MEMORANDUM
TO: Angela Fontaine, Responsible Partner; Liam Prescott, Of Counsel
FROM: Amy Chesterton, Lead Associate
DATE: September 12, 2025
RE: Insurance Coverage Gap Analysis — Skybridge Fintech Ltd. / Meridian National Bank, N.A. Enterprise SaaS Agreement (SkyComply™ Platform)
MATTER NO.: 1009-00007
PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT This memorandum is protected by the attorney-client privilege and the work product doctrine. It is prepared in anticipation of litigation and in connection with the provision of legal advice. Do not disclose or distribute without prior authorization.
I. Executive Summary
The purpose of this memorandum is to analyze the existing insurance portfolio maintained by Skybridge Fintech Ltd. ("Skybridge") against the contractual insurance requirements imposed by Meridian National Bank, N.A. ("Meridian") under the proposed Master Software-as-a-Service Agreement (the "MSA") for the SkyComply™ regulatory compliance platform. The MSA, currently under active negotiation, contemplates a total contract value of approximately $50,000,000 over an initial five-year term commencing March 1, 2026, with annual fees of approximately $9,325,000 (subject to a 3% annual escalator beginning in Year 3). Given the magnitude of this engagement and the sensitivity of the data at issue — including non-public personal information ("NPI"), personally identifiable information ("PII"), and Bank Secrecy Act / anti-money laundering ("BSA/AML") compliance data for one of the ten largest banking institutions in the United States — the insurance provisions of the MSA carry outsized commercial and legal significance.
The primary policy under review is the technology errors and omissions ("E&O") / cyber liability policy issued by Coastal Assurance Corporation, a Connecticut stock insurance corporation, under Policy No. CA-TECH-2025-07831, which provides coverage of $25,000,000 per occurrence and $50,000,000 in the aggregate. This policy is the most critical element of Skybridge's insurance program from the standpoint of the MSA's requirements.
Based on our analysis, Skybridge's existing cyber liability coverage meets or exceeds Meridian's stated minimum requirements for technology E&O / cyber liability insurance. However, several issues require attention before the MSA can be executed, and before the certificate of insurance can be delivered in the form Meridian expects. Specifically:
(i) Additional Insured Status. Meridian has requested that it be named as an additional insured on both the commercial general liability ("CGL") and the technology E&O / cyber liability policies. The CGL endorsement is standard and should be readily obtainable. The cyber/E&O additional insured endorsement is less standard and may not be available from Coastal Assurance, or may be available only on limited terms and at additional premium cost. This remains one of the eight key open negotiation issues between the parties.
(ii) Umbrella/Excess Coverage Levels. We have not yet confirmed the coverage limits and underlying scheduled policies under Skybridge's umbrella/excess liability policy. Meridian requires a minimum of $10,000,000 in umbrella/excess coverage, and we need to verify compliance.
(iii) Policy Renewal Timing. The Coastal Assurance cyber/E&O policy expires on March 31, 2026, only one month after the targeted MSA Go-Live Date. The MSA requires continuous coverage throughout the initial five-year term and for a period of two years following termination or expiration. Skybridge must plan for annual renewals or secure a multi-year policy to ensure uninterrupted coverage through approximately February 28, 2033.
(iv) Potential Endorsement Requirements. In addition to the additional insured endorsement, we need to confirm that the Coastal Assurance policy covers claims arising from the acts or omissions of Skybridge's subprocessors — most critically, Orion Cloud Services, Inc. — and that regulatory fines are insurable under the policy terms. These items may require separate endorsements or policy amendments.
The MSA requires delivery of a certificate of insurance within ten (10) business days of execution and annually thereafter. This timeline is achievable, provided the necessary endorsements and policy confirmations are obtained in advance.
This memorandum should be read in conjunction with the Indemnification and Liability Cap Analysis Memorandum and the Data Security and Privacy Requirements Memorandum, each of which addresses related provisions of the MSA currently under negotiation.
II. Scope of Analysis
Materials Reviewed. This memorandum is based on a review of the following materials:
(a) The draft Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. and Meridian National Bank, N.A., dated August 22, 2025, including the insurance requirements set forth in Article XIV (the "Insurance Article"), as proposed by Meridian's outside counsel, Hargrove, Tully & Cascade Insurance Brokers (lead partner Douglas Krenshaw; senior associate Megan Faircloth);
(b) Skybridge's response draft of the MSA, dated September 3, 2025, including Skybridge's proposed redlines to Article XIV;
(c) The Coastal Assurance Corporation technology E&O / cyber liability insurance policy, Policy No. CA-TECH-2025-07831, including the policy declarations page, coverage forms, and known endorsements (to the extent provided by Skybridge's management);
(d) Skybridge's commercial general liability policy (declarations page and coverage summary requested but not yet received as of the date of this memorandum);
(e) Skybridge's workers' compensation policy (declarations page requested but not yet received);
(f) Skybridge's umbrella/excess liability policy (declarations page and schedule of underlying policies requested but not yet received);
(g) Relevant regulatory guidance, including OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance) and the Interagency Guidance on Third-Party Relationships: Risk Management (June 6, 2023, issued jointly by the OCC, the Board of Governors of the Federal Reserve System, and the FDIC).
Interviews and Consultations
In preparing this memorandum, the author conducted interviews and consultations with the following individuals:
• David Shimura, General Counsel, Skybridge Fintech Ltd. — Mr. Shimura provided background on Skybridge's historical insurance program, its relationship with Coastal Assurance Corporation, and Skybridge's position on the additional insured request;
• Amara Okafor, Chief Information Security Officer, Skybridge Fintech Ltd. — Ms. Okafor provided information regarding the types and volumes of data processed by the SkyComply™ platform, Skybridge's subprocessor relationships (particularly with Orion Cloud Services, Inc.), and the data security incident history relevant to underwriting considerations;
• Jonathan Kreske, Chief Financial Officer, Skybridge Fintech Ltd. — Mr. Kreske is responsible for Skybridge's insurance procurement and has been our primary point of contact for obtaining policy documents. As of the date of this memorandum, Mr. Kreske has provided the Coastal Assurance policy declarations page but has not yet provided declarations pages for the CGL, workers' compensation, or umbrella/excess policies. We have made follow-up requests and expect to receive these documents within the next five business days.
Regulatory Context. Meridian National Bank, N.A. is a nationally chartered bank and one of the ten largest banking institutions in the United States, with approximately $485 billion in total consolidated assets as of its most recent Call Report filing. Meridian is a systemically important financial institution subject to primary supervision by the Office of the Comptroller of the Currency ("OCC"), with additional oversight by the Board of Governors of the Federal Reserve System and the Federal Deposit Insurance Corporation ("FDIC").
OCC Bulletin 2013-29, as supplemented by the Interagency Guidance on Third-Party Relationships: Risk Management issued on June 6, 2023, establishes the framework under which national banks like Meridian are expected to manage risks associated with third-party relationships. These standards expressly require banks to evaluate the insurance coverage maintained by critical third-party service providers as part of their due diligence and ongoing monitoring obligations. Under the Interagency Guidance, a bank should consider, among other things, whether a third party maintains "adequate insurance" to cover potential losses arising from the third-party relationship.
Skybridge, as the provider of the SkyComply™ regulatory compliance platform — a critical application used in connection with Meridian's BSA/AML compliance, sanctions screening, and regulatory reporting obligations — will be classified as a "critical" third-party service provider under Meridian's vendor risk management program. Moreover, because SkyComply™ constitutes a "bank service" within the meaning of the Bank Service Company Act, 12 U.S.C. § 1867, federal banking regulators have direct examination authority over Skybridge's operations with respect to the services it provides to Meridian. This examination authority could extend to a review of the adequacy of Skybridge's insurance arrangements.
The MSA's insurance requirements are designed in part to satisfy these regulatory expectations, and both parties have an interest in ensuring that Skybridge's insurance program can withstand regulatory scrutiny, not merely meet the contractual minimums negotiated between the parties.
III. Meridian's Contractual Insurance Requirements
The following section summarizes the insurance requirements set forth in Article XIV of the draft MSA, as proposed by Meridian. We note that Skybridge has not proposed material redlines to Article XIV in its September 3 response draft, with the exception of language relating to the additional insured endorsement on the cyber/E&O policy, which remains under negotiation. Unless otherwise indicated, the requirements described below reflect Meridian's proposed language.
A. Technology Errors & Omissions / Cyber Liability Insurance
Meridian requires Skybridge to maintain technology errors and omissions and cyber liability insurance with limits of not less than $25,000,000 per occurrence and $50,000,000 in the aggregate. The policy must cover, at a minimum, the following categories of risk:
(i) Technology errors and omissions arising from the provision of software-as-a-service and related professional services;
(ii) Data breach and cyber liability, including liability arising from unauthorized access to, or unauthorized acquisition, use, or disclosure of, confidential information, personally identifiable information, and non-public personal information;
(iii) Network security liability, including liability arising from the failure of network security to prevent unauthorized access, denial-of-service attacks, transmission of malicious code, or similar security failures;
(iv) Privacy liability, including claims arising from alleged violations of federal and state privacy statutes, regulations, and common law privacy rights; and
(v) Media liability, including claims arising from defamation, infringement of copyright or other intellectual property rights in digital media content, and invasion of privacy in connection with electronic media.
The MSA further requires that this coverage be maintained throughout the entire term of the MSA — including the initial five-year term commencing March 1, 2026, plus any renewal terms — and for a period of two (2) years following the expiration or termination of the MSA for any reason. This two-year "tail" requirement is significant for a claims-made policy, as discussed in greater detail in Section V.A.2 below.
B. Commercial General Liability (CGL)
Meridian requires Skybridge to maintain commercial general liability insurance with limits of not less than $5,000,000 per occurrence and $10,000,000 in the aggregate. This coverage must include, at a minimum, standard CGL coverage for bodily injury, property damage, personal injury, and advertising injury. The MSA does not specify a particular policy form, but Meridian expects coverage on a standard ISO occurrence-based CGL form or its equivalent.
C. Workers' Compensation
Meridian requires Skybridge to maintain workers' compensation insurance providing statutory coverage limits as required by the laws of each state in which Skybridge has employees or performs work in connection with the MSA. The MSA does not separately specify a minimum employer's liability limit, but standard practice in comparable enterprise technology agreements typically requires employer's liability coverage of at least $1,000,000 per accident / $1,000,000 disease (per employee) / $1,000,000 disease (policy limit). We expect Meridian will apply these standard minimums upon review.
D. Umbrella / Excess Liability
Meridian requires Skybridge to maintain umbrella or excess liability insurance with a combined limit of not less than $10,000,000 per occurrence. The umbrella/excess policy must provide excess coverage over the CGL and employer's liability policies at a minimum. The MSA does not expressly require the umbrella to sit excess over the technology E&O / cyber liability policy, although such an arrangement would provide an additional cushion of coverage and is preferable from a risk management perspective.
E. Additional Insured Status
Meridian National Bank, N.A. has requested that it be named as an additional insured under both the CGL policy and the technology E&O / cyber liability policy maintained by Skybridge. The additional insured endorsement must provide coverage for claims against Meridian arising out of or relating to Skybridge's performance of its obligations under the MSA. Meridian's proposed language provides that the additional insured coverage shall be "primary and non-contributory" with respect to any insurance maintained by Meridian for claims covered by the endorsement.
As noted above, Skybridge has proposed a redline to the additional insured requirement as it applies to the cyber/E&O policy. Skybridge's September 3 response draft accepts the additional insured requirement for the CGL policy but brackets the cyber/E&O additional insured requirement, noting that availability and terms must be confirmed with Coastal Assurance Corporation. This remains one of the eight key open negotiation issues, and the analysis of alternatives is addressed in detail in Section VI below.
F. Certificate of Insurance
The MSA requires Skybridge to deliver a certificate of insurance to Meridian within ten (10) business days of the execution of the MSA. The certificate must evidence all required coverages, coverage limits, and applicable endorsements (including additional insured status, if obtained). Following the initial delivery, Skybridge must provide updated certificates annually thereafter, and promptly upon any material change in coverage.
In addition, Skybridge must provide Meridian with not less than thirty (30) days' prior written notice of cancellation, non-renewal, or material reduction in coverage under any of the required policies. Meridian's proposed language places this notice obligation directly on Skybridge, rather than relying on the carrier's standard cancellation notice provisions (which may provide for shorter notice periods or which, depending on the jurisdiction and policy form, may not create a direct obligation to a third-party certificate holder).
IV. Skybridge's Existing Insurance Coverage
A. Technology E&O / Cyber Liability Policy — Coastal Assurance Corporation
1. Policy Details. Skybridge maintains its primary technology errors and omissions and cyber liability coverage through a policy issued by Coastal Assurance Corporation, a Connecticut stock insurance corporation rated A (Excellent) by A.M. Best with a Financial Size Category of XV ($2 billion or greater). The relevant policy details are as follows:
Carrier: Coastal Assurance Corporation (Hartford, Connecticut)
Policy Number: CA-TECH-2025-07831
Named Insured: Skybridge Fintech Ltd.
Coverage Limits: $25,000,000 per claim / $50,000,000 aggregate
Policy Period: April 1, 2025 – March 31, 2026 (twelve-month term)
Policy Type: Claims-made and reported
Premium: Confirmed at $487,500 for the current policy year (per Jonathan Kreske)
The policy was originally placed through Skybridge's insurance broker, Wentworth & Hale Insurance Brokers LLC ("Wentworth & Hale"), and has been renewed annually with Coastal Assurance since the 2021 policy year (previously at lower limits). The current $25M / $50M limits were first established at the April 1, 2024 renewal in anticipation of Skybridge's expanded enterprise client engagements, including the Meridian opportunity.
2. Scope of Coverage. Based on our review of the policy forms and coverage summaries provided by Skybridge, the Coastal Assurance policy provides coverage for the following insuring agreements:
(a) Technology Errors and Omissions. The policy covers claims arising from actual or alleged errors, omissions, negligent acts, or failures to perform in the rendering or failure to render technology services, including the provision of software-as-a-service, data processing, and related professional services. This insuring agreement is directly relevant to Skybridge's obligations under the MSA for the provision of the SkyComply™ platform and associated implementation, configuration, and support services.
(b) Cyber Liability / Network Security. The policy covers claims arising from unauthorized access to or use of computer systems, including but not limited to unauthorized access, hacking, denial-of-service attacks, introduction of malicious code, and failure of computer security to prevent such events. This coverage extends to both third-party claims and first-party losses (subject to separate sublimits for first-party coverage).
(c) Privacy Liability. The policy covers claims arising from the wrongful disclosure, collection, use, or failure to protect personally identifiable information ("PII") and non-public personal information ("NPI"), including violations of federal and state privacy laws such as the Gramm-Leach-Bliley Act ("GLBA"), the California Consumer Privacy Act ("CCPA"), and comparable state statutes. Given that the SkyComply™ platform will process NPI and PII of Meridian's customers in connection with BSA/AML compliance and regulatory reporting, this coverage is critical.
(d) Network Security Liability. The policy covers claims arising from the failure of network security measures to prevent or mitigate security events, including but not limited to transmission of malicious code from the insured's network to third-party systems.
(e) Regulatory Defense Costs and Fines. The policy provides coverage for defense costs incurred in connection with regulatory proceedings and, where insurable by law, for regulatory fines and penalties imposed on the insured. We note that the insurability of regulatory fines varies by jurisdiction and by the nature of the fine (punitive vs. compensatory), and this coverage may be subject to specific sublimits and exclusions. This issue is of particular importance given Meridian's request that regulatory fines be carved out from the MSA's consequential damages exclusion, as discussed in Section IX below.
(f) Crisis Management and Breach Response Costs. The policy provides first-party coverage for crisis management expenses, including forensic investigation, notification costs, credit monitoring, public relations, and legal expenses incurred in response to a data breach or security incident. These costs can be substantial in the context of a breach affecting a financial institution of Meridian's size and customer base.
(g) Business Interruption. The policy provides first-party coverage for business interruption losses resulting from a security event, subject to a sublimit. The specific sublimit amount needs to be confirmed with Coastal Assurance. This coverage may have potential relevance to Skybridge's service level agreement ("SLA") obligations under the MSA, to the extent a covered security event causes downtime or degradation in the SkyComply™ platform's availability.
3. Key Policy Terms and Conditions. The following key terms and conditions of the Coastal Assurance policy warrant attention in the context of the MSA:
(a) Claims-Made Basis. The policy is written on a claims-made and reported basis, which is standard for technology E&O and cyber liability insurance. Under a claims-made policy, coverage is triggered when a claim is first made against the insured and reported to the carrier during the policy period (or any applicable extended reporting period). This contrasts with an occurrence-based policy, which is triggered by the date of the underlying event. The claims-made structure has important implications for the MSA's two-year tail coverage requirement, as discussed in Section V.A.2 below.
(b) Retroactive Date. The policy's retroactive date — the date before which wrongful acts are excluded from coverage — must be confirmed. For continuity of coverage, the retroactive date should predate Skybridge's founding or, at a minimum, should be no later than 2018, when Skybridge began providing SaaS services to financial institution clients. If the retroactive date has been advanced at any renewal, there may be a gap in coverage for wrongful acts occurring prior to the current retroactive date. We have requested confirmation of the retroactive date from Jonathan Kreske and Coastal Assurance.
(c) Deductible / Self-Insured Retention. The deductible or self-insured retention ("SIR") applicable to the policy must be confirmed. The SIR represents Skybridge's out-of-pocket obligation before insurance coverage attaches. A high SIR could affect Skybridge's ability to fund initial defense costs and breach response expenses. We have requested this information from Jonathan Kreske and expect to receive it within the next five business days.
(d) Territory. The policy provides worldwide coverage, subject to claims brought in or subject to the jurisdiction of the United States. This is important given Meridian's domestic and international operations, as claims arising from the SkyComply™ platform could originate in connection with Meridian's overseas operations or cross-border regulatory proceedings.
(e) Subcontractor / Subprocessor Coverage. A critical open question is whether the Coastal Assurance policy covers claims arising from the acts or omissions of Skybridge's subcontractors and subprocessors, particularly Orion Cloud Services, Inc. ("Orion Cloud"), which provides the IaaS hosting infrastructure for the SkyComply™ platform in its US-East (Virginia) and US-West (Oregon) regions. If Orion Cloud causes or contributes to a data breach or security failure that results in claims against Skybridge by Meridian, the Coastal Assurance policy must respond. Many technology E&O policies cover the insured's liability arising from the acts of subcontractors to the extent the insured is legally liable, but some policies contain exclusions or limitations for subcontracted services that could create a gap. This issue is discussed further in Section V.A.3 below.
(f) Hammer Clause / Consent to Settle. We should review the policy's consent-to-settle provisions (commonly known as the "hammer clause") to understand whether Coastal Assurance can compel Skybridge to accept a settlement over Skybridge's objection, and what financial consequences attach to Skybridge's refusal. In the context of a high-profile data breach claim involving a major bank, the settlement dynamics could be significant.
B. Commercial General Liability Policy
Skybridge maintains a commercial general liability policy, the details of which have been requested from Jonathan Kreske but have not yet been received as of the date of this memorandum. Based on preliminary discussions with Mr. Kreske and David Shimura, we understand that:
• The CGL policy is written on a standard ISO occurrence-based form (CG 00 01 or equivalent);
• The carrier is separate from Coastal Assurance Corporation (carrier name to be confirmed upon receipt of declarations page);
• The policy provides coverage for bodily injury, property damage, personal injury, and advertising injury;
• Coverage limits are believed to be at least $2,000,000 per occurrence / $4,000,000 aggregate (standard limits for a technology company of Skybridge's size), but this has not been confirmed against Meridian's requirement of $5,000,000 per occurrence / $10,000,000 aggregate.
If the preliminary information is correct and current CGL limits are $2,000,000 / $4,000,000, there would be a significant shortfall relative to Meridian's requirements. However, this gap may be partially addressed by the umbrella/excess policy, which would sit excess over the CGL limits and, together with the primary CGL, may satisfy the aggregate requirement. This cannot be confirmed until we have received the declarations pages for both the CGL and umbrella/excess policies.
C. Workers' Compensation Policy
Skybridge, as a Delaware-incorporated company with approximately 420 employees across offices in Wilmington, Delaware; New York, New York; Austin, Texas; and San Francisco, California, is required by the laws of each applicable state to maintain workers' compensation insurance providing statutory benefits. Based on our discussions with David Shimura, Skybridge maintains a workers' compensation policy providing statutory coverage in all states in which it has employees.
The carrier and specific policy details have been requested from Jonathan Kreske but not yet received. We presume compliance with statutory requirements pending confirmation. Meridian's MSA does not specify a separate employer's liability minimum, although standard practice would suggest minimums of $1,000,000 per accident / $1,000,000 disease (per employee) / $1,000,000 disease (policy limit).
D. Umbrella / Excess Liability Policy
Skybridge maintains an umbrella or excess liability policy, the details of which have been requested from Jonathan Kreske but not yet received. Based on preliminary discussions with Mr. Kreske, we understand that Skybridge carries an umbrella policy with a limit of at least $10,000,000, but we cannot confirm the exact limit, the carrier, or the schedule of underlying policies until the declarations page is received.
Key questions to be resolved upon receipt of the umbrella policy documentation include:
(i) Whether the umbrella limit meets or exceeds Meridian's $10,000,000 minimum;
(ii) Whether the umbrella sits excess over both the CGL and employer's liability policies (as required by the MSA);
(iii) Whether the umbrella also sits excess over the technology E&O / cyber liability policy (which would provide an additional layer of protection beyond the $25M per-occurrence limit of the Coastal Assurance policy); and
(iv) Whether the umbrella is true umbrella coverage (providing drop-down coverage for claims excluded by underlying policies) or follows-form excess coverage (mirroring the terms and conditions of the underlying policies).
V. Gap Analysis — Coverage-by-Coverage Comparison
A. Technology E&O / Cyber Liability
1. Coverage Limits. Meridian Requires: $25,000,000 per occurrence / $50,000,000 aggregate.
Skybridge Has: $25,000,000 per claim / $50,000,000 aggregate (Coastal Assurance Policy No. CA-TECH-2025-07831).
Finding: No gap on a contractual compliance basis. Skybridge's current coverage limits exactly match Meridian's stated minimum requirements. On a strict reading of the MSA's insurance provisions, Skybridge's Coastal Assurance policy satisfies the technology E&O / cyber liability insurance requirement.
Observation and Risk Assessment: While the current limits satisfy the contractual minimum, this analysis team has significant concerns about the adequacy of the $25,000,000 per-occurrence limit from a broader risk management perspective, particularly in light of the following factors:
(a) Scale of the MSA and Total Contract Value. The MSA contemplates a total contract value of approximately $50,000,000 over five years, with annual fees of approximately $9,325,000 (escalating in Years 3–5). The per-occurrence cyber limit of $25M represents only half of the total contract value. In the event of a catastrophic data breach or prolonged service outage, losses and liabilities could potentially exceed the per-occurrence limit.
(b) Sensitivity of Data Processed. The SkyComply™ platform will process NPI, PII, and BSA/AML compliance data for Meridian, one of the ten largest banks in the United States with approximately $485 billion in total assets and tens of millions of customer accounts. A breach involving Meridian's customer data could result in regulatory investigations, enforcement actions, class action litigation, and reputational harm far exceeding $25M in aggregate costs. For reference, the average cost of a data breach in the financial services sector was approximately $5.9 million in 2024 (Bramwell Partners LLC / Stonefield Group), but breaches affecting tens of millions of records at major financial institutions have resulted in costs and settlements in the hundreds of millions of dollars (e.g., Penmark Group, $190M settlement; Harborview Enterprises, $575M settlement).
(c) Interaction with Indemnification Cap Positions. The current negotiation positions on indemnification caps further highlight the potential for the per-occurrence limit to be insufficient:
• Skybridge's proposed data breach indemnity cap: 2× annual fees ≈ $18,650,000 (within the $25M per-occurrence limit)
• Skybridge's proposed data security super-cap: 3× annual fees ≈ $27,975,000 (exceeds the $25M per-occurrence limit by approximately $2,975,000)
• Meridian's position: uncapped data breach indemnification (exposure potentially unlimited and far in excess of the $25M per-occurrence limit)
If the data security super-cap of $27,975,000 is agreed upon, Skybridge would face a $2,975,000 gap between its contractual exposure and its per-occurrence insurance coverage. If Meridian's uncapped position prevails, the gap could be far more significant.
(d) Aggregate Erosion. The $50M aggregate limit applies to all claims made during the policy year, not just claims arising from the Meridian engagement. If Skybridge experiences claims from other clients during the same policy period, the aggregate could be eroded, reducing available coverage for Meridian-related claims. While Skybridge has reported no material claims under the Coastal Assurance policy to date, this risk increases as Skybridge's client portfolio grows.
Recommendation: We recommend discussing with David Shimura and Jonathan Kreske whether it is prudent and cost-effective to increase the per-occurrence limit at the next Coastal Assurance renewal (before March 31, 2026) to provide a greater cushion above the proposed indemnification caps. An increase to $30M or $35M per occurrence would more comfortably cover the data security super-cap position and provide meaningful additional protection in the event of a significant breach. Jonathan Kreske should be asked to obtain indicative pricing from Coastal Assurance or Wentworth & Hale for increased limits.
2. Policy Period / Term Alignment. Current Policy Period: April 1, 2025 – March 31, 2026 (one-year term).
MSA Initial Term: March 1, 2026 – February 28, 2031 (five years).
MSA Tail Requirement: Coverage must be maintained for two (2) years following termination or expiration of the MSA, i.e., through approximately February 28, 2033.
Finding: Gap identified — structural term mismatch requiring proactive management. The current Coastal Assurance policy expires on March 31, 2026, only one month after the targeted MSA Go-Live Date of March 1, 2026. Skybridge must renew the policy at least seven more times (annual renewals through approximately the 2032-2033 policy year) to maintain continuous coverage throughout the MSA term and the two-year post-termination tail period. Because the policy is written on a claims-made basis, continuous renewal without a gap in coverage is essential. If Skybridge fails to renew the policy, changes carriers, or otherwise allows a lapse in coverage, claims arising from wrongful acts during the covered period but reported after the lapse would not be covered unless an extended reporting period ("ERP" or "tail") endorsement is purchased.
The risk of a coverage gap is particularly acute in the following scenarios:
(i) Carrier Change. If Skybridge changes carriers at any renewal, the new carrier may impose a new retroactive date that post-dates the MSA's Go-Live Date, effectively excluding coverage for wrongful acts occurring during the prior carrier's policy period but not reported until after the carrier change. To mitigate this risk, Skybridge would need to purchase a tail/ERP endorsement from Coastal Assurance and ensure that the new carrier accepts the prior retroactive date.
(ii) Non-Renewal. If Coastal Assurance declines to renew the policy — for example, due to a material change in Skybridge's risk profile, an adverse claims history, or market conditions — Skybridge would need to secure replacement coverage promptly and purchase a tail from Coastal Assurance to avoid a gap.
(iii) Merger, Acquisition, or Change of Control. Many claims-made policies terminate automatically or provide for optional cancellation in the event of a change of control of the insured. If Skybridge undergoes a merger, acquisition, or other change of control during the MSA term, the Coastal Assurance policy may terminate, and Skybridge (or its successor) would need to secure replacement coverage and purchase a tail.
Recommendations:
(i) Include a covenant in the MSA requiring Skybridge to maintain continuous technology E&O / cyber liability coverage with limits at least equal to the required minimums throughout the MSA term and for two years following termination or expiration. Skybridge's September 3 redline already accepts this obligation in principle.
(ii) Negotiate with Coastal Assurance (through Wentworth & Hale) for a multi-year policy commitment or, at minimum, obtain confirmation from Coastal Assurance of its willingness to renew annually at substantially similar terms, subject to underwriting. A multi-year policy would provide greater certainty and lock in favorable pricing.
(iii) Confirm the availability and estimated cost of a tail/ERP endorsement from Coastal Assurance in the event of a carrier change or policy termination. Typical ERP periods range from one to three years, and the premium is typically calculated as a percentage of the expiring policy's annual premium (commonly 100%–200% of the annual premium for a two- to three-year tail). Jonathan Kreske should request this information from Wentworth & Hale.
(iv) Consider including a provision in the MSA requiring Skybridge to notify Meridian promptly of any change of carrier, change of control, or other event that could affect the continuity of coverage.
3. Subprocessor / Subcontractor Coverage. Context: Orion Cloud Services, Inc. ("Orion Cloud") is Skybridge's infrastructure-as-a-service ("IaaS") subprocessor, providing the cloud hosting environment for the SkyComply™ platform. The platform is deployed in Orion Cloud's US-East (Northern Virginia) and US-West (Oregon) regions. Orion Cloud handles substantial quantities of NPI, PII, and BSA/AML data in connection with its hosting services for SkyComply™. Under the MSA, Skybridge bears full responsibility for the acts and omissions of its subprocessors, and Skybridge's indemnification obligations to Meridian would be triggered in the event of a data breach caused by an Orion Cloud security failure.
Finding: Potential gap requiring confirmation. We need to confirm that the Coastal Assurance policy covers claims arising from the acts or omissions of Skybridge's subprocessors and subcontractors. Many technology E&O policies cover the insured's vicarious liability for subcontractor conduct so long as the insured itself is legally liable to the claimant, but some policies contain express exclusions for "outsourced services" or "subcontracted work." If the Coastal Assurance policy contains such an exclusion, or if the coverage is limited in scope, a significant gap could exist.
The risk is not theoretical. Cloud infrastructure providers have experienced high-profile security incidents, and a breach of the Orion Cloud environment hosting SkyComply™ data could result in substantial claims against Skybridge by Meridian. Skybridge's ability to pursue contractual remedies against Orion Cloud under its subprocessor agreement is a separate consideration, but the immediate concern is ensuring that Skybridge's insurance coverage responds to such claims.
Recommendation: Request from Coastal Assurance (through Wentworth & Hale) written confirmation that the policy covers claims arising from the acts or omissions of Skybridge's subprocessors and subcontractors, including specifically Orion Cloud Services, Inc. If coverage is not currently provided or is uncertain, request an endorsement expressly extending coverage to subprocessor-related claims. This item should be prioritized, as subprocessor risk is one of the most significant areas of potential exposure under the MSA.
B. Commercial General Liability
Meridian Requires: $5,000,000 per occurrence / $10,000,000 aggregate.
Skybridge Has: To be confirmed. Preliminary information suggests limits of approximately $2,000,000 per occurrence / $4,000,000 aggregate, but this has not been verified.
Finding: Pending verification; potential gap. If the preliminary information is accurate, Skybridge's primary CGL limits fall short of Meridian's requirements by $3,000,000 per occurrence and $6,000,000 in the aggregate. The gap may be partially or fully addressed by the umbrella/excess policy, which would provide additional coverage in excess of the primary CGL limits. However, the MSA's insurance provisions appear to require primary CGL limits of $5M / $10M, not combined primary and excess limits. If Meridian interprets the requirement as applying to primary limits only, Skybridge would need to increase its CGL limits.
Recommendation: Obtain the current CGL declarations page from Jonathan Kreske to confirm coverage limits, carrier, policy period, and policy form. If the primary CGL limits are below $5M / $10M, assess whether the umbrella/excess policy fills the gap to Meridian's satisfaction, or whether Skybridge needs to increase its primary CGL limits. If an increase is needed, Jonathan Kreske should be directed to request indicative pricing from the CGL carrier for an increase to $5M / $10M.
C. Workers' Compensation
Meridian Requires: Statutory limits as required by applicable law.
Skybridge Has: Statutory workers' compensation coverage (presumed, pending confirmation).
Finding: Presumed compliant. Skybridge, as a Delaware-incorporated company with approximately 420 employees across four states, is required by law to maintain workers' compensation coverage at statutory limits. We have no reason to believe that Skybridge is not in compliance, but formal confirmation should be obtained by reviewing the current policy declarations page. Skybridge should also confirm that its employer's liability coverage meets standard minimums of $1,000,000 per accident / $1,000,000 disease (per employee) / $1,000,000 disease (policy limit), as Meridian may raise this as a supplemental requirement during the negotiation process.
Recommendation: Obtain the current workers' compensation declarations page from Jonathan Kreske to confirm coverage and compliance.
D. Umbrella / Excess Liability
Meridian Requires: $10,000,000 per occurrence.
Skybridge Has: To be confirmed. Preliminary information suggests an umbrella limit of at least $10,000,000, but this has not been verified.
Finding: Pending verification. The umbrella/excess policy details must be confirmed to assess compliance with Meridian's requirements. Key questions include whether the coverage limit meets the $10M minimum, which underlying policies are scheduled, and whether the umbrella extends over the technology E&O / cyber policy (which would provide additional protection beyond the primary $25M per-occurrence limit).
Recommendation: Obtain the current umbrella/excess declarations page and schedule of underlying policies from Jonathan Kreske. If the umbrella sits excess over both the CGL and the Coastal Assurance cyber/E&O policy, this should be highlighted in the insurance summary provided to Meridian, as it demonstrates a more robust coverage structure than the minimum requirements alone.
VI. Analysis of Additional Insured Request
A. Meridian's Request
Article XIV of the draft MSA requires Skybridge to cause Meridian National Bank, N.A. to be named as an additional insured on two categories of policies:
(i) The commercial general liability policy; and
(ii) The technology errors and omissions / cyber liability policy (i.e., Coastal Assurance Policy No. CA-TECH-2025-07831).
The additional insured endorsement must provide coverage for claims against Meridian arising out of or relating to Skybridge's performance of its obligations under the MSA. Meridian's proposed language further requires that the additional insured coverage be "primary and non-contributory" with respect to any insurance maintained by Meridian, meaning that Skybridge's policies would respond first in the event of a covered claim, without contribution from Meridian's own insurance.
This request is consistent with common practice for large enterprise technology agreements in the financial services sector. However, the two components of the request — CGL additional insured and cyber/E&O additional insured — present materially different considerations.
B. CGL Additional Insured
Additional insured endorsements on commercial general liability policies are standard, widely available, and routinely issued by CGL carriers. The endorsement is typically accomplished through one of the standard ISO additional insured endorsement forms, such as CG 20 10 (Additional Insured — Owners, Lessees or Contractors — Scheduled Person or Organization) or CG 20 37 (Additional Insured — Owners, Lessees or Contractors — Completed Operations), or through a blanket additional insured endorsement triggered by a contractual requirement.
The endorsement typically provides coverage to the additional insured (Meridian) for claims arising out of the named insured's (Skybridge's) operations or work performed on behalf of the additional insured, but does not cover claims arising from the additional insured's own independent negligence or misconduct.
Finding: Low risk. This is a standard accommodation that Skybridge's CGL carrier should be able to provide without difficulty and at minimal or no additional premium cost. Many CGL policies already include a blanket additional insured endorsement that is automatically triggered when the named insured is contractually required to name a third party as additional insured.
Recommendation: Skybridge should agree to this requirement. Jonathan Kreske or Wentworth & Hale should contact the CGL carrier to request the endorsement, specifying Meridian National Bank, N.A. as the additional insured, with coverage limited to claims arising from Skybridge's performance under the MSA.
C. Cyber / E&O Additional Insured
Additional insured status on technology E&O / cyber liability policies is a qualitatively different matter. Unlike CGL policies, where additional insured endorsements have been standardized for decades, the cyber/E&O market has not developed a universal approach to additional insured endorsements. The following considerations apply:
(a) Carrier Availability. Many cyber/E&O carriers do not offer additional insured endorsements as a standard feature of their policies. The cyber insurance market is still evolving, and policy forms are less standardized than in the CGL market. Some carriers will offer additional insured endorsements upon request, but the terms and availability vary significantly from carrier to carrier and from policy to policy. We do not yet know whether Coastal Assurance Corporation offers this endorsement under Policy No. CA-TECH-2025-07831.
(b) Scope Limitations. Where additional insured endorsements are available on cyber/E&O policies, they are often limited in scope. For example, the endorsement may cover only the additional insured's vicarious liability arising from the named insured's acts or omissions, and not direct claims against the additional insured. This means that if a regulatory enforcement action is brought directly against Meridian for a data breach caused by Skybridge, the endorsement may not provide coverage to Meridian for its own defense costs and penalties. Meridian's counsel at Hargrove, Tully & Marsh may push back on a limited endorsement that does not provide meaningful coverage for Meridian's most significant risk scenarios.
(c) Aggregate Erosion. Adding Meridian as an additional insured could have an adverse impact on the aggregate limit available to Skybridge. If Meridian, as an additional insured, submits a claim under the policy, the claim would erode the same $50M aggregate limit that Skybridge relies upon for its own coverage. In a catastrophic breach scenario, Skybridge and Meridian could be competing for the same limited pool of coverage, creating a conflict of interest. This dynamic should be understood and communicated to David Shimura.
(d) Premium Impact. The addition of a large financial institution like Meridian as an additional insured under a cyber/E&O policy may trigger a premium increase from Coastal Assurance, reflecting the increased risk exposure associated with covering a systemically important bank. The magnitude of any premium increase is unknown at this time and should be explored with Wentworth & Hale.
(e) Subrogation Implications. If Meridian is named as an additional insured, Coastal Assurance may waive its subrogation rights against Meridian (since a carrier generally cannot subrogate against its own insured). This could be advantageous to Meridian but disadvantageous to Skybridge and Coastal Assurance if Meridian's own conduct contributed to a loss.
Finding: Potential gap / active negotiation issue. The availability, scope, and cost of the cyber/E&O additional insured endorsement remain unconfirmed. This is one of the eight key open negotiation issues between Skybridge and Meridian and requires prompt resolution.
Recommendations:
(i) Contact Coastal Assurance. Through Wentworth & Hale, contact Coastal Assurance Corporation's underwriting team to determine whether an additional insured endorsement is available under Policy No. CA-TECH-2025-07831. If available, request the specific endorsement language, any coverage limitations, and the additional premium cost. This inquiry should be initiated immediately.
(ii) Prepare Alternative Proposals. If the endorsement is not available, or if it is available only on terms that are unacceptably limited or prohibitively expensive, Skybridge should be prepared to propose alternative protections to Meridian that provide comparable assurance without the formal additional insured designation. Recommended alternatives include:
(a) A waiver of subrogation endorsement in favor of Meridian, which would prevent Coastal Assurance from pursuing subrogation claims against Meridian in connection with claims paid under the policy;
(b) A contractual commitment by Skybridge to maintain the required minimum coverage levels throughout the MSA term and the two-year tail period, with breach of this commitment constituting a material breach of the MSA;
(c) Prompt notice obligations requiring Skybridge to provide Meridian with not less than thirty (30) days' prior written notice of any cancellation, non-renewal, material reduction in coverage, or material change in the terms of the Coastal Assurance policy; and
(d) A right to cure provision allowing Meridian to procure replacement coverage at Skybridge's expense in the event Skybridge fails to maintain the required insurance.
(iii) Scope Limitations. If the endorsement is available and Skybridge agrees to proceed, confirm that the endorsement is limited to claims arising from Skybridge's performance of its obligations under the MSA and does not provide Meridian with direct coverage for its own independent acts or omissions. An overly broad endorsement could create unintended exposure for Skybridge's policy.
(iv) Premium Allocation. Coordinate with David Shimura and Jonathan Kreske on Skybridge's willingness to absorb any premium increase associated with the endorsement. If the premium increase is material, Skybridge may wish to include the additional cost as a pass-through in the MSA pricing or negotiate a sharing arrangement with Meridian.
(v) Communication to Meridian's Counsel. Once Skybridge's position is determined, communicate the analysis and proposed resolution to Hargrove, Tully & Cascade Insurance Brokers through the next negotiation letter, which is currently scheduled for delivery on or about September 26, 2025.
VII. Certificate of Insurance — Delivery Obligations
The MSA imposes the following obligations on Skybridge with respect to certificates of insurance:
(a) Initial Delivery. Skybridge must deliver a certificate of insurance to Meridian within ten (10) business days of execution of the MSA. Based on the current negotiation timeline, MSA execution is targeted for late January or early February 2026, meaning that the initial certificate would need to be delivered by approximately mid-February 2026.
(b) Annual Renewals. Updated certificates must be provided annually thereafter, promptly following each policy renewal.
(c) Material Changes. Updated certificates must be provided promptly upon any material change in coverage, including but not limited to changes in coverage limits, carriers, deductibles/SIRs, or endorsements.
(d) Content Requirements. The certificate must evidence all required coverages and limits as specified in Article XIV of the MSA. If Meridian is named as additional insured on any policy, the certificate must reflect the additional insured endorsement.
(e) Notice of Cancellation / Non-Renewal. Skybridge must provide Meridian with not less than thirty (30) days' prior written notice of cancellation, non-renewal, or material reduction in coverage under any required policy. We note that this obligation runs from Skybridge to Meridian; it is separate from (and may exceed) any notice that the carrier is required to provide under the policy terms or applicable law. Skybridge will need to establish an internal process to monitor policy status and ensure timely notice to Meridian.
Feasibility Assessment: The ten-business-day delivery timeline for the initial certificate is achievable, provided that (i) all endorsement requests (particularly the additional insured endorsement) are submitted to the carriers well in advance of MSA execution, and (ii) Wentworth & Hale is engaged to coordinate the certificate issuance process across all applicable carriers. We recommend that the endorsement requests and certificate preparation process begin no later than November 2025, approximately three months before anticipated MSA execution, to allow sufficient lead time for underwriting review and endorsement issuance.
Action Item: Prepare a certificate of insurance request letter to Coastal Assurance Corporation (and other applicable carriers) on behalf of Skybridge, requesting issuance of certificates of insurance naming Meridian National Bank, N.A. as certificate holder (and as additional insured, if the endorsement is obtained). The letter should specify all required coverages, limits, and endorsements as set forth in Article XIV of the MSA. This letter will be drafted under separate cover and circulated for review by David Shimura and Jonathan Kreske before submission.
VIII. Regulatory Considerations
The insurance provisions of the MSA must be understood in the broader regulatory context governing Meridian's third-party risk management obligations. The following regulatory considerations are relevant to this analysis:
OCC Bulletin 2013-29 and the Interagency Guidance on Third-Party Relationships (June 2023). As discussed in Section II above, the federal banking regulators expect banks to evaluate the insurance coverage maintained by critical third-party service providers. The Interagency Guidance specifically identifies insurance as a factor to be considered during the due diligence phase of a third-party relationship and as part of the bank's ongoing monitoring of the relationship. Meridian's examiners — including the OCC (as primary federal regulator of a national bank) and potentially the Federal Reserve and FDIC (in connection with consolidated supervision of Meridian's parent holding company) — may review the adequacy of Skybridge's insurance as part of their examination of Meridian's third-party risk management practices. An examiner finding that Skybridge's insurance is inadequate could result in supervisory criticism of Meridian, including Matters Requiring Attention ("MRAs") or Matters Requiring Immediate Attention ("MRIAs"), which could in turn affect Meridian's supervisory ratings and create pressure for contract renegotiation.
Bank Service Company Act. Because SkyComply™ constitutes a "bank service" within the meaning of 12 U.S.C. § 1867, Skybridge is subject to direct examination by federal banking regulators with respect to the services it provides to Meridian. While regulatory examination of Skybridge would primarily focus on operational risk, information security, and business continuity, examiners could also inquire into the adequacy of Skybridge's insurance program as part of a broader assessment of Skybridge's financial stability and risk management capabilities. A finding that Skybridge lacks adequate insurance coverage for the services it provides to a systemically important financial institution could adversely affect Skybridge's reputation and its ability to maintain and grow its financial institution client base.
State Insurance Regulatory Considerations. Skybridge should also be aware of any state-specific insurance requirements that may apply to its operations, particularly in states where Skybridge has significant operations or employees (Delaware, New York, Texas, and California). While these requirements are unlikely to exceed the MSA's contractual minimums, compliance should be confirmed as a matter of course.
Recommendation: Ensure that the MSA's insurance provisions and Skybridge's actual coverage are robust enough to withstand regulatory scrutiny. This means not merely satisfying the contractual minimums negotiated between the parties, but maintaining coverage levels, policy terms, and endorsements that a reasonable examiner would consider adequate for a critical third-party service provider processing NPI and BSA/AML data for a top-10 U.S. bank. Where there is a choice between meeting the minimum contractual requirement and exceeding it to provide a greater margin of safety, Skybridge should seriously consider the latter, particularly with respect to the per-occurrence cyber limit and the subprocessor coverage scope.
IX. Interaction with Indemnification and Liability Cap Provisions
The insurance coverage analysis presented in this memorandum should not be viewed in isolation. The adequacy of Skybridge's insurance program is directly affected by the indemnification and liability cap provisions currently under negotiation in the MSA. The insurance coverage serves as a financial backstop for Skybridge's contractual liabilities; if the contractual liabilities exceed available coverage, Skybridge will be exposed to out-of-pocket losses that could have a material impact on its financial condition.
The following indemnification and liability cap provisions are currently under negotiation and interact with the insurance analysis:
(a) IP Indemnification — Uncapped. Both parties have agreed that Skybridge's obligation to indemnify Meridian against third-party intellectual property infringement claims will be uncapped. This is consistent with industry standard practice. IP infringement claims are generally insurable under the technology E&O / cyber liability policy (to the extent they fall within the "media liability" or "Intellectual property" coverage grants), and the $25M per-occurrence / $50M aggregate limits provide a meaningful backstop. However, in the event of a catastrophic IP claim (e.g., a patent troll asserting infringement against the core SkyComply™ technology), the uncapped nature of the indemnity could result in exposure exceeding the policy limits.
(b) Data Breach Indemnification — Disputed. Skybridge proposes to cap its data breach indemnification obligation at 2× annual fees, or approximately $18,650,000. Meridian demands uncapped data breach indemnification. At Skybridge's proposed cap, the per-occurrence cyber limit of $25M provides approximately $6,350,000 of headroom above the cap. At Meridian's uncapped position, there is no defined limit to Skybridge's contractual exposure, and the $25M per-occurrence limit could be far exceeded in a significant breach event.
(c) General Indemnification Cap — 1× Annual Fees. The parties appear to be aligned on a general indemnification cap of 1× annual fees, or approximately $9,325,000. This cap is well within the per-occurrence limits of both the cyber and CGL policies.
(d) Aggregate Liability Cap — 2× Annual Fees. Skybridge proposes an aggregate liability cap of 2× annual fees, or approximately $18,650,000. This cap is within the per-occurrence cyber limit of $25M.
(e) Data Security Super-Cap — Disputed. Skybridge proposes a data security "super-cap" of 3× annual fees, or approximately $27,975,000, to apply to data breach-related liabilities in excess of the general indemnification cap. Meridian demands that data breach liabilities be uncapped (i.e., no super-cap). At the proposed super-cap of $27,975,000, Skybridge's contractual exposure exceeds the per-occurrence cyber limit of $25,000,000 by approximately $2,975,000. This means that if a data breach claim triggers the full super-cap, approximately $2,975,000 of the liability would be uninsured and would fall directly on Skybridge's balance sheet.