1009-00007 · Skybridge Fintech Ltd · Transaction Documents/Exhibits

acceptable-use-policy-exhibit.docx DOCUMENT Funds

23 / 35 ← → ✕

Contract analysis Extract to table

ACCEPTABLE USE POLICY

EXHIBIT D

to the

MASTER SOFTWARE-AS-A-SERVICE AGREEMENT

by and between

SKYBRIDGE FINTECH LTD.

and

MERIDIAN NATIONAL BANK, NATIONAL ASSOCIATION

Drafted by: Nathan Ikeda Calderwood & Harkness LLP

Parties:

Skybridge Fintech Ltd. ("Licensor" or "Skybridge"), a Delaware limited company, with its principal headquarters located at 1400 Concord Pike, Suite 320, Wilmington, Delaware 19803.

Meridian National Bank, National Association ("Licensee" or "Meridian"), a national banking association chartered under federal law, with its principal offices located at 600 Lexington Avenue, 40th Floor, New York, New York 10022.

Platform: SkyComply™ AI-driven anti-money-laundering and transaction-monitoring platform (the "Platform").

Reference to MSA: This Acceptable Use Policy ("AUP" or this "Policy") is attached as Exhibit D to and incorporated by reference into the Master Software-as-a-Service Agreement dated as of __, 2025 (the "Agreement") between Licensor and Licensee. Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement. In the event of any inconsistency between this AUP and the body of the Agreement, the Agreement shall control unless this AUP expressly provides otherwise with respect to the scope of permissible use of the Platform.

Right-click to update Table of Contents

SECTION 1: PURPOSE AND SCOPE

1.1 Purpose.

This Acceptable Use Policy establishes the rules, guidelines, restrictions, and conditions governing Licensee's and its Authorized Users' access to and use of the SkyComply™ platform and all associated services, features, modules, documentation, application programming interfaces ("APIs"), data feeds, analytics outputs, reports, and other data outputs provided by Licensor under the Agreement. The purpose of this Policy is to promote the secure, lawful, and efficient use of the Platform; to protect the integrity, availability, and performance of the Platform for all users; to safeguard the confidential and proprietary information of both parties; and to ensure compliance with applicable laws, regulations, and industry standards governing the financial services industry. This Policy is intended to supplement, not replace, Licensee's own internal acceptable use, information security, and data governance policies, which Licensee is separately obligated to maintain in accordance with applicable regulatory requirements.

1.2 Scope.

This AUP applies to all Authorized Users who access or use the Platform in any manner, regardless of the method of access (including, without limitation, via web browser, desktop application, mobile application, API integration, or any other interface). As of the Effective Date of the Agreement, Licensee is authorized to provision up to thirty-two thousand (32,000) named users as specified in the initial Order Form executed concurrently with the Agreement, with the ability to add incremental named users during the term at a rate of two hundred seventy-five dollars ($275) per user per year, subject to the terms and conditions of the Order Form and the Agreement. This AUP applies equally to all categories of Authorized Users, including but not limited to full-time and part-time employees of Meridian, temporary workers, independent contractors, consultants, agents, and other individuals who have been granted access credentials by or on behalf of Licensee. The scope of this AUP extends to Authorized Users operating within Meridian's retail banking division, commercial banking division, wealth management division, and any other business unit or subsidiary that has been authorized to access the Platform under the Agreement, whether such Authorized Users are located within the United States or at Meridian's international offices, subject to the data residency and geographic restrictions set forth herein and in the Agreement.

1.3 Incorporation.

This AUP is incorporated into and forms an integral part of the Agreement. Licensee's execution of the Agreement constitutes Licensee's acceptance of and agreement to be bound by the terms and conditions of this AUP. Licensee shall ensure that all Authorized Users are made aware of, and comply with, the terms of this AUP prior to accessing the Platform. In the event of a conflict between this AUP and the body of the Agreement, the terms of the Agreement shall control, unless this AUP expressly provides otherwise with respect to the definition or scope of permissible use of the Platform, in which case the more specific provisions of this AUP shall govern. To the extent any provision of this AUP conflicts with any other Exhibit to the Agreement (including the SLA Exhibit (Exhibit A), the Security Exhibit (Exhibit B), or the Data Processing Addendum (Exhibit C)), such conflict shall be resolved in accordance with the order of precedence established in the Agreement.

SECTION 2: DEFINITIONS

For purposes of this AUP, the following terms shall have the meanings set forth below. All other capitalized terms used but not defined in this Section 2 shall have the meanings ascribed to them in the Agreement.

2.1 "Authorized Users" means the named individuals designated by Licensee who have been assigned unique login credentials to access the SkyComply™ platform, as identified and managed through Licensee's user administration processes and as specified in the applicable Order Form. Each Authorized User must be a specific, identifiable natural person; generic, shared, or group accounts are not permitted except as expressly authorized by Licensor in writing for limited administrative or service account purposes.

2.2 "Platform" means the SkyComply™ software-as-a-service platform, including all modules (including, without limitation, the transaction monitoring module, the case management module, the suspicious activity report ("SAR") filing module, the customer due diligence ("CDD") module, and the sanctions screening module), features, functionality, user interfaces, updates, upgrades, patches, bug fixes, enhancements, and related Documentation made available by Licensor to Licensee under the Agreement. The term "Platform" includes both the production environment and any non-production environments (e.g., staging, testing, or sandbox environments) made available to Licensee by Licensor.

2.3 "Licensee Data" means all data, content, information, files, records, and materials uploaded, submitted, transmitted, entered, or otherwise provided by Licensee or its Authorized Users to or through the Platform, whether manually or through automated integrations or data feeds. Licensee Data includes, without limitation, transaction records, customer identification information, account data, alerts, case files, investigative notes, SAR filings, and any Non-Public Personal Information ("NPI") as defined under the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809) and its implementing regulations, personally identifiable information ("PII"), and any other categories of regulated data provided by Licensee. Licensee Data does not include any data or content independently created by Licensor without reference to Licensee Data, including Platform usage analytics and aggregated, de-identified statistical data as described in the Agreement.

2.4 "Malicious Code" means any software, code, file, script, agent, or program that is intentionally designed to damage, disrupt, disable, harm, or otherwise impede in any manner the operation of a computer system or network, including but not limited to viruses, worms, Trojan horses, ransomware, spyware, adware, rootkits, keyloggers, time bombs, logic bombs, or other harmful or malicious computer code, files, scripts, or programs.

2.5 "Acceptable Use" means use of the Platform that complies in all material respects with the terms and conditions of this AUP, the Agreement (including all Exhibits and Order Forms), the then-current Documentation provided by Licensor, and all applicable laws, rules, and regulations, including without limitation the regulatory requirements identified in Section 5 of this AUP.

SECTION 3: AUTHORIZED ACCESS AND USE

3.1 Permitted Use.

Licensee and its Authorized Users are authorized to access and use the Platform solely for Licensee's internal business purposes in connection with Licensee's anti-money-laundering ("AML") compliance program, transaction monitoring operations, Bank Secrecy Act ("BSA") and AML regulatory obligations, customer due diligence and enhanced due diligence activities, sanctions screening, suspicious activity reporting, and related financial crimes compliance activities, all as described in the Agreement and the Documentation. Without limiting the foregoing, permitted uses of the Platform include: (i) uploading and processing Licensee's transaction data and customer data for the purpose of generating alerts, risk scores, and analytical outputs; (ii) reviewing, investigating, and dispositioning alerts generated by the Platform; (iii) creating, managing, and documenting cases within the Platform's case management module; (iv) preparing, reviewing, and filing SARs through the Platform's SAR filing functionality; (v) configuring and tuning the Platform's monitoring rules, thresholds, scenarios, and parameters in accordance with Licensee's risk-based AML compliance program; (vi) generating reports and analytics for internal compliance, audit, and regulatory examination purposes; and (vii) integrating the Platform with Licensee's existing systems (e.g., core banking systems, data warehouses, and other compliance tools) through the APIs and integration mechanisms documented and supported by Licensor.

Licensee acknowledges that the Platform is designed to assist Licensee in meeting its regulatory obligations and that the outputs generated by the Platform are tools intended to support, not replace, the professional judgment and decision-making of Licensee's qualified compliance personnel. All decisions regarding regulatory filings, escalations, and compliance determinations remain the sole responsibility of Licensee.

3.2 Account Credentials.

Each Authorized User shall be assigned unique, individual login credentials consisting of a username and password (or such other authentication factors as may be required by the Platform's security configuration). Licensee shall ensure that login credentials are not shared, transferred, or disclosed among individuals, and that each Authorized User accesses the Platform only under his or her own uniquely assigned credentials. Licensee is responsible for maintaining the confidentiality and security of all account credentials issued to its Authorized Users, including implementing password complexity requirements, periodic password rotation, and multi-factor authentication ("MFA") consistent with the requirements set forth in the Security Exhibit (Exhibit B) and Licensee's own information security policies. Licensee shall be responsible for all activities, transactions, and actions that occur under its Authorized Users' accounts, regardless of whether such activities were authorized by Licensee. Licensee shall immediately notify Licensor of any known or suspected unauthorized use of any Authorized User account, any known or suspected compromise of account credentials, or any other security breach related to Platform access.

3.3 User Administration.

Licensee shall designate one or more administrators (each, a "Licensee Administrator") who shall be responsible for managing Authorized User accounts within the Platform. Licensee Administrator responsibilities include, without limitation: (i) provisioning new Authorized User accounts in accordance with the processes and procedures documented in the Documentation; (ii) assigning and managing role-based access levels and permissions for each Authorized User in accordance with the principle of least privilege and Licensee's internal access control policies; (iii) promptly de-provisioning, disabling, or revoking access for any Authorized User who is no longer authorized to access the Platform, including upon such user's termination of employment, separation from Licensee, reassignment to a role that does not require Platform access, or leave of absence exceeding ninety (90) days; and (iv) conducting periodic access reviews (at least quarterly) to verify that all active Authorized User accounts correspond to individuals who are currently authorized to access the Platform in their respective roles. Licensee shall maintain accurate and up-to-date records of all Authorized Users and their assigned access levels, and shall make such records available to Licensor upon reasonable request in connection with audits or compliance reviews conducted under the Agreement.

3.4 Compliance with Documentation.

All use of the Platform by Licensee and its Authorized Users must be in accordance with the then-current Documentation provided by Licensor. Documentation includes, without limitation, user guides, administrator guides, API specifications, integration guides, release notes, technical requirements, system configuration guides, and any other instructional or reference materials made available by Licensor through the Platform's help center, customer portal, or other delivery mechanisms. Licensor shall provide Licensee with reasonable advance notice of material changes to the Documentation that may affect Licensee's use of the Platform. Licensee shall ensure that its Authorized Users receive appropriate training on the Platform's features, functionality, and Documentation, and that such training is refreshed on a periodic basis in accordance with Licensee's internal training requirements and any recommendations provided by Licensor.

3.5 Data Input Responsibility.

Licensee is solely responsible for the accuracy, quality, completeness, legality, and integrity of all Licensee Data uploaded to, transmitted to, or processed through the Platform. Licensor does not independently verify the accuracy or completeness of Licensee Data and shall not be liable for any errors, omissions, or inaccuracies in the outputs generated by the Platform that result from errors, omissions, or inaccuracies in Licensee Data. Licensee acknowledges that the quality and accuracy of the Platform's analytical outputs, alerts, risk scores, and reports are directly dependent upon the quality and accuracy of the data inputs provided by Licensee, and Licensee shall implement and maintain appropriate data quality controls and validation processes for all data provided to the Platform.

SECTION 4: PROHIBITED ACTIVITIES

4.1 General Prohibitions.

Licensee and its Authorized Users shall not, and shall not authorize, permit, enable, or assist any third party to, engage in any of the following activities in connection with the Platform:

(a) Use the Platform for any purpose other than the authorized internal business purposes described in Section 3.1 of this AUP, including but not limited to any personal, non-business, or recreational use;

(b) Sublicense, resell, rent, lease, loan, distribute, time-share, or otherwise make the Platform or any component thereof available to any third party, whether for compensation or otherwise, except as expressly permitted by the Agreement (including any provisions permitting access by Licensee's regulators or examiners);

(c) Copy, reproduce, modify, adapt, translate, localize, reverse engineer, decompile, disassemble, or create derivative works based on the Platform or any component thereof, except to the extent expressly permitted by applicable law notwithstanding this contractual restriction;

(d) Attempt to gain unauthorized access to the Platform, any other systems or networks of Licensor, any accounts of other customers of Licensor, or any third-party systems or networks connected to or accessible through the Platform, whether by hacking, password mining, social engineering, or any other means;

(e) Circumvent, disable, interfere with, or attempt to circumvent, disable, or interfere with any security features, access controls, authentication mechanisms, encryption protocols, digital rights management systems, or usage limitations or restrictions of the Platform;

(f) Introduce, upload, transmit, or otherwise cause to be present any Malicious Code into the Platform, Licensor's systems, or any systems connected to or accessible through the Platform;

(g) Use the Platform to transmit, store, process, or display any data, content, or materials that are unlawful, fraudulent, defamatory, libelous, obscene, pornographic, threatening, harassing, hateful, discriminatory, or that infringe or misappropriate the intellectual property rights, privacy rights, publicity rights, or other legal rights of any third party;

(h) Use the Platform in any manner that could damage, disable, overburden, impair, or degrade the performance, availability, or functionality of the Platform or any Licensor system, or that could interfere with any other party's use and enjoyment of the Platform, including without limitation through denial-of-service attacks, distributed denial-of-service attacks, excessive or abusive API calls that exceed documented rate limits, automated scraping of Platform data or content, or the generation of artificially inflated transaction volumes;

(i) Remove, alter, obscure, deface, or tamper with any proprietary notices, labels, trademarks, service marks, trade names, logos, copyright notices, patent markings, or other intellectual property notices or designations on or within the Platform, the Documentation, or any outputs generated by the Platform;

(j) Use the Platform, or any data, outputs, reports, benchmarks, or other information obtained through the Platform, to conduct competitive analysis, benchmarking, or performance comparisons for the purpose of developing, marketing, or improving a product or service that competes with the Platform or any other product or service offered by Licensor;

(k) Access the Platform from, or transfer, transmit, or store Licensee Data to, any geographic location outside of the continental United States, except as expressly authorized under the Agreement and the Data Processing Addendum (Exhibit C), which restricts data residency to Orion Cloud Services, Inc.'s US-East (Virginia) and US-West (Oregon) regions. Without limiting the foregoing, Licensee shall implement appropriate technical and administrative controls to prevent Authorized Users from accessing the Platform or transmitting Licensee Data from jurisdictions that are subject to comprehensive economic sanctions administered by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC");

(l) Use the Platform in any manner that violates any applicable law, statute, regulation, ordinance, rule, order, judgment, decree, or industry standard, including but not limited to the Gramm-Leach-Bliley Act, the Bank Secrecy Act, regulations promulgated by the Office of the Comptroller of the Currency ("OCC"), guidance issued by the Federal Financial Institutions Examination Council ("FFIEC"), applicable state and federal privacy and data protection laws, applicable anti-money-laundering and counter-terrorism financing laws, and applicable sanctions laws and regulations.

4.2 Automated Access Restrictions.

Any automated or programmatic access to the Platform, including without limitation access via API integration, batch data upload, automated data extraction, webhook consumption, or any other machine-to-machine interaction, must comply in all respects with the API documentation, technical specifications, and rate limits specified by Licensor in the Documentation. Licensor's current API rate limits and usage quotas are set forth in the API specification document published on Licensor's customer portal, as updated from time to time. Licensee shall not use bots, spiders, crawlers, scrapers, or other automated tools or scripts to access, index, scrape, mine, harvest, or interact with the Platform except through Licensor-approved APIs and integration mechanisms. Licensee shall implement appropriate safeguards and controls to ensure that its automated integrations do not exceed applicable rate limits or otherwise adversely affect the performance or availability of the Platform. In the event that Licensee's automated access patterns materially and adversely affect Platform performance, Licensor may throttle or temporarily restrict such access upon notice to Licensee, and the parties shall cooperate in good faith to resolve the issue.

4.3 Security Testing Prohibition.

Licensee shall not conduct, authorize, or permit any penetration testing, vulnerability scanning, vulnerability assessment, load testing, stress testing, red team exercises, or other security testing of the Platform or any component of Licensor's infrastructure except as expressly authorized under the Security Exhibit (Exhibit B) to the Agreement and subject to the terms and conditions thereof. Without limiting the generality of the foregoing, the Security Exhibit provides that Licensee-initiated security testing shall be limited to application-layer testing of the Platform, conducted by a mutually agreed-upon qualified third-party testing firm, during mutually agreed-upon testing windows, and in accordance with an agreed-upon scope and rules of engagement. Infrastructure-layer testing (including any testing of the underlying cloud infrastructure provided by Orion Cloud Services, Inc.) shall require Licensor's prior written consent, which may be withheld or conditioned in Licensor's reasonable discretion. Licensee shall provide Licensor with the results of any authorized security testing promptly upon completion and shall cooperate with Licensor to remediate any vulnerabilities identified through such testing.

SECTION 5: COMPLIANCE WITH APPLICABLE LAW

5.1 Legal Compliance Obligation.

Licensee shall use the Platform in compliance with all applicable federal, state, and local laws, statutes, regulations, rules, orders, and governmental guidance, as well as applicable industry standards and self-regulatory requirements. Without limiting the generality of the foregoing, Licensee's legal compliance obligations include compliance with the following, to the extent applicable to Licensee's access to and use of the Platform:

(a) The Gramm-Leach-Bliley Act ("GLBA") (15 U.S.C. §§ 6801–6809) and its implementing regulations, including the OCC's Privacy of Consumer Financial Information regulations (12 C.F.R. Part 1016) and the FTC's Safeguards Rule, to the extent applicable, regarding the protection, safeguarding, and confidential treatment of Non-Public Personal Information;

(b) The Bank Secrecy Act ("BSA") (31 U.S.C. §§ 5311–5330) and applicable anti-money-laundering regulations promulgated thereunder by the Financial Crimes Enforcement Network ("FinCEN"), including regulations regarding currency transaction reporting, suspicious activity reporting, customer identification programs, and customer due diligence;

(c) OCC regulations and guidance applicable to national banks, including without limitation OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), as supplemented and updated by the Interagency Guidance on Third-Party Relationships: Risk Management issued in June 2023 by the OCC, the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation, and any successor guidance;

(d) Applicable state and federal data breach notification laws, including without limitation the New York SHIELD Act (N.Y. Gen. Bus. Law § 899-aa), and any other data breach notification statute or regulation that may apply to Licensee in connection with a security incident affecting Licensee Data processed through the Platform;

(e) FFIEC guidance and examination standards, including the FFIEC BSA/AML Examination Manual, the FFIEC Information Technology Examination Handbook, and any other FFIEC guidance applicable to Licensee's use of the Platform for AML compliance and transaction monitoring purposes.

Licensee acknowledges that the foregoing list is illustrative and not exhaustive, and that Licensee bears sole responsibility for identifying and complying with all laws, regulations, and standards applicable to its use of the Platform.

5.2 Regulatory Cooperation.

Licensee acknowledges and agrees that the Platform is designed as a technology tool intended to support and facilitate Licensee's regulatory compliance efforts, including Licensee's BSA/AML compliance program, and that the Platform does not guarantee compliance with any law, regulation, or regulatory requirement. Licensee remains solely responsible for its compliance with all BSA/AML and other regulatory requirements, including without limitation the design, implementation, configuration, tuning, validation, and ongoing management of the Platform's monitoring rules, scenarios, thresholds, risk-scoring parameters, and alert dispositioning workflows in accordance with Licensee's own risk-based compliance program and the expectations of Licensee's prudential regulators. Licensee further acknowledges that regulatory compliance is a shared responsibility and that Licensee must exercise independent professional judgment in reviewing and acting upon the outputs generated by the Platform. Licensor shall cooperate with Licensee in connection with any regulatory examination, audit, or inquiry relating to the Platform, as further described in the Agreement and the Security Exhibit (Exhibit B).

SECTION 6: DATA AND CONTENT OBLIGATIONS

6.1 Licensee Data Responsibility.

Licensee represents and warrants to Licensor that:

(a) Licensee has obtained and shall maintain all necessary rights, consents, permissions, authorizations, and legal bases required under applicable law to provide Licensee Data to Licensor for processing through the Platform, including any consents required under applicable privacy and data protection laws for the collection, use, disclosure, and processing of NPI and PII;

(b) Licensee Data, as provided to and processed through the Platform, does not and will not infringe, misappropriate, or violate any intellectual property rights (including patents, copyrights, trademarks, and trade secrets), privacy rights, publicity rights, contractual rights, or other legal rights of any third party;

(c) Licensee Data complies with all applicable laws, regulations, and rules, including without limitation the GLBA, the BSA, applicable state privacy laws, and applicable data protection laws; and

(d) Licensee has implemented and shall maintain appropriate internal controls, policies, and procedures to ensure the accuracy, integrity, and quality of Licensee Data prior to its submission to the Platform.

6.2 Data Classification.

Licensee shall classify all data provided to the Platform in accordance with Licensee's internal data classification policy and applicable regulatory requirements. Licensee's data classification framework includes, at a minimum, "Public," "Internal," "Confidential," and "Highly Restricted" classification tiers, each of which carries specific handling, access control, encryption, and retention requirements. Licensee shall inform Licensor of any specific handling, security, or processing requirements associated with the data classifications applicable to Licensee Data, to the extent such requirements impose obligations on Licensor beyond those already set forth in the Agreement, the Data Processing Addendum (Exhibit C), and the Security Exhibit (Exhibit B). Without limiting the foregoing, Licensee acknowledges that the Platform processes data that Licensee classifies as "Confidential" and "Highly Restricted" (including NPI and PII) and that the security controls and data handling requirements applicable to such data are set forth in the Data Processing Addendum (Exhibit C) and the Security Exhibit (Exhibit B).

6.3 Prohibited Data.

Unless expressly authorized under the Agreement and the Data Processing Addendum (Exhibit C), Licensee shall not upload, transmit, store, or otherwise process through the Platform any data that Licensor is not authorized or equipped to process. Without limiting the generality of the foregoing, Licensee shall not provide to the Platform:

(a) Data that is subject to foreign data localization requirements, data residency mandates, or cross-border data transfer restrictions that are incompatible with the continental United States data residency restrictions set forth in the Agreement and the Data Processing Addendum, including but not limited to data subject to the European Union's General Data Protection Regulation ("GDPR") where such data cannot lawfully be transferred to and processed within the United States under the applicable legal framework;

(b) Protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), unless the parties have executed a Business Associate Agreement and the Data Processing Addendum has been amended to address HIPAA requirements;

(c) Payment card data subject to the Payment Card Industry Data Security Standard ("PCI DSS"), including primary account numbers, unless the Platform has been certified as PCI DSS compliant for such processing; or

(d) Any data the processing of which through the Platform would cause Licensor to violate applicable law or regulation.

Licensee shall immediately notify Licensor if Licensee becomes aware that prohibited data has been inadvertently uploaded to the Platform, and the parties shall cooperate to remove such data promptly.

SECTION 7: MONITORING AND ENFORCEMENT

7.1 Licensor's Monitoring Rights.

Licensor reserves the right, but does not undertake an obligation, to monitor Licensee's and its Authorized Users' use of the Platform for compliance with this AUP, the Agreement, and applicable law. Monitoring activities may include, without limitation, automated usage analytics, system performance assessments, log reviews and analysis, review of API call volumes and patterns, and detection of anomalous or potentially unauthorized access patterns. Licensor shall conduct any monitoring activities in a manner consistent with the confidentiality and data protection obligations set forth in the Agreement and the Data Processing Addendum (Exhibit C). To the extent Licensor's monitoring activities involve the collection or processing of Licensee Data or data about Authorized Users, such activities shall be conducted in accordance with applicable law and the terms of the Agreement. Licensor shall not access the content of Licensee Data for monitoring purposes except to the extent necessary to investigate a specific, identified potential violation of this AUP or a security incident, and only in accordance with the procedures set forth in the Agreement and the Data Processing Addendum.

7.2 Reporting of Violations.

Licensee shall promptly notify Licensor of any known or suspected violation of this AUP by any Authorized User, former Authorized User, or third party. Such notification shall be provided to Licensor's designated security contact as specified in the Security Exhibit (Exhibit B) and shall include, to the extent known and available, a description of the nature and scope of the suspected violation, the identity of the individuals involved, the date and time of the suspected violation, and any remedial actions taken or planned by Licensee. Licensee shall cooperate with Licensor in investigating any reported or suspected violation and shall provide Licensor with reasonable access to relevant information, records, and personnel as necessary to conduct such investigation, subject to applicable legal privileges and regulatory requirements.

7.3 Remedial Actions.

In the event of a material violation of this AUP, Licensor may take one or more of the following remedial actions, provided that Licensor shall provide Licensee with prior written notice and a reasonable opportunity to cure (except in cases of emergency as described below):

(a) Suspend the offending Authorized User's access to the Platform, pending investigation and resolution of the violation;

(b) Suspend Licensee's access to the Platform in whole or in part, to the extent reasonably necessary to prevent ongoing harm to the Platform, Licensor's systems, other customers of Licensor, or third parties;

(c) Require Licensee to take immediate corrective action to remediate the violation, including without limitation removing offending data or content, disabling compromised accounts, and implementing additional security controls.

Notwithstanding the foregoing, in cases of emergency posing imminent harm to the security, integrity, availability, or performance of the Platform or Licensor's systems, or posing a risk of harm to other customers of Licensor or third parties, Licensor may take immediate remedial action, including suspension of access, without prior notice to Licensee. In any such emergency situation, Licensor shall provide Licensee with written notice of the emergency suspension within twenty-four (24) hours of the suspension taking effect, including a description of the nature of the emergency and the actions taken. Any suspension imposed under this Section 7.3 shall be narrowly tailored and limited to the minimum scope and duration reasonably necessary to address the identified violation or emergency. Licensor shall cooperate with Licensee in good faith to restore full access to the Platform as promptly as practicable following remediation of the underlying violation.

7.4 No Waiver.

Licensor's failure to monitor Licensee's use of the Platform, to detect a violation of this AUP, or to enforce any provision of this AUP in any particular instance shall not constitute a waiver of Licensor's right to monitor, detect, or enforce such provision, or any other provision of this AUP, at any time. All rights and remedies of Licensor under this AUP are cumulative and are in addition to, and not in lieu of, any other rights and remedies available to Licensor under the Agreement or at law or in equity.

SECTION 8: INDEMNIFICATION FOR AUP BREACHES

8.1 Licensee Indemnification Obligation.

Consistent with and in addition to the indemnification provisions set forth in the Agreement, Licensee shall indemnify, defend, and hold harmless Licensor and its affiliates, and their respective officers, directors, employees, agents, successors, and assigns (collectively, the "Licensor Indemnified Parties"), from and against any and all third-party claims, demands, actions, suits, proceedings, investigations, losses, damages, liabilities, judgments, settlements, penalties, fines, costs, and expenses (including reasonable attorneys' fees, expert witness fees, and court costs) arising out of or related to:

(a) Any breach of this AUP by Licensee or any of its Authorized Users, including any violation of the prohibited activities set forth in Section 4;

(b) Any data, content, or materials provided by Licensee or its Authorized Users to or through the Platform that infringes, misappropriates, or violates the intellectual property rights, privacy rights, contractual rights, or other legal rights of any third party;

(c) Licensee's use of the Platform in violation of any applicable law, statute, regulation, rule, order, or governmental guidance, including any failure to comply with the legal compliance obligations set forth in Section 5 of this AUP.

8.2 Indemnification Procedures.

The indemnification procedures set forth in the Agreement shall apply to all indemnification obligations arising under this Section 8, including but not limited to the requirements for prompt written notice of any indemnifiable claim, the indemnifying party's right to assume control of the defense and settlement of any such claim, the indemnified party's obligation to cooperate in the defense of any such claim, and the limitations on the indemnified party's right to settle any claim without the prior written consent of the indemnifying party. To the extent of any inconsistency between the indemnification procedures set forth in this Section 8 and the corresponding provisions of the Agreement, the provisions of the Agreement shall control.

8.3 Liability Cap.

Licensee's indemnification obligations under this Section 8 shall be subject to the general indemnity cap set forth in the Agreement. As specified in the Agreement, the general indemnity cap is equal to one times (1×) the annual fees paid or payable by Licensee to Licensor in the twelve (12)-month period immediately preceding the date on which the applicable claim first arose, which, in a steady-state year, is approximately nine million three hundred twenty-five thousand dollars ($9,325,000). Notwithstanding the foregoing, to the extent the underlying claim falls within an uncapped liability category or a super-capped liability category as expressly set forth in the Agreement (including, without limitation, claims arising from gross negligence, willful misconduct, fraud, or breaches of confidentiality obligations), the applicable uncapped or super-capped limits shall apply in lieu of the general indemnity cap.

SECTION 9: CONSEQUENCES OF VIOLATION

9.1 Material Breach.

A material or repeated violation of this AUP by Licensee or any of its Authorized Users shall constitute a material breach of the Agreement. Licensee acknowledges that a material breach of this AUP may cause significant harm to the Platform, Licensor's systems, Licensor's other customers, and Licensor's business reputation, and that such harm may not be fully compensable by monetary damages alone. A single, isolated, non-material violation of this AUP that is promptly identified and cured by Licensee shall not, in and of itself, constitute a material breach of the Agreement, provided that a pattern of repeated non-material violations may, in the aggregate, constitute a material breach. Determination of whether a violation is material shall take into account the nature, severity, scope, duration, and impact of the violation, the willfulness or negligence of the violating party, and any prior violations by Licensee or its Authorized Users.

9.2 Termination Right.

In the event of a material breach of this AUP that remains uncured following the expiration of the notice and cure period specified in the Agreement (which, as set forth in the Agreement, provides for written notice of breach and a cure period of thirty (30) days, or such shorter cure period as may be applicable to specific categories of breach as expressly stated in the Agreement), Licensor shall have the right to terminate the Agreement in accordance with its terms. Any such termination shall be without prejudice to Licensor's right to pursue any and all other remedies available to it under the Agreement, at law, or in equity, including without limitation the right to seek injunctive or other equitable relief. In the event of termination of the Agreement due to Licensee's material breach of this AUP, the parties' respective rights and obligations regarding data return, data deletion, transition assistance, and post-termination obligations shall be as set forth in the Agreement.

9.3 Survival.

The following provisions of this AUP shall survive any expiration or termination of the Agreement, regardless of the reason for such expiration or termination: (a) Licensee's indemnification obligations under Section 8; (b) Licensor's remedial rights under Section 7 (to the extent necessary to address violations that occurred during the term of the Agreement); (c) the definitions set forth in Section 2 (to the extent necessary to interpret the surviving provisions); and (d) the general provisions set forth in Section 11. All other provisions of this AUP shall terminate upon expiration or termination of the Agreement, subject to any survival provisions set forth in the Agreement itself.

SECTION 10: MODIFICATIONS TO THIS POLICY

10.1 Licensor Updates.

Licensor may update, revise, supplement, or otherwise modify this AUP from time to time during the term of the Agreement to reflect changes in applicable law, regulation, or governmental guidance; changes in industry standards, best practices, or self-regulatory requirements; changes in the Platform's features, functionality, or capabilities; changes in the threat landscape or security environment; or other changes that Licensor reasonably determines are necessary or appropriate. Licensor shall provide Licensee with no less than thirty (30) days' prior written notice of any material changes to this AUP. Such notice shall describe the nature of the proposed changes and the effective date thereof, and shall be provided to Licensee's designated administrator and to Licensee's primary contact for AUP-related matters identified in Section 11.3 below.

10.2 Licensee Objection Right.

If a material modification to this AUP materially and adversely affects Licensee's authorized use of the Platform or imposes material new obligations or restrictions on Licensee that were not contemplated by the Agreement, Licensee may object to such modification in writing within fifteen (15) days of Licensee's receipt of the notice described in Section 10.1. Upon receipt of Licensee's written objection, the parties shall negotiate in good faith for a period of thirty (30) days to resolve the objection, including by exploring alternative modifications that address Licensor's concerns while minimizing the adverse impact on Licensee. If the parties are unable to reach mutual agreement within such thirty (30)-day negotiation period, either party may escalate the dispute through the dispute escalation procedures set forth in the Agreement, which provide for Level 1 escalation to the parties' designated account managers, Level 2 escalation to senior management representatives, and Level 3 escalation to executive sponsors, followed by JAMS-administered mediation in New York, New York, if the dispute remains unresolved. During the pendency of any such dispute resolution process, the prior version of the AUP shall remain in effect with respect to the disputed provisions, and Licensee shall continue to comply with all undisputed provisions of the updated AUP.

10.3 Non-Material Changes.

Non-material updates to this AUP, including clarifications that do not alter the substantive rights or obligations of either party, corrections of typographical or grammatical errors, updates to formatting or structure, and updates to cross-references or hyperlinks, may be made by Licensor without prior notice, provided that Licensor posts the updated AUP to its customer portal and notifies Licensee's designated Licensee Administrator via email or through the Platform's administrative notification system. Non-material updates shall be clearly identified as such in the updated version of the AUP, and Licensor shall maintain a version history of all changes to the AUP on the customer portal for Licensee's reference.

SECTION 11: GENERAL PROVISIONS

11.1 Governing Law.

This AUP shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to conflict of laws principles that would require or permit the application of the laws of any other jurisdiction. This governing law provision is consistent with and subject to the governing law, venue, and jurisdiction provisions set forth in the Agreement.

11.2 Relationship to Agreement.

This AUP is subject to and governed by the terms and conditions of the Agreement, including all Exhibits and Order Forms thereto. Nothing in this AUP shall be construed to expand Licensor's rights or Licensee's obligations beyond those set forth in the Agreement, or to limit, restrict, or diminish any of Licensee's rights, remedies, or protections under the Agreement. In the event of any ambiguity in this AUP, such ambiguity shall be resolved in a manner consistent with the terms of the Agreement and the parties' mutual intent as expressed therein. This AUP does not create any rights or obligations on the part of any third party, and no third party shall be entitled to enforce any provision of this AUP.

11.3 Notices.

All notices, requests, demands, and other communications required or permitted under this AUP shall be provided in writing and delivered in accordance with the notice provisions of the Agreement (including by personal delivery, nationally recognized overnight courier, or certified mail, return receipt requested). Routine operational communications related to this AUP (including notifications of non-material updates under Section 10.3) may also be delivered via email or through the Platform's administrative notification system, subject to confirmation of receipt. The primary contacts for AUP-related matters are as follows:

Licensee:

Luis Arriaga Senior Vice President, Procurement & Vendor Management Meridian National Bank, N.A. 600 Lexington Avenue, 40th Floor New York, New York 10022

Licensor:

Tara Bellingham Vice President, Enterprise Sales Skybridge Fintech Ltd. 1400 Concord Pike, Suite 320 Wilmington, Delaware 19803

Either party may update its designated contact for AUP-related matters by providing written notice to the other party in accordance with the notice provisions of the Agreement.

11.4 Entire Exhibit.

This AUP, together with the Agreement and the other Exhibits thereto — including Exhibit A (Service Level Agreement), Exhibit B (Security Exhibit), and Exhibit C (Data Processing Addendum) — and all Order Forms executed thereunder, constitutes the complete and exclusive statement of the parties' agreement with respect to the subject matter of this AUP, namely the acceptable use of the Platform by Licensee and its Authorized Users. This AUP supersedes all prior and contemporaneous proposals, understandings, representations, and communications, whether oral or written, between the parties with respect to the acceptable use of the Platform, to the extent not otherwise embodied in the Agreement. No amendment, modification, or waiver of any provision of this AUP shall be binding unless made in accordance with the amendment and modification procedures set forth in this AUP and the Agreement.

ACKNOWLEDGMENT AND EXECUTION

This Acceptable Use Policy (Exhibit D) is incorporated into and forms part of the Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. and Meridian National Bank, National Association. By executing the Agreement, each party acknowledges that it has read, understands, and agrees to be bound by the terms and conditions of this AUP.

Executed as part of the Agreement as of the date set forth therein.

SKYBRIDGE FINTECH LTD.

By: ________

Name: Priya Chandrasekaran

Title: Chief Executive Officer

Date: ________

MERIDIAN NATIONAL BANK, NATIONAL ASSOCIATION

By: ________

Name: Gerald Brannigan

Title: Chief Information Officer

Date: ________

CONFIDENTIAL — This document contains proprietary and confidential information of Skybridge Fintech Ltd. and Meridian National Bank, N.A. Unauthorized reproduction, distribution, or disclosure is strictly prohibited.

ACCEPTABLE USE POLICY
EXHIBIT D
to the
MASTER SOFTWARE-AS-A-SERVICE AGREEMENT
by and between
SKYBRIDGE FINTECH LTD.
and
MERIDIAN NATIONAL BANK, NATIONAL ASSOCIATION
Drafted by: Nathan Ikeda Calderwood & Harkness LLP
Parties:
Skybridge Fintech Ltd. ("Licensor" or "Skybridge"), a Delaware limited company, with its principal headquarters located at 1400 Concord Pike, Suite 320, Wilmington, Delaware 19803.
Meridian National Bank, National Association ("Licensee" or "Meridian"), a national banking association chartered under federal law, with its principal offices located at 600 Lexington Avenue, 40th Floor, New York, New York 10022.
Platform: SkyComply™ AI-driven anti-money-laundering and transaction-monitoring platform (the "Platform").
Reference to MSA: This Acceptable Use Policy ("AUP" or this "Policy") is attached as Exhibit D to and incorporated by reference into the Master Software-as-a-Service Agreement dated as of __, 2025 (the "Agreement") between Licensor and Licensee. Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement. In the event of any inconsistency between this AUP and the body of the Agreement, the Agreement shall control unless this AUP expressly provides otherwise with respect to the scope of permissible use of the Platform.
Right-click to update Table of Contents
SECTION 1: PURPOSE AND SCOPE
1.1 Purpose.
This Acceptable Use Policy establishes the rules, guidelines, restrictions, and conditions governing Licensee's and its Authorized Users' access to and use of the SkyComply™ platform and all associated services, features, modules, documentation, application programming interfaces ("APIs"), data feeds, analytics outputs, reports, and other data outputs provided by Licensor under the Agreement. The purpose of this Policy is to promote the secure, lawful, and efficient use of the Platform; to protect the integrity, availability, and performance of the Platform for all users; to safeguard the confidential and proprietary information of both parties; and to ensure compliance with applicable laws, regulations, and industry standards governing the financial services industry. This Policy is intended to supplement, not replace, Licensee's own internal acceptable use, information security, and data governance policies, which Licensee is separately obligated to maintain in accordance with applicable regulatory requirements.
1.2 Scope.
This AUP applies to all Authorized Users who access or use the Platform in any manner, regardless of the method of access (including, without limitation, via web browser, desktop application, mobile application, API integration, or any other interface). As of the Effective Date of the Agreement, Licensee is authorized to provision up to thirty-two thousand (32,000) named users as specified in the initial Order Form executed concurrently with the Agreement, with the ability to add incremental named users during the term at a rate of two hundred seventy-five dollars ($275) per user per year, subject to the terms and conditions of the Order Form and the Agreement. This AUP applies equally to all categories of Authorized Users, including but not limited to full-time and part-time employees of Meridian, temporary workers, independent contractors, consultants, agents, and other individuals who have been granted access credentials by or on behalf of Licensee. The scope of this AUP extends to Authorized Users operating within Meridian's retail banking division, commercial banking division, wealth management division, and any other business unit or subsidiary that has been authorized to access the Platform under the Agreement, whether such Authorized Users are located within the United States or at Meridian's international offices, subject to the data residency and geographic restrictions set forth herein and in the Agreement.
1.3 Incorporation.
This AUP is incorporated into and forms an integral part of the Agreement. Licensee's execution of the Agreement constitutes Licensee's acceptance of and agreement to be bound by the terms and conditions of this AUP. Licensee shall ensure that all Authorized Users are made aware of, and comply with, the terms of this AUP prior to accessing the Platform. In the event of a conflict between this AUP and the body of the Agreement, the terms of the Agreement shall control, unless this AUP expressly provides otherwise with respect to the definition or scope of permissible use of the Platform, in which case the more specific provisions of this AUP shall govern. To the extent any provision of this AUP conflicts with any other Exhibit to the Agreement (including the SLA Exhibit (Exhibit A), the Security Exhibit (Exhibit B), or the Data Processing Addendum (Exhibit C)), such conflict shall be resolved in accordance with the order of precedence established in the Agreement.
SECTION 2: DEFINITIONS
For purposes of this AUP, the following terms shall have the meanings set forth below. All other capitalized terms used but not defined in this Section 2 shall have the meanings ascribed to them in the Agreement.
2.1 "Authorized Users" means the named individuals designated by Licensee who have been assigned unique login credentials to access the SkyComply™ platform, as identified and managed through Licensee's user administration processes and as specified in the applicable Order Form. Each Authorized User must be a specific, identifiable natural person; generic, shared, or group accounts are not permitted except as expressly authorized by Licensor in writing for limited administrative or service account purposes.
2.2 "Platform" means the SkyComply™ software-as-a-service platform, including all modules (including, without limitation, the transaction monitoring module, the case management module, the suspicious activity report ("SAR") filing module, the customer due diligence ("CDD") module, and the sanctions screening module), features, functionality, user interfaces, updates, upgrades, patches, bug fixes, enhancements, and related Documentation made available by Licensor to Licensee under the Agreement. The term "Platform" includes both the production environment and any non-production environments (e.g., staging, testing, or sandbox environments) made available to Licensee by Licensor.
2.3 "Licensee Data" means all data, content, information, files, records, and materials uploaded, submitted, transmitted, entered, or otherwise provided by Licensee or its Authorized Users to or through the Platform, whether manually or through automated integrations or data feeds. Licensee Data includes, without limitation, transaction records, customer identification information, account data, alerts, case files, investigative notes, SAR filings, and any Non-Public Personal Information ("NPI") as defined under the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809) and its implementing regulations, personally identifiable information ("PII"), and any other categories of regulated data provided by Licensee. Licensee Data does not include any data or content independently created by Licensor without reference to Licensee Data, including Platform usage analytics and aggregated, de-identified statistical data as described in the Agreement.
2.4 "Malicious Code" means any software, code, file, script, agent, or program that is intentionally designed to damage, disrupt, disable, harm, or otherwise impede in any manner the operation of a computer system or network, including but not limited to viruses, worms, Trojan horses, ransomware, spyware, adware, rootkits, keyloggers, time bombs, logic bombs, or other harmful or malicious computer code, files, scripts, or programs.
2.5 "Acceptable Use" means use of the Platform that complies in all material respects with the terms and conditions of this AUP, the Agreement (including all Exhibits and Order Forms), the then-current Documentation provided by Licensor, and all applicable laws, rules, and regulations, including without limitation the regulatory requirements identified in Section 5 of this AUP.
SECTION 3: AUTHORIZED ACCESS AND USE
3.1 Permitted Use.
Licensee and its Authorized Users are authorized to access and use the Platform solely for Licensee's internal business purposes in connection with Licensee's anti-money-laundering ("AML") compliance program, transaction monitoring operations, Bank Secrecy Act ("BSA") and AML regulatory obligations, customer due diligence and enhanced due diligence activities, sanctions screening, suspicious activity reporting, and related financial crimes compliance activities, all as described in the Agreement and the Documentation. Without limiting the foregoing, permitted uses of the Platform include: (i) uploading and processing Licensee's transaction data and customer data for the purpose of generating alerts, risk scores, and analytical outputs; (ii) reviewing, investigating, and dispositioning alerts generated by the Platform; (iii) creating, managing, and documenting cases within the Platform's case management module; (iv) preparing, reviewing, and filing SARs through the Platform's SAR filing functionality; (v) configuring and tuning the Platform's monitoring rules, thresholds, scenarios, and parameters in accordance with Licensee's risk-based AML compliance program; (vi) generating reports and analytics for internal compliance, audit, and regulatory examination purposes; and (vii) integrating the Platform with Licensee's existing systems (e.g., core banking systems, data warehouses, and other compliance tools) through the APIs and integration mechanisms documented and supported by Licensor.
Licensee acknowledges that the Platform is designed to assist Licensee in meeting its regulatory obligations and that the outputs generated by the Platform are tools intended to support, not replace, the professional judgment and decision-making of Licensee's qualified compliance personnel. All decisions regarding regulatory filings, escalations, and compliance determinations remain the sole responsibility of Licensee.
3.2 Account Credentials.
Each Authorized User shall be assigned unique, individual login credentials consisting of a username and password (or such other authentication factors as may be required by the Platform's security configuration). Licensee shall ensure that login credentials are not shared, transferred, or disclosed among individuals, and that each Authorized User accesses the Platform only under his or her own uniquely assigned credentials. Licensee is responsible for maintaining the confidentiality and security of all account credentials issued to its Authorized Users, including implementing password complexity requirements, periodic password rotation, and multi-factor authentication ("MFA") consistent with the requirements set forth in the Security Exhibit (Exhibit B) and Licensee's own information security policies. Licensee shall be responsible for all activities, transactions, and actions that occur under its Authorized Users' accounts, regardless of whether such activities were authorized by Licensee. Licensee shall immediately notify Licensor of any known or suspected unauthorized use of any Authorized User account, any known or suspected compromise of account credentials, or any other security breach related to Platform access.
3.3 User Administration.
Licensee shall designate one or more administrators (each, a "Licensee Administrator") who shall be responsible for managing Authorized User accounts within the Platform. Licensee Administrator responsibilities include, without limitation: (i) provisioning new Authorized User accounts in accordance with the processes and procedures documented in the Documentation; (ii) assigning and managing role-based access levels and permissions for each Authorized User in accordance with the principle of least privilege and Licensee's internal access control policies; (iii) promptly de-provisioning, disabling, or revoking access for any Authorized User who is no longer authorized to access the Platform, including upon such user's termination of employment, separation from Licensee, reassignment to a role that does not require Platform access, or leave of absence exceeding ninety (90) days; and (iv) conducting periodic access reviews (at least quarterly) to verify that all active Authorized User accounts correspond to individuals who are currently authorized to access the Platform in their respective roles. Licensee shall maintain accurate and up-to-date records of all Authorized Users and their assigned access levels, and shall make such records available to Licensor upon reasonable request in connection with audits or compliance reviews conducted under the Agreement.
3.4 Compliance with Documentation.
All use of the Platform by Licensee and its Authorized Users must be in accordance with the then-current Documentation provided by Licensor. Documentation includes, without limitation, user guides, administrator guides, API specifications, integration guides, release notes, technical requirements, system configuration guides, and any other instructional or reference materials made available by Licensor through the Platform's help center, customer portal, or other delivery mechanisms. Licensor shall provide Licensee with reasonable advance notice of material changes to the Documentation that may affect Licensee's use of the Platform. Licensee shall ensure that its Authorized Users receive appropriate training on the Platform's features, functionality, and Documentation, and that such training is refreshed on a periodic basis in accordance with Licensee's internal training requirements and any recommendations provided by Licensor.
3.5 Data Input Responsibility.
Licensee is solely responsible for the accuracy, quality, completeness, legality, and integrity of all Licensee Data uploaded to, transmitted to, or processed through the Platform. Licensor does not independently verify the accuracy or completeness of Licensee Data and shall not be liable for any errors, omissions, or inaccuracies in the outputs generated by the Platform that result from errors, omissions, or inaccuracies in Licensee Data. Licensee acknowledges that the quality and accuracy of the Platform's analytical outputs, alerts, risk scores, and reports are directly dependent upon the quality and accuracy of the data inputs provided by Licensee, and Licensee shall implement and maintain appropriate data quality controls and validation processes for all data provided to the Platform.
SECTION 4: PROHIBITED ACTIVITIES
4.1 General Prohibitions.
Licensee and its Authorized Users shall not, and shall not authorize, permit, enable, or assist any third party to, engage in any of the following activities in connection with the Platform:
(a) Use the Platform for any purpose other than the authorized internal business purposes described in Section 3.1 of this AUP, including but not limited to any personal, non-business, or recreational use;
(b) Sublicense, resell, rent, lease, loan, distribute, time-share, or otherwise make the Platform or any component thereof available to any third party, whether for compensation or otherwise, except as expressly permitted by the Agreement (including any provisions permitting access by Licensee's regulators or examiners);
(c) Copy, reproduce, modify, adapt, translate, localize, reverse engineer, decompile, disassemble, or create derivative works based on the Platform or any component thereof, except to the extent expressly permitted by applicable law notwithstanding this contractual restriction;
(d) Attempt to gain unauthorized access to the Platform, any other systems or networks of Licensor, any accounts of other customers of Licensor, or any third-party systems or networks connected to or accessible through the Platform, whether by hacking, password mining, social engineering, or any other means;
(e) Circumvent, disable, interfere with, or attempt to circumvent, disable, or interfere with any security features, access controls, authentication mechanisms, encryption protocols, digital rights management systems, or usage limitations or restrictions of the Platform;
(f) Introduce, upload, transmit, or otherwise cause to be present any Malicious Code into the Platform, Licensor's systems, or any systems connected to or accessible through the Platform;
(g) Use the Platform to transmit, store, process, or display any data, content, or materials that are unlawful, fraudulent, defamatory, libelous, obscene, pornographic, threatening, harassing, hateful, discriminatory, or that infringe or misappropriate the intellectual property rights, privacy rights, publicity rights, or other legal rights of any third party;
(h) Use the Platform in any manner that could damage, disable, overburden, impair, or degrade the performance, availability, or functionality of the Platform or any Licensor system, or that could interfere with any other party's use and enjoyment of the Platform, including without limitation through denial-of-service attacks, distributed denial-of-service attacks, excessive or abusive API calls that exceed documented rate limits, automated scraping of Platform data or content, or the generation of artificially inflated transaction volumes;
(i) Remove, alter, obscure, deface, or tamper with any proprietary notices, labels, trademarks, service marks, trade names, logos, copyright notices, patent markings, or other intellectual property notices or designations on or within the Platform, the Documentation, or any outputs generated by the Platform;
(j) Use the Platform, or any data, outputs, reports, benchmarks, or other information obtained through the Platform, to conduct competitive analysis, benchmarking, or performance comparisons for the purpose of developing, marketing, or improving a product or service that competes with the Platform or any other product or service offered by Licensor;
(k) Access the Platform from, or transfer, transmit, or store Licensee Data to, any geographic location outside of the continental United States, except as expressly authorized under the Agreement and the Data Processing Addendum (Exhibit C), which restricts data residency to Orion Cloud Services, Inc.'s US-East (Virginia) and US-West (Oregon) regions. Without limiting the foregoing, Licensee shall implement appropriate technical and administrative controls to prevent Authorized Users from accessing the Platform or transmitting Licensee Data from jurisdictions that are subject to comprehensive economic sanctions administered by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC");
(l) Use the Platform in any manner that violates any applicable law, statute, regulation, ordinance, rule, order, judgment, decree, or industry standard, including but not limited to the Gramm-Leach-Bliley Act, the Bank Secrecy Act, regulations promulgated by the Office of the Comptroller of the Currency ("OCC"), guidance issued by the Federal Financial Institutions Examination Council ("FFIEC"), applicable state and federal privacy and data protection laws, applicable anti-money-laundering and counter-terrorism financing laws, and applicable sanctions laws and regulations.
4.2 Automated Access Restrictions.
Any automated or programmatic access to the Platform, including without limitation access via API integration, batch data upload, automated data extraction, webhook consumption, or any other machine-to-machine interaction, must comply in all respects with the API documentation, technical specifications, and rate limits specified by Licensor in the Documentation. Licensor's current API rate limits and usage quotas are set forth in the API specification document published on Licensor's customer portal, as updated from time to time. Licensee shall not use bots, spiders, crawlers, scrapers, or other automated tools or scripts to access, index, scrape, mine, harvest, or interact with the Platform except through Licensor-approved APIs and integration mechanisms. Licensee shall implement appropriate safeguards and controls to ensure that its automated integrations do not exceed applicable rate limits or otherwise adversely affect the performance or availability of the Platform. In the event that Licensee's automated access patterns materially and adversely affect Platform performance, Licensor may throttle or temporarily restrict such access upon notice to Licensee, and the parties shall cooperate in good faith to resolve the issue.
4.3 Security Testing Prohibition.
Licensee shall not conduct, authorize, or permit any penetration testing, vulnerability scanning, vulnerability assessment, load testing, stress testing, red team exercises, or other security testing of the Platform or any component of Licensor's infrastructure except as expressly authorized under the Security Exhibit (Exhibit B) to the Agreement and subject to the terms and conditions thereof. Without limiting the generality of the foregoing, the Security Exhibit provides that Licensee-initiated security testing shall be limited to application-layer testing of the Platform, conducted by a mutually agreed-upon qualified third-party testing firm, during mutually agreed-upon testing windows, and in accordance with an agreed-upon scope and rules of engagement. Infrastructure-layer testing (including any testing of the underlying cloud infrastructure provided by Orion Cloud Services, Inc.) shall require Licensor's prior written consent, which may be withheld or conditioned in Licensor's reasonable discretion. Licensee shall provide Licensor with the results of any authorized security testing promptly upon completion and shall cooperate with Licensor to remediate any vulnerabilities identified through such testing.
SECTION 5: COMPLIANCE WITH APPLICABLE LAW
5.1 Legal Compliance Obligation.
Licensee shall use the Platform in compliance with all applicable federal, state, and local laws, statutes, regulations, rules, orders, and governmental guidance, as well as applicable industry standards and self-regulatory requirements. Without limiting the generality of the foregoing, Licensee's legal compliance obligations include compliance with the following, to the extent applicable to Licensee's access to and use of the Platform:
(a) The Gramm-Leach-Bliley Act ("GLBA") (15 U.S.C. §§ 6801–6809) and its implementing regulations, including the OCC's Privacy of Consumer Financial Information regulations (12 C.F.R. Part 1016) and the FTC's Safeguards Rule, to the extent applicable, regarding the protection, safeguarding, and confidential treatment of Non-Public Personal Information;
(b) The Bank Secrecy Act ("BSA") (31 U.S.C. §§ 5311–5330) and applicable anti-money-laundering regulations promulgated thereunder by the Financial Crimes Enforcement Network ("FinCEN"), including regulations regarding currency transaction reporting, suspicious activity reporting, customer identification programs, and customer due diligence;
(c) OCC regulations and guidance applicable to national banks, including without limitation OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), as supplemented and updated by the Interagency Guidance on Third-Party Relationships: Risk Management issued in June 2023 by the OCC, the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation, and any successor guidance;
(d) Applicable state and federal data breach notification laws, including without limitation the New York SHIELD Act (N.Y. Gen. Bus. Law § 899-aa), and any other data breach notification statute or regulation that may apply to Licensee in connection with a security incident affecting Licensee Data processed through the Platform;
(e) FFIEC guidance and examination standards, including the FFIEC BSA/AML Examination Manual, the FFIEC Information Technology Examination Handbook, and any other FFIEC guidance applicable to Licensee's use of the Platform for AML compliance and transaction monitoring purposes.
Licensee acknowledges that the foregoing list is illustrative and not exhaustive, and that Licensee bears sole responsibility for identifying and complying with all laws, regulations, and standards applicable to its use of the Platform.
5.2 Regulatory Cooperation.
Licensee acknowledges and agrees that the Platform is designed as a technology tool intended to support and facilitate Licensee's regulatory compliance efforts, including Licensee's BSA/AML compliance program, and that the Platform does not guarantee compliance with any law, regulation, or regulatory requirement. Licensee remains solely responsible for its compliance with all BSA/AML and other regulatory requirements, including without limitation the design, implementation, configuration, tuning, validation, and ongoing management of the Platform's monitoring rules, scenarios, thresholds, risk-scoring parameters, and alert dispositioning workflows in accordance with Licensee's own risk-based compliance program and the expectations of Licensee's prudential regulators. Licensee further acknowledges that regulatory compliance is a shared responsibility and that Licensee must exercise independent professional judgment in reviewing and acting upon the outputs generated by the Platform. Licensor shall cooperate with Licensee in connection with any regulatory examination, audit, or inquiry relating to the Platform, as further described in the Agreement and the Security Exhibit (Exhibit B).
SECTION 6: DATA AND CONTENT OBLIGATIONS
6.1 Licensee Data Responsibility.
Licensee represents and warrants to Licensor that:
(a) Licensee has obtained and shall maintain all necessary rights, consents, permissions, authorizations, and legal bases required under applicable law to provide Licensee Data to Licensor for processing through the Platform, including any consents required under applicable privacy and data protection laws for the collection, use, disclosure, and processing of NPI and PII;
(b) Licensee Data, as provided to and processed through the Platform, does not and will not infringe, misappropriate, or violate any intellectual property rights (including patents, copyrights, trademarks, and trade secrets), privacy rights, publicity rights, contractual rights, or other legal rights of any third party;
(c) Licensee Data complies with all applicable laws, regulations, and rules, including without limitation the GLBA, the BSA, applicable state privacy laws, and applicable data protection laws; and
(d) Licensee has implemented and shall maintain appropriate internal controls, policies, and procedures to ensure the accuracy, integrity, and quality of Licensee Data prior to its submission to the Platform.
6.2 Data Classification.
Licensee shall classify all data provided to the Platform in accordance with Licensee's internal data classification policy and applicable regulatory requirements. Licensee's data classification framework includes, at a minimum, "Public," "Internal," "Confidential," and "Highly Restricted" classification tiers, each of which carries specific handling, access control, encryption, and retention requirements. Licensee shall inform Licensor of any specific handling, security, or processing requirements associated with the data classifications applicable to Licensee Data, to the extent such requirements impose obligations on Licensor beyond those already set forth in the Agreement, the Data Processing Addendum (Exhibit C), and the Security Exhibit (Exhibit B). Without limiting the foregoing, Licensee acknowledges that the Platform processes data that Licensee classifies as "Confidential" and "Highly Restricted" (including NPI and PII) and that the security controls and data handling requirements applicable to such data are set forth in the Data Processing Addendum (Exhibit C) and the Security Exhibit (Exhibit B).
6.3 Prohibited Data.
Unless expressly authorized under the Agreement and the Data Processing Addendum (Exhibit C), Licensee shall not upload, transmit, store, or otherwise process through the Platform any data that Licensor is not authorized or equipped to process. Without limiting the generality of the foregoing, Licensee shall not provide to the Platform:
(a) Data that is subject to foreign data localization requirements, data residency mandates, or cross-border data transfer restrictions that are incompatible with the continental United States data residency restrictions set forth in the Agreement and the Data Processing Addendum, including but not limited to data subject to the European Union's General Data Protection Regulation ("GDPR") where such data cannot lawfully be transferred to and processed within the United States under the applicable legal framework;
(b) Protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), unless the parties have executed a Business Associate Agreement and the Data Processing Addendum has been amended to address HIPAA requirements;
(c) Payment card data subject to the Payment Card Industry Data Security Standard ("PCI DSS"), including primary account numbers, unless the Platform has been certified as PCI DSS compliant for such processing; or
(d) Any data the processing of which through the Platform would cause Licensor to violate applicable law or regulation.
Licensee shall immediately notify Licensor if Licensee becomes aware that prohibited data has been inadvertently uploaded to the Platform, and the parties shall cooperate to remove such data promptly.
SECTION 7: MONITORING AND ENFORCEMENT
7.1 Licensor's Monitoring Rights.
Licensor reserves the right, but does not undertake an obligation, to monitor Licensee's and its Authorized Users' use of the Platform for compliance with this AUP, the Agreement, and applicable law. Monitoring activities may include, without limitation, automated usage analytics, system performance assessments, log reviews and analysis, review of API call volumes and patterns, and detection of anomalous or potentially unauthorized access patterns. Licensor shall conduct any monitoring activities in a manner consistent with the confidentiality and data protection obligations set forth in the Agreement and the Data Processing Addendum (Exhibit C). To the extent Licensor's monitoring activities involve the collection or processing of Licensee Data or data about Authorized Users, such activities shall be conducted in accordance with applicable law and the terms of the Agreement. Licensor shall not access the content of Licensee Data for monitoring purposes except to the extent necessary to investigate a specific, identified potential violation of this AUP or a security incident, and only in accordance with the procedures set forth in the Agreement and the Data Processing Addendum.
7.2 Reporting of Violations.
Licensee shall promptly notify Licensor of any known or suspected violation of this AUP by any Authorized User, former Authorized User, or third party. Such notification shall be provided to Licensor's designated security contact as specified in the Security Exhibit (Exhibit B) and shall include, to the extent known and available, a description of the nature and scope of the suspected violation, the identity of the individuals involved, the date and time of the suspected violation, and any remedial actions taken or planned by Licensee. Licensee shall cooperate with Licensor in investigating any reported or suspected violation and shall provide Licensor with reasonable access to relevant information, records, and personnel as necessary to conduct such investigation, subject to applicable legal privileges and regulatory requirements.
7.3 Remedial Actions.
In the event of a material violation of this AUP, Licensor may take one or more of the following remedial actions, provided that Licensor shall provide Licensee with prior written notice and a reasonable opportunity to cure (except in cases of emergency as described below):
(a) Suspend the offending Authorized User's access to the Platform, pending investigation and resolution of the violation;
(b) Suspend Licensee's access to the Platform in whole or in part, to the extent reasonably necessary to prevent ongoing harm to the Platform, Licensor's systems, other customers of Licensor, or third parties;
(c) Require Licensee to take immediate corrective action to remediate the violation, including without limitation removing offending data or content, disabling compromised accounts, and implementing additional security controls.
Notwithstanding the foregoing, in cases of emergency posing imminent harm to the security, integrity, availability, or performance of the Platform or Licensor's systems, or posing a risk of harm to other customers of Licensor or third parties, Licensor may take immediate remedial action, including suspension of access, without prior notice to Licensee. In any such emergency situation, Licensor shall provide Licensee with written notice of the emergency suspension within twenty-four (24) hours of the suspension taking effect, including a description of the nature of the emergency and the actions taken. Any suspension imposed under this Section 7.3 shall be narrowly tailored and limited to the minimum scope and duration reasonably necessary to address the identified violation or emergency. Licensor shall cooperate with Licensee in good faith to restore full access to the Platform as promptly as practicable following remediation of the underlying violation.
7.4 No Waiver.
Licensor's failure to monitor Licensee's use of the Platform, to detect a violation of this AUP, or to enforce any provision of this AUP in any particular instance shall not constitute a waiver of Licensor's right to monitor, detect, or enforce such provision, or any other provision of this AUP, at any time. All rights and remedies of Licensor under this AUP are cumulative and are in addition to, and not in lieu of, any other rights and remedies available to Licensor under the Agreement or at law or in equity.
SECTION 8: INDEMNIFICATION FOR AUP BREACHES
8.1 Licensee Indemnification Obligation.
Consistent with and in addition to the indemnification provisions set forth in the Agreement, Licensee shall indemnify, defend, and hold harmless Licensor and its affiliates, and their respective officers, directors, employees, agents, successors, and assigns (collectively, the "Licensor Indemnified Parties"), from and against any and all third-party claims, demands, actions, suits, proceedings, investigations, losses, damages, liabilities, judgments, settlements, penalties, fines, costs, and expenses (including reasonable attorneys' fees, expert witness fees, and court costs) arising out of or related to:
(a) Any breach of this AUP by Licensee or any of its Authorized Users, including any violation of the prohibited activities set forth in Section 4;
(b) Any data, content, or materials provided by Licensee or its Authorized Users to or through the Platform that infringes, misappropriates, or violates the intellectual property rights, privacy rights, contractual rights, or other legal rights of any third party;
(c) Licensee's use of the Platform in violation of any applicable law, statute, regulation, rule, order, or governmental guidance, including any failure to comply with the legal compliance obligations set forth in Section 5 of this AUP.
8.2 Indemnification Procedures.
The indemnification procedures set forth in the Agreement shall apply to all indemnification obligations arising under this Section 8, including but not limited to the requirements for prompt written notice of any indemnifiable claim, the indemnifying party's right to assume control of the defense and settlement of any such claim, the indemnified party's obligation to cooperate in the defense of any such claim, and the limitations on the indemnified party's right to settle any claim without the prior written consent of the indemnifying party. To the extent of any inconsistency between the indemnification procedures set forth in this Section 8 and the corresponding provisions of the Agreement, the provisions of the Agreement shall control.
8.3 Liability Cap.
Licensee's indemnification obligations under this Section 8 shall be subject to the general indemnity cap set forth in the Agreement. As specified in the Agreement, the general indemnity cap is equal to one times (1×) the annual fees paid or payable by Licensee to Licensor in the twelve (12)-month period immediately preceding the date on which the applicable claim first arose, which, in a steady-state year, is approximately nine million three hundred twenty-five thousand dollars ($9,325,000). Notwithstanding the foregoing, to the extent the underlying claim falls within an uncapped liability category or a super-capped liability category as expressly set forth in the Agreement (including, without limitation, claims arising from gross negligence, willful misconduct, fraud, or breaches of confidentiality obligations), the applicable uncapped or super-capped limits shall apply in lieu of the general indemnity cap.
SECTION 9: CONSEQUENCES OF VIOLATION
9.1 Material Breach.
A material or repeated violation of this AUP by Licensee or any of its Authorized Users shall constitute a material breach of the Agreement. Licensee acknowledges that a material breach of this AUP may cause significant harm to the Platform, Licensor's systems, Licensor's other customers, and Licensor's business reputation, and that such harm may not be fully compensable by monetary damages alone. A single, isolated, non-material violation of this AUP that is promptly identified and cured by Licensee shall not, in and of itself, constitute a material breach of the Agreement, provided that a pattern of repeated non-material violations may, in the aggregate, constitute a material breach. Determination of whether a violation is material shall take into account the nature, severity, scope, duration, and impact of the violation, the willfulness or negligence of the violating party, and any prior violations by Licensee or its Authorized Users.
9.2 Termination Right.
In the event of a material breach of this AUP that remains uncured following the expiration of the notice and cure period specified in the Agreement (which, as set forth in the Agreement, provides for written notice of breach and a cure period of thirty (30) days, or such shorter cure period as may be applicable to specific categories of breach as expressly stated in the Agreement), Licensor shall have the right to terminate the Agreement in accordance with its terms. Any such termination shall be without prejudice to Licensor's right to pursue any and all other remedies available to it under the Agreement, at law, or in equity, including without limitation the right to seek injunctive or other equitable relief. In the event of termination of the Agreement due to Licensee's material breach of this AUP, the parties' respective rights and obligations regarding data return, data deletion, transition assistance, and post-termination obligations shall be as set forth in the Agreement.
9.3 Survival.
The following provisions of this AUP shall survive any expiration or termination of the Agreement, regardless of the reason for such expiration or termination: (a) Licensee's indemnification obligations under Section 8; (b) Licensor's remedial rights under Section 7 (to the extent necessary to address violations that occurred during the term of the Agreement); (c) the definitions set forth in Section 2 (to the extent necessary to interpret the surviving provisions); and (d) the general provisions set forth in Section 11. All other provisions of this AUP shall terminate upon expiration or termination of the Agreement, subject to any survival provisions set forth in the Agreement itself.
SECTION 10: MODIFICATIONS TO THIS POLICY
10.1 Licensor Updates.
Licensor may update, revise, supplement, or otherwise modify this AUP from time to time during the term of the Agreement to reflect changes in applicable law, regulation, or governmental guidance; changes in industry standards, best practices, or self-regulatory requirements; changes in the Platform's features, functionality, or capabilities; changes in the threat landscape or security environment; or other changes that Licensor reasonably determines are necessary or appropriate. Licensor shall provide Licensee with no less than thirty (30) days' prior written notice of any material changes to this AUP. Such notice shall describe the nature of the proposed changes and the effective date thereof, and shall be provided to Licensee's designated administrator and to Licensee's primary contact for AUP-related matters identified in Section 11.3 below.
10.2 Licensee Objection Right.
If a material modification to this AUP materially and adversely affects Licensee's authorized use of the Platform or imposes material new obligations or restrictions on Licensee that were not contemplated by the Agreement, Licensee may object to such modification in writing within fifteen (15) days of Licensee's receipt of the notice described in Section 10.1. Upon receipt of Licensee's written objection, the parties shall negotiate in good faith for a period of thirty (30) days to resolve the objection, including by exploring alternative modifications that address Licensor's concerns while minimizing the adverse impact on Licensee. If the parties are unable to reach mutual agreement within such thirty (30)-day negotiation period, either party may escalate the dispute through the dispute escalation procedures set forth in the Agreement, which provide for Level 1 escalation to the parties' designated account managers, Level 2 escalation to senior management representatives, and Level 3 escalation to executive sponsors, followed by JAMS-administered mediation in New York, New York, if the dispute remains unresolved. During the pendency of any such dispute resolution process, the prior version of the AUP shall remain in effect with respect to the disputed provisions, and Licensee shall continue to comply with all undisputed provisions of the updated AUP.
10.3 Non-Material Changes.
Non-material updates to this AUP, including clarifications that do not alter the substantive rights or obligations of either party, corrections of typographical or grammatical errors, updates to formatting or structure, and updates to cross-references or hyperlinks, may be made by Licensor without prior notice, provided that Licensor posts the updated AUP to its customer portal and notifies Licensee's designated Licensee Administrator via email or through the Platform's administrative notification system. Non-material updates shall be clearly identified as such in the updated version of the AUP, and Licensor shall maintain a version history of all changes to the AUP on the customer portal for Licensee's reference.
SECTION 11: GENERAL PROVISIONS
11.1 Governing Law.
This AUP shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to conflict of laws principles that would require or permit the application of the laws of any other jurisdiction. This governing law provision is consistent with and subject to the governing law, venue, and jurisdiction provisions set forth in the Agreement.
11.2 Relationship to Agreement.
This AUP is subject to and governed by the terms and conditions of the Agreement, including all Exhibits and Order Forms thereto. Nothing in this AUP shall be construed to expand Licensor's rights or Licensee's obligations beyond those set forth in the Agreement, or to limit, restrict, or diminish any of Licensee's rights, remedies, or protections under the Agreement. In the event of any ambiguity in this AUP, such ambiguity shall be resolved in a manner consistent with the terms of the Agreement and the parties' mutual intent as expressed therein. This AUP does not create any rights or obligations on the part of any third party, and no third party shall be entitled to enforce any provision of this AUP.
11.3 Notices.
All notices, requests, demands, and other communications required or permitted under this AUP shall be provided in writing and delivered in accordance with the notice provisions of the Agreement (including by personal delivery, nationally recognized overnight courier, or certified mail, return receipt requested). Routine operational communications related to this AUP (including notifications of non-material updates under Section 10.3) may also be delivered via email or through the Platform's administrative notification system, subject to confirmation of receipt. The primary contacts for AUP-related matters are as follows:
Licensee:
Luis Arriaga Senior Vice President, Procurement & Vendor Management Meridian National Bank, N.A. 600 Lexington Avenue, 40th Floor New York, New York 10022
Licensor:
Tara Bellingham Vice President, Enterprise Sales Skybridge Fintech Ltd. 1400 Concord Pike, Suite 320 Wilmington, Delaware 19803
Either party may update its designated contact for AUP-related matters by providing written notice to the other party in accordance with the notice provisions of the Agreement.
11.4 Entire Exhibit.
This AUP, together with the Agreement and the other Exhibits thereto — including Exhibit A (Service Level Agreement), Exhibit B (Security Exhibit), and Exhibit C (Data Processing Addendum) — and all Order Forms executed thereunder, constitutes the complete and exclusive statement of the parties' agreement with respect to the subject matter of this AUP, namely the acceptable use of the Platform by Licensee and its Authorized Users. This AUP supersedes all prior and contemporaneous proposals, understandings, representations, and communications, whether oral or written, between the parties with respect to the acceptable use of the Platform, to the extent not otherwise embodied in the Agreement. No amendment, modification, or waiver of any provision of this AUP shall be binding unless made in accordance with the amendment and modification procedures set forth in this AUP and the Agreement.
ACKNOWLEDGMENT AND EXECUTION
This Acceptable Use Policy (Exhibit D) is incorporated into and forms part of the Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. and Meridian National Bank, National Association. By executing the Agreement, each party acknowledges that it has read, understands, and agrees to be bound by the terms and conditions of this AUP.
Executed as part of the Agreement as of the date set forth therein.
SKYBRIDGE FINTECH LTD.
By: ________
Name: Priya Chandrasekaran
Title: Chief Executive Officer
Date: ________
MERIDIAN NATIONAL BANK, NATIONAL ASSOCIATION
By: ________
Name: Gerald Brannigan
Title: Chief Information Officer
Date: ________
CONFIDENTIAL — This document contains proprietary and confidential information of Skybridge Fintech Ltd. and Meridian National Bank, N.A. Unauthorized reproduction, distribution, or disclosure is strictly prohibited.

ACCEPTABLE USE POLICY

EXHIBIT D

MASTER SOFTWARE-AS-A-SERVICE AGREEMENT

SKYBRIDGE FINTECH LTD.

MERIDIAN NATIONAL BANK, NATIONAL ASSOCIATION

SECTION 1: PURPOSE AND SCOPE

SECTION 2: DEFINITIONS

SECTION 3: AUTHORIZED ACCESS AND USE

SECTION 4: PROHIBITED ACTIVITIES

SECTION 5: COMPLIANCE WITH APPLICABLE LAW

SECTION 6: DATA AND CONTENT OBLIGATIONS

SECTION 7: MONITORING AND ENFORCEMENT

SECTION 8: INDEMNIFICATION FOR AUP BREACHES

SECTION 9: CONSEQUENCES OF VIOLATION

SECTION 10: MODIFICATIONS TO THIS POLICY

SECTION 11: GENERAL PROVISIONS

ACKNOWLEDGMENT AND EXECUTION

SKYBRIDGE FINTECH LTD.

MERIDIAN NATIONAL BANK, NATIONAL ASSOCIATION

Record

Parties

Dates

Amounts