MEMORANDUM
PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
TO: Amy Chesterton, Lead Associate, Calderwood & Harkness LLP
FROM: Nathan Ikeda, Associate, Calderwood & Harkness LLP
DATE: September 8, 2025
RE: SLA Terms Analysis — Skybridge Fintech Ltd. / Meridian National Bank, N.A. Enterprise SaaS Agreement — Uptime, Credits, and Market Benchmarks
MATTER NO.: 1009-00007
REVIEWED BY: Amy Chesterton
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
This memorandum analyzes the disputed Service Level Agreement ("SLA") provisions in the proposed Master Software-as-a-Service Agreement (the "MSA" or "Agreement") between Skybridge Fintech Ltd. ("Skybridge" or "Licensor") and Meridian National Bank, N.A. ("Meridian" or "Licensee") for the deployment of Skybridge's SkyComply™ AI-driven anti-money laundering ("AML") and transaction-monitoring platform (the "Platform"). The Agreement carries a total contract value ("TCV") of approximately $50,000,000 over a five-year initial term and contemplates deployment to approximately 32,000 named users spanning Meridian's retail banking, commercial banking, and wealth management divisions.
The parties have reached impasse on two central SLA issues:
First, the monthly platform availability target. Meridian, through its outside counsel Hargrove, Tully & Cascade Insurance Brokers ("HTM"), demands a 99.95% monthly uptime commitment. Skybridge proposes 99.9% monthly uptime. While the 0.05% differential appears marginal in percentage terms, it halves the permissible unscheduled downtime per month from approximately 43.8 minutes to approximately 21.9 minutes, and introduces material operational and financial risks to Skybridge, particularly given the constraints imposed by Skybridge's upstream infrastructure-as-a-service ("IaaS") relationship with Orion Cloud Services, Inc. ("Orion Cloud").
Second, the SLA service credit structure. Meridian demands uncapped SLA service credits — that is, no monthly or annual ceiling on the credits Skybridge would be obligated to issue for availability shortfalls. Skybridge proposes a tiered credit structure with a monthly credit cap of 30% of the monthly subscription fee and an annual credit cap of 15% of the annual subscription fee. Meridian contends that capping credits diminishes Skybridge's financial incentive to maintain high availability; Skybridge contends that uncapped credits transform what should be a pricing-adjustment mechanism into an unlimited financial penalty, fundamentally altering the deal's risk profile.
Based on the analysis set forth below — including quantitative impact modeling, upstream infrastructure dependency analysis, market benchmarking against comparable enterprise financial services SaaS transactions, and strategic considerations unique to this engagement — I recommend the following approach:
• Hold at 99.9% monthly uptime as the primary position. This standard is market-conforming for enterprise SaaS in the financial services sector and is the only defensible commitment given Orion Cloud's upstream 99.95% infrastructure SLA, which leaves zero margin for application-layer issues if Skybridge were to match it.
• Offer enhanced credit tiers as a negotiated compromise to demonstrate Skybridge's confidence in the Platform and to provide Meridian with meaningful financial protection. Specifically, I recommend increasing the credit percentages at Tiers 1 through 3 (from 5%/10%/20% to 7.5%/15%/25%, respectively) while maintaining the 30% credit at the lowest tier and preserving the monthly and annual caps.
• Do not concede to uncapped credits. The combination of capped credits, enhanced credit percentages, and a performance-based termination right (Meridian may terminate if uptime falls below 98.0% in three of any consecutive six months) provides Meridian with a comprehensive remedy framework that is both commercially reasonable and consistent with market practice.
• Prepare fallback and alternative positions, including a bifurcated SLA concept and a burn-in period for the initial post-Go-Live stabilization phase, for deployment in negotiations as necessary and upon client authorization.
The balance of this memorandum provides the detailed analysis supporting these recommendations.
II. BACKGROUND AND CONTEXT
A. Transaction Overview
Skybridge Fintech Ltd. is a Delaware limited company (alternative entity) headquartered at 1400 Concord Pike, Suite 320, Wilmington, DE 19803. Skybridge is a growth-stage financial technology company that develops and markets the SkyComply™ platform, an AI-driven SaaS solution for AML compliance, Bank Secrecy Act ("BSA") transaction monitoring, sanctions screening, and suspicious activity reporting. Founded in 2018, Skybridge currently employs approximately 420 people across its Wilmington headquarters, its engineering center in Austin, Texas, and its customer success offices in New York and Charlotte.
Skybridge's financial profile is relevant to the SLA analysis because the credit exposure under the Agreement must be assessed against Skybridge's overall financial capacity and margin structure. Key financial metrics for FY 2024 (ending December 31, 2024) include:
• Revenue: $78.3 million
• Annual Recurring Revenue ("ARR"): approximately $78 million
• EBITDA: $11.7 million (approximately 14.9% EBITDA margin)
• Gross margin: 74%
• Net revenue retention rate: 118%
Skybridge holds SOC 2 Type II certification (audit report dated March 15, 2025, covering the period April 1, 2024 through March 14, 2025) and ISO 27001 certification (certificate dated January 22, 2025, issued by BSI Group). These certifications are relevant to the SLA discussion because they evidence Skybridge's operational maturity and the credibility of its availability commitments.
Skybridge is majority-owned (62% equity interest) by Pinnacle Ridge Capital Partners, LP ("PRCP"), a mid-market growth equity fund. The remaining equity is held by Skybridge's founders and management team. PRCP's ownership position and consent rights are addressed in Section VII.C below.
Meridian National Bank, N.A. is a national banking association chartered under federal law, with its principal office located at 600 Lexington Avenue, 40th Floor, New York, NY 10022. Meridian holds approximately $485 billion in total assets as of its most recent quarterly filing, placing it among the ten largest commercial banks in the United States by total assets. Meridian's holding company, Meridian Financial Group, Inc., is publicly traded on the New York Stock Exchange. Meridian is subject to supervision and regulation by the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System (the "Federal Reserve"), and the Federal Deposit Insurance Corporation ("FDIC"). As a systemically important financial institution ("SIFI"), Meridian is subject to heightened prudential standards under the Dodd-Frank Wall Street Reform and Consumer Protection Act, including enhanced risk management requirements that are directly relevant to the criticality of its AML compliance infrastructure.
Meridian is undertaking a comprehensive replacement of its legacy AML and transaction-monitoring platform with SkyComply™. The legacy platform, which has been in production for over twelve years, is being retired due to limitations in its ability to process the volume and complexity of transaction data generated by Meridian's U.S. and international operations and its inability to leverage advanced machine learning and artificial intelligence techniques for pattern detection and alert optimization. The SkyComply™ deployment will span Meridian's retail banking division (approximately 18,000 named users), commercial banking division (approximately 9,500 named users), and wealth management division (approximately 4,500 named users), for a total of approximately 32,000 named users.
B. Commercial Terms Relevant to SLA Analysis
A precise understanding of the Agreement's fee structure is essential to quantifying the financial exposure arising from SLA credit obligations. The relevant commercial terms, as reflected in the current draft of the Fee Schedule (Schedule 2 to the MSA), are summarized below.
Year 1 Fees (Post-discount, Rounded):
Years 2–5 Annual Fees:
For purposes of calculating SLA service credits, the monthly subscription fee applicable to each contract year is as follows:
• Year 1: $12,700,000 ÷ 12 = $1,058,333 per month
• Years 2–5: $9,325,000 ÷ 12 = $777,083 per month
Beginning in Year 3, annual fees are subject to a CPI-based escalator of 3.0%, capped at 3.5% per annum. This escalator will modestly increase the monthly base for credit calculations in Years 3 through 5, though for purposes of this memorandum, the analysis uses the base Year 2–5 rate of $777,083 per month to simplify the exposure calculations. Payment is due quarterly in advance, net 30 days from the date of Skybridge's invoice.
C. Counsel and Counterparty Counsel
Calderwood & Harkness LLP represents Skybridge in the negotiation and documentation of the MSA and all ancillary transaction documents. The C&H engagement team consists of the following:
• Angela Fontaine — Responsible Partner (Technology Transactions Practice Group)
• Liam Prescott — Of Counsel (Technology Transactions Practice Group; cloud computing and SaaS licensing specialist)
• Amy Chesterton — Lead Associate
• Nathan Ikeda — Working Associate (author of this memorandum)
The primary client contact is David Shimura, General Counsel of Skybridge Fintech Ltd. Additional Skybridge stakeholders who may be consulted on technical and operational aspects of the SLA include Marcus Holt (Chief Technology Officer) and Amara Okafor (Chief Information Security Officer).
Hargrove, Tully & Cascade Insurance Brokers represents Meridian in connection with the Agreement. The HTM team is led by Douglas Krenshaw (partner), with Megan Faircloth (senior associate) and Ryan Tso (associate) handling day-to-day drafting and negotiation.
Meridian's internal stakeholder group includes:
• Gerald Brannigan — Chief Information Officer
• Luis Arriaga — Senior Vice President, Procurement & Vendor Management
• Catherine Woo — Associate General Counsel, Technology
• Sandra Petrov — Head, Financial Crimes & Compliance
We should anticipate that Meridian's negotiating positions on SLA availability will be heavily influenced by Sandra Petrov (whose compliance function depends on uninterrupted access to the AML platform) and Gerald Brannigan (who will bear operational accountability for any Platform outages).
D. Infrastructure Architecture Relevant to SLA
The SkyComply™ platform is hosted on the infrastructure-as-a-service ("IaaS") platform operated by Orion Cloud Services, Inc., a Delaware corporation headquartered at 4500 Great America Parkway, Santa Clara, CA 95054. Orion Cloud is one of the three major U.S.-based hyperscale cloud providers and operates data center regions across North America, Europe, and Asia-Pacific.
Pursuant to Skybridge's enterprise agreement with Orion Cloud, SkyComply™ is deployed in a multi-availability-zone configuration across two Orion Cloud regions:
• US-East (Northern Virginia) — Primary production environment
• US-West (Oregon) — Disaster recovery and failover environment
All Meridian data will be stored and processed exclusively within the continental United States, within these two Orion Cloud regions, consistent with Meridian's data residency requirements and applicable regulatory guidance from the OCC regarding the geographic location of bank records and data.
Orion Cloud's platform SLA, as set forth in the Orion Cloud Enterprise Service Level Agreement (Version 7.2, effective June 1, 2025), provides a 99.95% monthly uptime commitment for its compute, storage, and network infrastructure services. This upstream SLA is the ceiling on the infrastructure-level availability that Skybridge can guarantee to its own customers. Skybridge's SLA commitments to Meridian therefore flow down from, and are constrained by, Orion Cloud's upstream uptime guarantees. The implications of this dependency are analyzed in detail in Section IV.B below.
III. CURRENT POSITIONS OF THE PARTIES ON SLA TERMS
This section sets forth the current positions of each party on the three principal SLA components: platform availability targets, SLA service credits, and critical incident response times. These positions are reflected in the competing SLA Exhibits (Exhibit A) exchanged between C&H and HTM on September 2 and September 5, 2025, respectively.
A. Platform Availability Target
1. Skybridge's Position: 99.9% Monthly Uptime
Skybridge proposes a monthly platform availability commitment of 99.9%, measured on the basis of each calendar month and calculated as follows:
Monthly Uptime Percentage = ((Total Minutes in Month − Scheduled Maintenance Minutes − Unscheduled Downtime Minutes) ÷ (Total Minutes in Month − Scheduled Maintenance Minutes)) × 100
Scheduled maintenance windows are defined as Saturdays from 2:00 AM to 6:00 AM Eastern Time, representing a maximum of four (4) hours per week. Time consumed by scheduled maintenance is excluded from the uptime calculation, consistent with standard industry practice. Skybridge is required to provide Meridian with no fewer than five (5) business days' advance written notice of any scheduled maintenance that may result in service disruption.
Skybridge's rationale for the 99.9% standard rests on the following points:
• Industry consistency. A 99.9% monthly uptime commitment is consistent with the availability standards offered by leading enterprise SaaS providers in the financial services sector. It represents the modal market commitment for cloud-hosted compliance platforms, as demonstrated by the benchmarking data presented in Section VI.
• Infrastructure margin. The 99.9% standard provides Skybridge with a necessary operational margin against its upstream IaaS provider's 99.95% SLA. Because SkyComply™ is a multi-layered software platform with application-tier, middleware, database, and integration components operating on top of Orion Cloud's infrastructure, Skybridge must retain a margin between its own availability commitment and the infrastructure provider's guarantee to account for application-layer issues that are independent of infrastructure availability.
• Operational realism. Even the most rigorously engineered SaaS platforms experience occasional application-layer incidents — software deployments, configuration changes, database optimizations, and third-party API dependency failures — that are unrelated to the underlying infrastructure. A 99.9% target appropriately accounts for these inevitable incidents without penalizing Skybridge for events beyond the scope of infrastructure availability.
2. Meridian's Position: 99.95% Monthly Uptime
Meridian, through HTM, demands a monthly platform availability commitment of 99.95%, using the same measurement methodology proposed by Skybridge (with scheduled maintenance excluded from the calculation).
Meridian's rationale, as communicated in HTM's redline of the SLA Exhibit (received September 5, 2025) and in prior email correspondence between Megan Faircloth and Amy Chesterton (September 4, 2025), is premised on the following arguments:
• Regulatory imperative. As a SIFI regulated by the OCC, Federal Reserve, and FDIC, Meridian is subject to heightened supervisory expectations regarding the availability and resilience of its critical compliance infrastructure. The SkyComply™ platform will serve as Meridian's sole AML and transaction-monitoring system across all business lines. Any downtime could impair Meridian's ability to satisfy its obligations under the BSA, the USA PATRIOT Act, and related regulations, potentially exposing Meridian to regulatory enforcement actions, consent orders, or civil money penalties.
• Mission-critical classification. Meridian has internally classified the SkyComply™ platform as a Tier 1 critical system under its enterprise risk management framework. Meridian's vendor management policies require Tier 1 vendors to commit to availability levels of 99.95% or higher.
• Orion Cloud parity. Meridian notes that Orion Cloud's own upstream SLA provides 99.95% monthly uptime. Meridian contends that if Skybridge's infrastructure provider guarantees 99.95%, Skybridge should be able to pass through that same commitment to its enterprise customers. Meridian views Skybridge's proposal of 99.9% as effectively reserving a 0.05% "cushion" for application-layer issues, which Meridian considers unacceptable for a platform of this criticality.
• User scale. With 32,000 named users dependent on the Platform for day-to-day compliance operations, even brief downtime events have a multiplied impact across Meridian's organization. Meridian estimates that each minute of unscheduled downtime results in the functional impairment of approximately 8,000 concurrent users (assuming a 25% concurrent usage rate during peak business hours), with downstream effects on suspicious activity report filing deadlines, real-time transaction monitoring, and regulatory inquiry response times.
B. SLA Service Credits
1. Skybridge's Position: Tiered Credits with Caps
Skybridge proposes a four-tier credit structure with both monthly and annual caps, as follows:
Monthly Credit Cap: 30% of the applicable monthly subscription fee.
Annual Credit Cap: 15% of the applicable annual subscription fee.
Termination Right: In addition to the credit mechanism, Skybridge's proposal includes a performance-based termination right: Meridian may terminate the Agreement for cause if monthly uptime falls below 98.0% in three (3) of any consecutive six (6) months. Upon such termination, Meridian would be entitled to a pro rata refund of any prepaid and unused subscription fees and the return or destruction of Meridian's data in accordance with the data handling provisions of the MSA.
2. Meridian's Position: Uncapped Credits
Meridian demands that SLA service credits be uncapped — that is, neither the monthly credit cap of 30% nor the annual credit cap of 15% would apply. Meridian also requests higher credit percentages at each tier, though it has not specified the exact percentages it seeks in its initial redline. HTM's cover email (September 5, 2025) states that Meridian will provide a counterproposal on specific credit percentages "once the uptime standard is resolved."
Meridian's rationale for uncapped credits is as follows:
• Incentive alignment. Meridian contends that capping credits diminishes Skybridge's financial incentive to prioritize availability. If Skybridge's maximum exposure in any given month is limited to 30% of the monthly fee regardless of the severity or duration of the outage, Skybridge may be less motivated to invest in the engineering resources, redundancy measures, and operational processes necessary to prevent extended downtime events.
• Liquidated damages characterization. Meridian characterizes SLA credits as a form of liquidated damages intended to approximate the actual harm Meridian suffers from Platform unavailability. Meridian argues that because the actual harm from a significant outage of Meridian's sole AML compliance platform could far exceed 30% of the monthly subscription fee — particularly if the outage results in regulatory exposure, missed filing deadlines, or the need to activate manual backup processes — caps are inherently inadequate as a damages proxy.
• Risk proportionality. Meridian takes the position that as the customer bearing the operational and regulatory consequences of downtime, it should not also bear the risk of financial under-recovery through artificial caps on the service-credit remedy. Meridian argues that the service provider, not the customer, is best positioned to manage and mitigate availability risk.
C. Critical Incident Response Times
Both parties have generally aligned on the incident classification framework and response time commitments, though Meridian has requested tighter resolution targets for Severity 1 and Severity 2 incidents. The current positions are summarized below:
Incident response times are not currently in active dispute in the sense that neither party has identified them as a "deal-breaker" issue. However, as discussed in Section VIII.D, the gap between the parties on Severity 1 and Severity 2 resolution targets represents a potential source of negotiating capital that Skybridge could deploy as a concession in exchange for Meridian's acceptance of the 99.9% uptime standard.
IV. ANALYSIS OF THE UPTIME STANDARD DISPUTE
A. Quantitative Impact of the 0.05% Differential
The 0.05% difference between Skybridge's proposed 99.9% standard and Meridian's demanded 99.95% standard may appear trivial in percentage terms, but the operational impact is significant when translated into permissible unscheduled downtime minutes.
Assuming a 30-day calendar month (43,200 total minutes), and excluding the scheduled maintenance window (4 hours × ~4.3 Saturdays per month ≈ 1,029 minutes, though the precise calculation varies by month), the available measured minutes are approximately 42,171 minutes. The permissible unscheduled downtime under each standard is:
The practical difference is stark: under Meridian's proposed 99.95% standard, Skybridge would have half the permissible downtime buffer. At the 99.95% level, any single deployment incident, brief service degradation event, database connection pool exhaustion, or application-layer issue could trigger a credit event even if the underlying Orion Cloud infrastructure remains fully operational at 100% availability throughout the month.
To place this in operational context, a single deployment rollback — even one executed efficiently by Skybridge's engineering team — typically consumes 10 to 20 minutes of user-facing service degradation. Under a 99.95% standard, a single such event could consume 45% to 91% of the entire monthly downtime budget. Under a 99.9% standard, the same event would consume only 23% to 46% of the monthly budget, leaving reasonable headroom for other minor incidents.
B. Orion Cloud upstream SLA Dependency Analysis
The relationship between Skybridge's SLA commitments to Meridian and Orion Cloud's upstream SLA to Skybridge is the single most important technical factor in this analysis. A thorough understanding of this dependency is essential to evaluating the feasibility and risk of each party's proposed uptime standard.
Orion Cloud's 99.95% SLA is an infrastructure-level guarantee. It covers the availability of compute instances, block storage volumes, object storage, and network connectivity within each Orion Cloud region. It does not cover — and expressly excludes — the availability of customer applications, middleware, databases, or integrations running on Orion Cloud infrastructure. In other words, Orion Cloud guarantees that the virtual machines and storage volumes on which SkyComply™ runs will be available 99.95% of the time; it does not guarantee that SkyComply™ itself will be available 99.95% of the time.
If Skybridge commits to 99.95% (matching Orion Cloud's infrastructure SLA), it leaves zero margin for application-layer issues. Any application downtime — even if Orion Cloud is performing at 100% — would immediately constitute an SLA breach and trigger service credits. This is an untenable position for any SaaS provider that does not own and operate its own dedicated infrastructure. The SkyComply™ platform has its own application layer, middleware tier (including message queuing and event processing services), database tier (including both relational and NoSQL databases), and integration layer (including APIs connecting to Meridian's core banking system, SWIFT network interfaces, and regulatory filing systems). Each of these layers introduces potential failure points that are independent of the underlying Orion Cloud infrastructure.
Orion Cloud's SLA remedies to Skybridge are limited and asymmetric. Under Skybridge's enterprise agreement with Orion Cloud, Orion Cloud's service credits for SLA breaches are calculated as a percentage of the monthly charges for the affected Orion Cloud services — not as a percentage of the downstream revenue that Skybridge earns from its customers. In a scenario where an Orion Cloud infrastructure outage causes Skybridge to breach its SLA with Meridian, the flow of credits would be as follows:
• Orion Cloud would issue Skybridge a service credit equal to a percentage of Skybridge's monthly Orion Cloud bill (estimated at approximately $85,000–$95,000 per month for the Meridian-specific infrastructure allocation).
• Skybridge would owe Meridian a service credit equal to a percentage of Meridian's monthly subscription fee ($777,083 per month in Years 2–5).
The mismatch is obvious: Skybridge's recovery from Orion Cloud would be an order of magnitude smaller than its credit obligation to Meridian. This asymmetric financial exposure means that Skybridge would bear the vast majority of the financial impact of any infrastructure outage, with only nominal recovery from Orion Cloud. Committing to a 99.95% uptime standard that exactly matches Orion Cloud's own guarantee would amplify this asymmetry by ensuring that every infrastructure outage, no matter how brief, triggers a credit obligation to Meridian.
The flow-down risk is compounded by Skybridge's inability to contractually compel Orion Cloud to exceed its own SLA. Skybridge cannot negotiate Orion Cloud's 99.95% infrastructure SLA upward; it is a standardized enterprise commitment offered on the same terms to all Orion Cloud enterprise customers. Skybridge is, in effect, a price-taker with respect to its upstream availability guarantee. Committing to Meridian at the same level as the upstream guarantee would mean that Skybridge is guaranteeing an outcome over which it has only partial control.
C. Application-Layer vs. Infrastructure-Layer Availability
A conceptual distinction between infrastructure availability and application availability is essential to a principled analysis of the uptime dispute.
Infrastructure availability refers to the uptime of the compute, storage, and network resources provided by Orion Cloud. When these resources are "up," the virtual machines are running, storage volumes are accessible, and network connectivity is functional. Infrastructure availability is Orion Cloud's responsibility and is governed by Orion Cloud's SLA.
Application availability refers to the uptime of the SkyComply™ platform as experienced by end users. Application availability depends on infrastructure availability but also on the proper functioning of Skybridge's software stack — including the application server tier, the middleware tier, the database tier, third-party API integrations, and the user interface layer. Application availability is Skybridge's responsibility and is governed by the SLA between Skybridge and Meridian.
In practice, application availability is always equal to or lower than infrastructure availability. This is because application-layer incidents — events that cause the application to become unavailable or degraded even when the underlying infrastructure is functioning normally — are a routine feature of SaaS operations. Common causes of application-layer downtime not attributable to infrastructure include:
• Software deployment and rollback: New code releases, even when rigorously tested, can introduce bugs or performance regressions that require rollback. The rollback process itself may cause brief service disruption.
• Database migration and optimization: Schema changes, index rebuilds, and data migration jobs can temporarily lock database tables or degrade query performance, resulting in user-facing latency or unavailability.
• Memory leaks and resource exhaustion: Application-tier processes may gradually consume memory or other resources, leading to degraded performance or process crashes that require restart.
• Third-party API dependency failure: SkyComply™ integrates with multiple external services (e.g., sanctions list providers, regulatory filing interfaces, identity verification services). If a third-party API becomes unresponsive, dependent SkyComply™ features may be impaired.
• Configuration change errors: Changes to application configuration files, environment variables, load balancer rules, or DNS records can cause service disruption if implemented incorrectly.
• Certificate expiration and renewal: TLS/SSL certificate issues can cause service interruptions if certificates expire or are improperly rotated.
Industry data from leading cloud operations monitoring firms indicates that application-layer incidents typically consume 0.02% to 0.05% of monthly availability above and beyond any infrastructure downtime. This empirical data strongly supports Skybridge's position that its availability commitment should incorporate a margin below Orion Cloud's 99.95% infrastructure SLA. A 99.9% application-availability commitment is consistent with — and mathematically implied by — a 99.95% infrastructure SLA combined with a reasonable allowance for application-layer incidents.
D. Operational Feasibility Assessment
Before finalizing our recommended position, we should verify Skybridge's historical uptime performance with Marcus Holt (CTO) and Amara Okafor (CISO). Based on preliminary information provided by David Shimura during the engagement kick-off call on September 2, 2025, SkyComply™ has maintained monthly availability above 99.9% for eleven of the past twelve months across its production customer base. In the remaining month (believed to be April 2025), availability dipped to approximately 99.92% due to a scheduled database migration that overran its maintenance window and extended into production hours. Notably, even in that worst-case month, Skybridge achieved availability above the 99.9% threshold — but only barely, and only because the migration occurred during a low-traffic weekend period.
Committing to a 99.95% uptime standard would require Skybridge to undertake significant operational changes, including:
• Reducing deployment frequency to minimize the risk of deployment-related service disruptions, which could slow Skybridge's product development velocity and delay feature releases to Meridian and other customers.
• Implementing zero-downtime deployment architecture, including blue-green deployments or canary release patterns, if not already in place. This investment carries both cost and timeline implications that would need to be evaluated by Marcus Holt's engineering team.
• Negotiating enhanced SLA terms with Orion Cloud, potentially including premium support tiers or dedicated infrastructure commitments, which would increase Skybridge's cost of goods sold and reduce gross margins on the Meridian engagement.
• Establishing dedicated on-call engineering coverage for the Meridian deployment, separate from Skybridge's existing on-call rotation, to ensure that any Platform issue is identified and resolved within the extremely tight downtime budget imposed by a 99.95% standard.
Additionally, the implementation period (September 15, 2025 through February 28, 2026) and the initial post-Go-Live period (commencing March 1, 2026) represent particularly high-risk windows for availability issues. During these phases, Skybridge will be onboarding 32,000 users, integrating with Meridian's core banking systems, migrating historical transaction data from the legacy AML platform, and tuning the Platform's machine learning models to Meridian's specific transaction patterns. It would be imprudent to commit to a 99.95% standard during a period when the Platform will be undergoing the most intensive operational stress in the history of its deployment.
V. ANALYSIS OF SLA CREDIT CAPS
A. Financial Exposure Under Current Skybridge Proposal (Capped Credits)
The financial exposure under Skybridge's proposed capped credit structure can be quantified with precision. The caps operate as both monthly and annual ceilings on Skybridge's credit obligations, regardless of the severity or frequency of availability shortfalls within the measurement period.
1. Monthly Exposure
The monthly credit cap is set at 30% of the applicable monthly subscription fee:
This means that in any given month, Skybridge's maximum credit obligation to Meridian is $317,500 (Year 1) or $233,125 (Years 2–5), regardless of whether the Platform was available at 99.8%, 95%, or 0%. The monthly cap thus provides a hard floor on Skybridge's retained revenue for each month and ensures that no single monthly outage event — however severe — can result in credit obligations exceeding 30% of the monthly fee.
2. Annual Exposure
The annual credit cap operates independently of the monthly cap and is set at 15% of the applicable annual subscription fee:
The annual cap functions as a backstop: even if monthly credit obligations are triggered every month of a given year (each up to the 30% monthly cap), the total credits Skybridge is required to issue for that year cannot exceed 15% of the annual fee. This creates a meaningful distinction between the theoretical monthly maximum (30% × 12 months = 360% of monthly fee = 30% of annual fee) and the actual annual maximum (15% of annual fee). The annual cap effectively halves the cumulative annual exposure relative to what the monthly caps alone would permit.
3. Maximum Five-Year Exposure
Over the full five-year initial term, the maximum aggregate credit exposure under Skybridge's proposal is:
Year 1 annual cap: $1,905,000
Years 2–5 annual cap: $1,398,750 × 4 = $5,595,000
Total five-year maximum credit exposure: $1,905,000 + $5,595,000 = $7,500,000
This $7,500,000 maximum represents 15% of the $50,000,000 TCV. Expressed differently, under even a catastrophic, worst-case scenario in which Skybridge fails to meet the SLA target in every month of the five-year term, Skybridge would retain a minimum of $42,500,000 (85% of TCV) in subscription revenue after credit payouts. This exposure level is predictable, bounded, and manageable within Skybridge's financial profile.
B. Financial Exposure Under Meridian's Proposal (Uncapped Credits)
Meridian's demand for uncapped credits removes both the monthly and annual ceilings on Skybridge's credit obligations. The implications are significant:
Without the monthly cap, Skybridge's credit obligation in any given month is limited only by the credit percentage applicable to the relevant tier. Under the current tier structure, the highest credit percentage is 30% (for uptime below 98.0%), so the practical monthly maximum remains 30% of the monthly fee. However, Meridian has signaled its intent to propose higher credit percentages at each tier, which could push monthly exposure well above 30%. Moreover, without the monthly cap, there is nothing in the credit structure to prevent Meridian from arguing that each individual downtime incident within a month should generate a separate credit calculation — a reading that could result in aggregate monthly credits exceeding 30%.
Without the annual cap, cumulative monthly credits flow through without any backstop. In a scenario where Skybridge experiences credit events in multiple months of a given year, the aggregate annual credit obligation could approach or exceed 100% of the annual fee. Consider the following illustrative scenario:
Hypothetical: In Year 2, Skybridge experiences significant Platform issues during a major software version upgrade. Monthly uptime falls below 99.0% in four months and below 98.0% in two months. Under uncapped credit terms with Skybridge's proposed tier percentages:
• 2 months at Tier 4 (below 98.0%): 30% × $777,083 × 2 = $466,250
• 4 months at Tier 3 (99.0%–98.0%): 20% × $777,083 × 4 = $621,667
• Total annual credits: $1,087,917
• Under capped terms, this would be limited to $1,398,750 (annual cap) — in this case, the uncapped and capped results are similar because the hypothetical does not breach the annual cap.
But now consider a more severe scenario where uptime falls below 98.0% in eight months:
• 8 months at Tier 4: 30% × $777,083 × 8 = $1,865,000
• Under capped terms: limited to $1,398,750 (annual cap)
• Under uncapped terms: full $1,865,000 in credits — a $466,250 increase in exposure
In an extreme sustained-outage scenario, uncapped credits could theoretically approach or exceed 100% of annual fees. This effectively transforms the SLA from a service-credit mechanism — designed to provide a pricing adjustment for underperformance — into an unlimited financial penalty provision. The distinction is not merely semantic; it fundamentally alters the risk profile of the deal and could have cascading effects on Skybridge's financial statements, debt covenants, and equity investor expectations.
C. Policy Rationale for Caps
The inclusion of caps in an SLA credit structure is grounded in well-established commercial and legal principles:
SLA credits are a pricing adjustment, not an unlimited penalty. The commercial purpose of SLA credits is to provide the customer with a proportionate financial remedy for service-level shortfalls — a reduction in the price paid for a service that was not delivered at the agreed-upon level. Credits are analogous to a rebate or discount, not to uncapped damages. Capping credits ensures that the remedy remains proportionate to the value of the service and does not exceed the price paid for the service in the relevant period.
Caps provide predictability for both parties. Skybridge needs to be able to forecast its revenue, EBITDA, and cash flow with reasonable certainty. Uncapped credit obligations introduce an unquantifiable contingent liability that would complicate Skybridge's financial planning, potentially require disclosure in Skybridge's financial statements as a contingent liability under GAAP, and could affect Skybridge's ability to raise debt or equity financing on favorable terms.
Caps maintain internal consistency with the MSA's overall risk allocation framework. Skybridge's proposed aggregate liability cap under the MSA is 2× annual fees, or approximately $18,650,000 (based on the Year 2–5 annual fee). Uncapped SLA credits could potentially erode or even exceed the aggregate liability cap, creating an internal inconsistency in the contract. If SLA credits are not counted toward the aggregate liability cap (as Meridian may argue), uncapped credits represent an unlimited carve-out from the liability framework — a result that undermines the entire purpose of the aggregate cap. If SLA credits are counted toward the aggregate liability cap, uncapped credits could consume the entire cap, leaving Skybridge with no remaining headroom for other liabilities (e.g., indemnification obligations, breach of warranty claims). Either way, uncapped credits create a structural problem in the MSA's liability architecture.
Skybridge's financial profile amplifies the risk. Meridian-specific annual revenue of $9,325,000 (in Years 2–5) represents approximately 11.9% of Skybridge's FY 2024 revenue of $78.3 million. Uncapped credit exposure on a single customer engagement that represents nearly 12% of total revenue could have a material adverse impact on Skybridge's financial performance, particularly given Skybridge's EBITDA of $11.7 million. In a severe downtime scenario, uncapped credits on the Meridian contract alone could consume a substantial portion of Skybridge's annual EBITDA.
D. Interaction with Termination Right
The credit cap analysis must be considered in conjunction with the performance-based termination right included in Skybridge's proposal. As noted above, Skybridge's draft SLA provides that Meridian may terminate the Agreement for cause if monthly uptime falls below 98.0% in three (3) of any consecutive six (6) months.
This termination right provides Meridian with a meaningful and distinct remedy for persistent, severe underperformance — separate from and in addition to the credit mechanism. The two remedies serve complementary functions:
• Credits address moderate, occasional underperformance (e.g., a single month where uptime dips to 99.7% or 99.3%). Credits provide a proportionate financial adjustment without disrupting the ongoing commercial relationship.
• Termination addresses sustained, material underperformance (e.g., a pattern of severe outages over multiple months). Termination provides Meridian with an exit ramp — the right to leave the Agreement, recover prepaid fees, and transition to an alternative provider — in circumstances where the credit mechanism alone would be an insufficient remedy.
Together, capped credits and the performance-based termination right create a balanced and comprehensive remedy framework. Meridian is not left without recourse in a sustained-outage scenario; it has the right to terminate and pursue damages (subject to the MSA's limitation of liability provisions). The existence of this termination right significantly diminishes the force of Meridian's argument that caps leave it without adequate protection against persistent underperformance.
VI. MARKET BENCHMARKING
A. Methodology
To assess whether the parties' respective positions fall within market norms, I reviewed SLA provisions from the following sources:
• Calderwood & Harkness's internal precedent database of technology transactions in the financial services sector, which includes over 200 enterprise SaaS agreements executed between 2019 and 2025.
• Publicly available SLA terms from leading enterprise SaaS providers in the compliance, risk management, and regulatory technology sectors, including terms published on provider websites and in SEC filings (e.g., material contract exhibits filed under Item 601 of Regulation S-K).
• Industry analyst reports on SaaS SLA best practices, including reports from Penmark Consulting Group, Meridian Advisors, and Northpoint Strategy Partners enterprise SaaS agreements in the financial services vertical.
• Guidance from the OCC (OCC Bulletin 2013-29, "Third-Party Relationships: Risk Management Guidance," as supplemented by the Interagency Guidance on Third-Party Relationships: Risk Management, issued June 6, 2023) regarding supervisory expectations for service-level agreements in bank-vendor relationships.
The comparison set was narrowed to agreements for mission-critical compliance platforms — specifically, AML, KYC/CDD, fraud detection, sanctions screening, and regulatory reporting solutions — deployed by financial institutions with total assets exceeding $50 billion. This focus ensures that the benchmarking data reflects transactions comparable in scope, criticality, and regulatory context to the Skybridge-Meridian engagement.
From this universe, I identified ten comparable enterprise financial services SaaS agreements (anonymized) that provide the benchmarking data summarized below. The detailed comparison is set forth in Appendix B.
B. Uptime Standards — Market Range
The distribution of uptime commitments across the benchmark set is as follows:
• 99.5%: Two (2) of ten agreements (both involving non-critical ancillary compliance tools, not core transaction-monitoring platforms).
• 99.9%: Six (6) of ten agreements (the modal commitment for mission-critical financial services SaaS).
• 99.95%: One (1) of ten agreements (a provider that owns and operates its own dedicated data center infrastructure rather than relying on a third-party cloud provider).
• 99.99%: One (1) of ten agreements (a core banking platform with fully redundant, geographically dispersed dedicated infrastructure and an SLA backed by financial guarantees from a major systems integrator).
Conclusions:
• 99.9% is the most common uptime commitment for mission-critical financial services SaaS platforms. Six of ten comparable agreements — a clear majority — employ this standard. Skybridge's proposed 99.9% is squarely within the market-standard range.
• 99.95% is above the modal market standard but is not unprecedented. However, the single agreement in our benchmark set that commits to 99.95% involves a provider with its own dedicated infrastructure — a fundamentally different architecture from Skybridge's Orion Cloud-hosted model. Providers that rely on third-party IaaS platforms (as Skybridge does) universally commit to uptime levels below their upstream infrastructure provider's SLA.
• 99.99% is rare and generally limited to core banking or payment processing platforms with fully redundant, dedicated infrastructure. It is not a realistic benchmark for cloud-hosted SaaS compliance platforms.
• Meridian's demand for 99.95% is above the modal market standard for this category of platform. While it is not unreasonable for a SIFI to request enhanced availability commitments, the 99.95% level is achievable only by providers that either (a) own their own infrastructure or (b) are willing to accept the risk of guaranteeing availability equal to their upstream IaaS provider's commitment with no margin for application-layer issues.
C. SLA Credit Structures — Market Comparisons
Credit Tiers. Most enterprise SaaS agreements in the benchmark set employ a tiered credit structure with three to five tiers. Skybridge's four-tier structure is consistent with market practice. The use of tiers (as opposed to a single flat credit rate) is a well-established convention that aligns the credit amount with the severity of the availability shortfall.
Credit Percentages. Skybridge's proposed credit percentages of 5%, 10%, 20%, and 30% are at or slightly above the market median. Several agreements in the benchmark set employ lower credit percentages, particularly at the lower tiers:
Skybridge's credit percentages are already above the market median at Tiers 3 and 4, providing Meridian with relatively generous credits for significant availability shortfalls. This is a useful data point in negotiations: Skybridge can demonstrate that its credit structure is already favorable to the licensee by market standards.
Monthly Caps. Monthly credit caps in the benchmark set range from 25% to 30% of monthly fees. Skybridge's 30% monthly cap is at the upper end of this range and is thus favorable to Meridian relative to market norms.
Annual Caps. Annual credit caps range from 10% to 20% of annual fees, with a median of approximately 12.5%. Skybridge's 15% annual cap is at the midpoint of this range — neither the most nor the least favorable to the licensee.
Uncapped Credits. Uncapped SLA credits are uncommon in enterprise SaaS transactions. Among the agreements reviewed, fewer than 15% of financial services SaaS transactions include uncapped credit structures. Those that do are typically limited to agreements with very high-availability providers (99.99%+) that have their own dedicated infrastructure and can therefore absorb the risk of uncapped exposure with greater confidence. Meridian's demand for uncapped credits on a cloud-hosted 99.9% (or even 99.95%) platform is outside the market mainstream.
D. Termination Rights — Market Comparisons
Performance-based termination rights are a standard feature of enterprise SaaS agreements and are included in nine of the ten agreements in the benchmark set. The typical trigger is failure to meet the minimum SLA target in two to three months within a six- to twelve-month rolling period. Skybridge's proposed trigger — uptime below 98.0% in three of any consecutive six months — is consistent with the median market practice (three months in six) and falls within the standard range. This provides further support for the position that Skybridge's SLA remedy framework, taken as a whole, is commercially reasonable and market-conforming.