MEMORANDUM
PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT
To: Angela Fontaine, Responsible Partner, Calderwood & Harkness LLP
From: Amy Chesterton, Lead Associate, and Liam Prescott, Of Counsel (Technology Transactions), Calderwood & Harkness LLP
Date: September 12, 2025
Re: Skybridge Fintech Ltd. — Enterprise SaaS Agreement with Meridian National Bank, N.A. — Indemnification and Liability Cap Analysis
Matter No.: 1009-00007
Client: Skybridge Fintech Ltd.
Counterparty: Meridian National Bank, National Association
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to analyze the indemnification and liability cap provisions currently under negotiation between Skybridge Fintech Ltd. ("Skybridge" or the "Company") and Meridian National Bank, N.A. ("Meridian") in connection with the Master Software-as-a-Service Agreement (the "MSA") for the SkyComply™ AI-driven anti-money laundering ("AML") and transaction-monitoring platform. This memorandum identifies each category of indemnification and liability limitation, summarizes each party's current position, assesses risk exposure, benchmarks against market practice for enterprise financial services SaaS agreements, and recommends negotiation positions and strategies for achieving deal closure on commercially acceptable terms.
The MSA represents a significant commercial opportunity for Skybridge. The total contract value ("TCV") of the transaction is approximately $50,000,000 over a five-year initial term, with Year 1 fees of approximately $12,700,000 (inclusive of implementation and support/managed services fees) and Years 2–5 fees of approximately $9,325,000 per year. Meridian is a top-10 U.S. commercial bank by total assets (approximately $485 billion), a systemically important financial institution ("SIFI") regulated by the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System (the "Federal Reserve"), and the Federal Deposit Insurance Corporation ("FDIC"). Meridian's holding company, Meridian Financial Group, Inc., is listed on the New York Stock Exchange. The deal, if executed, would represent Skybridge's largest single-customer engagement to date and a marquee client relationship in the financial services sector.
Meridian's outside counsel, Hargrove, Tully & Cascade Insurance Brokers ("HTM"), led by Douglas Krenshaw with senior associate Megan Faircloth, has taken aggressive positions on the indemnification and liability provisions. In particular, HTM has demanded: (a) uncapped liability for data breach and data security obligations; (b) a carve-out from the mutual consequential damages exclusion for regulatory fines, penalties, and assessments imposed on Meridian by the OCC, FDIC, Federal Reserve, the Financial Crimes Enforcement Network ("FinCEN"), or other governmental authorities arising from or relating to Skybridge's breach of the MSA; and (c) uncapped SLA credits. These demands, individually and collectively, represent existential-level financial risk for Skybridge.
Our key recommendation is as follows: Skybridge should hold firm on capped data breach indemnification at 2× annual fees (approximately $18,650,000 in a steady-state year), maintain the data security super-cap at 3× annual fees (approximately $27,975,000), and resist the uncapped consequential damages carve-out for regulatory fines, while offering targeted concessions on lower-priority items — such as enhanced SLA credit tiers, a compromise on the security incident notification window, and expanded penetration testing cooperation — to achieve overall deal closure. As a fallback position, Skybridge may consider increasing the data security super-cap to 4× annual fees (approximately $37,300,000), but only as a last resort and only in exchange for corresponding concessions from Meridian on other contested terms. Under no circumstances should Skybridge agree to uncapped data security liability or an uncapped regulatory fines carve-out triggered by mere breach.
This memorandum is organized as follows: Section II provides background on the parties and deal context; Section III analyzes the indemnification obligations in detail; Section IV addresses the liability cap structure; Section V examines the consequential damages exclusion and Meridian's regulatory fines carve-out demand; Section VI discusses the interaction with insurance coverage; Section VII considers other open negotiation issues and their interplay with indemnification terms; Section VIII addresses relevant Delaware law considerations; Section IX discusses the regulatory overlay, including OCC and interagency guidance; Section X provides a summary of recommended positions and negotiation strategy; Section XI sets forth next steps; and Section XII contains supporting appendices.
II. Background and Deal Context
A. Parties and Transaction Overview
1. Skybridge Fintech Ltd.
Skybridge Fintech Ltd. is a Delaware limited company (alternative entity), headquartered at 1400 Concord Pike, Suite 320, Wilmington, Delaware 19803. The Company's senior leadership team includes Priya Chandrasekaran (Chief Executive Officer), David Shimura (General Counsel), Amara Okafor (Chief Information Security Officer), Marcus Holt (Chief Technology Officer), and Jonathan Kreske (Chief Financial Officer).
Skybridge is a growth-stage financial technology SaaS company specializing in AI-driven regulatory compliance solutions for banking and financial services institutions. The Company employs approximately 420 persons across its Wilmington, Delaware headquarters; its engineering center in Austin, Texas; and a data science team based in Toronto, Ontario, Canada. For the fiscal year ended December 31, 2024, Skybridge reported the following financial results, per the audit opinion of Hathaway & Pendleton, LLP dated April 30, 2025:
• Revenue: $78.3 million
• EBITDA: $11.7 million
• Gross Margin: 74%
• Net Revenue Retention Rate: 118%
• Annual Recurring Revenue ("ARR"): approximately $78 million
Skybridge currently serves over 60 banking and financial services clients, including regional and community banks, credit unions, and mid-tier commercial lenders. The Meridian engagement would be Skybridge's first Tier 1 SIFI deployment and its largest single-customer agreement by total contract value.
Skybridge is majority-owned (62%) by Pinnacle Ridge Capital Partners, LP ("PRCP"), a Delaware limited partnership growth-equity fund with approximately $3.4 billion in assets under management, led by Managing Partner Elise Drummond. PRCP's limited partnership agreement and the Skybridge investors' rights agreement grant PRCP consent rights over contracts with a total contract value exceeding $25,000,000. Because the MSA's TCV is approximately $50,000,000, the agreement is subject to PRCP's consent requirement. PRCP's outside legal counsel for purposes of this consent review is Alcott & Grenier LLP, with Simone Alcott serving as lead partner. The indemnification and liability cap provisions will be a focal point of the PRCP consent review, and uncapped liability exposure is expected to raise significant investor concerns.
2. Meridian National Bank, N.A.
Meridian National Bank, N.A. is a national banking association organized under the National Bank Act, with its principal office located at 600 Lexington Avenue, 40th Floor, New York, New York 10022. Meridian is one of the ten largest U.S. commercial banks by total assets, with consolidated total assets of approximately $485 billion as of December 31, 2024. Meridian is a wholly owned subsidiary of Meridian Financial Group, Inc., a bank holding company listed on the New York Stock Exchange (ticker: MFG).
As a SIFI, Meridian is subject to heightened prudential standards and regulatory oversight by the OCC (as its primary federal banking regulator), the Federal Reserve (through Meridian Financial Group, Inc.), and the FDIC. Meridian is also subject to BSA/AML requirements enforced by FinCEN and is regularly examined for compliance with the USA PATRIOT Act, the Bank Secrecy Act, OFAC sanctions programs, and related regulations.
Meridian's key stakeholders for this transaction include:
• Gerald Brannigan — Chief Information Officer
• Catherine Woo — Associate General Counsel (Technology)
• Sandra Petrov — Head of Financial Crimes & Compliance
• Luis Arriaga — Senior Vice President, Procurement
Meridian's outside counsel for the MSA negotiation is Hargrove, Tully & Cascade Insurance Brokers, led by Douglas Krenshaw (partner) with Megan Faircloth (senior associate).
3. Deployment Scope
The MSA contemplates the deployment of Skybridge's SkyComply™ platform across Meridian's retail banking, commercial banking, and wealth management divisions, with approximately 32,000 named users. The SkyComply™ platform will serve as Meridian's primary AI-driven AML transaction-monitoring and suspicious activity reporting system, replacing Meridian's legacy on-premises NICE Bramwell Solutions installation. The platform will process transaction data, customer due diligence information, and related financial crime risk data that includes Nonpublic Personal Information ("NPI") as defined under the Gramm-Leach-Bliley Act ("GLBA") and Personally Identifiable Information ("PII") as defined under applicable state data breach notification statutes.
B. Commercial Terms Summary
The material commercial terms of the MSA, as presently contemplated, are summarized below:
• Year 1 Fees (Post-6.72% Volume discount, Rounded): $12,700,000. This amount comprises: (a) platform subscription fees; (b) an implementation fee of $3,600,000 (covering data migration, system integration, configuration, model tuning, and user acceptance testing); and (c) a support and managed services fee of $1,800,000.
• Years 2–5 Annual Fees: $9,325,000 per year. This amount comprises: (a) platform subscription fees; and (b) support and managed services fees. Implementation fees are non-recurring and are excluded from the annual fee base in Years 2–5.
• Total Contract Value (Initial 5-Year Term): Approximately $50,000,000.
• Payment Terms: Quarterly in advance; net 30 days from invoice date.
• Annual Escalator: Beginning in Year 3, fees are subject to an annual escalator equal to the lesser of: (a) the increase in the Consumer Price Index for All Urban Consumers ("CPI-U") for the twelve-month period ending on the anniversary of the Effective Date; or (b) 3.5%. The parties have agreed to a minimum floor escalator of 3.0% beginning in Year 3.
• Initial Term: Five years, commencing on the Platform Go-Live Date (targeted for March 1, 2026) and ending on February 28, 2031.
• Renewal Terms: Two successive one-year automatic renewal periods, subject to either party's delivery of a written non-renewal notice at least 180 days prior to the expiration of the then-current term.
C. Relevance of Indemnification Terms to Skybridge's Financial Profile
The indemnification and liability cap provisions under negotiation are of critical importance to Skybridge because of the significant disparity in financial scale between the two parties. Skybridge is a growth-stage company with $78.3 million in annual revenue and $11.7 million in EBITDA. Meridian, by contrast, is a $485 billion-asset SIFI. Uncapped indemnification obligations could expose Skybridge to liability that represents multiples of its entire annual revenue — or, in catastrophic scenarios, multiples of its total enterprise value — arising from a single customer engagement.
To illustrate the magnitude of the risk, consider the following scenarios:
• A data breach involving Meridian data processed through SkyComply™ could trigger regulatory penalties, class action litigation, and notification and remediation costs that, for a SIFI of Meridian's size, could easily reach $100 million or more.
• A BSA/AML compliance failure attributed to deficiencies in the SkyComply™ platform could result in OCC or FinCEN enforcement actions with civil money penalties in the tens or hundreds of millions of dollars. Recent precedent includes penalties of $400 million or more imposed on large banks for BSA/AML deficiencies.
• If Skybridge's indemnification obligations were uncapped and included a carve-out for regulatory fines, Skybridge could face claims that exceed not only its annual revenue but also its total assets and available insurance coverage, potentially triggering insolvency.
PRCP, through its outside counsel Alcott & Grenier LLP (lead partner Simone Alcott), will scrutinize the indemnification provisions as part of the consent process. Based on our prior interactions with Ms. Alcott regarding comparable transactions, we anticipate that PRCP will object to any contract that exposes Skybridge to uncapped data security or regulatory compliance liability. Early coordination with PRCP and Alcott & Grenier is advisable to ensure alignment on the negotiation parameters.
Additionally, Skybridge's existing cyber liability insurance through Coastal Assurance Corporation (Policy No. CA-TECH-2025-07831) provides $25 million per occurrence and $50 million in aggregate coverage, with a policy period of April 1, 2025 through March 31, 2026. While this insurance provides a meaningful backstop, it is limited relative to Meridian's uncapped demands and may not cover all categories of loss (particularly regulatory fines and penalties), as discussed further in Section VI.
D. Governing Law
The MSA is governed by the laws of the State of Delaware, without regard to its conflict of laws principles. The parties have agreed that any disputes arising under the MSA shall be subject to the exclusive jurisdiction of the state or federal courts located in Wilmington, Delaware — specifically, the Delaware Court of Chancery or the United States District Court for the District of Delaware. The MSA includes a mutual waiver of the right to a jury trial. These provisions are not currently in dispute between the parties.
The selection of Delaware law is significant for the indemnification and liability analysis, as Delaware courts are generally receptive to the enforcement of contractual limitations on liability between sophisticated commercial parties. The relevant Delaware law considerations are discussed in detail in Section VIII.
III. Indemnification Obligations — Structure and Analysis
A. Overview of Mutual Indemnification Framework
The MSA, as currently drafted, contemplates a mutual indemnification framework. Each party agrees to "indemnify, defend, and hold harmless" the other party and its respective directors, officers, employees, agents, successors, and assigns (collectively, "Indemnitees") from and against specified categories of losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and court costs) arising from enumerated triggering events.
Critically, the MSA imposes both a duty to indemnify and a duty to defend on the indemnifying party. This distinction is significant under Delaware law. The duty to defend is broader than the duty to indemnify: it is triggered when the allegations in a third-party claim, if proven, could give rise to an indemnification obligation — even if the claim is ultimately determined to lack merit. The duty to indemnify, by contrast, arises only upon a final determination that the claim falls within the scope of the indemnification obligation. By including a duty to defend, the MSA imposes a more substantial obligation on the indemnifying party than a pure indemnification clause, as it requires the indemnifying party to bear defense costs from the outset of a claim, regardless of the ultimate outcome.
The MSA also includes the following indemnification procedures:
• Notice Requirements: The Indemnitee must provide prompt written notice to the Indemnifying Party of any claim for which indemnification is sought, specifying in reasonable detail the nature of the claim and the basis for the indemnification demand. Failure to provide timely notice does not relieve the Indemnifying Party of its obligation except to the extent that the Indemnifying Party is materially prejudiced by the delay.
• Cooperation Obligations: The Indemnitee shall reasonably cooperate with the Indemnifying Party in the investigation and defense of the claim, including by providing access to relevant documents, records, and personnel, at the Indemnifying Party's expense.
• Control of Defense: The Indemnifying Party shall have the right to assume and control the defense of any claim for which indemnification is sought, including the selection of counsel reasonably acceptable to the Indemnitee. The Indemnitee may participate in the defense at its own expense with counsel of its own choosing. If the Indemnifying Party fails to timely assume the defense, the Indemnitee may do so at the Indemnifying Party's expense.
• Consent to Settlement: The Indemnifying Party may not settle or compromise any claim without the prior written consent of the Indemnitee (not to be unreasonably withheld, conditioned, or delayed), unless the settlement: (a) includes an unconditional release of the Indemnitee from all liability; (b) does not impose any non-monetary obligations on the Indemnitee; and (c) does not contain any admission of wrongdoing by the Indemnitee.
These procedural provisions are generally consistent with market practice for enterprise SaaS agreements. We do not identify material issues with the procedural framework and recommend acceptance, subject to minor wording refinements that are outside the scope of this memorandum.
B. Skybridge's Indemnification Obligations (Licensor Indemnification)
Skybridge bears indemnification obligations in three principal categories under the MSA: (1) intellectual property infringement; (2) data breach and data security; and (3) legal/regulatory compliance. Each is analyzed below.
1. Intellectual Property Infringement Indemnification
Scope. Skybridge shall indemnify, defend, and hold harmless Meridian and its Indemnitees from and against any and all losses arising from third-party claims alleging that Meridian's authorized use of the SkyComply™ platform, as permitted under the MSA, infringes, misappropriates, or otherwise violates any third-party intellectual property right, including patents, copyrights, trademarks, trade secrets, or other proprietary rights.
Liability Cap. The IP infringement indemnification obligation is uncapped — that is, it is excluded from both the general aggregate liability cap and the data security super-cap. This is consistent with prevailing industry practice for enterprise SaaS agreements, where vendors customarily accept uncapped IP infringement indemnification to give customers comfort regarding freedom to operate.
Exclusive Remedy. The MSA provides that, in the event that the SkyComply™ platform becomes subject to an injunction or if Skybridge reasonably determines that the platform is likely to become subject to an injunction, Skybridge shall, at its sole option and expense:
(a) Procure for Meridian the right to continue using the affected portion of the platform under a license from the third-party rights holder;
(b) Modify or replace the affected portion of the platform to make it non-infringing, provided that the modified or replacement platform provides substantially equivalent functionality; or
(c) If neither option (a) nor option (b) is commercially practicable after Skybridge's good-faith efforts, terminate the affected portion of the MSA and refund to Meridian any pre-paid fees for the terminated portion on a pro-rata basis, calculated from the effective date of termination through the end of the then-current prepaid period.
Risk Assessment. We assess the risk of a third-party IP infringement claim as low to moderate. Skybridge's SkyComply™ platform is proprietary software developed in-house by Skybridge's engineering team. The Company holds a SOC 2 Type II attestation report (dated March 15, 2025, prepared by Crestfield Cyber Advisors, Inc.) and an ISO 27001 certification (recertified January 22, 2025, by Crestfield), both of which reflect mature software development practices, including code review and provenance tracking. However, the platform incorporates third-party open-source components and licensed libraries, and the AI/machine learning functionality relies on models and algorithms that may present patent infringement risk in an evolving IP landscape. We recommend confirming with Marcus Holt (CTO) that: (i) all open-source components are identified and used in compliance with their respective license terms; (ii) Skybridge has conducted freedom-to-operate analysis for key platform algorithms; and (iii) Skybridge maintains an IP provenance log for all material platform components.
Recommendation. Accept uncapped IP infringement indemnification as market standard. However, ensure that the indemnification provision includes the following carve-outs (standard exclusions that limit Skybridge's obligation to claims arising from authorized, as-designed use of the platform):
(i) Claims arising from Meridian's unauthorized modification of the SkyComply™ platform;
(ii) Claims arising from the use of the SkyComply™ platform in combination with products, services, software, hardware, or data not provided by Skybridge, to the extent the infringement would not have arisen but for such combination;
(iii) Claims arising from Meridian's use of the SkyComply™ platform in violation of the MSA or the Acceptable Use Policy (Exhibit D to the MSA); and
(iv) Claims arising from data, content, configurations, or specifications supplied by Meridian and processed through the SkyComply™ platform.
These carve-outs are standard and should not encounter material resistance from HTM. If Meridian objects to any of the carve-outs, we should discuss further.
2. Data Breach / Data Security Indemnification
Scope. Skybridge shall indemnify, defend, and hold harmless Meridian and its Indemnitees from and against losses arising from a breach by Skybridge of its data security and confidentiality obligations under the MSA (including the Security Exhibit and Data Processing Addendum) that results in the unauthorized access, disclosure, acquisition, or exfiltration of Meridian Data (as defined in the MSA), including NPI (as defined under the GLBA and its implementing regulations) and PII (as defined under applicable state data breach notification statutes).
Meridian's Position. Meridian, through HTM, demands that the data breach indemnification obligation be fully uncapped — that is, not subject to any dollar limitation whatsoever. HTM's rationale is that Meridian, as a SIFI subject to heightened regulatory scrutiny, faces potentially catastrophic financial consequences from a data breach involving a third-party service provider. HTM argues that the costs of such a breach — including regulatory penalties, customer notification obligations, credit monitoring, litigation defense, settlements, and reputational harm — are inherently unpredictable and cannot be meaningfully bounded by contractual caps. HTM further contends that Meridian's board of directors and regulators expect that contracts with critical third-party service providers will provide "full indemnification" for data security failures.
Skybridge's Position. Skybridge proposes that the data breach indemnification obligation be capped at 2× the annual fees paid or payable by Meridian in the 12-month period immediately preceding the event giving rise to the claim (the "Data Breach Cap"). The Data Breach Cap would be calculated as follows:
• Years 2–5 (steady-state): 2 × $9,325,000 = $18,650,000
• Year 1: 2 × $12,700,000 = $25,400,000
Meridian Data Context. The data processed through SkyComply™ on behalf of Meridian will include data classified as "Confidential" and "Highly Restricted" under Meridian's internal data classification policy. The deployment will span 32,000 named users across Meridian's U.S. and international operations, covering retail banking, commercial banking, and wealth management divisions. The data will include customer identification data, transaction records, suspicious activity reports and related workpapers, customer due diligence files, and other information that constitutes NPI under the GLBA and Regulation P, as well as PII under the data breach notification statutes of all 50 U.S. states. The volume, sensitivity, and regulatory significance of this data underscore both the criticality of robust security controls and the magnitude of potential breach-related losses.
Risk Assessment: HIGH PRIORITY. This is the single most contentious indemnification issue in the MSA negotiation and represents the highest-priority risk allocation question for Skybridge. We categorize this as a high priority item for the following reasons:
Financial Exposure. Uncapped data breach indemnification is potentially existential for Skybridge. A significant data breach involving a SIFI of Meridian's scale could generate regulatory penalties, class action litigation, notification and remediation costs, and reputational harm well in excess of Skybridge's total annual revenue of $78.3 million. In a worst-case scenario — for example, a breach affecting millions of Meridian's underlying retail banking customers — the total cost to Meridian could reach hundreds of millions of dollars or more, all of which Meridian would seek to recover from Skybridge under an uncapped indemnification provision.
Balance Sheet Impact. Even the proposed 2× Data Breach Cap of $18,650,000 represents approximately 23.8% of Skybridge's FY 2024 revenue and approximately 159% of EBITDA. An uncapped obligation would leave Skybridge with no contractual ceiling on its exposure, potentially requiring it to recognize an unlimited contingent liability for financial reporting purposes.
Investor Concerns. PRCP, as the 62% majority owner, holds consent rights over the MSA. Simone Alcott at Alcott & Grenier LLP is expected to closely scrutinize uncapped indemnification provisions. Based on precedent from prior PRCP consent reviews, we anticipate that PRCP will not approve a contract with uncapped data security liability absent extraordinary circumstances and offsetting protections (e.g., customer-funded escrow or joint insurance arrangements), neither of which is under discussion here.
Market Benchmark Analysis. In enterprise financial services SaaS agreements, data breach indemnification is typically subject to an elevated or "super-cap" that exceeds the general aggregate liability cap but is still subject to a defined dollar limit. Based on our review of comparable transactions (see Appendix B for anonymized benchmark data), the following ranges are representative:
• 2×–3× annual fees: Most common range for mid-market and growth-stage SaaS vendors serving financial services customers.
• 4×–5× annual fees: Occasionally seen in transactions involving critical infrastructure platforms or where the SaaS vendor is a large, publicly traded company with substantial financial resources.
• Uncapped: Rare in the SaaS vendor market. Fully uncapped data breach indemnification is typically seen only in agreements with the largest enterprise software companies (e.g., companies with annual revenues in excess of $1 billion), where the vendor's financial capacity makes the cap less meaningful, or in legacy on-premises license agreements where the customer retains greater control over data.
The 2× annual fees Data Breach Cap proposed by Skybridge is within the market-standard range for a company of Skybridge's size and financial profile. HTM's demand for uncapped indemnification is aggressive relative to market practice and inconsistent with the risk allocation norms in the growth-stage SaaS market.
Coastal Assurance Coverage. Skybridge's cyber liability insurance through Coastal Assurance Corporation provides $25 million per occurrence and $50 million in aggregate coverage. The proposed Data Breach Cap of $18,650,000 is well within the per-occurrence coverage limit of $25 million, providing a meaningful insurance backstop. If indemnification were uncapped, a major breach claim could rapidly exhaust both the per-occurrence and aggregate policy limits, leaving Skybridge with significant uninsured liability. The relationship between the proposed caps and insurance coverage is discussed further in Section VI.
Recommendation. Hold firm at 2× annual fees ($18,650,000) as the primary position. If Meridian/HTM pushes back significantly, offer to consolidate the data breach indemnification into the data security super-cap of 3× annual fees ($27,975,000), such that the super-cap serves as a single, unified cap covering both data breach indemnification obligations and all confidentiality/data security-related liability under the MSA (see Section IV.B for further analysis of the super-cap). Do not agree to uncapped data breach indemnification under any circumstances.
In presenting this position, emphasize the following points to HTM:
• Skybridge maintains robust security controls, including SOC 2 Type II attestation, ISO 27001 certification, AES-256 encryption at rest, TLS 1.2+ encryption in transit, BYOK (bring-your-own-key) encryption option for Meridian, annual third-party penetration testing conducted by Crestfield Cyber Advisors, Inc., and adherence to NIST Cybersecurity Framework controls.
• Uncapped indemnification disproportionately shifts risk given the substantial size disparity between the parties. Skybridge's annual revenue ($78.3 million) is less than 0.02% of Meridian's total assets ($485 billion). It is commercially unreasonable to expect a vendor of Skybridge's scale to assume uncapped liability for the data security exposure of a $485 billion bank.
• The proposed cap is designed to be commercially insurable, which benefits both parties by ensuring that Skybridge has the financial capacity (through its insurance program) to satisfy its indemnification obligations. An uncapped obligation that exceeds insurance limits is functionally unrecoverable and provides Meridian with illusory protection.
• Capped indemnification is the market standard for enterprise SaaS agreements, including those serving the financial services sector. We can provide HTM with anonymized benchmark data to support this position (see Appendix B).
3. Legal/Regulatory Compliance Indemnification
Scope. Skybridge shall indemnify, defend, and hold harmless Meridian and its Indemnitees from and against losses arising from Skybridge's material breach of applicable law in the performance of its obligations under the MSA, including the GLBA, BSA/AML regulations promulgated by FinCEN and the OCC, and applicable state data breach notification statutes. This indemnification is intended to cover losses attributable to Skybridge's own legal non-compliance — for example, a failure by Skybridge to comply with data breach notification requirements applicable to it as a service provider, or a failure to implement security controls required by GLBA safeguarding rules.
Liability Cap. The legal/regulatory compliance indemnification is subject to the general indemnity cap of 1× annual fees paid or payable by Meridian in the 12-month period preceding the claim — approximately $9,325,000 in a steady-state year (Years 2–5) and $12,700,000 in Year 1.
Risk Assessment. We assess this risk as moderate. SkyComply™ is specifically an AML and transaction-monitoring platform; its core functionality is directly intertwined with Meridian's BSA/AML compliance program. Any material regulatory finding related to the platform's performance — for example, a determination that the platform's transaction-monitoring models failed to identify suspicious activity patterns — could have significant regulatory consequences for Meridian. However, Skybridge should resist uncapped exposure in this category for several important reasons:
Shared Responsibility. BSA/AML compliance is a shared responsibility between Meridian (as the regulated financial institution) and Skybridge (as the technology provider). Meridian retains ultimate regulatory accountability for its own BSA/AML compliance program. The OCC, FinCEN, and other regulators consistently hold the bank — not its third-party service provider — responsible for the adequacy of the bank's compliance framework. Skybridge provides a technology tool; Meridian is responsible for establishing policies, configuring detection rules and thresholds, reviewing and adjudicating alerts, filing SARs, and overseeing the overall program. Skybridge's indemnification should cover only losses attributable to Skybridge's own breaches of law, not losses arising from Meridian's own regulatory compliance decisions.
Scope Limitation. The indemnification is appropriately limited to "material" breaches of applicable law, which provides a meaningful threshold and excludes de minimis or technical violations.
Recommendation. Cap at 1× annual fees ($9,325,000). Include clear risk allocation language in the MSA specifying that Skybridge's legal/regulatory compliance indemnification covers only losses arising from Skybridge's own material breach of applicable law in the performance of its obligations under the MSA, and expressly excludes losses arising from Meridian's own acts, omissions, regulatory obligations, or compliance decisions. The MSA should also include a provision stating that Meridian, as the regulated entity, retains sole responsibility for its BSA/AML compliance program and that Skybridge's provision of the SkyComply™ platform does not constitute legal, compliance, or regulatory advice.
C. Meridian's Indemnification Obligations (Licensee Indemnification)
Meridian bears indemnification obligations in three categories:
1. Acceptable Use Policy Breaches
Scope. Meridian shall indemnify, defend, and hold harmless Skybridge and its Indemnitees from and against losses arising from third-party claims resulting from Meridian's breach of the Acceptable Use Policy set forth in Exhibit D to the MSA. The Acceptable Use Policy governs Meridian's permitted use of the SkyComply™ platform and prohibits, among other things, reverse engineering, unauthorized sublicensing, use of the platform for illegal purposes, and use of the platform in a manner that infringes third-party rights. This indemnification is intended to protect Skybridge against claims that arise not from the platform itself but from Meridian's misuse of the platform in violation of contractual restrictions.
Liability Cap. Subject to the general indemnity cap of 1× annual fees.
2. Meridian Data / Content
Scope. Meridian shall indemnify, defend, and hold harmless Skybridge and its Indemnitees from and against losses arising from third-party claims alleging that data or content provided by Meridian to Skybridge for processing through the SkyComply™ platform infringes, misappropriates, or otherwise violates any third-party intellectual property right or other proprietary right. This indemnification covers the scenario in which Meridian provides Skybridge with data that Meridian does not have the right to share — for example, data subject to third-party license restrictions or data obtained in violation of privacy laws.
Liability Cap. Subject to the general indemnity cap of 1× annual fees.
3. Meridian Legal Compliance
Scope. Meridian shall indemnify, defend, and hold harmless Skybridge and its Indemnitees from and against losses arising from third-party claims resulting from Meridian's material breach of applicable law in connection with Meridian's use of the SkyComply™ platform or Meridian's performance of its obligations under the MSA.
Liability Cap. Subject to the general indemnity cap of 1× annual fees.
D. Symmetry Analysis
The indemnification framework as currently structured is significantly asymmetric, with Skybridge bearing broader and higher-capped indemnification obligations than Meridian. The asymmetry is illustrated below:
This asymmetry is inherent in the SaaS provider/customer relationship: the vendor provides the technology platform and assumes responsibility for its integrity, security, and IP provenance, while the customer assumes responsibility primarily for its own use of the platform and the data it provides. The asymmetry is generally accepted in the market and does not, in itself, present an unreasonable allocation. However, the asymmetry must be bounded by commercially reasonable caps on the vendor's elevated obligations — particularly data breach indemnification — to avoid creating existential risk for a vendor of Skybridge's financial profile. The purpose of a liability cap is not to eliminate Skybridge's accountability, but to ensure that the risk allocation is proportionate to the vendor's capacity to absorb and insure against potential losses.
IV. Liability Caps — Detailed Analysis
A. Aggregate Liability Cap
Structure. The MSA provides that each party's total aggregate liability arising under or in connection with the MSA, regardless of the form of action (whether in contract, tort, strict liability, or otherwise), shall not exceed 2× the annual fees paid or payable by Meridian in the 12-month period immediately preceding the event first giving rise to the claim, exclusive of certain enumerated uncapped items (discussed in Section IV.D).
Calculation.
• Years 2–5 (steady-state): 2 × $9,325,000 = $18,650,000
• Year 1: 2 × $12,700,000 = $25,400,000
Parties' Positions. Both parties have agreed in principle to the 2× annual fees aggregate liability cap for general liability. This provision is not currently in dispute between the parties.
Market Benchmark. An aggregate liability cap of 1×–2× annual fees is the standard range for enterprise SaaS agreements. The 2× level falls at the upper end of the range and is appropriate given the overall deal size, the criticality of the SkyComply™ platform to Meridian's compliance operations, and the regulatory sensitivity of the data involved. We do not recommend seeking to reduce the aggregate cap below 2×, as doing so could reopen a settled issue and would be inconsistent with market expectations for a deal of this magnitude.
B. Data Security / Confidentiality Super-Cap
Structure. In addition to the general aggregate liability cap, the MSA contemplates a separate, elevated cap — a "super-cap" — applicable to losses arising from breaches of confidentiality and data security obligations. The super-cap is intended to sit above the general aggregate cap (recognizing the heightened risk and potential exposure associated with data security failures) but below the uncapped level (preserving a meaningful ceiling on Skybridge's financial exposure).
Skybridge's Position. Skybridge proposes a data security super-cap of 3× annual fees paid or payable in the 12-month period preceding the claim:
• Years 2–5: 3 × $9,325,000 = $27,975,000
• Year 1: 3 × $12,700,000 = $38,100,000
Meridian's Position. Meridian, through HTM, demands that all liability arising from data security and confidentiality breaches be fully uncapped. HTM's position is that any dollar limitation on data security liability is inappropriate given Meridian's status as a SIFI, the volume and sensitivity of the data processed through SkyComply™, and the potentially catastrophic cost of a major data breach at a top-10 U.S. bank. HTM contends that the super-cap concept, while common in the SaaS market generally, is inadequate for a deployment of this scale and regulatory significance.
Analysis. We have carefully considered both parties' positions and conclude that Skybridge's proposed super-cap of 3× annual fees is the commercially appropriate and defensible position. Our analysis is as follows:
Insurance Alignment. The proposed super-cap of $27,975,000 is within Coastal Assurance Corporation's $50 million aggregate coverage limit, providing a meaningful insurance backstop. Although the $27,975,000 figure exceeds the per-occurrence limit of $25 million by $2,975,000, the per-occurrence gap is modest and manageable. If indemnification were uncapped, Skybridge's exposure could rapidly exhaust both the per-occurrence and aggregate policy limits, leaving the company with substantial uninsured liability. An uncapped obligation thus provides Meridian with a theoretical recovery right that may, in practice, prove uncollectible — an outcome that serves neither party's interests.
Financial Proportionality. The super-cap of $27,975,000 already represents approximately 35.7% of Skybridge's FY 2024 revenue ($78.3 million) and approximately 239% of EBITDA ($11.7 million). These are very substantial percentages, reflecting a meaningful commitment by Skybridge to stand behind its data security obligations. An uncapped obligation would provide no ceiling on exposure relative to Skybridge's financial capacity and could, in a severe breach scenario, render the company insolvent — an outcome that would deprive Meridian of its remediation and support provider at the moment when continued access to the platform and cooperation with the vendor are most critical.
Investor Impact. As noted above, Pinnacle Ridge Capital Partners (62% owner) holds consent rights over contracts exceeding $25 million TCV. PRCP's counsel, Simone Alcott at Alcott & Grenier LLP, should be alerted early to the super-cap issue. Based on our experience with prior PRCP consent reviews, we expect that PRCP will view uncapped data security exposure as a material concern and may condition its consent on the inclusion of a defined cap. If Skybridge agrees to uncapped data security liability without PRCP's advance approval, it risks either a consent denial (requiring renegotiation of the MSA) or a strained investor relationship.
Uncapped Exposure Quantification. If data security liability were uncapped, Skybridge's theoretical exposure could include: (i) regulatory fines imposed on Meridian by the OCC, FDIC, Federal Reserve, and/or state banking regulators; (ii) Meridian's defense costs and settlements in third-party class action litigation brought by affected customers; (iii) notification and remediation costs for a breach affecting 32,000+ named users and the underlying retail, commercial, and wealth management customers whose data flows through SkyComply™; (iv) credit monitoring and identity theft protection services; and (v) reputational harm and lost business. In aggregate, these costs for a SIFI of Meridian's size could reach hundreds of millions of dollars, vastly exceeding Skybridge's total assets and available insurance.
Recommendation. Hold at 3× annual fees ($27,975,000) as the maximum data security super-cap. If Meridian insists on a higher figure and this issue becomes a genuine barrier to closing, consider increasing the super-cap to 4× annual fees ($37,300,000) as an absolute fallback position, but only in exchange for meaningful concessions from Meridian on other open issues, including: (a) Meridian's acceptance of capped (rather than uncapped) SLA credits; (b) a compromise on the security incident notification window; and/or (c) withdrawal of the regulatory fines carve-out from the consequential damages exclusion. The 4× fallback should be deployed only with the express approval of Priya Chandrasekaran (CEO) and Jonathan Kreske (CFO), and should be flagged to Simone Alcott at Alcott & Grenier in advance. Under no circumstances should Skybridge agree to uncapped data security liability.
C. General Indemnity Cap
Structure. All indemnification obligations other than (a) IP infringement indemnification and (b) data breach/data security indemnification are subject to a general indemnity cap of 1× annual fees paid or payable in the 12-month period preceding the event giving rise to the claim.
Calculation.
• Years 2–5: 1 × $9,325,000 = $9,325,000
• Year 1: 1 × $12,700,000 = $12,700,000
Parties' Positions. The 1× annual fees general indemnity cap has been agreed in principle by both parties and is not currently in dispute.
Market Benchmark. A general indemnity cap of 1× annual fees is the prevailing market standard for enterprise SaaS agreements. No further negotiation is recommended on this point.
D. Items Excluded from Liability Caps (Uncapped Items)
The MSA, as currently drafted, identifies the following categories of liability that are excluded from all caps (i.e., for which each party's liability is unlimited):
(a) IP Infringement Indemnification. Both parties have accepted that the IP infringement indemnification obligation (applicable to Skybridge under Section III.B.1) is uncapped. This is standard market practice.
(b) Breaches of Confidentiality/Data Security Obligations. DISPUTED. Skybridge proposes that data security liability be subject to the super-cap of 3× annual fees ($27,975,000). Meridian demands that data security liability be fully uncapped and excluded from all caps. This is the primary disputed item, as discussed in Section IV.B above.
(c) Gross Negligence or Willful Misconduct. The MSA excludes from all caps any liability arising from a party's gross negligence or willful misconduct. This is a standard exclusion in enterprise SaaS agreements and commercial contracts generally. Under Delaware law, gross negligence requires conduct that constitutes a "reckless indifference" to the rights of others, while willful misconduct requires intentional wrongdoing. Both standards impose a high evidentiary bar, and claims based on mere negligence or ordinary breach of contract remain subject to the applicable caps. We recommend accepting this exclusion, but ensuring that the MSA clearly defines "gross negligence" and "willful misconduct" or incorporates the prevailing Delaware law standards by reference.
(d) Data Export and Certified Destruction Post-Termination. The MSA imposes an obligation on Skybridge to (i) make all Meridian Data available for export in a standard, machine-readable format within 30 days following the effective date of termination or expiration, and (ii) securely destroy all copies of Meridian Data within 60 days following completion of the export period (or upon Meridian's confirmation that export is not required). Upon completion of destruction, Skybridge must provide Meridian with a written certification of destruction signed by an authorized officer of the Company. This obligation is uncapped — that is, Skybridge's liability for failure to perform data export and destruction is not subject to any dollar cap. This exclusion is appropriate because the obligation is primarily operational in nature and the financial exposure associated with non-performance is de minimis relative to the other categories. We recommend acceptance.
(e) Payment Obligations. Each party's obligation to pay amounts due and owing under the MSA (e.g., Meridian's obligation to pay fees; Skybridge's obligation to pay refunds) is uncapped. This is standard and appropriate; a cap on payment obligations would be commercially anomalous.
Summary. Of the five enumerated uncapped items, only item (b) — confidentiality/data security — is in dispute. Our recommendation remains to subject data security liability to the super-cap of 3× annual fees, as discussed in Section IV.B. The remaining four categories of uncapped liability are standard and accepted by both parties.
E. Summary Table of Liability Structure
The following table summarizes the current positions of the parties with respect to each category of liability, together with the applicable market standard:
V. Consequential Damages Exclusion — Regulatory Fines Carve-Out
A. Baseline Provision
The MSA includes a mutual exclusion of indirect, incidental, consequential, special, and punitive damages, regardless of the form of action and regardless of whether the claiming party has been advised of the possibility of such damages. This is a standard provision in enterprise SaaS agreements and commercial contracts generally, and its purpose is to limit each party's liability to direct damages arising from a breach of the agreement.
The parties have agreed to the following exceptions to the mutual consequential damages exclusion:
(a) Breaches of confidentiality obligations under the MSA (including the NDA provisions and the Data Processing Addendum);
(b) IP indemnification obligations (i.e., Skybridge's obligation to indemnify Meridian against third-party IP infringement claims); and
(c) Breaches of data security obligations under the Security Exhibit and Data Processing Addendum.
These three exceptions are market-standard carve-outs that reflect the heightened significance of IP, confidentiality, and data security risks in a SaaS engagement. They are not currently in dispute.
B. Meridian's Requested Carve-Out for Regulatory Fines
In addition to the three agreed-upon exceptions, Meridian, through HTM, has demanded a fourth carve-out from the consequential damages exclusion: regulatory fines, penalties, assessments, and civil money penalties imposed on Meridian by the OCC, FDIC, Federal Reserve, FinCEN, or other federal or state governmental authorities arising from or relating to Skybridge's breach of the MSA — particularly its data security and BSA/AML compliance obligations.
HTM articulates the following rationale for this demand:
Heightened Regulatory Environment. As a SIFI, Meridian is subject to heightened supervisory scrutiny and enforcement attention from the OCC and other banking regulators. Regulatory examinations are frequent and rigorous. If a Skybridge platform failure causes a BSA/AML compliance deficiency — for example, if SkyComply™ fails to generate alerts for suspicious transactions that should have been flagged — Meridian could face consent orders, formal enforcement actions, civil money penalties, and cease-and-desist orders. The potential financial impact of such enforcement actions is substantial.
"Direct" Damage Characterization. HTM argues that regulatory fines imposed on Meridian as a direct result of Skybridge's breach are, from Meridian's perspective, "direct" damages rather than "consequential" damages. HTM contends that fines are a foreseeable, direct consequence of a compliance platform failure and should not be excluded from recovery under the consequential damages exclusion.
Regulatory Expectations. HTM asserts that Meridian's regulators expect the bank to negotiate contractual protections that enable it to recover the full cost of regulatory penalties attributable to third-party vendor failures. HTM suggests that the OCC would view a consequential damages exclusion that bars recovery of regulatory fines as an inadequate contractual protection.
Skybridge's Position. Skybridge should resist the carve-out. Our analysis and recommendation are set forth below.
C. Risk Assessment
The regulatory fine carve-out represents a critical risk for Skybridge. The combination of this carve-out with Meridian's demand for uncapped data security liability would create a scenario in which Skybridge faces theoretically unlimited exposure for regulatory penalties imposed on a $485 billion bank — penalties that are determined by government regulators over whom Skybridge has no control, in proceedings in which Skybridge may have limited or no participation rights, and based on standards (such as "adequacy" of the BSA/AML program) that encompass factors well beyond Skybridge's platform functionality.
The following considerations inform our risk assessment:
Magnitude of Potential Fines. OCC and FinCEN enforcement actions against SIFIs for BSA/AML failures have historically resulted in penalties ranging from tens of millions to billions of dollars. Recent examples include:
• In 2020, a major U.S. bank paid approximately $400 million in combined OCC and FinCEN penalties for BSA/AML compliance failures.
• In 2018, a mid-tier bank paid approximately $185 million in OCC and FinCEN penalties related to deficient AML transaction monitoring.
• In multiple cases, consent orders have required banks to undertake multi-year remediation programs costing hundreds of millions of dollars in addition to the monetary penalties themselves.
If any such penalty were attributed, in whole or in part, to a deficiency in the SkyComply™ platform, and if the regulatory fines carve-out were in place, Meridian could seek to recover the full amount of the penalty from Skybridge — an amount that could exceed Skybridge's total enterprise value.
Direct Nexus Between SkyComply™ and BSA/AML Compliance. SkyComply™ is specifically an AML and transaction-monitoring platform. Its core functionality — detecting suspicious transactions, generating alerts, and facilitating SAR filings — is at the heart of Meridian's BSA/AML compliance program. The nexus between the platform's performance and Meridian's regulatory compliance obligations is direct and unavoidable. This means that virtually any BSA/AML enforcement action against Meridian could potentially be attributed, at least in part, to the SkyComply™ platform, creating a pathway for indemnification claims under the regulatory fines carve-out.
Combined Effect with Uncapped Indemnification. If regulatory fines are carved out of the consequential damages exclusion AND data security/compliance indemnification is uncapped (as Meridian demands), Skybridge faces theoretically unlimited exposure for regulatory penalties imposed on a SIFI. The combined effect of these two provisions would create a risk profile that is manifestly disproportionate to the economic value of the contract to Skybridge.
Even with Super-Cap. Even if the regulatory fines carve-out were subject to the data security super-cap of 3× annual fees ($27,975,000), regulatory fines in BSA/AML enforcement cases could easily exceed the super-cap by an order of magnitude. A $27,975,000 super-cap, while substantial for Skybridge, would provide only limited protection in the context of a major BSA/AML enforcement action involving a SIFI.
D. Market Practice
Our review of comparable enterprise SaaS agreements in the financial services sector reveals the following market practice regarding regulatory fines and the consequential damages exclusion:
• Most enterprise SaaS agreements do not include a carve-out from the consequential damages exclusion for regulatory fines. The standard approach is to treat regulatory fines as consequential or indirect damages that are excluded from recovery under the mutual damages exclusion.
• Some financial services-specific agreements include a limited carve-out, but only where all of the following conditions are met: (i) the fines are directly and proximately caused by the vendor's willful misconduct or gross negligence (not mere breach or ordinary negligence); (ii) the fines are subject to the data security super-cap (i.e., not uncapped); (iii) the vendor has been given written notice of the alleged compliance deficiency and a reasonable opportunity to cure before any indemnification obligation is triggered; and (iv) the customer has used commercially reasonable efforts to mitigate the fines and cooperate with the vendor in addressing the underlying deficiency.
• An uncapped carve-out triggered by mere breach (as HTM demands) is not consistent with prevailing market practice and would place Skybridge well outside the range of risk allocation norms for SaaS vendors in the financial services market.
E. Recommended Position
Based on the foregoing analysis, we recommend the following negotiation approach:
Primary Position. Reject the regulatory fines carve-out entirely. Regulatory fines imposed on Meridian arise from Meridian's own status as a regulated financial institution and Meridian's own regulatory obligations. Such fines are properly classified as indirect or consequential damages — they are not direct damages flowing from Skybridge's breach but rather downstream consequences that are mediated by regulatory action, a governmental process over which Skybridge has no control. The consequential damages exclusion should apply to regulatory fines as written.