: Nathan Ikeda, Working Associate

This memorandum is a privileged and confidential attorney work product and attorney-client communication. It is prepared in anticipation of litigation and in connection with the provision of legal advice to Skybridge Fintech Ltd. It should not be disclosed to any third party without prior written authorization from the responsible partner.

Right-click to update Table of Contents

I. Purpose and Executive Summary

The purpose of this memorandum is threefold. First, it provides a comprehensive summary of the key terms of the proposed enterprise Software-as-a-Service agreement between our client, Skybridge Fintech Ltd. ("Skybridge" or "SBF"), as licensor and SaaS provider, and the counterparty, Meridian National Bank, National Association ("Meridian" or "MNB"), as licensee. Second, it identifies and analyzes the eight principal open negotiation issues that remain unresolved between the parties. Third, it sets forth a recommended negotiation strategy for each such open issue, including our primary position, compromise positions, fallback positions, and walk-away boundaries, so that the deal team and our client contacts can proceed with clear tactical guidance as we enter the substantive negotiation phase with Meridian and its outside counsel.

The proposed transaction is a significant enterprise SaaS agreement with a Total Contract Value of $50,000,000 over a five-year initial term. Under the agreement, Skybridge will license its proprietary SkyComply™ platform — an AI-driven anti-money-laundering and transaction-monitoring solution — to Meridian for deployment across Meridian's retail banking, commercial banking, and wealth management divisions. The platform will serve approximately 32,000 named users across Meridian's U.S. and international operations. This is the single largest contract in Skybridge's history and, if executed successfully, will represent a marquee client relationship that positions Skybridge favorably in the Tier 1 banking market segment.

Meridian is represented by Hargrove, Tully & Cascade Insurance Brokers ("HTM"), a prominent New York-based firm with a well-established financial institutions practice. HTM's team is led by Douglas Krenshaw, Partner, and Megan Faircloth, Senior Associate, with associate support from Ryan Tso. Meridian's internal legal lead for this transaction is Catherine Woo, Associate General Counsel (Technology). Based on our prior dealings with HTM and their general reputation in the market, we anticipate that HTM will take an aggressive posture in negotiations, particularly on security, indemnification, and liability terms. HTM's standard approach for bank clients is to impose the bank's own form agreement; however, we have successfully secured agreement to proceed from Skybridge's initial draft MSA, which provides us with a meaningful negotiating advantage in framing the terms.

On the Skybridge side, the key client contacts for this transaction are as follows: David Shimura, General Counsel; Amara Okafor, Chief Information Security Officer; Marcus Holt, Chief Technology Officer; Tara Bellingham, Vice President, Enterprise Sales; Jonathan Kreske, Chief Financial Officer; and Priya Chandrasekaran, Chief Executive Officer. We will be working most closely with David Shimura and Tara Bellingham on day-to-day negotiations, with escalation to Jonathan Kreske and Priya Chandrasekaran as needed on commercial and strategic questions.

A critical procedural consideration is that Pinnacle Ridge Capital Partners, LP ("PRCP"), Skybridge's 62% majority owner, holds a contractual consent right over any Skybridge contract exceeding $25,000,000 in total value. PRCP is a growth-equity fund with approximately $3.4 billion in assets under management, led by Managing Partner Elise Drummond. PRCP made its Series C investment in Skybridge in 2021 at a $310 million pre-money valuation and currently holds two board seats. Because this agreement has a TCV of $50,000,000, it unambiguously triggers PRCP's consent right. PRCP's outside counsel is Simone Alcott, Partner at Alcott & Grenier LLP. We will need to submit the near-final MSA and Order Form to Simone Alcott for PRCP review and prepare a form of written consent for Elise Drummond's execution. This process must be completed before MSA execution, and we have built a two-week window for PRCP review into our recommended negotiation timeline (Section VII below).

The eight principal open negotiation issues, which are summarized in Section III and analyzed in full detail in Section IV, span the core risk allocation provisions of the agreement: uptime commitments, SLA credits, data breach indemnification, consequential damages, security incident notification, penetration testing, liability caps, and insurance. These issues are interrelated and should be negotiated as an integrated package wherever possible. Our overarching strategic objective is to protect Skybridge's financial exposure while acknowledging Meridian's legitimate regulatory and operational concerns as a systemically important financial institution, and to close the transaction on terms that are commercially sustainable for Skybridge, satisfactory to PRCP, and defensible in the market.

II. Transaction Overview

A. The Parties

Skybridge Fintech Ltd.

Skybridge Fintech Ltd. is a Delaware limited company (alternative entity) with its headquarters at 1400 Concord Pike, Suite 320, Wilmington, Delaware 19803. Skybridge is a growth-stage financial technology SaaS company founded in 2018 that specializes in compliance automation solutions for the banking and financial services industry. Its flagship product, SkyComply™, is an AI-driven anti-money-laundering and transaction-monitoring platform designed to assist financial institutions in meeting their obligations under the Bank Secrecy Act, USA PATRIOT Act, and related regulatory requirements.

As of the most recent fiscal year, Skybridge had approximately 420 employees. Its audited financial statements for fiscal year 2024, prepared by Hathaway & Pendleton, LLP (audit opinion dated April 30, 2025, lead audit partner Bruce Ogilvie), reflect annual revenue of $78.3 million, EBITDA of $11.7 million, gross margin of approximately 74%, and a net retention rate of 118%. Annualized recurring revenue stands at approximately $78 million. The company currently serves over 60 banking and financial services clients, including regional and mid-market banks, credit unions, and broker-dealer firms. However, the proposed Meridian engagement would represent Skybridge's first Tier 1 U.S. banking client.

Skybridge maintains a robust security posture. It holds a SOC 2 Type II certification (report dated March 15, 2025, prepared by Crestfield Cyber Advisors, Inc.) and ISO 27001 certification (recertified January 22, 2025, also by Crestfield). Crestfield is the company's long-standing independent third-party security auditor, and the lead auditor on the most recent engagements is Deepa Rajan. These certifications, combined with Skybridge's internal security program, are central to the company's value proposition in the regulated financial services market and will be key to our negotiation positions on security-related issues.

Skybridge is majority-owned (62%) by Pinnacle Ridge Capital Partners, LP, which made its Series C investment in 2021 at a pre-money valuation of $310 million. PRCP is a growth-equity fund with approximately $3.4 billion in assets under management, led by Managing Partner Elise Drummond. PRCP holds two seats on Skybridge's board of directors and, as noted above, maintains a contractual consent right over any Skybridge contract exceeding $25 million in total value. The remaining equity is held by the founders, management team, and earlier-stage investors.

Meridian National Bank, N.A.

Meridian National Bank, N.A. is a national banking association chartered under federal law, with its principal office located at 600 Lexington Avenue, 40th Floor, New York, New York 10022. Meridian is a wholly owned subsidiary of Meridian Financial Group, Inc., a Delaware corporation listed on the New York Stock Exchange. Meridian Financial Group is one of the largest financial holding companies in the United States.

Meridian holds approximately $485 billion in total assets, placing it among the top ten U.S. banks by total assets. It is classified as a systemically important financial institution ("SIFI") and is subject to heightened regulatory oversight by the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation ("FDIC"). Meridian's SIFI designation carries significant implications for this transaction, as the bank is subject to enhanced prudential standards, heightened expectations for third-party vendor management, and intensified examination scrutiny of its technology and compliance infrastructure.

Meridian is undertaking a comprehensive modernization of its anti-money-laundering compliance infrastructure, replacing its legacy AML platform with SkyComply™ across three divisions: retail banking, commercial banking, and wealth management. The deployment will encompass approximately 32,000 licensed users across Meridian's U.S. and international operations. The bank's key internal stakeholders for this transaction are Gerald Brannigan, Chief Information Officer (executive sponsor for the initiative); Sandra Petrov, Head of Financial Crimes and Compliance; and Luis Arriaga, Senior Vice President, Procurement and Vendor Management (who serves as the day-to-day relationship lead for vendor engagements of this type).

The significance of this engagement to both parties cannot be overstated. For Meridian, the replacement of its legacy AML platform with SkyComply™ is a strategic initiative driven by both regulatory pressure and the desire to leverage artificial intelligence and machine learning capabilities to improve the quality of transaction monitoring and suspicious activity reporting. For Skybridge, securing Meridian as a client validates the platform in the Tier 1 banking market, creates substantial recurring revenue, and enhances the company's competitive position for future engagements with large financial institutions.

B. Agreement Structure

The proposed transaction will be documented through a suite of interlocking agreements and exhibits, structured as follows:

Master Software-as-a-Service Agreement ("MSA"). The MSA serves as the core contract governing the overall relationship between the parties. It addresses the scope of the license grant, the parties' respective obligations, service levels, security requirements, intellectual property ownership, indemnification, limitations of liability, term and termination, confidentiality, and general provisions. The MSA is being drafted from Skybridge's standard form, which we have customized for this engagement to address the unique requirements of a SIFI counterparty.

Order Form. The Order Form documents the specific commercial terms of the engagement, including the fee structure, user counts, payment schedule, implementation timeline, and any transaction-specific commercial concessions. The Order Form will be executed simultaneously with the MSA and incorporated by reference.

Exhibit A: SLA Exhibit. The SLA Exhibit sets forth the detailed service level commitments, including monthly uptime targets, the tiered SLA credit structure, incident response time requirements, planned maintenance windows, and the methodology for calculating uptime and credits. The SLA Exhibit is one of the most heavily negotiated components of the agreement and is the subject of Issues 1 and 2 in our analysis below.

Exhibit B: Security Exhibit. The Security Exhibit documents Skybridge's security obligations, including required certifications (SOC 2 Type II, ISO 27001), encryption standards (at rest and in transit), penetration testing requirements, audit rights, security incident notification procedures, and personnel background check requirements. This exhibit is the subject of Issues 5 and 6 in our analysis below.

Exhibit C: Data Processing Addendum ("DPA"). The DPA governs the processing of Meridian's data by Skybridge, including data categorization (with particular emphasis on GLBA nonpublic personal information and personally identifiable information), subprocessor approval requirements, data residency commitments, data retention and deletion obligations, and cross-border data transfer restrictions. The DPA identifies Orion Cloud Services, Inc. as an initial approved subprocessor.

Exhibit D: Acceptable Use Policy ("AUP"). The AUP establishes permitted and prohibited uses of the SkyComply™ platform and provides for Meridian's indemnification of Skybridge with respect to any claims arising from Meridian's breach of the AUP.

Source Code Escrow Agreement. The parties will enter into a three-party source code escrow agreement with Sentinel Escrow Services, Inc. (Escrow Agreement No. SCE-2025-04417). The agreement provides for an initial deposit of the SkyComply™ source code within 30 days of MSA execution, with quarterly updates thereafter. Release triggers include Skybridge's insolvency, material breach of support obligations uncured for 60 days, and cessation of business. Escrow fees are $13,000 per year, split equally between the parties ($6,500 each).

Governing Law and Dispute Resolution. The MSA will be governed by the laws of the State of Delaware, without regard to conflict of laws principles. Exclusive venue for any disputes will lie in the state or federal courts sitting in Wilmington, Delaware — specifically, the Delaware Court of Chancery or the United States District Court for the District of Delaware. Prior to litigation, the parties will be required to follow a mandatory dispute resolution process consisting of three-tier executive escalation (account managers, then VP-level, then CEO/CIO) followed by a 60-day JAMS-administered mediation. The MSA will include a mutual waiver of the right to a jury trial.

C. Commercial Terms Summary

The commercial terms of this engagement are substantial and reflect both the scale of Meridian's deployment and the volume-based discount that Skybridge has offered to secure the relationship. The key financial terms are as follows:

Total Contract Value. The Total Contract Value is $50,000,000 over the five-year initial term of the agreement.

Gross Undiscounted TCV. The gross undiscounted TCV, based on list pricing, is $53,600,000, broken down as follows: Year 1 fees of $13,600,000 plus Years 2 through 5 fees totaling $40,000,000.

Volume discount. The aggregate volume discount is 6.72%, calculated as follows: ($53,600,000 − $50,000,000) ÷ $53,600,000 = 6.72%. This discount level is within the range authorized by Tara Bellingham under Skybridge's internal pricing guidelines for Tier 1 banking engagements and has been approved by Jonathan Kreske.

Fee Components (Pre-discount). The undiscounted fee components are structured as follows:

Adjusted Annual Fees (Post-discount). After application of the volume discount, the annual fee schedule is as follows:

The Year 1 fee of $12,700,000 reflects the inclusion of the one-time implementation and onboarding fee. The remaining $37,300,000 across Years 2 through 5 is distributed evenly at $9,325,000 per year.

Payment Terms. Fees are payable quarterly in advance, with payment due within net 30 days of the invoice date. Invoices will be issued at the beginning of each calendar quarter during the term.

Annual Escalator. Beginning in Year 3, annual fees are subject to a CPI-based escalator of 3.0%, capped at 3.5% per year. The escalator applies to the platform subscription and support and managed services components but does not apply to the one-time implementation fee. The escalator was a late addition to the commercial negotiation at Meridian's request (Meridian sought a flat rate for the full term); the 3.0% base with a 3.5% cap represents a reasonable compromise that protects Skybridge against inflationary cost increases while providing Meridian with rate predictability.

Incremental Users. Users above the 32,000 named user base are priced at $275 per user per year, with no volume discount applied to incremental users. This pricing reflects a modest premium over the discounted per-user rate of approximately $239 per user per year embedded in the base subscription (i.e., $9,325,000 less $1,800,000 support = $7,525,000 for subscription, divided by 32,000 users).

Licensed User Count. The initial deployment covers 32,000 named users. Meridian has indicated that it may seek to expand the user base during the term, particularly if the platform is deployed to additional international operations or if headcount growth in its compliance and financial crimes functions exceeds current projections.

D. Term, Renewal, and Termination

Initial Term. The initial term is five years, commencing on the Platform Go-Live Date and ending five years thereafter. The targeted Go-Live Date is March 1, 2026, which would establish an initial term running from March 1, 2026 through February 28, 2031.

Implementation Period. The implementation period is targeted to run from approximately September 15, 2025 through February 28, 2026, a span of approximately 5.5 months. This period encompasses system configuration, data migration, integration testing, user acceptance testing, training, and parallel processing with Meridian's legacy AML platform. Marcus Holt (CTO) has confirmed that this timeline is achievable, though aggressive, and has flagged the need for timely access to Meridian's systems and data environments as a potential risk to the schedule.

Renewal. Following the expiration of the initial five-year term, the agreement will automatically renew for up to two successive one-year renewal terms, unless either party provides written notice of non-renewal at least 180 days prior to the end of the then-current term. The 180-day notice period is designed to provide both parties with adequate time to plan for either a transition to a replacement platform (in Meridian's case) or for revenue planning purposes (in Skybridge's case).

Termination for Convenience. Meridian may terminate the agreement for convenience after the completion of Year 2, subject to two conditions: (i) Meridian must provide 12 months' prior written notice of termination; and (ii) Meridian must pay an early termination fee ("ETF") equal to 50% of the remaining Annual Contract Value for the then-current term. For illustrative purposes, if Meridian terminates effective at the end of Year 3, the ETF would be calculated as follows: 50% × $9,325,000 × 2 remaining years = $9,325,000. The termination for convenience right was a commercial concession agreed upon during the term sheet phase; the ETF is designed to protect Skybridge's investment in the implementation and the economics of the five-year commitment.

SLA-Based Termination Right. In addition to the termination for convenience right, Meridian has a termination right if platform uptime falls below 98.0% in three of any consecutive six months. This termination right is designed to protect Meridian against chronic underperformance and is a standard provision in enterprise SaaS agreements for critical-function platforms. The 98.0% threshold and the three-of-six-months measurement period were negotiated during the commercial phase and are not among the currently open issues.

E. Key Third-Party Relationships

The proposed transaction involves several important third-party relationships that are relevant to the negotiation and that are referenced throughout the agreement documents.

Orion Cloud Services, Inc. Orion Cloud Services is the infrastructure-as-a-service ("IaaS") provider that hosts the SkyComply™ platform. Skybridge operates SkyComply™ on Orion Cloud's platform, which provides compute, storage, and networking services in a multi-tenant cloud environment. Orion Cloud's platform SLA provides a 99.95% monthly uptime commitment for its infrastructure services. The SkyComply™ platform is hosted in Orion Cloud's US-East (Virginia) and US-West (Oregon) regions only, consistent with Meridian's data residency requirements. Orion Cloud is identified as an initial approved subprocessor under the DPA. The dependency on Orion Cloud's infrastructure is directly relevant to Issues 1 and 6 in our negotiation analysis, as Skybridge's ability to deliver uptime above 99.9% is constrained by Orion Cloud's own infrastructure performance, and Orion Cloud's terms of service restrict customer-initiated infrastructure-layer penetration testing.

Crestfield Cyber Advisors, Inc. Crestfield is Skybridge's independent third-party security auditor. Crestfield prepared the most recent SOC 2 Type II report (dated March 15, 2025) and conducted the ISO 27001 recertification audit (dated January 22, 2025). The lead auditor on both engagements is Deepa Rajan. Crestfield also conducts Skybridge's annual third-party penetration testing, the results of which Skybridge has historically shared with clients under NDA. Meridian has requested the right to commission additional penetration testing through Crestfield or its own designated auditor, which is the subject of Issue 6 below.

Coastal Assurance Corporation. Coastal Assurance Corporation is Skybridge's cyber liability and errors and omissions insurer. The current policy is Policy No. CA-TECH-2025-07831, with coverage limits of $25 million per occurrence and $50 million in the aggregate. The policy period runs from April 1, 2025 through March 31, 2026. The Coastal Assurance policy is directly relevant to the negotiations on the data breach indemnification cap (Issue 3), the confidentiality/data security super-cap (Issue 7), and additional insured status (Issue 8). The alignment between the per-occurrence limit of $25 million and our proposed super-cap of approximately $27,975,000 (3× annual fees) is an important data point for the negotiation.

Sentinel Escrow Services, Inc. Sentinel Escrow Services is the source code escrow agent. The three-party Source Code Escrow Agreement (No. SCE-2025-04417) provides for an initial deposit of the SkyComply™ source code within 30 days of MSA execution, with quarterly updates to the deposit thereafter. The release triggers negotiated in the escrow agreement include: (i) Skybridge's insolvency or commencement of bankruptcy proceedings; (ii) a material breach of Skybridge's support obligations that remains uncured for 60 days following written notice; and (iii) Skybridge's cessation of business operations. Annual escrow fees are $13,000, split equally between the parties at $6,500 each. The escrow agreement is substantially agreed and is not among the open negotiation issues.

Hathaway & Pendleton, LLP. Hathaway & Pendleton is Skybridge's independent financial auditor. The firm's most recent audit opinion, covering fiscal year 2024, is dated April 30, 2025. The lead audit partner is Bruce Ogilvie. Meridian's due diligence team has requested and received a copy of the FY 2024 audited financial statements, and the financial data in this memorandum is drawn from that report.

F. Regulatory Landscape

The regulatory environment governing this transaction is complex and warrants careful attention throughout the negotiation process. Meridian's status as a nationally chartered bank and SIFI means that the agreement must be structured and documented in a manner that satisfies the expectations of multiple federal banking regulators.

OCC, Federal Reserve, and FDIC Oversight. As a national banking association, Meridian is subject to primary supervision by the OCC, with additional oversight by the Federal Reserve (as the consolidated supervisor of the holding company) and the FDIC (as deposit insurer). Meridian's SIFI designation subjects it to enhanced prudential standards under Title I of the Dodd-Frank Wall Street Reform and Consumer Protection Act, including heightened expectations for enterprise-wide risk management, which extends to third-party vendor relationships.

OCC Bulletin 2013-29 and Interagency Guidance. The agreement must comply with the requirements and expectations set forth in OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance) and the Interagency Guidance on Third-Party Relationships issued jointly by the OCC, Federal Reserve, and FDIC in June 2023. These guidance documents establish supervisory expectations for banks' management of third-party relationships, including expectations for due diligence, contract negotiation, ongoing monitoring, and contingency planning. The guidance is particularly prescriptive with respect to "critical" third-party relationships — which this engagement will almost certainly be classified as — and requires, among other things, that contracts address performance standards, audit rights, regulatory examination access, business continuity, data protection, and termination rights.

Bank Service Company Act. Skybridge qualifies as a "bank service company" under the Bank Service Company Act, 12 U.S.C. § 1867, by virtue of providing technology services to a federally regulated bank. Under the Act, federal banking regulators have the authority to examine the services, records, and facilities of a bank service company to the same extent as if the services were being performed by the bank itself. The MSA must include a contractual acknowledgment of this examination right. Specifically, Skybridge must agree to cooperate with examinations by the OCC, Federal Reserve, and FDIC, to make its relevant records and facilities available for examination, and to not unreasonably restrict the regulators' access. This provision is not among the open negotiation issues, as Skybridge has previously agreed to similar provisions in other bank client contracts.

BSA/AML Regulatory Compliance. BSA/AML regulatory compliance is the core function of the SkyComply™ platform. The platform is designed to monitor transactions, identify suspicious activity, facilitate the filing of suspicious activity reports, and support Meridian's broader compliance program. Any material regulatory finding against the platform — such as a finding that the platform's monitoring algorithms are inadequate or that the platform contributed to a compliance failure — could have severe consequences for both Meridian and Skybridge. The MSA includes a termination right in favor of Meridian in the event of a material adverse regulatory finding directly related to the SkyComply™ platform, subject to a cure period. The interplay between the platform's regulatory function and the consequential damages carve-out for regulatory fines (Issue 4) is one of the most sensitive negotiation points.

GLBA and Data Breach Notification Requirements. The Gramm-Leach-Bliley Act ("GLBA") imposes obligations on financial institutions and their service providers with respect to the protection of nonpublic personal information ("NPI"). As a service provider handling Meridian's customer NPI, Skybridge must implement appropriate safeguards and comply with GLBA requirements as implemented through the Interagency Guidelines Establishing Information Security Standards. In addition, applicable state data breach notification laws will govern the obligations of both parties in the event of unauthorized access to or disclosure of personally identifiable information ("PII") or NPI.

G. Representations and Warranties

The MSA includes a standard set of mutual and one-sided representations and warranties, as follows:

By Skybridge. Skybridge represents and warrants that: (a) the SkyComply™ platform will perform materially in accordance with the Documentation provided to Meridian; (b) all services will be performed in a professional and workmanlike manner consistent with generally accepted industry standards; (c) Skybridge has all necessary rights, licenses, and authorizations to grant the license contemplated by the agreement and to provide the services; (d) the platform, as delivered, will not contain any malicious code, viruses, worms, Trojan horses, or similar disabling or destructive code; (e) Skybridge is in material compliance with all applicable laws, rules, and regulations relevant to its performance under the agreement; and (f) Skybridge's security practices meet or exceed industry standards for financial services SaaS providers, as evidenced by its SOC 2 Type II and ISO 27001 certifications.

By Meridian. Meridian represents and warrants that: (a) it has the corporate authority to enter into the agreement and to perform its obligations thereunder; and (b) its use of the platform will be in compliance with the Acceptable Use Policy and all applicable laws, rules, and regulations.

Warranty Period. The warranty period for implementation services is 12 months from the Go-Live Date. The platform subscription warranties are ongoing throughout the term of the agreement. The 12-month warranty period for implementation services provides Meridian with protection against latent defects in the configuration and deployment work performed during the implementation phase.

H. Insurance Requirements

The MSA requires Skybridge to maintain specified insurance coverage throughout the term of the agreement. The contractual insurance minimums, as proposed by Skybridge, are as follows:

Skybridge's current Coastal Assurance Corporation policy (Policy No. CA-TECH-2025-07831) meets or exceeds the Technology E&O / Cyber Liability requirements. The current policy limits of $25 million per occurrence and $50 million in the aggregate are precisely aligned with the contractual minimums proposed in the MSA. The CGL, Workers' Compensation, and Umbrella/Excess policies are maintained through separate carriers and are current and in good standing.

Meridian has requested additional insured status on both the CGL and Cyber/E&O policies, which is the subject of Issue 8 in our analysis below. Meridian has also requested that Skybridge deliver a certificate of insurance within 10 business days of MSA execution and annually thereafter for the duration of the term, confirming that the required coverage is in effect and that the coverage meets or exceeds the contractual minimums.

III. Summary of Eight Key Open Negotiation Issues

Based on our review of Meridian's initial term sheet comments, the preliminary discussions between Tara Bellingham and Luis Arriaga, and the positions articulated by Catherine Woo in her August 22, 2025 email to David Shimura, we have identified eight principal open negotiation issues. These issues represent the core risk allocation disputes between the parties and will constitute the primary focus of the substantive negotiation sessions with HTM. Each of these issues is analyzed in detail in Section IV below.

The eight open issues are as follows:

1. SLA Uptime Standard (99.95% vs. 99.9%). Meridian demands a 99.95% monthly uptime commitment; Skybridge proposes 99.9%. The gap represents approximately 22 minutes of additional permitted monthly downtime.

2. SLA Credit Cap (Uncapped vs. 15% Annual Cap). Meridian demands uncapped SLA credits; Skybridge proposes a monthly cap of 30% and an annual cap of 15% of the applicable subscription fee.

3. Data Breach Indemnity Cap (Uncapped vs. 2× Annual Fees). Meridian demands uncapped indemnification for data breach claims; Skybridge proposes a cap at 2× the annual fees paid in the preceding 12-month period.

4. Consequential Damages Carve-Out for Regulatory Fines. Meridian seeks to carve out regulatory fines and penalties from the mutual exclusion of consequential damages; Skybridge resists the carve-out.

5. Security Incident Notification Window (12 Hours vs. 24 Hours). Meridian demands 12-hour notification following discovery of a confirmed Security Incident; Skybridge proposes 24 hours.

6. Penetration Testing Scope (Infrastructure + Application vs. Application Only). Meridian demands the right to conduct penetration testing covering both infrastructure-layer and application-layer testing; Skybridge permits application-layer testing only.

7. Confidentiality/Data Security Super-Cap (Uncapped vs. 3× Annual Fees). Meridian demands uncapped liability for confidentiality and data security breaches; Skybridge proposes a "super-cap" at 3× annual fees.

8. Additional Insured Status on Cyber Policy. Meridian requests additional insured status on Skybridge's Cyber/E&O policy; Skybridge is reviewing feasibility with its carrier.

These issues are interconnected in several important respects. Issues 3, 4, and 7 collectively define the liability architecture for data-related claims and should be negotiated as an integrated package. Issues 1 and 2 together determine the financial consequences of uptime failures. Issues 5 and 6 relate to Skybridge's security obligations and Meridian's oversight rights. Issue 8 intersects with the liability and indemnification provisions by providing an insurance backstop for data-related claims.

IV. Detailed Analysis and Negotiation Strategy for Each Open Issue

Issue 1: SLA Uptime Standard

Meridian's Position. Meridian demands a monthly uptime commitment of 99.95%, measured exclusive of scheduled maintenance windows. Meridian's negotiating posture on this issue is driven by its status as a systemically important financial institution and the critical nature of the SkyComply™ platform to Meridian's BSA/AML compliance functions. Catherine Woo and Douglas Krenshaw have framed this demand as non-negotiable, arguing that SkyComply™ will serve as a regulatory-critical system and that any downtime creates examination risk and could impair Meridian's ability to meet its real-time transaction-monitoring obligations. Meridian has cited examples of other enterprise technology vendors that have committed to 99.95% or higher uptime standards in contracts with Tier 1 banks.

Skybridge's Position. Skybridge proposes a monthly uptime commitment of 99.9%, which is the standard commitment in Skybridge's existing client base and is consistent with Skybridge's historical performance metrics. The rationale for the 99.9% standard is grounded in the technical architecture of the SkyComply™ platform. Specifically, SkyComply™ is hosted on Orion Cloud Services' infrastructure, and Orion Cloud's own platform SLA provides a 99.95% monthly uptime commitment for its infrastructure layer. If Skybridge commits to 99.95% uptime to Meridian for the full application stack (which includes both the Orion Cloud infrastructure layer and the Skybridge application layer), there is effectively no margin for any application-layer issues, including routine deployments, patches, or minor performance degradations that fall within normal operating parameters.

The practical difference between 99.9% and 99.95% is approximately 22 minutes of additional permitted downtime per month. At 99.9%, the permitted monthly downtime is approximately 43 minutes; at 99.95%, the permitted monthly downtime is approximately 22 minutes. While this difference may appear modest in the abstract, it is significant from an operational and risk management perspective, particularly given the upstream dependency on Orion Cloud.

Market Benchmark. Based on our review of publicly available SLA terms and our experience with comparable enterprise SaaS agreements in the financial services sector, the prevailing market standard for mission-critical financial services SaaS platforms is 99.9% monthly uptime. Some agreements specify 99.5% as the baseline, with credits beginning at that threshold and escalating at higher downtime levels. A 99.95% commitment is aspirational and is typically seen only from hyperscale cloud infrastructure providers (e.g., Ridgeway Industries, Crestline Systems, Northgate Corporation) with respect to their core infrastructure services — not from SaaS application providers. It is important to note that even Orion Cloud's 99.95% SLA applies only to the infrastructure layer; it does not extend to or guarantee application-layer performance.

Nathan Ikeda is preparing a detailed SLA Terms Analysis Memo with additional market benchmarking data from comparable transactions, which will be available to support our negotiation position.

Recommended Strategy. Primary Position. Hold at 99.9% monthly uptime. Justify the position based on the upstream dependency on Orion Cloud Services, noting that Skybridge cannot commercially guarantee a standard that exceeds its own infrastructure provider's guarantee for the full technology stack. Emphasize that 99.9% is the prevailing market standard for enterprise SaaS providers in the financial services sector and that Skybridge's historical performance has consistently exceeded 99.9% (Marcus Holt can provide performance data to support this point).

Compromise Position. Offer 99.9% as the committed standard with enhanced SLA credit tiers. Specifically, we would propose increasing the credit percentage for performance below 98.0% from 30% to 35% of the monthly subscription fee, providing Meridian with additional financial protection in the event of significant underperformance. In addition, we would include a contractual commitment by Skybridge to use commercially reasonable efforts to achieve 99.95% as a performance target (as distinguished from a binding commitment), and to report monthly uptime performance against both the 99.9% committed standard and the 99.95% aspirational target.

Fallback Position. If Meridian remains insistent on 99.95% as the contractual standard, we would agree to 99.95% only under the following conditions: (i) the uptime measurement expressly excludes both scheduled maintenance windows and any downtime attributable to Orion Cloud Services infrastructure-level outages (i.e., a carve-out treating Orion Cloud infrastructure downtime as a force majeure or excluded event for SLA measurement purposes); and (ii) the parties expressly agree that SLA credits are the sole and exclusive remedy for any failure to meet the uptime target, with no right to claim additional damages for SLA shortfalls.

Walk-Away. Skybridge should not agree to 99.95% as a hard, contractually binding SLA without the infrastructure carve-out described above. Committing to 99.95% without such a carve-out would expose Skybridge to SLA credit liability and potential termination rights arising from events entirely outside its control (i.e., Orion Cloud outages). This is a risk that Skybridge cannot commercially absorb and that would set an unsustainable precedent for future client contracts.

Issue 2: SLA Credit Cap

Meridian's Position. Meridian demands uncapped SLA credits, arguing that credits serve as the primary financial incentive for Skybridge to invest in maintaining high uptime and that any cap on credits reduces the effectiveness of that incentive. HTM's position is that the cap effectively limits Meridian's downside protection to a modest fraction of the fees paid, even in the event of catastrophic and sustained platform outages. Meridian may also seek to structure credits as a reduction against future invoices without any monthly or annual ceiling.

Skybridge's Position. Skybridge proposes a tiered SLA credit structure with the following caps:

• Monthly Credit Cap: 30% of the monthly subscription fee. Based on the adjusted annual fees, this equates to a maximum monthly credit of approximately $317,500 in Year 1 (calculated as $12,700,000 ÷ 12 × 30% = $317,500) and approximately $233,125 in Years 2 through 5 (calculated as $9,325,000 ÷ 12 × 30% = $233,125).

• Annual Credit Cap: 15% of the annual subscription fee. This equates to a maximum annual credit of approximately $1,905,000 in Year 1 (calculated as $12,700,000 × 15%) and approximately $1,398,750 in Years 2 through 5 (calculated as $9,325,000 × 15%).

For credit calculation purposes, the monthly subscription fee is derived by dividing the annual fee by 12: $1,058,333 per month in Year 1 and $777,083 per month in Years 2 through 5.

A critical element of Skybridge's position is that SLA credits are designated as the sole and exclusive remedy for any failure to meet the uptime targets specified in the SLA Exhibit. This exclusive remedy provision is essential to the overall liability architecture, as it prevents Meridian from asserting additional claims for breach of contract or seeking damages beyond the credit structure for SLA-related performance shortfalls.

Recommended Strategy. Primary Position. Maintain the existing capped credit structure with the tiered framework described above. Argue that SLA credits are properly understood as a service-level incentive mechanism, not a liability or damages provision, and that uncapped credits fundamentally undermine revenue predictability — a concern that is particularly acute for a growth-stage company like Skybridge. Emphasize that Meridian's true protection against chronic underperformance lies in the termination right (below 98.0% in three of any consecutive six months), not in unlimited service credits.

Compromise Position. Increase the annual credit cap from 15% to 20% of the annual subscription fee, resulting in a maximum annual credit of approximately $2,540,000 in Year 1 and approximately $1,865,000 in Years 2 through 5. Pair this increase with the express inclusion of the chronic underperformance termination right (below 98.0% in three of any consecutive six months), framing the termination right as the meaningful backstop that renders uncapped credits unnecessary. This combination provides Meridian with both enhanced financial incentives for performance and a decisive exit option in the event of sustained underperformance.

Fallback Position. Increase the monthly credit cap from 30% to 40% of the monthly subscription fee, but maintain the annual cap at 20%. This provides Meridian with greater month-to-month credit protection while preserving an annual ceiling that protects Skybridge's revenue. Continue to insist that credits are the sole and exclusive remedy for SLA failures.

Walk-Away. Skybridge should not agree to uncapped SLA credits under any circumstances. The credit structure must include both a monthly and an annual cap, and credits must be expressly designated as the sole and exclusive remedy for uptime failures. Uncapped credits would create an unbounded financial liability that is inconsistent with the economics of a SaaS subscription model and could, in a sustained outage scenario, result in Skybridge effectively refunding the entirety of the fees paid — an outcome that is commercially unacceptable and that would raise concerns with PRCP and the board.

Issue 3: Data Breach Indemnification Cap

Meridian's Position. Meridian demands fully uncapped indemnification for data breach claims — that is, claims arising from Skybridge's breach of its data security or confidentiality obligations that results in the unauthorized access to, disclosure of, or loss of Meridian's data, including the NPI and PII of Meridian's customers. Meridian's rationale is straightforward and commercially powerful: Meridian handles the nonpublic personal information of millions of banking customers, and a data breach involving this information could result in regulatory enforcement actions by the OCC, Federal Reserve, and FDIC; class action litigation under state consumer protection laws and common law theories; individual customer claims; state attorney general investigations and enforcement; costs of notification, credit monitoring, and remediation; and significant reputational harm. Meridian argues that the potential losses from a major data breach could vastly exceed any cap and that it would be unreasonable to limit Skybridge's liability for breaches that are within Skybridge's control.

Skybridge's Position. Skybridge proposes capping data breach indemnification at 2× the annual fees paid in the 12-month period preceding the claim. In a steady-state year (Years 2 through 5), this cap would be approximately $18,650,000 (calculated as 2 × $9,325,000). This position is grounded in several considerations:

First, Skybridge's financial profile makes uncapped data breach exposure existential. With fiscal year 2024 revenue of $78.3 million and EBITDA of $11.7 million, a truly uncapped indemnification obligation on a $50 million contract with a $485 billion-asset bank represents an exposure that could exceed the entire enterprise value of Skybridge. The disparity in size and financial capacity between the parties is enormous, and the risk allocation must reflect this reality.

Second, intellectual property indemnification is already uncapped, which is consistent with industry standard practice. Adding uncapped data breach indemnification creates a compounding unlimited exposure that significantly increases Skybridge's overall risk profile.

Third, Skybridge's cyber insurance coverage through Coastal Assurance Corporation provides $25 million per occurrence and $50 million in the aggregate. While this coverage provides a meaningful backstop, it cannot cover truly uncapped contractual indemnification obligations, particularly if a single catastrophic breach were to exceed the per-occurrence limit or if multiple claims were to erode the aggregate limit.

Recommended Strategy. Primary Position. Hold at 2× annual fees (approximately $18,650,000). Emphasize that this cap level is consistent with market practice for enterprise SaaS agreements and that it represents a substantial commitment by a company of Skybridge's size. Highlight Skybridge's SOC 2 Type II and ISO 27001 certifications, its robust internal security program, and its track record of zero material security incidents across its 60+ banking and financial services client base as evidence that the risk of a data breach is low and that the cap is more than adequate.

Compromise Position. Offer a "super-cap" for data security and confidentiality breaches at 3× annual fees (approximately $27,975,000), as further discussed in Issue 7 below. Present this as the maximum that the company can commercially bear and note the close alignment between the $27,975,000 super-cap and the $25 million per-occurrence limit of the Coastal Assurance cyber insurance policy. The super-cap structure acknowledges the heightened sensitivity of data security claims while preserving a defined ceiling on exposure.

Fallback Position. If Meridian is adamant that the data breach indemnity must be uncapped, propose that uncapped liability apply only to data breaches caused by Skybridge's gross negligence or willful misconduct in connection with its data security obligations. This would narrow the uncapped trigger to the most egregious conduct (e.g., knowing failure to implement required security measures, deliberate circumvention of security controls) while maintaining the super-cap for data breach claims arising from ordinary negligence or other non-culpable breaches. This approach provides Meridian with genuine protection against bad-faith conduct while protecting Skybridge from uncapped exposure for good-faith security failures.

Walk-Away. Skybridge should not agree to fully uncapped data breach indemnification without any qualifier or narrowing mechanism. At an absolute minimum, if the indemnity is to be uncapped in any respect, the trigger must be narrowed to exclude non-culpable breaches (i.e., breaches not caused by Skybridge's gross negligence or willful misconduct), and the super-cap must apply to all other claims.

Client Coordination Note. This is the most contentious of the eight open issues and the one most likely to require escalation within Skybridge's leadership team. We recommend scheduling a dedicated call with David Shimura (General Counsel) and Jonathan Kreske (CFO) to confirm Skybridge's risk tolerance on this issue, review the financial implications of various cap levels, and determine the point at which Skybridge would be prepared to walk away from the deal. We also recommend coordinating with Amara Okafor (CISO) to prepare a security posture summary that can be shared with Meridian (subject to appropriate confidentiality protections) to demonstrate the strength of Skybridge's security controls and the low risk profile, which may help reduce the temperature on this issue.

Issue 4: Consequential Damages Carve-Out for Regulatory Fines

Meridian's Position. Meridian seeks to carve out regulatory fines and penalties from the mutual exclusion of indirect, incidental, consequential, and punitive damages contained in the MSA. Meridian's argument is that if the SkyComply™ platform causes a BSA/AML compliance failure — for example, by failing to detect suspicious transactions that should have been flagged, or by generating an unacceptable false-negative rate — Meridian could face an OCC enforcement action with substantial monetary fines. Meridian views such fines as direct, foreseeable consequences of a compliance platform failure, not as remote or speculative consequential damages, and argues that excluding them from the consequential damages waiver is both reasonable and necessary to properly allocate the risk.

This is a particularly sensitive issue because it goes to the heart of the SkyComply™ value proposition. SkyComply™ is marketed and sold as a regulatory compliance platform, and its purpose is to help banks detect and report suspicious activity. If the platform fails to perform that function adequately, the most significant and direct consequence to the bank — apart from the operational impact — is regulatory exposure.

Skybridge's Position. The MSA already provides a mutual exclusion of consequential damages with negotiated carve-outs for three categories: (a) breaches of confidentiality obligations; (b) IP indemnification obligations; and (c) data security breaches. These carve-outs are consistent with market practice for enterprise SaaS agreements and reflect the areas where the parties have agreed that consequential damages should be recoverable.

Skybridge resists adding regulatory fines as an additional carve-out for three principal reasons. First, regulatory fines and penalties are quintessentially consequential or indirect damages. They are imposed by a third party (the regulator) on Meridian, not directly by Skybridge, and their magnitude is determined by factors entirely outside Skybridge's control, including Meridian's overall compliance program, examination history, cooperation with regulators, and the regulatory climate. Second, Meridian retains ultimate responsibility for its own BSA/AML compliance. SkyComply™ is a tool that supports Meridian's compliance program, but it is not and cannot be a guarantee of regulatory compliance. Meridian's compliance obligations are non-delegable, and its own policies, procedures, training, and oversight are at least as important as the technology platform in determining regulatory outcomes. Third, the exposure is unquantifiable. OCC enforcement actions against major banks have resulted in fines ranging from tens of millions to hundreds of millions of dollars. Agreeing to bear this exposure, even through a consequential damages carve-out, could result in a claim that dwarfs the total contract value and Skybridge's entire revenue base.

Recommended Strategy. Primary Position. Reject the carve-out entirely. Argue that Meridian's own compliance program — not Skybridge's platform alone — drives regulatory outcomes, and that the MSA's representations and warranties (including the warranty that the platform performs materially in accordance with the Documentation and the warranty of material compliance with applicable laws), together with the existing indemnification provisions, provide Meridian with adequate contractual protection. Emphasize that the consequential damages exclusion already includes carve-outs for the most sensitive risk categories (confidentiality, IP, data security) and that regulatory fines present a fundamentally different risk profile — one that is driven by the regulator's exercise of discretion, not by the vendor's conduct alone.

Compromise Position. If Meridian views this as essential, agree to a narrowly drafted carve-out that applies only to regulatory fines that are directly and solely the result of a defect in the SkyComply™ platform of which Skybridge was notified in writing and failed to remediate within a commercially reasonable cure period (we recommend 90 days). The carve-out would be subject to the aggregate liability cap (2× annual fees, or approximately $18,650,000), or at most the data security/confidentiality super-cap (3× annual fees, or approximately $27,975,000). This narrowing ensures that the carve-out applies only to situations where Skybridge had actual notice of a platform defect and failed to act, and it preserves a financial ceiling that is manageable for the company.

Fallback Position. If Meridian insists on a broader formulation, cap the regulatory fines carve-out at the data security super-cap (3× annual fees, approximately $27,975,000) and require that the regulatory fine must have been directly caused by a material breach by Skybridge (not by Meridian's own compliance failures, staffing decisions, or other factors). The carve-out would also exclude fines arising from (i) Meridian's failure to implement Skybridge's recommended configurations or updates; (ii) Meridian's modification of or interference with the platform; and (iii) any acts or omissions by Meridian's own personnel in the use of the platform.

Walk-Away. Skybridge should not agree to an uncapped carve-out for regulatory fines without any causation qualifier or financial cap. The combination of uncapped exposure, unquantifiable risk, and multi-factor causation makes an uncapped regulatory fines carve-out commercially unacceptable. If Meridian is unwilling to accept any cap or causation limitation, we should escalate to Priya Chandrasekaran for a strategic decision on whether to proceed.

Issue 5: Security Incident Notification Window

Meridian's Position. Meridian demands that Skybridge provide notification within 12 hours following the discovery of a confirmed Security Incident affecting Meridian data. Meridian's position is driven by OCC supervisory expectations and the Interagency Guidance on Third-Party Relationships, which require banks to receive prompt notification from critical service providers of security events that may affect the bank's operations, data, or customers. Meridian has indicated that a 12-hour window is consistent with what it has obtained from other critical technology vendors and that the 24-hour period proposed by Skybridge is insufficient for a platform handling regulatory-critical AML/BSA data.

Skybridge's Position. Skybridge proposes a 24-hour notification window following discovery of a confirmed Security Incident. The 24-hour window is based on Skybridge's operational need to conduct an initial investigation and triage before issuing a notification to Meridian. Skybridge's incident response process involves multiple stages: initial detection and alerting, confirmation that a genuine security incident has occurred (as opposed to a false positive or routine security event), preliminary assessment of scope and impact, and formulation of an initial containment strategy. Premature notification — before these steps are complete — can create unnecessary alarm, trigger Meridian's own incident response protocols prematurely, and result in incomplete or inaccurate information being communicated to Meridian's leadership and potentially to regulators. Skybridge also notes that many state data breach notification laws provide 60 to 72 hours for consumer notification, and that 24 hours from discovery is already a significantly accelerated timeline.

Recommended Strategy. Primary Position. Hold at 24 hours. Note that this is consistent with standard industry practice for enterprise SaaS providers, that it provides Skybridge with the time necessary for initial investigation and triage, and that premature notification without sufficient information can be counterproductive and potentially harmful to both parties' interests.

Compromise Position. Offer an 18-hour notification window as a middle ground. Alternatively — and this is our preferred compromise — offer a two-stage notification protocol: (i) a preliminary notification within 12 hours of discovery, confirming that a Security Incident affecting Meridian data has occurred and is under active investigation by Skybridge's incident response team, with a preliminary assessment of the nature of the incident; followed by (ii) a detailed incident report within 48 hours of the preliminary notification, providing the scope of the incident, the categories and approximate volume of affected data, the containment and remediation steps taken, and an assessment of the root cause. This two-stage approach gives Meridian the prompt awareness that it needs for regulatory purposes while giving Skybridge the time necessary to provide accurate, actionable information. We believe this approach will be attractive to Meridian because it aligns with the bank's own internal incident escalation procedures and regulatory reporting obligations.

Fallback Position. Accept the 12-hour notification window, but insist on narrow definitions of key terms. Specifically: (i) "Discovery" should be defined as the point at which Skybridge's incident response team has confirmed that a Security Incident involving Meridian data has occurred, not the point of initial detection or automated alert; (ii) "confirmed Security Incident" should be defined to exclude routine security events, false positives, vulnerability scans, and unsuccessful intrusion attempts; and (iii) the notification obligation should be limited to Security Incidents that are reasonably likely to result in the unauthorized access to, disclosure of, or loss of Meridian data. These definitional guardrails prevent the 12-hour clock from being triggered by every automated security alert and ensure that notifications are meaningful and actionable.

Walk-Away. A 12-hour notification window with reasonable definitions of "Discovery" and "confirmed Security Incident" is acceptable if necessary to close the deal. This is not a walk-away issue, but we should be firm on the definitional protections.

Issue 6: Penetration Testing Scope

Meridian's Position. Meridian demands the right to conduct annual penetration testing at Meridian's expense covering both the infrastructure layer and the application layer of the SkyComply™ platform. Meridian cites FFIEC guidance and OCC expectations for vendor oversight of critical service providers, arguing that a bank must have the ability to independently verify the security posture of its critical vendors across the full technology stack, including the underlying infrastructure. Meridian's designated auditor would conduct the testing, though Meridian has indicated it would also accept testing conducted by Crestfield Cyber Advisors.

Skybridge's Position. Skybridge permits annual third-party penetration testing of the application layer only. Skybridge opposes customer-initiated infrastructure-layer testing for three reasons. First, the SkyComply™ platform operates on Orion Cloud Services' multi-tenant infrastructure. Infrastructure-layer penetration testing initiated by or on behalf of a single customer could affect other Skybridge customers sharing the same infrastructure. Second, Orion Cloud's terms of service restrict customer-initiated infrastructure testing; Skybridge

MEMORANDUM
PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT / ATTORNEY-CLIENT COMMUNICATION
TO: Angela Fontaine, Responsible Partner Liam Prescott, Of Counsel (Technology Transactions)
FROM: Amy Chesterton, Lead Associate
DATE: September 3, 2025
RE: Deal Summary and Negotiation Strategy — Skybridge Fintech Ltd. / Meridian National Bank, N.A. Enterprise SaaS Agreement
MATTER NO.: 1009-00007
CC: Nathan Ikeda, Working Associate
This memorandum is a privileged and confidential attorney work product and attorney-client communication. It is prepared in anticipation of litigation and in connection with the provision of legal advice to Skybridge Fintech Ltd. It should not be disclosed to any third party without prior written authorization from the responsible partner.
Right-click to update Table of Contents
I. Purpose and Executive Summary
The purpose of this memorandum is threefold. First, it provides a comprehensive summary of the key terms of the proposed enterprise Software-as-a-Service agreement between our client, Skybridge Fintech Ltd. ("Skybridge" or "SBF"), as licensor and SaaS provider, and the counterparty, Meridian National Bank, National Association ("Meridian" or "MNB"), as licensee. Second, it identifies and analyzes the eight principal open negotiation issues that remain unresolved between the parties. Third, it sets forth a recommended negotiation strategy for each such open issue, including our primary position, compromise positions, fallback positions, and walk-away boundaries, so that the deal team and our client contacts can proceed with clear tactical guidance as we enter the substantive negotiation phase with Meridian and its outside counsel.
The proposed transaction is a significant enterprise SaaS agreement with a Total Contract Value of $50,000,000 over a five-year initial term. Under the agreement, Skybridge will license its proprietary SkyComply™ platform — an AI-driven anti-money-laundering and transaction-monitoring solution — to Meridian for deployment across Meridian's retail banking, commercial banking, and wealth management divisions. The platform will serve approximately 32,000 named users across Meridian's U.S. and international operations. This is the single largest contract in Skybridge's history and, if executed successfully, will represent a marquee client relationship that positions Skybridge favorably in the Tier 1 banking market segment.
Meridian is represented by Hargrove, Tully & Cascade Insurance Brokers ("HTM"), a prominent New York-based firm with a well-established financial institutions practice. HTM's team is led by Douglas Krenshaw, Partner, and Megan Faircloth, Senior Associate, with associate support from Ryan Tso. Meridian's internal legal lead for this transaction is Catherine Woo, Associate General Counsel (Technology). Based on our prior dealings with HTM and their general reputation in the market, we anticipate that HTM will take an aggressive posture in negotiations, particularly on security, indemnification, and liability terms. HTM's standard approach for bank clients is to impose the bank's own form agreement; however, we have successfully secured agreement to proceed from Skybridge's initial draft MSA, which provides us with a meaningful negotiating advantage in framing the terms.
On the Skybridge side, the key client contacts for this transaction are as follows: David Shimura, General Counsel; Amara Okafor, Chief Information Security Officer; Marcus Holt, Chief Technology Officer; Tara Bellingham, Vice President, Enterprise Sales; Jonathan Kreske, Chief Financial Officer; and Priya Chandrasekaran, Chief Executive Officer. We will be working most closely with David Shimura and Tara Bellingham on day-to-day negotiations, with escalation to Jonathan Kreske and Priya Chandrasekaran as needed on commercial and strategic questions.
A critical procedural consideration is that Pinnacle Ridge Capital Partners, LP ("PRCP"), Skybridge's 62% majority owner, holds a contractual consent right over any Skybridge contract exceeding $25,000,000 in total value. PRCP is a growth-equity fund with approximately $3.4 billion in assets under management, led by Managing Partner Elise Drummond. PRCP made its Series C investment in Skybridge in 2021 at a $310 million pre-money valuation and currently holds two board seats. Because this agreement has a TCV of $50,000,000, it unambiguously triggers PRCP's consent right. PRCP's outside counsel is Simone Alcott, Partner at Alcott & Grenier LLP. We will need to submit the near-final MSA and Order Form to Simone Alcott for PRCP review and prepare a form of written consent for Elise Drummond's execution. This process must be completed before MSA execution, and we have built a two-week window for PRCP review into our recommended negotiation timeline (Section VII below).
The eight principal open negotiation issues, which are summarized in Section III and analyzed in full detail in Section IV, span the core risk allocation provisions of the agreement: uptime commitments, SLA credits, data breach indemnification, consequential damages, security incident notification, penetration testing, liability caps, and insurance. These issues are interrelated and should be negotiated as an integrated package wherever possible. Our overarching strategic objective is to protect Skybridge's financial exposure while acknowledging Meridian's legitimate regulatory and operational concerns as a systemically important financial institution, and to close the transaction on terms that are commercially sustainable for Skybridge, satisfactory to PRCP, and defensible in the market.
II. Transaction Overview
A. The Parties
Skybridge Fintech Ltd.
Skybridge Fintech Ltd. is a Delaware limited company (alternative entity) with its headquarters at 1400 Concord Pike, Suite 320, Wilmington, Delaware 19803. Skybridge is a growth-stage financial technology SaaS company founded in 2018 that specializes in compliance automation solutions for the banking and financial services industry. Its flagship product, SkyComply™, is an AI-driven anti-money-laundering and transaction-monitoring platform designed to assist financial institutions in meeting their obligations under the Bank Secrecy Act, USA PATRIOT Act, and related regulatory requirements.
As of the most recent fiscal year, Skybridge had approximately 420 employees. Its audited financial statements for fiscal year 2024, prepared by Hathaway & Pendleton, LLP (audit opinion dated April 30, 2025, lead audit partner Bruce Ogilvie), reflect annual revenue of $78.3 million, EBITDA of $11.7 million, gross margin of approximately 74%, and a net retention rate of 118%. Annualized recurring revenue stands at approximately $78 million. The company currently serves over 60 banking and financial services clients, including regional and mid-market banks, credit unions, and broker-dealer firms. However, the proposed Meridian engagement would represent Skybridge's first Tier 1 U.S. banking client.
Skybridge maintains a robust security posture. It holds a SOC 2 Type II certification (report dated March 15, 2025, prepared by Crestfield Cyber Advisors, Inc.) and ISO 27001 certification (recertified January 22, 2025, also by Crestfield). Crestfield is the company's long-standing independent third-party security auditor, and the lead auditor on the most recent engagements is Deepa Rajan. These certifications, combined with Skybridge's internal security program, are central to the company's value proposition in the regulated financial services market and will be key to our negotiation positions on security-related issues.
Skybridge is majority-owned (62%) by Pinnacle Ridge Capital Partners, LP, which made its Series C investment in 2021 at a pre-money valuation of $310 million. PRCP is a growth-equity fund with approximately $3.4 billion in assets under management, led by Managing Partner Elise Drummond. PRCP holds two seats on Skybridge's board of directors and, as noted above, maintains a contractual consent right over any Skybridge contract exceeding $25 million in total value. The remaining equity is held by the founders, management team, and earlier-stage investors.
Meridian National Bank, N.A.
Meridian National Bank, N.A. is a national banking association chartered under federal law, with its principal office located at 600 Lexington Avenue, 40th Floor, New York, New York 10022. Meridian is a wholly owned subsidiary of Meridian Financial Group, Inc., a Delaware corporation listed on the New York Stock Exchange. Meridian Financial Group is one of the largest financial holding companies in the United States.
Meridian holds approximately $485 billion in total assets, placing it among the top ten U.S. banks by total assets. It is classified as a systemically important financial institution ("SIFI") and is subject to heightened regulatory oversight by the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation ("FDIC"). Meridian's SIFI designation carries significant implications for this transaction, as the bank is subject to enhanced prudential standards, heightened expectations for third-party vendor management, and intensified examination scrutiny of its technology and compliance infrastructure.
Meridian is undertaking a comprehensive modernization of its anti-money-laundering compliance infrastructure, replacing its legacy AML platform with SkyComply™ across three divisions: retail banking, commercial banking, and wealth management. The deployment will encompass approximately 32,000 licensed users across Meridian's U.S. and international operations. The bank's key internal stakeholders for this transaction are Gerald Brannigan, Chief Information Officer (executive sponsor for the initiative); Sandra Petrov, Head of Financial Crimes and Compliance; and Luis Arriaga, Senior Vice President, Procurement and Vendor Management (who serves as the day-to-day relationship lead for vendor engagements of this type).
The significance of this engagement to both parties cannot be overstated. For Meridian, the replacement of its legacy AML platform with SkyComply™ is a strategic initiative driven by both regulatory pressure and the desire to leverage artificial intelligence and machine learning capabilities to improve the quality of transaction monitoring and suspicious activity reporting. For Skybridge, securing Meridian as a client validates the platform in the Tier 1 banking market, creates substantial recurring revenue, and enhances the company's competitive position for future engagements with large financial institutions.
B. Agreement Structure
The proposed transaction will be documented through a suite of interlocking agreements and exhibits, structured as follows:
Master Software-as-a-Service Agreement ("MSA"). The MSA serves as the core contract governing the overall relationship between the parties. It addresses the scope of the license grant, the parties' respective obligations, service levels, security requirements, intellectual property ownership, indemnification, limitations of liability, term and termination, confidentiality, and general provisions. The MSA is being drafted from Skybridge's standard form, which we have customized for this engagement to address the unique requirements of a SIFI counterparty.
Order Form. The Order Form documents the specific commercial terms of the engagement, including the fee structure, user counts, payment schedule, implementation timeline, and any transaction-specific commercial concessions. The Order Form will be executed simultaneously with the MSA and incorporated by reference.
Exhibit A: SLA Exhibit. The SLA Exhibit sets forth the detailed service level commitments, including monthly uptime targets, the tiered SLA credit structure, incident response time requirements, planned maintenance windows, and the methodology for calculating uptime and credits. The SLA Exhibit is one of the most heavily negotiated components of the agreement and is the subject of Issues 1 and 2 in our analysis below.
Exhibit B: Security Exhibit. The Security Exhibit documents Skybridge's security obligations, including required certifications (SOC 2 Type II, ISO 27001), encryption standards (at rest and in transit), penetration testing requirements, audit rights, security incident notification procedures, and personnel background check requirements. This exhibit is the subject of Issues 5 and 6 in our analysis below.
Exhibit C: Data Processing Addendum ("DPA"). The DPA governs the processing of Meridian's data by Skybridge, including data categorization (with particular emphasis on GLBA nonpublic personal information and personally identifiable information), subprocessor approval requirements, data residency commitments, data retention and deletion obligations, and cross-border data transfer restrictions. The DPA identifies Orion Cloud Services, Inc. as an initial approved subprocessor.
Exhibit D: Acceptable Use Policy ("AUP"). The AUP establishes permitted and prohibited uses of the SkyComply™ platform and provides for Meridian's indemnification of Skybridge with respect to any claims arising from Meridian's breach of the AUP.
Source Code Escrow Agreement. The parties will enter into a three-party source code escrow agreement with Sentinel Escrow Services, Inc. (Escrow Agreement No. SCE-2025-04417). The agreement provides for an initial deposit of the SkyComply™ source code within 30 days of MSA execution, with quarterly updates thereafter. Release triggers include Skybridge's insolvency, material breach of support obligations uncured for 60 days, and cessation of business. Escrow fees are $13,000 per year, split equally between the parties ($6,500 each).
Governing Law and Dispute Resolution. The MSA will be governed by the laws of the State of Delaware, without regard to conflict of laws principles. Exclusive venue for any disputes will lie in the state or federal courts sitting in Wilmington, Delaware — specifically, the Delaware Court of Chancery or the United States District Court for the District of Delaware. Prior to litigation, the parties will be required to follow a mandatory dispute resolution process consisting of three-tier executive escalation (account managers, then VP-level, then CEO/CIO) followed by a 60-day JAMS-administered mediation. The MSA will include a mutual waiver of the right to a jury trial.
C. Commercial Terms Summary
The commercial terms of this engagement are substantial and reflect both the scale of Meridian's deployment and the volume-based discount that Skybridge has offered to secure the relationship. The key financial terms are as follows:
Total Contract Value. The Total Contract Value is $50,000,000 over the five-year initial term of the agreement.
Gross Undiscounted TCV. The gross undiscounted TCV, based on list pricing, is $53,600,000, broken down as follows: Year 1 fees of $13,600,000 plus Years 2 through 5 fees totaling $40,000,000.
Volume discount. The aggregate volume discount is 6.72%, calculated as follows: ($53,600,000 − $50,000,000) ÷ $53,600,000 = 6.72%. This discount level is within the range authorized by Tara Bellingham under Skybridge's internal pricing guidelines for Tier 1 banking engagements and has been approved by Jonathan Kreske.
Fee Components (Pre-discount). The undiscounted fee components are structured as follows:
Adjusted Annual Fees (Post-discount). After application of the volume discount, the annual fee schedule is as follows:
The Year 1 fee of $12,700,000 reflects the inclusion of the one-time implementation and onboarding fee. The remaining $37,300,000 across Years 2 through 5 is distributed evenly at $9,325,000 per year.
Payment Terms. Fees are payable quarterly in advance, with payment due within net 30 days of the invoice date. Invoices will be issued at the beginning of each calendar quarter during the term.
Annual Escalator. Beginning in Year 3, annual fees are subject to a CPI-based escalator of 3.0%, capped at 3.5% per year. The escalator applies to the platform subscription and support and managed services components but does not apply to the one-time implementation fee. The escalator was a late addition to the commercial negotiation at Meridian's request (Meridian sought a flat rate for the full term); the 3.0% base with a 3.5% cap represents a reasonable compromise that protects Skybridge against inflationary cost increases while providing Meridian with rate predictability.
Incremental Users. Users above the 32,000 named user base are priced at $275 per user per year, with no volume discount applied to incremental users. This pricing reflects a modest premium over the discounted per-user rate of approximately $239 per user per year embedded in the base subscription (i.e., $9,325,000 less $1,800,000 support = $7,525,000 for subscription, divided by 32,000 users).
Licensed User Count. The initial deployment covers 32,000 named users. Meridian has indicated that it may seek to expand the user base during the term, particularly if the platform is deployed to additional international operations or if headcount growth in its compliance and financial crimes functions exceeds current projections.
D. Term, Renewal, and Termination
Initial Term. The initial term is five years, commencing on the Platform Go-Live Date and ending five years thereafter. The targeted Go-Live Date is March 1, 2026, which would establish an initial term running from March 1, 2026 through February 28, 2031.
Implementation Period. The implementation period is targeted to run from approximately September 15, 2025 through February 28, 2026, a span of approximately 5.5 months. This period encompasses system configuration, data migration, integration testing, user acceptance testing, training, and parallel processing with Meridian's legacy AML platform. Marcus Holt (CTO) has confirmed that this timeline is achievable, though aggressive, and has flagged the need for timely access to Meridian's systems and data environments as a potential risk to the schedule.
Renewal. Following the expiration of the initial five-year term, the agreement will automatically renew for up to two successive one-year renewal terms, unless either party provides written notice of non-renewal at least 180 days prior to the end of the then-current term. The 180-day notice period is designed to provide both parties with adequate time to plan for either a transition to a replacement platform (in Meridian's case) or for revenue planning purposes (in Skybridge's case).
Termination for Convenience. Meridian may terminate the agreement for convenience after the completion of Year 2, subject to two conditions: (i) Meridian must provide 12 months' prior written notice of termination; and (ii) Meridian must pay an early termination fee ("ETF") equal to 50% of the remaining Annual Contract Value for the then-current term. For illustrative purposes, if Meridian terminates effective at the end of Year 3, the ETF would be calculated as follows: 50% × $9,325,000 × 2 remaining years = $9,325,000. The termination for convenience right was a commercial concession agreed upon during the term sheet phase; the ETF is designed to protect Skybridge's investment in the implementation and the economics of the five-year commitment.
SLA-Based Termination Right. In addition to the termination for convenience right, Meridian has a termination right if platform uptime falls below 98.0% in three of any consecutive six months. This termination right is designed to protect Meridian against chronic underperformance and is a standard provision in enterprise SaaS agreements for critical-function platforms. The 98.0% threshold and the three-of-six-months measurement period were negotiated during the commercial phase and are not among the currently open issues.
E. Key Third-Party Relationships
The proposed transaction involves several important third-party relationships that are relevant to the negotiation and that are referenced throughout the agreement documents.
Orion Cloud Services, Inc. Orion Cloud Services is the infrastructure-as-a-service ("IaaS") provider that hosts the SkyComply™ platform. Skybridge operates SkyComply™ on Orion Cloud's platform, which provides compute, storage, and networking services in a multi-tenant cloud environment. Orion Cloud's platform SLA provides a 99.95% monthly uptime commitment for its infrastructure services. The SkyComply™ platform is hosted in Orion Cloud's US-East (Virginia) and US-West (Oregon) regions only, consistent with Meridian's data residency requirements. Orion Cloud is identified as an initial approved subprocessor under the DPA. The dependency on Orion Cloud's infrastructure is directly relevant to Issues 1 and 6 in our negotiation analysis, as Skybridge's ability to deliver uptime above 99.9% is constrained by Orion Cloud's own infrastructure performance, and Orion Cloud's terms of service restrict customer-initiated infrastructure-layer penetration testing.
Crestfield Cyber Advisors, Inc. Crestfield is Skybridge's independent third-party security auditor. Crestfield prepared the most recent SOC 2 Type II report (dated March 15, 2025) and conducted the ISO 27001 recertification audit (dated January 22, 2025). The lead auditor on both engagements is Deepa Rajan. Crestfield also conducts Skybridge's annual third-party penetration testing, the results of which Skybridge has historically shared with clients under NDA. Meridian has requested the right to commission additional penetration testing through Crestfield or its own designated auditor, which is the subject of Issue 6 below.
Coastal Assurance Corporation. Coastal Assurance Corporation is Skybridge's cyber liability and errors and omissions insurer. The current policy is Policy No. CA-TECH-2025-07831, with coverage limits of $25 million per occurrence and $50 million in the aggregate. The policy period runs from April 1, 2025 through March 31, 2026. The Coastal Assurance policy is directly relevant to the negotiations on the data breach indemnification cap (Issue 3), the confidentiality/data security super-cap (Issue 7), and additional insured status (Issue 8). The alignment between the per-occurrence limit of $25 million and our proposed super-cap of approximately $27,975,000 (3× annual fees) is an important data point for the negotiation.
Sentinel Escrow Services, Inc. Sentinel Escrow Services is the source code escrow agent. The three-party Source Code Escrow Agreement (No. SCE-2025-04417) provides for an initial deposit of the SkyComply™ source code within 30 days of MSA execution, with quarterly updates to the deposit thereafter. The release triggers negotiated in the escrow agreement include: (i) Skybridge's insolvency or commencement of bankruptcy proceedings; (ii) a material breach of Skybridge's support obligations that remains uncured for 60 days following written notice; and (iii) Skybridge's cessation of business operations. Annual escrow fees are $13,000, split equally between the parties at $6,500 each. The escrow agreement is substantially agreed and is not among the open negotiation issues.
Hathaway & Pendleton, LLP. Hathaway & Pendleton is Skybridge's independent financial auditor. The firm's most recent audit opinion, covering fiscal year 2024, is dated April 30, 2025. The lead audit partner is Bruce Ogilvie. Meridian's due diligence team has requested and received a copy of the FY 2024 audited financial statements, and the financial data in this memorandum is drawn from that report.
F. Regulatory Landscape
The regulatory environment governing this transaction is complex and warrants careful attention throughout the negotiation process. Meridian's status as a nationally chartered bank and SIFI means that the agreement must be structured and documented in a manner that satisfies the expectations of multiple federal banking regulators.
OCC, Federal Reserve, and FDIC Oversight. As a national banking association, Meridian is subject to primary supervision by the OCC, with additional oversight by the Federal Reserve (as the consolidated supervisor of the holding company) and the FDIC (as deposit insurer). Meridian's SIFI designation subjects it to enhanced prudential standards under Title I of the Dodd-Frank Wall Street Reform and Consumer Protection Act, including heightened expectations for enterprise-wide risk management, which extends to third-party vendor relationships.
OCC Bulletin 2013-29 and Interagency Guidance. The agreement must comply with the requirements and expectations set forth in OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance) and the Interagency Guidance on Third-Party Relationships issued jointly by the OCC, Federal Reserve, and FDIC in June 2023. These guidance documents establish supervisory expectations for banks' management of third-party relationships, including expectations for due diligence, contract negotiation, ongoing monitoring, and contingency planning. The guidance is particularly prescriptive with respect to "critical" third-party relationships — which this engagement will almost certainly be classified as — and requires, among other things, that contracts address performance standards, audit rights, regulatory examination access, business continuity, data protection, and termination rights.
Bank Service Company Act. Skybridge qualifies as a "bank service company" under the Bank Service Company Act, 12 U.S.C. § 1867, by virtue of providing technology services to a federally regulated bank. Under the Act, federal banking regulators have the authority to examine the services, records, and facilities of a bank service company to the same extent as if the services were being performed by the bank itself. The MSA must include a contractual acknowledgment of this examination right. Specifically, Skybridge must agree to cooperate with examinations by the OCC, Federal Reserve, and FDIC, to make its relevant records and facilities available for examination, and to not unreasonably restrict the regulators' access. This provision is not among the open negotiation issues, as Skybridge has previously agreed to similar provisions in other bank client contracts.
BSA/AML Regulatory Compliance. BSA/AML regulatory compliance is the core function of the SkyComply™ platform. The platform is designed to monitor transactions, identify suspicious activity, facilitate the filing of suspicious activity reports, and support Meridian's broader compliance program. Any material regulatory finding against the platform — such as a finding that the platform's monitoring algorithms are inadequate or that the platform contributed to a compliance failure — could have severe consequences for both Meridian and Skybridge. The MSA includes a termination right in favor of Meridian in the event of a material adverse regulatory finding directly related to the SkyComply™ platform, subject to a cure period. The interplay between the platform's regulatory function and the consequential damages carve-out for regulatory fines (Issue 4) is one of the most sensitive negotiation points.
GLBA and Data Breach Notification Requirements. The Gramm-Leach-Bliley Act ("GLBA") imposes obligations on financial institutions and their service providers with respect to the protection of nonpublic personal information ("NPI"). As a service provider handling Meridian's customer NPI, Skybridge must implement appropriate safeguards and comply with GLBA requirements as implemented through the Interagency Guidelines Establishing Information Security Standards. In addition, applicable state data breach notification laws will govern the obligations of both parties in the event of unauthorized access to or disclosure of personally identifiable information ("PII") or NPI.
G. Representations and Warranties
The MSA includes a standard set of mutual and one-sided representations and warranties, as follows:
By Skybridge. Skybridge represents and warrants that: (a) the SkyComply™ platform will perform materially in accordance with the Documentation provided to Meridian; (b) all services will be performed in a professional and workmanlike manner consistent with generally accepted industry standards; (c) Skybridge has all necessary rights, licenses, and authorizations to grant the license contemplated by the agreement and to provide the services; (d) the platform, as delivered, will not contain any malicious code, viruses, worms, Trojan horses, or similar disabling or destructive code; (e) Skybridge is in material compliance with all applicable laws, rules, and regulations relevant to its performance under the agreement; and (f) Skybridge's security practices meet or exceed industry standards for financial services SaaS providers, as evidenced by its SOC 2 Type II and ISO 27001 certifications.
By Meridian. Meridian represents and warrants that: (a) it has the corporate authority to enter into the agreement and to perform its obligations thereunder; and (b) its use of the platform will be in compliance with the Acceptable Use Policy and all applicable laws, rules, and regulations.
Warranty Period. The warranty period for implementation services is 12 months from the Go-Live Date. The platform subscription warranties are ongoing throughout the term of the agreement. The 12-month warranty period for implementation services provides Meridian with protection against latent defects in the configuration and deployment work performed during the implementation phase.
H. Insurance Requirements
The MSA requires Skybridge to maintain specified insurance coverage throughout the term of the agreement. The contractual insurance minimums, as proposed by Skybridge, are as follows:
Skybridge's current Coastal Assurance Corporation policy (Policy No. CA-TECH-2025-07831) meets or exceeds the Technology E&O / Cyber Liability requirements. The current policy limits of $25 million per occurrence and $50 million in the aggregate are precisely aligned with the contractual minimums proposed in the MSA. The CGL, Workers' Compensation, and Umbrella/Excess policies are maintained through separate carriers and are current and in good standing.
Meridian has requested additional insured status on both the CGL and Cyber/E&O policies, which is the subject of Issue 8 in our analysis below. Meridian has also requested that Skybridge deliver a certificate of insurance within 10 business days of MSA execution and annually thereafter for the duration of the term, confirming that the required coverage is in effect and that the coverage meets or exceeds the contractual minimums.
III. Summary of Eight Key Open Negotiation Issues
Based on our review of Meridian's initial term sheet comments, the preliminary discussions between Tara Bellingham and Luis Arriaga, and the positions articulated by Catherine Woo in her August 22, 2025 email to David Shimura, we have identified eight principal open negotiation issues. These issues represent the core risk allocation disputes between the parties and will constitute the primary focus of the substantive negotiation sessions with HTM. Each of these issues is analyzed in detail in Section IV below.
The eight open issues are as follows:
1. SLA Uptime Standard (99.95% vs. 99.9%). Meridian demands a 99.95% monthly uptime commitment; Skybridge proposes 99.9%. The gap represents approximately 22 minutes of additional permitted monthly downtime.
2. SLA Credit Cap (Uncapped vs. 15% Annual Cap). Meridian demands uncapped SLA credits; Skybridge proposes a monthly cap of 30% and an annual cap of 15% of the applicable subscription fee.
3. Data Breach Indemnity Cap (Uncapped vs. 2× Annual Fees). Meridian demands uncapped indemnification for data breach claims; Skybridge proposes a cap at 2× the annual fees paid in the preceding 12-month period.
4. Consequential Damages Carve-Out for Regulatory Fines. Meridian seeks to carve out regulatory fines and penalties from the mutual exclusion of consequential damages; Skybridge resists the carve-out.
5. Security Incident Notification Window (12 Hours vs. 24 Hours). Meridian demands 12-hour notification following discovery of a confirmed Security Incident; Skybridge proposes 24 hours.
6. Penetration Testing Scope (Infrastructure + Application vs. Application Only). Meridian demands the right to conduct penetration testing covering both infrastructure-layer and application-layer testing; Skybridge permits application-layer testing only.
7. Confidentiality/Data Security Super-Cap (Uncapped vs. 3× Annual Fees). Meridian demands uncapped liability for confidentiality and data security breaches; Skybridge proposes a "super-cap" at 3× annual fees.
8. Additional Insured Status on Cyber Policy. Meridian requests additional insured status on Skybridge's Cyber/E&O policy; Skybridge is reviewing feasibility with its carrier.
These issues are interconnected in several important respects. Issues 3, 4, and 7 collectively define the liability architecture for data-related claims and should be negotiated as an integrated package. Issues 1 and 2 together determine the financial consequences of uptime failures. Issues 5 and 6 relate to Skybridge's security obligations and Meridian's oversight rights. Issue 8 intersects with the liability and indemnification provisions by providing an insurance backstop for data-related claims.
IV. Detailed Analysis and Negotiation Strategy for Each Open Issue
Issue 1: SLA Uptime Standard
Meridian's Position. Meridian demands a monthly uptime commitment of 99.95%, measured exclusive of scheduled maintenance windows. Meridian's negotiating posture on this issue is driven by its status as a systemically important financial institution and the critical nature of the SkyComply™ platform to Meridian's BSA/AML compliance functions. Catherine Woo and Douglas Krenshaw have framed this demand as non-negotiable, arguing that SkyComply™ will serve as a regulatory-critical system and that any downtime creates examination risk and could impair Meridian's ability to meet its real-time transaction-monitoring obligations. Meridian has cited examples of other enterprise technology vendors that have committed to 99.95% or higher uptime standards in contracts with Tier 1 banks.
Skybridge's Position. Skybridge proposes a monthly uptime commitment of 99.9%, which is the standard commitment in Skybridge's existing client base and is consistent with Skybridge's historical performance metrics. The rationale for the 99.9% standard is grounded in the technical architecture of the SkyComply™ platform. Specifically, SkyComply™ is hosted on Orion Cloud Services' infrastructure, and Orion Cloud's own platform SLA provides a 99.95% monthly uptime commitment for its infrastructure layer. If Skybridge commits to 99.95% uptime to Meridian for the full application stack (which includes both the Orion Cloud infrastructure layer and the Skybridge application layer), there is effectively no margin for any application-layer issues, including routine deployments, patches, or minor performance degradations that fall within normal operating parameters.
The practical difference between 99.9% and 99.95% is approximately 22 minutes of additional permitted downtime per month. At 99.9%, the permitted monthly downtime is approximately 43 minutes; at 99.95%, the permitted monthly downtime is approximately 22 minutes. While this difference may appear modest in the abstract, it is significant from an operational and risk management perspective, particularly given the upstream dependency on Orion Cloud.
Market Benchmark. Based on our review of publicly available SLA terms and our experience with comparable enterprise SaaS agreements in the financial services sector, the prevailing market standard for mission-critical financial services SaaS platforms is 99.9% monthly uptime. Some agreements specify 99.5% as the baseline, with credits beginning at that threshold and escalating at higher downtime levels. A 99.95% commitment is aspirational and is typically seen only from hyperscale cloud infrastructure providers (e.g., Ridgeway Industries, Crestline Systems, Northgate Corporation) with respect to their core infrastructure services — not from SaaS application providers. It is important to note that even Orion Cloud's 99.95% SLA applies only to the infrastructure layer; it does not extend to or guarantee application-layer performance.
Nathan Ikeda is preparing a detailed SLA Terms Analysis Memo with additional market benchmarking data from comparable transactions, which will be available to support our negotiation position.
Recommended Strategy. Primary Position. Hold at 99.9% monthly uptime. Justify the position based on the upstream dependency on Orion Cloud Services, noting that Skybridge cannot commercially guarantee a standard that exceeds its own infrastructure provider's guarantee for the full technology stack. Emphasize that 99.9% is the prevailing market standard for enterprise SaaS providers in the financial services sector and that Skybridge's historical performance has consistently exceeded 99.9% (Marcus Holt can provide performance data to support this point).
Compromise Position. Offer 99.9% as the committed standard with enhanced SLA credit tiers. Specifically, we would propose increasing the credit percentage for performance below 98.0% from 30% to 35% of the monthly subscription fee, providing Meridian with additional financial protection in the event of significant underperformance. In addition, we would include a contractual commitment by Skybridge to use commercially reasonable efforts to achieve 99.95% as a performance target (as distinguished from a binding commitment), and to report monthly uptime performance against both the 99.9% committed standard and the 99.95% aspirational target.
Fallback Position. If Meridian remains insistent on 99.95% as the contractual standard, we would agree to 99.95% only under the following conditions: (i) the uptime measurement expressly excludes both scheduled maintenance windows and any downtime attributable to Orion Cloud Services infrastructure-level outages (i.e., a carve-out treating Orion Cloud infrastructure downtime as a force majeure or excluded event for SLA measurement purposes); and (ii) the parties expressly agree that SLA credits are the sole and exclusive remedy for any failure to meet the uptime target, with no right to claim additional damages for SLA shortfalls.
Walk-Away. Skybridge should not agree to 99.95% as a hard, contractually binding SLA without the infrastructure carve-out described above. Committing to 99.95% without such a carve-out would expose Skybridge to SLA credit liability and potential termination rights arising from events entirely outside its control (i.e., Orion Cloud outages). This is a risk that Skybridge cannot commercially absorb and that would set an unsustainable precedent for future client contracts.
Issue 2: SLA Credit Cap
Meridian's Position. Meridian demands uncapped SLA credits, arguing that credits serve as the primary financial incentive for Skybridge to invest in maintaining high uptime and that any cap on credits reduces the effectiveness of that incentive. HTM's position is that the cap effectively limits Meridian's downside protection to a modest fraction of the fees paid, even in the event of catastrophic and sustained platform outages. Meridian may also seek to structure credits as a reduction against future invoices without any monthly or annual ceiling.
Skybridge's Position. Skybridge proposes a tiered SLA credit structure with the following caps:
• Monthly Credit Cap: 30% of the monthly subscription fee. Based on the adjusted annual fees, this equates to a maximum monthly credit of approximately $317,500 in Year 1 (calculated as $12,700,000 ÷ 12 × 30% = $317,500) and approximately $233,125 in Years 2 through 5 (calculated as $9,325,000 ÷ 12 × 30% = $233,125).
• Annual Credit Cap: 15% of the annual subscription fee. This equates to a maximum annual credit of approximately $1,905,000 in Year 1 (calculated as $12,700,000 × 15%) and approximately $1,398,750 in Years 2 through 5 (calculated as $9,325,000 × 15%).
For credit calculation purposes, the monthly subscription fee is derived by dividing the annual fee by 12: $1,058,333 per month in Year 1 and $777,083 per month in Years 2 through 5.
A critical element of Skybridge's position is that SLA credits are designated as the sole and exclusive remedy for any failure to meet the uptime targets specified in the SLA Exhibit. This exclusive remedy provision is essential to the overall liability architecture, as it prevents Meridian from asserting additional claims for breach of contract or seeking damages beyond the credit structure for SLA-related performance shortfalls.
Recommended Strategy. Primary Position. Maintain the existing capped credit structure with the tiered framework described above. Argue that SLA credits are properly understood as a service-level incentive mechanism, not a liability or damages provision, and that uncapped credits fundamentally undermine revenue predictability — a concern that is particularly acute for a growth-stage company like Skybridge. Emphasize that Meridian's true protection against chronic underperformance lies in the termination right (below 98.0% in three of any consecutive six months), not in unlimited service credits.
Compromise Position. Increase the annual credit cap from 15% to 20% of the annual subscription fee, resulting in a maximum annual credit of approximately $2,540,000 in Year 1 and approximately $1,865,000 in Years 2 through 5. Pair this increase with the express inclusion of the chronic underperformance termination right (below 98.0% in three of any consecutive six months), framing the termination right as the meaningful backstop that renders uncapped credits unnecessary. This combination provides Meridian with both enhanced financial incentives for performance and a decisive exit option in the event of sustained underperformance.
Fallback Position. Increase the monthly credit cap from 30% to 40% of the monthly subscription fee, but maintain the annual cap at 20%. This provides Meridian with greater month-to-month credit protection while preserving an annual ceiling that protects Skybridge's revenue. Continue to insist that credits are the sole and exclusive remedy for SLA failures.
Walk-Away. Skybridge should not agree to uncapped SLA credits under any circumstances. The credit structure must include both a monthly and an annual cap, and credits must be expressly designated as the sole and exclusive remedy for uptime failures. Uncapped credits would create an unbounded financial liability that is inconsistent with the economics of a SaaS subscription model and could, in a sustained outage scenario, result in Skybridge effectively refunding the entirety of the fees paid — an outcome that is commercially unacceptable and that would raise concerns with PRCP and the board.
Issue 3: Data Breach Indemnification Cap
Meridian's Position. Meridian demands fully uncapped indemnification for data breach claims — that is, claims arising from Skybridge's breach of its data security or confidentiality obligations that results in the unauthorized access to, disclosure of, or loss of Meridian's data, including the NPI and PII of Meridian's customers. Meridian's rationale is straightforward and commercially powerful: Meridian handles the nonpublic personal information of millions of banking customers, and a data breach involving this information could result in regulatory enforcement actions by the OCC, Federal Reserve, and FDIC; class action litigation under state consumer protection laws and common law theories; individual customer claims; state attorney general investigations and enforcement; costs of notification, credit monitoring, and remediation; and significant reputational harm. Meridian argues that the potential losses from a major data breach could vastly exceed any cap and that it would be unreasonable to limit Skybridge's liability for breaches that are within Skybridge's control.
Skybridge's Position. Skybridge proposes capping data breach indemnification at 2× the annual fees paid in the 12-month period preceding the claim. In a steady-state year (Years 2 through 5), this cap would be approximately $18,650,000 (calculated as 2 × $9,325,000). This position is grounded in several considerations:
First, Skybridge's financial profile makes uncapped data breach exposure existential. With fiscal year 2024 revenue of $78.3 million and EBITDA of $11.7 million, a truly uncapped indemnification obligation on a $50 million contract with a $485 billion-asset bank represents an exposure that could exceed the entire enterprise value of Skybridge. The disparity in size and financial capacity between the parties is enormous, and the risk allocation must reflect this reality.
Second, intellectual property indemnification is already uncapped, which is consistent with industry standard practice. Adding uncapped data breach indemnification creates a compounding unlimited exposure that significantly increases Skybridge's overall risk profile.
Third, Skybridge's cyber insurance coverage through Coastal Assurance Corporation provides $25 million per occurrence and $50 million in the aggregate. While this coverage provides a meaningful backstop, it cannot cover truly uncapped contractual indemnification obligations, particularly if a single catastrophic breach were to exceed the per-occurrence limit or if multiple claims were to erode the aggregate limit.
Recommended Strategy. Primary Position. Hold at 2× annual fees (approximately $18,650,000). Emphasize that this cap level is consistent with market practice for enterprise SaaS agreements and that it represents a substantial commitment by a company of Skybridge's size. Highlight Skybridge's SOC 2 Type II and ISO 27001 certifications, its robust internal security program, and its track record of zero material security incidents across its 60+ banking and financial services client base as evidence that the risk of a data breach is low and that the cap is more than adequate.
Compromise Position. Offer a "super-cap" for data security and confidentiality breaches at 3× annual fees (approximately $27,975,000), as further discussed in Issue 7 below. Present this as the maximum that the company can commercially bear and note the close alignment between the $27,975,000 super-cap and the $25 million per-occurrence limit of the Coastal Assurance cyber insurance policy. The super-cap structure acknowledges the heightened sensitivity of data security claims while preserving a defined ceiling on exposure.
Fallback Position. If Meridian is adamant that the data breach indemnity must be uncapped, propose that uncapped liability apply only to data breaches caused by Skybridge's gross negligence or willful misconduct in connection with its data security obligations. This would narrow the uncapped trigger to the most egregious conduct (e.g., knowing failure to implement required security measures, deliberate circumvention of security controls) while maintaining the super-cap for data breach claims arising from ordinary negligence or other non-culpable breaches. This approach provides Meridian with genuine protection against bad-faith conduct while protecting Skybridge from uncapped exposure for good-faith security failures.
Walk-Away. Skybridge should not agree to fully uncapped data breach indemnification without any qualifier or narrowing mechanism. At an absolute minimum, if the indemnity is to be uncapped in any respect, the trigger must be narrowed to exclude non-culpable breaches (i.e., breaches not caused by Skybridge's gross negligence or willful misconduct), and the super-cap must apply to all other claims.
Client Coordination Note. This is the most contentious of the eight open issues and the one most likely to require escalation within Skybridge's leadership team. We recommend scheduling a dedicated call with David Shimura (General Counsel) and Jonathan Kreske (CFO) to confirm Skybridge's risk tolerance on this issue, review the financial implications of various cap levels, and determine the point at which Skybridge would be prepared to walk away from the deal. We also recommend coordinating with Amara Okafor (CISO) to prepare a security posture summary that can be shared with Meridian (subject to appropriate confidentiality protections) to demonstrate the strength of Skybridge's security controls and the low risk profile, which may help reduce the temperature on this issue.
Issue 4: Consequential Damages Carve-Out for Regulatory Fines
Meridian's Position. Meridian seeks to carve out regulatory fines and penalties from the mutual exclusion of indirect, incidental, consequential, and punitive damages contained in the MSA. Meridian's argument is that if the SkyComply™ platform causes a BSA/AML compliance failure — for example, by failing to detect suspicious transactions that should have been flagged, or by generating an unacceptable false-negative rate — Meridian could face an OCC enforcement action with substantial monetary fines. Meridian views such fines as direct, foreseeable consequences of a compliance platform failure, not as remote or speculative consequential damages, and argues that excluding them from the consequential damages waiver is both reasonable and necessary to properly allocate the risk.
This is a particularly sensitive issue because it goes to the heart of the SkyComply™ value proposition. SkyComply™ is marketed and sold as a regulatory compliance platform, and its purpose is to help banks detect and report suspicious activity. If the platform fails to perform that function adequately, the most significant and direct consequence to the bank — apart from the operational impact — is regulatory exposure.
Skybridge's Position. The MSA already provides a mutual exclusion of consequential damages with negotiated carve-outs for three categories: (a) breaches of confidentiality obligations; (b) IP indemnification obligations; and (c) data security breaches. These carve-outs are consistent with market practice for enterprise SaaS agreements and reflect the areas where the parties have agreed that consequential damages should be recoverable.
Skybridge resists adding regulatory fines as an additional carve-out for three principal reasons. First, regulatory fines and penalties are quintessentially consequential or indirect damages. They are imposed by a third party (the regulator) on Meridian, not directly by Skybridge, and their magnitude is determined by factors entirely outside Skybridge's control, including Meridian's overall compliance program, examination history, cooperation with regulators, and the regulatory climate. Second, Meridian retains ultimate responsibility for its own BSA/AML compliance. SkyComply™ is a tool that supports Meridian's compliance program, but it is not and cannot be a guarantee of regulatory compliance. Meridian's compliance obligations are non-delegable, and its own policies, procedures, training, and oversight are at least as important as the technology platform in determining regulatory outcomes. Third, the exposure is unquantifiable. OCC enforcement actions against major banks have resulted in fines ranging from tens of millions to hundreds of millions of dollars. Agreeing to bear this exposure, even through a consequential damages carve-out, could result in a claim that dwarfs the total contract value and Skybridge's entire revenue base.
Recommended Strategy. Primary Position. Reject the carve-out entirely. Argue that Meridian's own compliance program — not Skybridge's platform alone — drives regulatory outcomes, and that the MSA's representations and warranties (including the warranty that the platform performs materially in accordance with the Documentation and the warranty of material compliance with applicable laws), together with the existing indemnification provisions, provide Meridian with adequate contractual protection. Emphasize that the consequential damages exclusion already includes carve-outs for the most sensitive risk categories (confidentiality, IP, data security) and that regulatory fines present a fundamentally different risk profile — one that is driven by the regulator's exercise of discretion, not by the vendor's conduct alone.
Compromise Position. If Meridian views this as essential, agree to a narrowly drafted carve-out that applies only to regulatory fines that are directly and solely the result of a defect in the SkyComply™ platform of which Skybridge was notified in writing and failed to remediate within a commercially reasonable cure period (we recommend 90 days). The carve-out would be subject to the aggregate liability cap (2× annual fees, or approximately $18,650,000), or at most the data security/confidentiality super-cap (3× annual fees, or approximately $27,975,000). This narrowing ensures that the carve-out applies only to situations where Skybridge had actual notice of a platform defect and failed to act, and it preserves a financial ceiling that is manageable for the company.
Fallback Position. If Meridian insists on a broader formulation, cap the regulatory fines carve-out at the data security super-cap (3× annual fees, approximately $27,975,000) and require that the regulatory fine must have been directly caused by a material breach by Skybridge (not by Meridian's own compliance failures, staffing decisions, or other factors). The carve-out would also exclude fines arising from (i) Meridian's failure to implement Skybridge's recommended configurations or updates; (ii) Meridian's modification of or interference with the platform; and (iii) any acts or omissions by Meridian's own personnel in the use of the platform.
Walk-Away. Skybridge should not agree to an uncapped carve-out for regulatory fines without any causation qualifier or financial cap. The combination of uncapped exposure, unquantifiable risk, and multi-factor causation makes an uncapped regulatory fines carve-out commercially unacceptable. If Meridian is unwilling to accept any cap or causation limitation, we should escalate to Priya Chandrasekaran for a strategic decision on whether to proceed.
Issue 5: Security Incident Notification Window
Meridian's Position. Meridian demands that Skybridge provide notification within 12 hours following the discovery of a confirmed Security Incident affecting Meridian data. Meridian's position is driven by OCC supervisory expectations and the Interagency Guidance on Third-Party Relationships, which require banks to receive prompt notification from critical service providers of security events that may affect the bank's operations, data, or customers. Meridian has indicated that a 12-hour window is consistent with what it has obtained from other critical technology vendors and that the 24-hour period proposed by Skybridge is insufficient for a platform handling regulatory-critical AML/BSA data.
Skybridge's Position. Skybridge proposes a 24-hour notification window following discovery of a confirmed Security Incident. The 24-hour window is based on Skybridge's operational need to conduct an initial investigation and triage before issuing a notification to Meridian. Skybridge's incident response process involves multiple stages: initial detection and alerting, confirmation that a genuine security incident has occurred (as opposed to a false positive or routine security event), preliminary assessment of scope and impact, and formulation of an initial containment strategy. Premature notification — before these steps are complete — can create unnecessary alarm, trigger Meridian's own incident response protocols prematurely, and result in incomplete or inaccurate information being communicated to Meridian's leadership and potentially to regulators. Skybridge also notes that many state data breach notification laws provide 60 to 72 hours for consumer notification, and that 24 hours from discovery is already a significantly accelerated timeline.
Recommended Strategy. Primary Position. Hold at 24 hours. Note that this is consistent with standard industry practice for enterprise SaaS providers, that it provides Skybridge with the time necessary for initial investigation and triage, and that premature notification without sufficient information can be counterproductive and potentially harmful to both parties' interests.
Compromise Position. Offer an 18-hour notification window as a middle ground. Alternatively — and this is our preferred compromise — offer a two-stage notification protocol: (i) a preliminary notification within 12 hours of discovery, confirming that a Security Incident affecting Meridian data has occurred and is under active investigation by Skybridge's incident response team, with a preliminary assessment of the nature of the incident; followed by (ii) a detailed incident report within 48 hours of the preliminary notification, providing the scope of the incident, the categories and approximate volume of affected data, the containment and remediation steps taken, and an assessment of the root cause. This two-stage approach gives Meridian the prompt awareness that it needs for regulatory purposes while giving Skybridge the time necessary to provide accurate, actionable information. We believe this approach will be attractive to Meridian because it aligns with the bank's own internal incident escalation procedures and regulatory reporting obligations.
Fallback Position. Accept the 12-hour notification window, but insist on narrow definitions of key terms. Specifically: (i) "Discovery" should be defined as the point at which Skybridge's incident response team has confirmed that a Security Incident involving Meridian data has occurred, not the point of initial detection or automated alert; (ii) "confirmed Security Incident" should be defined to exclude routine security events, false positives, vulnerability scans, and unsuccessful intrusion attempts; and (iii) the notification obligation should be limited to Security Incidents that are reasonably likely to result in the unauthorized access to, disclosure of, or loss of Meridian data. These definitional guardrails prevent the 12-hour clock from being triggered by every automated security alert and ensure that notifications are meaningful and actionable.
Walk-Away. A 12-hour notification window with reasonable definitions of "Discovery" and "confirmed Security Incident" is acceptable if necessary to close the deal. This is not a walk-away issue, but we should be firm on the definitional protections.
Issue 6: Penetration Testing Scope
Meridian's Position. Meridian demands the right to conduct annual penetration testing at Meridian's expense covering both the infrastructure layer and the application layer of the SkyComply™ platform. Meridian cites FFIEC guidance and OCC expectations for vendor oversight of critical service providers, arguing that a bank must have the ability to independently verify the security posture of its critical vendors across the full technology stack, including the underlying infrastructure. Meridian's designated auditor would conduct the testing, though Meridian has indicated it would also accept testing conducted by Crestfield Cyber Advisors.
Skybridge's Position. Skybridge permits annual third-party penetration testing of the application layer only. Skybridge opposes customer-initiated infrastructure-layer testing for three reasons. First, the SkyComply™ platform operates on Orion Cloud Services' multi-tenant infrastructure. Infrastructure-layer penetration testing initiated by or on behalf of a single customer could affect other Skybridge customers sharing the same infrastructure. Second, Orion Cloud's terms of service restrict customer-initiated infrastructure testing; Skybridge

MEMORANDUM

PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT / ATTORNEY-CLIENT COMMUNICATION

MATTER NO.: 1009-00007

Record

Parties

Dates

Amounts