1009-00007 · Skybridge Fintech Ltd · Transaction Documents/MSA

master-saas-agreement-initial-draft.docx DOCUMENT Funds

32 / 35 ← → ✕

Contract analysis Extract to table

MASTER SOFTWARE-AS-A-SERVICE AGREEMENT

SkyComply™ Platform

By and Between

SKYBRIDGE FINTECH LTD.

and

MERIDIAN NATIONAL BANK, NATIONAL ASSOCIATION

INITIAL DRAFT — Prepared by Calderwood & Harkness LLP Privileged & Confidential — For Discussion Purposes Only

Dated as of __, 2025

Prepared by Amy Chesterton and Nathan Ikeda, Calderwood & Harkness LLP, with input from Liam Prescott (Of Counsel). All rights reserved. This document is a confidential attorney work product prepared at the direction of Skybridge Fintech Ltd. and is subject to the attorney-client privilege and the work product doctrine. Distribution of this document to any third party without the prior written consent of Calderwood & Harkness LLP is strictly prohibited.

Right-click to update Table of Contents

PREAMBLE

This Master Software-as-a-Service Agreement (this "Agreement") is entered into as of __, 2025 (the "Effective Date"), by and between:

Skybridge Fintech Ltd., a Delaware limited company formed under the Delaware Limited Liability Company Act and the Delaware Alternative Entity statute, with its principal office and headquarters located at 1400 Concord Pike, Suite 320, Wilmington, Delaware 19803 (hereinafter referred to as "Licensor" or "Skybridge");

and

Meridian National Bank, National Association, a national banking association chartered under the laws of the United States pursuant to the National Bank Act, 12 U.S.C. § 21 et seq., with its principal office located at 600 Lexington Avenue, 40th Floor, New York, New York 10022 (hereinafter referred to as "Licensee" or "Meridian").

Skybridge and Meridian are each referred to herein individually as a "Party" and collectively as the "Parties."

RECITALS. A. Skybridge is the developer and provider of a proprietary artificial-intelligence-driven anti-money-laundering and transaction-monitoring software-as-a-service platform marketed under the trade name SkyComply™ (the "Platform"), which enables financial institutions to detect, investigate, and report suspicious activity, manage customer due diligence and enhanced due diligence processes, screen transactions and counterparties against sanctions and watchlists, and fulfill regulatory reporting obligations under the Bank Secrecy Act and applicable anti-money-laundering laws and regulations.

B. Meridian desires to license access to the SkyComply™ Platform for use across its retail banking, commercial banking, and wealth management divisions, covering approximately thirty-two thousand (32,000) named users across Meridian's domestic and international operations, in order to enhance Meridian's BSA/AML compliance infrastructure and transaction monitoring capabilities.

C. The Parties desire to set forth the terms and conditions under which Skybridge will provide Meridian with access to the Platform and related implementation, configuration, data migration, training, ongoing support, and managed services throughout the term of this Agreement.

D. This Agreement, together with the Order Form executed by the Parties, Exhibit A (Service Level Agreement), Exhibit B (Security Exhibit), Exhibit C (Data Processing Addendum), and Exhibit D (Acceptable Use Policy), each of which is attached hereto or separately executed and incorporated herein by reference, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior or contemporaneous agreements, understandings, representations, and negotiations, whether written or oral, relating to such subject matter.

NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

ARTICLE 1 — DEFINITIONS

As used in this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Article 1 shall have the meanings ascribed to them elsewhere in this Agreement.

1.1 "Acceptable Use Policy" or "AUP" means Skybridge's acceptable use policy for the Platform, as set forth in Exhibit D attached hereto and incorporated herein by reference, as such policy may be updated by Skybridge from time to time in accordance with the terms of this Agreement.

1.2 "Affiliate" means, with respect to any Party, any entity that directly or indirectly controls, is controlled by, or is under common control with such Party. For purposes of this definition, "control" means the direct or indirect ownership of more than fifty percent (50%) of the voting securities or equivalent ownership interests of such entity, or the power to direct or cause the direction of the management and policies of such entity, whether through ownership of voting securities, by contract, or otherwise.

1.3 "Agreement" means this Master Software-as-a-Service Agreement, together with all Exhibits attached hereto or incorporated herein by reference and all Order Forms executed by the Parties, each as may be amended from time to time in accordance with the terms hereof.

1.4 "Annual Fees" means the aggregate fees payable by Licensee in a given contract year as set forth in the Order Form, including subscription fees, support and managed services fees, and, in Year 1, the Implementation Fee. The Annual Fees for each contract year are as set forth in Article 4 and the Order Form.

1.5 "Authorized Users" means Licensee's employees, officers, directors, and authorized contractors who are granted named user access to the Platform by Licensee, up to the Licensed User Count. Each Authorized User shall be assigned a unique user credential, and user credentials may not be shared among multiple individuals.

1.6 "BSA/AML" means the Bank Secrecy Act of 1970, as amended (31 U.S.C. §§ 5311–5332), and all applicable anti-money-laundering statutes, regulations, rules, and guidance promulgated thereunder, including but not limited to the regulations of the Financial Crimes Enforcement Network ("FinCEN") at 31 C.F.R. Chapter X, the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020.

1.7 "Confidential Information" means all information disclosed by or on behalf of one Party (the "Disclosing Party") to the other Party (the "Receiving Party") in connection with this Agreement that is designated as confidential, proprietary, or the equivalent, or that the Receiving Party reasonably should understand to be confidential given the nature of the information and the circumstances of disclosure. Without limiting the generality of the foregoing, Confidential Information includes: (a) the terms and conditions of this Agreement (including pricing, service levels, and commercial terms); (b) trade secrets, know-how, inventions, techniques, processes, algorithms, and software source code; (c) business plans, strategies, forecasts, financial information, and projections; (d) customer lists, customer data, and transaction data; (e) technical specifications, architectures, designs, and documentation; and (f) any other information that is marked or identified as "Confidential," "Proprietary," or with a similar legend. Notwithstanding the foregoing, Confidential Information shall not include information that: (i) is or becomes publicly available through no fault of or breach by the Receiving Party; (ii) was already known to the Receiving Party without restriction on use or disclosure prior to its disclosure by the Disclosing Party, as demonstrated by the Receiving Party's written records; (iii) is independently developed by the Receiving Party without use of or reference to any Confidential Information of the Disclosing Party, as demonstrated by the Receiving Party's written records; (iv) is rightfully received by the Receiving Party from a third party who is not under an obligation of confidentiality to the Disclosing Party with respect to such information; or (v) is required to be disclosed by law, regulation, subpoena, court order, or regulatory examination, subject to the provisions of Section 11.4.

1.8 "Data Processing Addendum" or "DPA" means the data processing addendum attached hereto as Exhibit C and incorporated herein by reference, which sets forth the terms and conditions governing Skybridge's processing of Licensee Data containing personally identifiable information and non-public personal information.

1.9 "Documentation" means Skybridge's then-current technical documentation, user manuals, release notes, API specifications, administrator guides, and online help materials for the Platform, as made available by Skybridge to Licensee during the Term and updated from time to time.

1.10 "Effective Date" means the date on which this Agreement is fully executed by both Parties, as set forth in the preamble of this Agreement.

1.11 "Go-Live Date" means the date on which the Platform is made available for production use by Licensee following completion of the Implementation Services and successful acceptance testing in accordance with Section 3.5. The targeted Go-Live Date is March 1, 2026; provided that the actual Go-Live Date may be adjusted by mutual written agreement of the Parties.

1.12 "Implementation Period" means the period commencing on September 15, 2025 and ending on February 28, 2026, during which Skybridge shall perform the Implementation Services. The Implementation Period may be extended by mutual written agreement of the Parties if necessary to complete the Implementation Services.

1.13 "Implementation Services" means the onboarding, platform configuration, data migration, system integration, user acceptance testing, end-user training, and related professional services to be performed by Skybridge as described in the Order Form and further detailed in the implementation plan to be mutually agreed upon by the Parties during the Implementation Period.

1.14 "Initial Term" means the period of five (5) years commencing on the Go-Live Date and expiring on the fifth (5th) anniversary of the Go-Live Date, as further described in Section 5.1.

1.15 "Licensee Data" means all data, content, records, files, information, and materials provided by or on behalf of Licensee (including by Licensee's Authorized Users, customers, or agents) to Skybridge or input into the Platform in connection with Licensee's use of the Platform, including but not limited to Non-Public Personal Information, Personally Identifiable Information, customer records, transaction data, suspicious activity reports and related workpapers, currency transaction reports, and any other data processed, stored, or transmitted through the Platform on behalf of Licensee.

1.16 "Licensed User Count" means thirty-two thousand (32,000) named Authorized Users, as set forth in the Order Form, which represents the maximum number of Authorized Users permitted to access the Platform at any time during the Term without incurring additional per-user fees.

1.17 "Malicious Code" means any software code, program, or mechanism that is designed to: (a) disrupt, disable, or harm the operation of software, hardware, or systems; (b) permit unauthorized access to software, hardware, or systems; or (c) damage, destroy, or alter data, including without limitation viruses, worms, Trojan horses, time bombs, lock-outs, drop-dead devices, ransomware, spyware, adware, or other harmful or malicious code.

1.18 "NPI" or "Non-Public Personal Information" means non-public personal information as defined under Title V of the Gramm-Leach-Bliley Act of 1999 (15 U.S.C. §§ 6801–6809) and its implementing regulations, including Regulation P (12 C.F.R. Part 1016) and the Interagency Guidelines Establishing Information Security Standards.

1.19 "Order Form" means the order form or statement of work executed by the Parties in connection with this Agreement, which sets forth the specific commercial terms, including Licensed User Count, fees, payment schedule, implementation milestones, and any additional service specifications. Each Order Form shall be deemed incorporated into and governed by this Agreement.

1.20 "PII" or "Personally Identifiable Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, as defined under applicable federal and state privacy laws, including the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.), as amended by the California Privacy Rights Act, and other applicable state data privacy laws.

1.21 "Platform" means the SkyComply™ software-as-a-service application, including all modules, features, and functionalities described in the Documentation and the Order Form, together with all updates, upgrades, enhancements, patches, bug fixes, and new releases made generally available by Skybridge to its customers during the Term, as hosted and operated by Skybridge or its authorized infrastructure provider.

1.22 "Renewal Term" means each successive one (1)-year renewal period following the expiration of the Initial Term, subject to the automatic renewal provisions of Section 5.2.

1.23 "Scheduled Maintenance Window" means the designated period during which Skybridge may perform scheduled maintenance on the Platform without such downtime counting against the Platform availability target under the SLA. The Scheduled Maintenance Window is Saturdays from 2:00 AM to 6:00 AM Eastern Time, for a maximum of four (4) hours per week.

1.24 "Security Exhibit" means the security requirements and standards set forth in Exhibit B attached hereto and incorporated herein by reference.

1.25 "Security Incident" means any unauthorized access to, or unauthorized acquisition, use, disclosure, modification, or destruction of, Licensee Data, or any breach or compromise of the security, confidentiality, or integrity of the systems, networks, or infrastructure used by Skybridge to process, store, or transmit Licensee Data.

1.26 "SLA" or "Service Level Agreement" means the service level agreement set forth in Exhibit A attached hereto and incorporated herein by reference, which specifies the Platform availability targets, incident response times, and service level credit structure.

1.27 "Subprocessor" means any third party (including any Affiliate of Skybridge) engaged by Skybridge or acting on Skybridge's behalf that processes, stores, or has access to Licensee Data in connection with Skybridge's performance of its obligations under this Agreement.

1.28 "Term" means, collectively, the Initial Term and any Renewal Terms, as applicable.

1.29 "Total Contract Value" or "TCV" means the total aggregate fees payable by Licensee over the five (5)-year Initial Term, which is Fifty Million Dollars ($50,000,000), as further detailed in Article 4 and the Order Form.

ARTICLE 2 — GRANT OF LICENSE; ACCESS RIGHTS

2.1 License Grant. Subject to the terms and conditions of this Agreement, including Licensee's timely payment of all fees set forth in the Order Form, Skybridge hereby grants to Meridian, and Meridian hereby accepts, a non-exclusive, non-transferable (except as permitted under Section 19.5), limited right and license to access and use the Platform during the Term, solely for Meridian's internal business purposes in connection with Meridian's anti-money-laundering compliance, Bank Secrecy Act compliance, transaction monitoring, sanctions screening, customer due diligence, enhanced due diligence, and related regulatory compliance activities. The license granted herein is subject at all times to the terms and conditions of this Agreement, the Order Form, the Acceptable Use Policy, and all applicable laws and regulations. For the avoidance of doubt, the license granted hereunder is a right to access and use the Platform as a hosted service and does not constitute a license to any underlying software code, whether in source code or object code form.

2.2 Licensed Users. Meridian's access to and use of the Platform is limited to up to thirty-two thousand (32,000) named Authorized Users, as specified in the Order Form (the "Licensed User Count"). Each Authorized User shall be assigned a unique set of login credentials, and such credentials may not be shared among or transferred between individuals. Meridian shall be responsible for ensuring that all Authorized Users comply with the terms of this Agreement and the Acceptable Use Policy, and Meridian shall be liable for any breach of this Agreement caused by its Authorized Users. Meridian may add additional Authorized Users beyond the Licensed User Count at any time during the Term by submitting a written request to Skybridge, and such additional users shall be subject to the incremental user rate of Two Hundred Seventy-Five Dollars ($275) per user per year, as set forth in the Order Form. No volume discount shall apply to incremental users added in excess of the Licensed User Count. Meridian may replace named Authorized Users from time to time (for example, upon employee departure or role change) without incurring additional fees, provided the total number of active Authorized Users does not exceed the Licensed User Count at any time.

2.3 Scope of Use. Meridian may use the Platform across its retail banking, commercial banking, and wealth management divisions, including both domestic (United States) and international operations, for the purposes described in Section 2.1. Use of the Platform in connection with Meridian's international operations shall be subject to the data residency restrictions set forth in Exhibit B (Security Exhibit) and Exhibit C (Data Processing Addendum), and Meridian shall ensure that its use of the Platform in any jurisdiction complies with all applicable local laws and regulations governing data protection, financial services, and anti-money-laundering.

2.4 Restrictions on Use. Licensee shall not, and shall not permit any Authorized User, Affiliate, or third party to:

(a) sublicense, resell, rent, lease, lend, distribute, or otherwise make the Platform or any portion thereof available to any third party, except that Meridian may permit access by Meridian Affiliates with the prior written consent of Skybridge, which consent shall not be unreasonably withheld, conditioned, or delayed;

(b) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, object code, algorithms, data structures, or underlying ideas or architecture of the Platform, except to the extent expressly permitted by applicable law notwithstanding this restriction;

(c) modify, adapt, translate, or create derivative works based upon the Platform or the Documentation, in whole or in part;

(d) remove, alter, or obscure any proprietary notices, labels, trademarks, or branding displayed on or within the Platform or the Documentation;

(e) circumvent, disable, or otherwise interfere with any access controls, security features, authentication mechanisms, or usage limitations implemented by Skybridge in connection with the Platform;

(f) use the Platform in violation of the Acceptable Use Policy (Exhibit D) or any applicable law, rule, regulation, or governmental order;

(g) use the Platform to process data or perform services on behalf of any third party (including any entity that is not a Meridian Affiliate) or to operate a service bureau;

(h) introduce any Malicious Code into the Platform or Skybridge's systems; or

(i) access the Platform for the purpose of building a competitive product or service, or for benchmarking or competitive analysis purposes.

2.5 Reservation of Rights. Skybridge retains all right, title, and interest in and to the Platform, the Documentation, and all intellectual property rights embodied therein, including all patents, copyrights, trademarks, trade secrets, and other proprietary rights. No rights or licenses are granted to Licensee except as expressly set forth in this Agreement. All rights not expressly granted herein are reserved by Skybridge.

2.6 Feedback. In the event that Licensee provides Skybridge with any suggestions, ideas, enhancement requests, recommendations, feature requests, or other feedback regarding the Platform or any Skybridge product or service (collectively, "Feedback"), Licensee hereby assigns to Skybridge all right, title, and interest in and to such Feedback. Skybridge shall be free to use, incorporate, modify, and commercialize such Feedback in any manner and for any purpose, without any obligation, restriction, or compensation to Licensee. Nothing in this Section 2.6 shall be construed to require Licensee to provide any Feedback to Skybridge.

ARTICLE 3 — IMPLEMENTATION SERVICES

3.1 Implementation. Skybridge shall perform the Implementation Services described in the Order Form during the Implementation Period, which shall commence on September 15, 2025 and end on February 28, 2026, unless the Parties mutually agree in writing to extend the Implementation Period. The Implementation Services shall include, without limitation: (a) project planning and governance establishment; (b) onboarding and environment provisioning; (c) platform configuration, including the configuration of rules engines, risk models, alert thresholds, workflow automation, and reporting templates to align with Meridian's policies and procedures; (d) data migration from Meridian's legacy systems, including historical transaction data, customer records, case files, and regulatory reports; (e) integration with Meridian's core banking systems, data warehouses, and other enterprise applications via APIs and secure file transfer protocols; (f) user acceptance testing, including the development and execution of test plans, test scripts, and defect tracking; (g) end-user training, including training for compliance analysts, investigators, supervisors, administrators, and IT support personnel; and (h) deployment to production and go-live support.

3.2 Implementation Fee. In consideration of the Implementation Services, Licensee shall pay Skybridge a one-time implementation fee of Three Million Six Hundred Thousand Dollars ($3,600,000) (the "Implementation Fee"), as set forth in the Order Form. The Implementation Fee shall be invoiced and payable in accordance with the payment milestones set forth in the Order Form. The Implementation Fee is non-refundable except as expressly provided in Section 6.6 of this Agreement.

3.3 Cooperation. Licensee acknowledges that successful implementation of the Platform depends on Licensee's timely and reasonable cooperation with Skybridge during the Implementation Period. Licensee shall: (a) designate a project manager and implementation team to work with Skybridge's implementation team; (b) provide reasonable and timely access to Licensee's systems, networks, data, and facilities as necessary for Skybridge to perform the Implementation Services; (c) provide complete and accurate data for data migration in the formats and within the timelines specified in the implementation plan; (d) make available appropriate Licensee personnel for training sessions, workshops, design reviews, and user acceptance testing; (e) provide timely decisions and approvals as reasonably requested by Skybridge; and (f) perform such other cooperation obligations as are set forth in the Order Form or the implementation plan. Skybridge shall not be responsible for any delays in implementation to the extent such delays are attributable to Licensee's failure to fulfill its cooperation obligations under this Section 3.3.

3.4 Go-Live Date. The targeted Go-Live Date is March 1, 2026. The Parties shall use commercially reasonable efforts to achieve Go-Live by the targeted date. In the event that the Go-Live Date is delayed beyond the targeted date, the Parties shall discuss the reasons for such delay and agree on a revised timeline. Delays caused by Licensee's failure to fulfill its cooperation obligations under Section 3.3 shall not constitute a breach by Skybridge and shall not give rise to any claim by Licensee for damages, credits, or other remedies. If the Go-Live Date is delayed beyond May 31, 2026 for reasons primarily attributable to Skybridge, Licensee shall have the right to terminate this Agreement upon thirty (30) days' written notice to Skybridge, and Skybridge shall refund all prepaid fees (including the Implementation Fee) to Licensee within thirty (30) days of such termination.

3.5 Acceptance. Following Skybridge's notification to Licensee that the Platform has been deployed and is ready for production use, Licensee shall have a period of thirty (30) calendar days (the "Acceptance Period") to conduct acceptance testing to verify that the Platform conforms in all material respects to the Documentation and the specifications set forth in the Order Form. If the Platform does not so conform, Licensee shall provide Skybridge with written notice specifying in reasonable detail the nature of each non-conformity (a "Deficiency Notice") prior to the expiration of the Acceptance Period. Upon receipt of a Deficiency Notice, Skybridge shall use commercially reasonable efforts to cure the identified non-conformities within thirty (30) days following receipt of such notice. If Skybridge cures the identified non-conformities within such cure period, the Platform shall be deemed accepted as of the date of cure. If Skybridge fails to cure the identified non-conformities within such cure period, Licensee may, at its option: (a) extend the cure period by an additional thirty (30) days; or (b) terminate this Agreement in accordance with Section 3.4. If Licensee does not deliver a Deficiency Notice prior to the expiration of the Acceptance Period, the Platform shall be deemed accepted as of the last day of the Acceptance Period, and the Go-Live Date shall be deemed to have occurred.

ARTICLE 4 — FEES AND PAYMENT

4.1 Fees. In consideration of the license, services, and other rights granted hereunder, Licensee shall pay to Skybridge the fees set forth in the Order Form, which are summarized as follows:

(a) Platform Subscription Fee. The annual subscription fee for access to the Platform for up to 32,000 named Authorized Users, as specified in the Order Form.

(b) Implementation Fee (Year 1 Only). A one-time implementation fee of Three Million Six Hundred Thousand Dollars ($3,600,000), payable in accordance with the payment milestones set forth in the Order Form.

(c) Support and Managed Services Fee. An annual fee of One Million Eight Hundred Thousand Dollars ($1,800,000) per year for ongoing technical support and managed services during the Term (Years 1 through 5).

(d) Year 1 Total (Post-discount). The total fees for Year 1 (including the Implementation Fee, Platform subscription fee, and support and managed services fee), as adjusted for the applicable volume discount, are Twelve Million Seven Hundred Thousand Dollars ($12,700,000), as set forth in the Order Form.

(e) Years 2 through 5 Annual Fees. The total annual fees for each of Years 2 through 5 (including the Platform subscription fee and support and managed services fee), as adjusted for the applicable volume discount, are Nine Million Three Hundred Twenty-Five Thousand Dollars ($9,325,000) per year, as set forth in the Order Form.

(f) Total Contract Value. The Total Contract Value over the five (5)-year Initial Term is Fifty Million Dollars ($50,000,000).

(g) Volume discount. A volume discount of six and seventy-two hundredths percent (6.72%) has been applied to the gross undiscounted Total Contract Value of Fifty-Three Million Six Hundred Thousand Dollars ($53,600,000) to arrive at the discounted Total Contract Value of Fifty Million Dollars ($50,000,000).

4.2 Payment Terms. All fees under this Agreement are payable quarterly in advance. Skybridge shall issue invoices to Licensee on or before the first day of each calendar quarter (or such other invoicing schedule as set forth in the Order Form). All invoices shall be due and payable within thirty (30) days of the date of invoice (the "Payment Due Date"). Payments shall be made by wire transfer or ACH to the bank account designated by Skybridge on the applicable invoice, in United States Dollars.

4.3 Annual Escalator. Beginning in Year 3 of the Initial Term (i.e., the third contract year following the Go-Live Date), the Annual Fees (excluding the Implementation Fee, which is a one-time charge) shall be subject to an annual escalation based on the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, All Items, as published by the U.S. Bureau of Labor Statistics. The annual escalation rate shall be equal to the percentage change in CPI-U for the twelve (12)-month period ending June 30 of the preceding calendar year, subject to a floor of three percent (3.0%) and a cap of three and one-half percent (3.5%) per annum. In the event that the applicable CPI-U increase is less than three percent (3.0%), the escalation rate shall default to three percent (3.0%). In the event that the applicable CPI-U increase exceeds three and one-half percent (3.5%), the escalation rate shall be capped at three and one-half percent (3.5%). For the avoidance of doubt, the CPI-based escalation shall be applied cumulatively, with each year's escalation calculated on the escalated fee from the prior year.

4.4 Incremental Users. If Licensee desires to add Authorized Users in excess of the Licensed User Count of thirty-two thousand (32,000) at any time during the Term, Licensee may do so by submitting a written request to Skybridge. Each additional Authorized User shall be billed at a rate of Two Hundred Seventy-Five Dollars ($275) per user per year, pro-rated for any partial year. No volume discount shall apply to fees for incremental users added in excess of the Licensed User Count. Incremental user fees shall be invoiced quarterly in arrears for each calendar quarter in which such incremental users are active.

4.5 Taxes. All fees stated in this Agreement and the Order Form are exclusive of any and all applicable sales, use, value-added, goods and services, withholding, excise, or similar taxes, levies, duties, or governmental charges of any kind (collectively, "Taxes"). Licensee shall be responsible for the payment of all such Taxes arising in connection with this Agreement, except for taxes imposed on Skybridge's net income, capital, or franchise taxes assessed against Skybridge based on Skybridge's business operations. If Skybridge is required by law to collect any Taxes from Licensee, Skybridge shall include such Taxes on the applicable invoice, and Licensee shall pay such amounts in addition to the fees otherwise due. If Licensee is required by law to withhold any Taxes from payments to Skybridge, Licensee shall provide Skybridge with an official tax receipt or other documentation evidencing such withholding.

4.6 Late Payment. Any amounts not paid by Licensee when due shall bear interest from the Payment Due Date until the date of actual payment at the lesser of: (a) one and one-half percent (1.5%) per month (eighteen percent (18%) per annum); or (b) the maximum rate of interest permitted by applicable law. The accrual of interest under this Section 4.6 shall not relieve Licensee of its obligation to make timely payment and shall be in addition to, and not in lieu of, any other remedies available to Skybridge under this Agreement or at law.

4.7 Disputed Invoices. If Licensee disputes any amount on an invoice in good faith, Licensee shall provide Skybridge with written notice of such dispute within thirty (30) days of receipt of the applicable invoice, specifying in reasonable detail the nature and basis of the dispute and the amount disputed. The Parties shall work together in good faith to resolve any billing dispute within thirty (30) days of Skybridge's receipt of Licensee's dispute notice. Notwithstanding the pendency of any billing dispute, all undisputed amounts shall remain due and payable in accordance with the payment terms of this Agreement. Licensee's failure to dispute an invoiced amount within the thirty (30)-day dispute period shall constitute Licensee's acceptance of such invoiced amount.

ARTICLE 5 — TERM AND RENEWAL

5.1 Initial Term. The Initial Term of this Agreement shall commence on the Go-Live Date (targeted: March 1, 2026) and shall continue for a period of five (5) years, expiring on the fifth (5th) anniversary of the Go-Live Date (targeted: February 28, 2031), unless earlier terminated in accordance with the provisions of Article 6. For the avoidance of doubt, Skybridge's obligations to perform Implementation Services under Article 3 shall commence on the Effective Date and shall continue during the Implementation Period, regardless of whether the Go-Live Date has occurred.

5.2 Renewal. Following the expiration of the Initial Term, this Agreement shall automatically renew for up to two (2) successive one (1)-year Renewal Terms, unless either Party provides the other Party with written notice of non-renewal at least one hundred eighty (180) days prior to the expiration of the then-current term (whether the Initial Term or a Renewal Term). If neither Party provides timely notice of non-renewal, the Agreement shall automatically renew for the next successive Renewal Term on the same terms and conditions then in effect, subject to the annual fee escalation provisions of Section 4.3. For the avoidance of doubt, the maximum term of this Agreement (absent mutual written agreement to further extend) shall be the five (5)-year Initial Term plus two (2) successive one (1)-year Renewal Terms, for a maximum aggregate term of seven (7) years.

5.3 Effect of Expiration or Termination. Upon expiration or termination of this Agreement for any reason, the following provisions shall survive and continue in full force and effect in accordance with their respective terms: Article 1 (Definitions, to the extent necessary to interpret surviving provisions), Article 10 (Data Export and Deletion), Article 11 (Confidentiality), Article 13 (Indemnification, with respect to claims arising prior to or in connection with the termination or expiration), Article 14 (Limitation of Liability), Article 15 (Intellectual Property), Article 17 (Regulatory Compliance and Examination Rights, to the extent relating to the period during which services were performed), Article 18 (Governing Law; Dispute Resolution), Article 19 (General Provisions), and Article 20 (Source Code Escrow, to the extent applicable following a release event). The expiration or termination of this Agreement shall not relieve either Party of any obligations accrued prior to the effective date of such expiration or termination.

ARTICLE 6 — TERMINATION

6.1 Termination for Cause. Either Party may terminate this Agreement upon written notice to the other Party in the event that:

(a) the other Party materially breaches any provision of this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice from the non-breaching Party specifying the nature of the breach in reasonable detail; provided, however, that in the case of non-payment by Licensee, the cure period shall be sixty (60) days after receipt of written notice; or

(b) the other Party: (i) becomes insolvent or is generally unable to pay its debts as they become due; (ii) files a voluntary petition in bankruptcy or has an involuntary petition in bankruptcy filed against it that is not dismissed within sixty (60) days; (iii) makes a general assignment for the benefit of creditors; (iv) has a receiver, trustee, or custodian appointed for all or a substantial portion of its assets; or (v) is subject to any proceeding under any bankruptcy, insolvency, reorganization, or similar law that is not dismissed within sixty (60) days.

6.2 Termination for Convenience by Licensee. Licensee may terminate this Agreement for convenience at any time after the end of Year 2 of the Initial Term (i.e., after the second anniversary of the Go-Live Date) upon twelve (12) months' prior written notice to Skybridge and payment of an early termination fee (the "ETF"). The ETF shall be equal to fifty percent (50%) of the remaining Annual Fees that would have been payable by Licensee for the balance of the then-current term (whether the Initial Term or a Renewal Term) had the Agreement not been terminated. For illustrative purposes only: if Licensee delivers a termination for convenience notice effective as of the end of Year 3 of the Initial Term (with two (2) years remaining in the Initial Term), the ETF would be calculated as fifty percent (50%) multiplied by Nine Million Three Hundred Twenty-Five Thousand Dollars ($9,325,000) multiplied by two (2) years, yielding an ETF of Nine Million Three Hundred Twenty-Five Thousand Dollars ($9,325,000). The ETF shall be payable within thirty (30) days of the effective date of termination. The Parties acknowledge that the ETF represents a reasonable pre-estimate of Skybridge's damages and is not a penalty.

6.3 Termination for Chronic SLA Failure. Notwithstanding any other provision of this Agreement, Licensee shall have the right to terminate this Agreement upon sixty (60) days' written notice to Skybridge if Platform availability (as measured in accordance with Exhibit A) falls below ninety-eight percent (98.0%) in three (3) of any consecutive six (6) calendar months. In the event of termination pursuant to this Section 6.3, no ETF shall be payable by Licensee, and Skybridge shall refund prepaid fees allocable to the post-termination period in accordance with Section 6.6.

6.4 Termination for Regulatory Event. Licensee may terminate this Agreement upon ninety (90) days' written notice to Skybridge if a federal banking regulator (including but not limited to the OCC, the Federal Reserve, or the FDIC) issues a material adverse finding, enforcement action, formal or informal supervisory action, consent order, cease-and-desist order, or similar regulatory determination relating to the Platform, Skybridge's services under this Agreement, or Skybridge's fitness to serve as a technology service provider to Licensee. In the event of termination pursuant to this Section 6.4, no ETF shall be payable by Licensee, and Skybridge shall refund prepaid fees allocable to the post-termination period in accordance with Section 6.6.

6.5 Effect of Termination. Upon the effective date of termination or expiration of this Agreement:

(a) Licensee's right to access and use the Platform shall immediately cease, and Skybridge shall disable Licensee's and all Authorized Users' access credentials;

(b) Skybridge shall perform its data export and deletion obligations in accordance with Article 10;

(c) Licensee shall pay all fees accrued and owing through the effective date of termination, including any applicable early termination fee under Section 6.2;

(d) each Party shall, at the Disclosing Party's election, promptly return or destroy all Confidential Information of the other Party in its possession or control, in accordance with Section 11.5, subject to any regulatory retention requirements and data export rights under Article 10; and

(e) the provisions identified in Section 5.3 shall survive in accordance with their terms.

6.6 Refund of Prepaid Fees. In the event of termination for cause by Licensee under Section 6.1, termination for chronic SLA failure under Section 6.3, or termination for a regulatory event under Section 6.4, Skybridge shall refund to Licensee any prepaid fees allocable to the post-termination period on a pro-rata basis, calculated from the effective date of termination through the end of the period for which such fees were prepaid. Such refund shall be paid by Skybridge within thirty (30) days of the effective date of termination. For the avoidance of doubt, no refund of prepaid fees shall be due in the event of termination for cause by Skybridge or termination for convenience by Licensee under Section 6.2.

ARTICLE 7 — SUPPORT AND MANAGED SERVICES

7.1 Support Services. Throughout the Term, Skybridge shall provide Licensee with ongoing technical support and managed services as described in the Order Form. Support services shall include, without limitation: (a) a dedicated support team for incident management, problem resolution, and service request fulfillment; (b) access to Skybridge's online support portal for ticket submission, status tracking, and knowledge base resources; (c) telephone and email support during business hours (Monday through Friday, 8:00 AM to 8:00 PM Eastern Time, excluding federal holidays); (d) twenty-four (24) hours per day, seven (7) days per week ("24/7") critical incident support for Severity 1 issues; and (e) ongoing system monitoring, performance optimization, and proactive alert management. The annual support and managed services fee is One Million Eight Hundred Thousand Dollars ($1,800,000) per year, payable as part of the Annual Fees in accordance with Section 4.1.

7.2 Service Levels. Skybridge's support services are subject to the service levels and incident response time commitments set forth in Exhibit A (Service Level Agreement), which are incorporated herein by reference and summarized as follows:

(a) Severity 1 (Platform Down / Critical Business Impact): Acknowledgment within fifteen (15) minutes; first response within one (1) hour; resolution target of four (4) hours. Severity 1 incidents are those in which the Platform is completely unavailable or a critical production function is inoperable, resulting in a material impact on Licensee's ability to conduct its compliance operations.

(b) Severity 2 (Major Feature Impaired / Significant Business Impact): Acknowledgment within thirty (30) minutes; first response within two (2) hours; resolution target of eight (8) hours. Severity 2 incidents are those in which a major feature or function of the Platform is significantly impaired or degraded, but a workaround may be available.

(c) Severity 3 (Minor Impact / Low Business Impact): Acknowledgment within four (4) hours; first response within one (1) business day; resolution target of five (5) business days. Severity 3 incidents are those involving minor issues, cosmetic defects, or documentation errors that do not materially affect Platform functionality.

Skybridge shall assign severity levels in good faith in consultation with Licensee. In the event of a disagreement regarding the appropriate severity level for an incident, Licensee's reasonable classification shall prevail, subject to subsequent good-faith review and reclassification by the Parties.

7.3 Updates and Upgrades. During the Term, Skybridge shall make available to Licensee, at no additional charge, all updates, patches, bug fixes, maintenance releases, and version upgrades to the Platform that are generally released by Skybridge to its customer base. Skybridge shall provide Licensee with reasonable advance notice of any major version upgrades, including release notes describing new features, changes, and any known issues. Skybridge shall ensure that all updates and upgrades are backward-compatible with Licensee's existing configurations and integrations, or, in the event that backward compatibility cannot be maintained, Skybridge shall provide Licensee with at least sixty (60) days' advance notice and reasonable migration assistance.

7.4 Scheduled Maintenance. Skybridge shall perform all scheduled maintenance during the Scheduled Maintenance Window, which is Saturdays from 2:00 AM to 6:00 AM Eastern Time, for a maximum of four (4) hours per week. Skybridge shall provide Licensee with at least forty-eight (48) hours' advance written notice (via email to Licensee's designated technical contact) of all scheduled maintenance activities, including a description of the work to be performed and the expected duration. Downtime during the Scheduled Maintenance Window shall not count against the Platform availability target under the SLA. In the event that Skybridge determines that emergency maintenance is required outside of the Scheduled Maintenance Window to address a critical security vulnerability or system stability issue, Skybridge shall provide Licensee with as much advance notice as is reasonably practicable under the circumstances and shall use commercially reasonable efforts to minimize the duration and impact of such emergency maintenance.

ARTICLE 8 — SERVICE LEVEL AGREEMENT

8.1 Incorporation. The service level terms applicable to the Platform are set forth in Exhibit A (Service Level Agreement), which is attached hereto and incorporated herein by reference. In the event of any conflict between the provisions of this Article 8 and the provisions of Exhibit A, the provisions of Exhibit A shall control with respect to the specific service level metrics, measurement methodologies, credit calculations, and exclusions set forth therein, and the provisions of this Article 8 shall control with respect to all other matters.

8.2 Platform Availability. Skybridge shall use commercially reasonable efforts to maintain Platform availability of ninety-nine and nine-tenths percent (99.9%) monthly uptime (the "Availability Target"), measured on a calendar-month basis exclusive of downtime occurring during the Scheduled Maintenance Window and any downtime attributable to force majeure events, Licensee's systems or network infrastructure, or Licensee's breach of this Agreement. Platform availability shall be calculated as follows:

Availability % = ((Total Minutes in Calendar Month – Scheduled Maintenance Minutes – Downtime Minutes) / (Total Minutes in Calendar Month – Scheduled Maintenance Minutes)) × 100

Note to Meridian: Skybridge's initial position is 99.9% monthly uptime. Meridian's position as communicated in preliminary discussions is 99.95% monthly uptime. This remains an open negotiation point.

8.3 SLA Credits. In the event that Skybridge fails to meet the Availability Target in any calendar month, Licensee shall be entitled to receive service level credits ("SLA Credits") as set forth in the credit schedule in Exhibit A. SLA Credits shall be calculated as a percentage of the applicable monthly subscription fee (i.e., the Annual Fees, excluding the Implementation Fee, divided by twelve (12)) based on the degree to which actual availability falls below the Availability Target. The credit schedule is as follows:

8.4 Credit Caps. SLA Credits are subject to the following caps:

(a) Monthly Cap: SLA Credits shall not exceed thirty percent (30%) of the applicable monthly subscription fee in any single calendar month. Based on the fee structure set forth in Article 4, the estimated monthly credit caps are: approximately Three Hundred Seventeen Thousand Five Hundred Dollars ($317,500) in Year 1, and approximately Two Hundred Thirty-Three Thousand One Hundred Twenty-Five Dollars ($233,125) in each of Years 2 through 5.

(b) Annual Cap: SLA Credits shall not exceed fifteen percent (15%) of the applicable annual subscription fee in any contract year. Based on the fee structure set forth in Article 4, the estimated annual credit caps are: approximately One Million Nine Hundred Five Thousand Dollars ($1,905,000) in Year 1, and approximately One Million Three Hundred Ninety-Eight Thousand Seven Hundred Fifty Dollars ($1,398,750) in each of Years 2 through 5.

8.5 Sole Remedy. The issuance of SLA Credits as set forth in this Article 8 and Exhibit A, together with Licensee's right to terminate this Agreement for chronic SLA failure under Section 6.3, shall constitute Licensee's sole and exclusive remedy, and Skybridge's sole and exclusive liability, for Skybridge's failure to meet the Availability Target, except in cases of Skybridge's gross negligence or willful misconduct. Nothing in this Section 8.5 shall limit Licensee's rights or Skybridge's obligations under any other provision of this Agreement with respect to claims not arising from a failure to meet the Availability Target.

8.6 Credit Requests. To receive SLA Credits, Licensee must submit a written credit request to Skybridge within thirty (30) calendar days following the end of the calendar month in which the Availability Target was not met. Each credit request shall specify the dates and times of the alleged downtime and any supporting documentation reasonably available to Licensee. Skybridge shall review each credit request and, within fifteen (15) business days of receipt, shall either approve the credit request and apply the approved SLA Credits against the next invoice issued to Licensee, or provide Licensee with a written explanation of its determination that the credit request does not meet the criteria for SLA Credits, including Skybridge's availability data for the applicable month. In the event of a dispute regarding Platform availability during any month, Skybridge's monitoring systems and records shall be the primary source of measurement data, subject to Licensee's right to present its own monitoring data for Skybridge's good-faith consideration.

ARTICLE 9 — DATA SECURITY AND PRIVACY

9.1 Security Obligations. Skybridge shall implement and maintain a comprehensive information security program consisting of administrative, technical, and physical safeguards designed to: (a) ensure the security, confidentiality, integrity, and availability of Licensee Data; (b) protect against any anticipated threats or hazards to the security or integrity of Licensee Data; (c) protect against unauthorized access to or use of Licensee Data that could result in substantial harm to Licensee or any of its customers; and (d) comply with the requirements of the Gramm-Leach-Bliley Act, the Interagency Guidelines Establishing Information Security Standards, and all other applicable federal and state data security laws and regulations. Skybridge's security obligations are further described in Exhibit B (Security Exhibit) and Exhibit C (Data Processing Addendum), each of which is incorporated herein by reference.

9.2 Security Certifications. Skybridge shall obtain and maintain throughout the Term the following security certifications and audit reports:

(a) SOC 2 Type II Report: Skybridge shall maintain a current SOC 2 Type II report (Service Organization Control report) covering the Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy, as applicable, issued by an independent third-party auditor. The SOC 2 Type II audit shall be conducted annually, and Skybridge shall provide Licensee with a copy of each SOC 2 Type II report within thirty (30) days of issuance. Skybridge's current SOC 2 Type II report is dated March 15, 2025, and was issued by Crestfield Cyber Advisors, Inc.

(b) ISO 27001 Certification: Skybridge shall maintain ISO/IEC 27001 certification for its information security management system covering the Platform and related operations. Recertification shall be obtained on a triennial basis, with annual surveillance audits conducted in the interim years. Skybridge shall provide Licensee with a copy of its ISO 27001 certificate and the results of any surveillance audits upon request. Skybridge's current ISO 27001 certificate is dated January 22, 2025, and was issued by Crestfield Cyber Advisors, Inc.

In the event that Skybridge's SOC 2 Type II report or ISO 27001 certification lapses, is revoked, or contains a qualified opinion or material finding, Skybridge shall promptly notify Licensee and shall use commercially reasonable efforts to remediate any identified deficiencies and obtain a renewed or unqualified report or certification within ninety (90) days.

9.3 Encryption Standards. Skybridge shall encrypt all Licensee Data as follows:

(a) Data at Rest: All Licensee Data stored within the Platform, databases, backups, and archival storage shall be encrypted using the Advanced Encryption Standard with a key length of 256 bits (AES-256) or a substantially equivalent or stronger encryption standard.

(b) Data in Transit: All Licensee Data transmitted between Licensee's systems and the Platform, and between components of the Platform, shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher.

(c) Key Management: Encryption keys shall be managed using Skybridge-managed hardware security modules (HSMs) in accordance with industry best practices. Skybridge shall offer Licensee the option to implement a bring-your-own-key ("BYOK") arrangement, under which Licensee retains control of its encryption keys while Skybridge manages the Platform infrastructure. The terms and conditions of any BYOK arrangement shall be as mutually agreed by the Parties.

9.4 Data Residency. All Licensee Data shall be stored, processed, and maintained exclusively within the continental United States. Skybridge's primary infrastructure provider for the Platform is Orion Cloud Services, Inc. Licensee Data shall be hosted in Orion Cloud Services, Inc.'s US-East (Virginia) and US-West (Oregon) regions. Skybridge shall not store, process, transfer, or otherwise make Licensee Data accessible outside the continental United States without Licensee's prior written consent. In the event that Skybridge desires to change its data center locations or infrastructure provider, Skybridge shall provide Licensee with at least ninety (90) days' prior written notice and shall not proceed with such change without Licensee's prior written consent if such change would result in Licensee Data being stored or processed outside the continental United States.

9.5 Penetration Testing. Skybridge shall engage a qualified, independent third-party security firm to conduct penetration testing of the Platform at least once per calendar year. The scope of such testing shall include, at a minimum, application-layer vulnerability assessment, web application testing, and API security testing. Skybridge shall provide Licensee with an executive summary of the results of each penetration test within thirty (30) days of completion, including a description of any identified vulnerabilities and the remediation plan and timeline for each. In addition to Skybridge's own penetration testing program, Licensee may conduct its own annual penetration test of the Platform at Licensee's sole expense, subject to the following conditions:

(a) Application-layer testing may be conducted by Licensee upon at least fifteen (15) business days' prior written notice to Skybridge, coordination with Skybridge's security team, and execution of Skybridge's standard penetration testing agreement;

(b) Infrastructure-layer testing (including testing of Skybridge's or Orion Cloud Services, Inc.'s underlying network, server, and storage infrastructure) shall require Skybridge's prior written consent, which shall not be unreasonably withheld but may be conditioned on reasonable scope limitations, scheduling requirements, and the execution of appropriate confidentiality and liability agreements.

Note to Meridian: Skybridge's initial position is that Licensee's penetration testing is limited to application-layer testing, with infrastructure-layer testing requiring Skybridge's prior written consent. Meridian has requested the right to conduct both application-layer and infrastructure-layer testing. This remains an open negotiation point.

9.6 Audit Rights. Licensee (or its designated independent third-party auditor, subject to reasonable confidentiality obligations) shall have the right to audit Skybridge's security controls, practices, and compliance with this Agreement and the Security Exhibit once per calendar year, upon not less than thirty (30) business days' prior written notice to Skybridge. Skybridge may satisfy Licensee's audit request by delivering to Licensee: (a) Skybridge's then-current SOC 2 Type II report; (b) Skybridge's then-current ISO 27001 certificate; and (c) a completed supplemental Security Assessment Questionnaire in a form reasonably acceptable to Licensee. If, after reviewing the foregoing materials, Licensee reasonably determines that an on-site audit is necessary based on a material security concern, a Security Incident, or a deficiency identified in the SOC 2 report, ISO 27001 certificate, or Security Assessment Questionnaire, Licensee may conduct an on-site audit of Skybridge's relevant facilities, systems, and records, subject to reasonable scheduling, scope limitations, and confidentiality requirements. Skybridge shall cooperate fully with any such audit and shall provide reasonable access to relevant personnel, systems, records, and facilities. Each Party shall bear its own costs in connection with any audit, except that if an audit reveals a material non-compliance with this Agreement or the Security Exhibit, Skybridge shall bear the reasonable costs of the audit.

9.7 Background Checks. Skybridge shall ensure that all Skybridge employees, contractors, and agents who have access to Licensee Data or to systems used to process, store, or transmit Licensee Data undergo background checks prior to being granted such access. Background checks shall be consistent with the standards set forth in the Federal Financial Institutions Examination Council (FFIEC) guidelines, including criminal history checks, employment verification, and, where applicable, credit checks. Skybridge shall maintain records of such background checks and shall make such records available for regulatory examination upon request.

9.8 Security Incident Notification. Skybridge shall notify Licensee of any confirmed Security Incident affecting Licensee Data as promptly as practicable, and in any event within twenty-four (24) hours of Skybridge's discovery or reasonable determination that a Security Incident has occurred. Such notification shall be provided to Licensee's designated security contact (as identified in the Order Form or as otherwise communicated in writing by Licensee) by telephone and in writing (via email with confirmation), and shall include the following information, to the extent known at the time of notification:

(a) the nature and scope of the Security Incident, including the categories of data and records affected;

(b) the specific Licensee Data affected or reasonably believed to have been affected;

(d) the measures being implemented to prevent recurrence; and

(e) a designated point of contact at Skybridge for ongoing communication regarding the Security Incident.

Skybridge shall provide supplemental updates to Licensee as additional information becomes available, and shall cooperate fully with Licensee in investigating and remediating the Security Incident. Skybridge shall not make any public statement regarding a Security Incident affecting Licensee Data without Licensee's prior written consent, except as required by applicable law.

Note to Meridian: Skybridge's initial position is twenty-four (24) hours for Security Incident notification. Meridian has demanded a twelve (12)-hour notification window. This remains an open negotiation point.

9.9 Data Processing. The processing of Licensee Data by Skybridge shall be governed by the Data Processing Addendum (Exhibit C), which is incorporated herein by reference. Without limiting the generality of the DPA, Skybridge acknowledges that Licensee Data may include: (a) data classified as "Confidential" and "Highly Restricted" under Licensee's data classification policy; (b) Non-Public Personal Information subject to the Gramm-Leach-Bliley Act; and (c) Personally Identifiable Information subject to applicable federal and state privacy laws. Skybridge shall process Licensee Data solely as necessary to perform its obligations under this Agreement and as instructed by Licensee, and shall not process, access, use, or disclose Licensee Data for any other purpose, including for Skybridge's own business purposes, except as expressly permitted by Section 15.3 (Aggregated/De-Identified Data).

9.10 Subprocessors. Skybridge shall not engage

MASTER SOFTWARE-AS-A-SERVICE AGREEMENT
SkyComply™ Platform
By and Between
SKYBRIDGE FINTECH LTD.
and
MERIDIAN NATIONAL BANK, NATIONAL ASSOCIATION
INITIAL DRAFT — Prepared by Calderwood & Harkness LLP Privileged & Confidential — For Discussion Purposes Only
Dated as of __, 2025
Prepared by Amy Chesterton and Nathan Ikeda, Calderwood & Harkness LLP, with input from Liam Prescott (Of Counsel). All rights reserved. This document is a confidential attorney work product prepared at the direction of Skybridge Fintech Ltd. and is subject to the attorney-client privilege and the work product doctrine. Distribution of this document to any third party without the prior written consent of Calderwood & Harkness LLP is strictly prohibited.
Right-click to update Table of Contents
PREAMBLE
This Master Software-as-a-Service Agreement (this "Agreement") is entered into as of __, 2025 (the "Effective Date"), by and between:
Skybridge Fintech Ltd., a Delaware limited company formed under the Delaware Limited Liability Company Act and the Delaware Alternative Entity statute, with its principal office and headquarters located at 1400 Concord Pike, Suite 320, Wilmington, Delaware 19803 (hereinafter referred to as "Licensor" or "Skybridge");
and
Meridian National Bank, National Association, a national banking association chartered under the laws of the United States pursuant to the National Bank Act, 12 U.S.C. § 21 et seq., with its principal office located at 600 Lexington Avenue, 40th Floor, New York, New York 10022 (hereinafter referred to as "Licensee" or "Meridian").
Skybridge and Meridian are each referred to herein individually as a "Party" and collectively as the "Parties."
RECITALS.  A. Skybridge is the developer and provider of a proprietary artificial-intelligence-driven anti-money-laundering and transaction-monitoring software-as-a-service platform marketed under the trade name SkyComply™ (the "Platform"), which enables financial institutions to detect, investigate, and report suspicious activity, manage customer due diligence and enhanced due diligence processes, screen transactions and counterparties against sanctions and watchlists, and fulfill regulatory reporting obligations under the Bank Secrecy Act and applicable anti-money-laundering laws and regulations.
B. Meridian desires to license access to the SkyComply™ Platform for use across its retail banking, commercial banking, and wealth management divisions, covering approximately thirty-two thousand (32,000) named users across Meridian's domestic and international operations, in order to enhance Meridian's BSA/AML compliance infrastructure and transaction monitoring capabilities.
C. The Parties desire to set forth the terms and conditions under which Skybridge will provide Meridian with access to the Platform and related implementation, configuration, data migration, training, ongoing support, and managed services throughout the term of this Agreement.
D. This Agreement, together with the Order Form executed by the Parties, Exhibit A (Service Level Agreement), Exhibit B (Security Exhibit), Exhibit C (Data Processing Addendum), and Exhibit D (Acceptable Use Policy), each of which is attached hereto or separately executed and incorporated herein by reference, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior or contemporaneous agreements, understandings, representations, and negotiations, whether written or oral, relating to such subject matter.
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE 1 — DEFINITIONS
As used in this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Article 1 shall have the meanings ascribed to them elsewhere in this Agreement.
1.1 "Acceptable Use Policy" or "AUP" means Skybridge's acceptable use policy for the Platform, as set forth in Exhibit D attached hereto and incorporated herein by reference, as such policy may be updated by Skybridge from time to time in accordance with the terms of this Agreement.
1.2 "Affiliate" means, with respect to any Party, any entity that directly or indirectly controls, is controlled by, or is under common control with such Party. For purposes of this definition, "control" means the direct or indirect ownership of more than fifty percent (50%) of the voting securities or equivalent ownership interests of such entity, or the power to direct or cause the direction of the management and policies of such entity, whether through ownership of voting securities, by contract, or otherwise.
1.3 "Agreement" means this Master Software-as-a-Service Agreement, together with all Exhibits attached hereto or incorporated herein by reference and all Order Forms executed by the Parties, each as may be amended from time to time in accordance with the terms hereof.
1.4 "Annual Fees" means the aggregate fees payable by Licensee in a given contract year as set forth in the Order Form, including subscription fees, support and managed services fees, and, in Year 1, the Implementation Fee. The Annual Fees for each contract year are as set forth in Article 4 and the Order Form.
1.5 "Authorized Users" means Licensee's employees, officers, directors, and authorized contractors who are granted named user access to the Platform by Licensee, up to the Licensed User Count. Each Authorized User shall be assigned a unique user credential, and user credentials may not be shared among multiple individuals.
1.6 "BSA/AML" means the Bank Secrecy Act of 1970, as amended (31 U.S.C. §§ 5311–5332), and all applicable anti-money-laundering statutes, regulations, rules, and guidance promulgated thereunder, including but not limited to the regulations of the Financial Crimes Enforcement Network ("FinCEN") at 31 C.F.R. Chapter X, the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020.
1.7 "Confidential Information" means all information disclosed by or on behalf of one Party (the "Disclosing Party") to the other Party (the "Receiving Party") in connection with this Agreement that is designated as confidential, proprietary, or the equivalent, or that the Receiving Party reasonably should understand to be confidential given the nature of the information and the circumstances of disclosure. Without limiting the generality of the foregoing, Confidential Information includes: (a) the terms and conditions of this Agreement (including pricing, service levels, and commercial terms); (b) trade secrets, know-how, inventions, techniques, processes, algorithms, and software source code; (c) business plans, strategies, forecasts, financial information, and projections; (d) customer lists, customer data, and transaction data; (e) technical specifications, architectures, designs, and documentation; and (f) any other information that is marked or identified as "Confidential," "Proprietary," or with a similar legend. Notwithstanding the foregoing, Confidential Information shall not include information that: (i) is or becomes publicly available through no fault of or breach by the Receiving Party; (ii) was already known to the Receiving Party without restriction on use or disclosure prior to its disclosure by the Disclosing Party, as demonstrated by the Receiving Party's written records; (iii) is independently developed by the Receiving Party without use of or reference to any Confidential Information of the Disclosing Party, as demonstrated by the Receiving Party's written records; (iv) is rightfully received by the Receiving Party from a third party who is not under an obligation of confidentiality to the Disclosing Party with respect to such information; or (v) is required to be disclosed by law, regulation, subpoena, court order, or regulatory examination, subject to the provisions of Section 11.4.
1.8 "Data Processing Addendum" or "DPA" means the data processing addendum attached hereto as Exhibit C and incorporated herein by reference, which sets forth the terms and conditions governing Skybridge's processing of Licensee Data containing personally identifiable information and non-public personal information.
1.9 "Documentation" means Skybridge's then-current technical documentation, user manuals, release notes, API specifications, administrator guides, and online help materials for the Platform, as made available by Skybridge to Licensee during the Term and updated from time to time.
1.10 "Effective Date" means the date on which this Agreement is fully executed by both Parties, as set forth in the preamble of this Agreement.
1.11 "Go-Live Date" means the date on which the Platform is made available for production use by Licensee following completion of the Implementation Services and successful acceptance testing in accordance with Section 3.5. The targeted Go-Live Date is March 1, 2026; provided that the actual Go-Live Date may be adjusted by mutual written agreement of the Parties.
1.12 "Implementation Period" means the period commencing on September 15, 2025 and ending on February 28, 2026, during which Skybridge shall perform the Implementation Services. The Implementation Period may be extended by mutual written agreement of the Parties if necessary to complete the Implementation Services.
1.13 "Implementation Services" means the onboarding, platform configuration, data migration, system integration, user acceptance testing, end-user training, and related professional services to be performed by Skybridge as described in the Order Form and further detailed in the implementation plan to be mutually agreed upon by the Parties during the Implementation Period.
1.14 "Initial Term" means the period of five (5) years commencing on the Go-Live Date and expiring on the fifth (5th) anniversary of the Go-Live Date, as further described in Section 5.1.
1.15 "Licensee Data" means all data, content, records, files, information, and materials provided by or on behalf of Licensee (including by Licensee's Authorized Users, customers, or agents) to Skybridge or input into the Platform in connection with Licensee's use of the Platform, including but not limited to Non-Public Personal Information, Personally Identifiable Information, customer records, transaction data, suspicious activity reports and related workpapers, currency transaction reports, and any other data processed, stored, or transmitted through the Platform on behalf of Licensee.
1.16 "Licensed User Count" means thirty-two thousand (32,000) named Authorized Users, as set forth in the Order Form, which represents the maximum number of Authorized Users permitted to access the Platform at any time during the Term without incurring additional per-user fees.
1.17 "Malicious Code" means any software code, program, or mechanism that is designed to: (a) disrupt, disable, or harm the operation of software, hardware, or systems; (b) permit unauthorized access to software, hardware, or systems; or (c) damage, destroy, or alter data, including without limitation viruses, worms, Trojan horses, time bombs, lock-outs, drop-dead devices, ransomware, spyware, adware, or other harmful or malicious code.
1.18 "NPI" or "Non-Public Personal Information" means non-public personal information as defined under Title V of the Gramm-Leach-Bliley Act of 1999 (15 U.S.C. §§ 6801–6809) and its implementing regulations, including Regulation P (12 C.F.R. Part 1016) and the Interagency Guidelines Establishing Information Security Standards.
1.19 "Order Form" means the order form or statement of work executed by the Parties in connection with this Agreement, which sets forth the specific commercial terms, including Licensed User Count, fees, payment schedule, implementation milestones, and any additional service specifications. Each Order Form shall be deemed incorporated into and governed by this Agreement.
1.20 "PII" or "Personally Identifiable Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, as defined under applicable federal and state privacy laws, including the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.), as amended by the California Privacy Rights Act, and other applicable state data privacy laws.
1.21 "Platform" means the SkyComply™ software-as-a-service application, including all modules, features, and functionalities described in the Documentation and the Order Form, together with all updates, upgrades, enhancements, patches, bug fixes, and new releases made generally available by Skybridge to its customers during the Term, as hosted and operated by Skybridge or its authorized infrastructure provider.
1.22 "Renewal Term" means each successive one (1)-year renewal period following the expiration of the Initial Term, subject to the automatic renewal provisions of Section 5.2.
1.23 "Scheduled Maintenance Window" means the designated period during which Skybridge may perform scheduled maintenance on the Platform without such downtime counting against the Platform availability target under the SLA. The Scheduled Maintenance Window is Saturdays from 2:00 AM to 6:00 AM Eastern Time, for a maximum of four (4) hours per week.
1.24 "Security Exhibit" means the security requirements and standards set forth in Exhibit B attached hereto and incorporated herein by reference.
1.25 "Security Incident" means any unauthorized access to, or unauthorized acquisition, use, disclosure, modification, or destruction of, Licensee Data, or any breach or compromise of the security, confidentiality, or integrity of the systems, networks, or infrastructure used by Skybridge to process, store, or transmit Licensee Data.
1.26 "SLA" or "Service Level Agreement" means the service level agreement set forth in Exhibit A attached hereto and incorporated herein by reference, which specifies the Platform availability targets, incident response times, and service level credit structure.
1.27 "Subprocessor" means any third party (including any Affiliate of Skybridge) engaged by Skybridge or acting on Skybridge's behalf that processes, stores, or has access to Licensee Data in connection with Skybridge's performance of its obligations under this Agreement.
1.28 "Term" means, collectively, the Initial Term and any Renewal Terms, as applicable.
1.29 "Total Contract Value" or "TCV" means the total aggregate fees payable by Licensee over the five (5)-year Initial Term, which is Fifty Million Dollars ($50,000,000), as further detailed in Article 4 and the Order Form.
ARTICLE 2 — GRANT OF LICENSE; ACCESS RIGHTS
2.1 License Grant. Subject to the terms and conditions of this Agreement, including Licensee's timely payment of all fees set forth in the Order Form, Skybridge hereby grants to Meridian, and Meridian hereby accepts, a non-exclusive, non-transferable (except as permitted under Section 19.5), limited right and license to access and use the Platform during the Term, solely for Meridian's internal business purposes in connection with Meridian's anti-money-laundering compliance, Bank Secrecy Act compliance, transaction monitoring, sanctions screening, customer due diligence, enhanced due diligence, and related regulatory compliance activities. The license granted herein is subject at all times to the terms and conditions of this Agreement, the Order Form, the Acceptable Use Policy, and all applicable laws and regulations. For the avoidance of doubt, the license granted hereunder is a right to access and use the Platform as a hosted service and does not constitute a license to any underlying software code, whether in source code or object code form.
2.2 Licensed Users. Meridian's access to and use of the Platform is limited to up to thirty-two thousand (32,000) named Authorized Users, as specified in the Order Form (the "Licensed User Count"). Each Authorized User shall be assigned a unique set of login credentials, and such credentials may not be shared among or transferred between individuals. Meridian shall be responsible for ensuring that all Authorized Users comply with the terms of this Agreement and the Acceptable Use Policy, and Meridian shall be liable for any breach of this Agreement caused by its Authorized Users. Meridian may add additional Authorized Users beyond the Licensed User Count at any time during the Term by submitting a written request to Skybridge, and such additional users shall be subject to the incremental user rate of Two Hundred Seventy-Five Dollars ($275) per user per year, as set forth in the Order Form. No volume discount shall apply to incremental users added in excess of the Licensed User Count. Meridian may replace named Authorized Users from time to time (for example, upon employee departure or role change) without incurring additional fees, provided the total number of active Authorized Users does not exceed the Licensed User Count at any time.
2.3 Scope of Use. Meridian may use the Platform across its retail banking, commercial banking, and wealth management divisions, including both domestic (United States) and international operations, for the purposes described in Section 2.1. Use of the Platform in connection with Meridian's international operations shall be subject to the data residency restrictions set forth in Exhibit B (Security Exhibit) and Exhibit C (Data Processing Addendum), and Meridian shall ensure that its use of the Platform in any jurisdiction complies with all applicable local laws and regulations governing data protection, financial services, and anti-money-laundering.
2.4 Restrictions on Use. Licensee shall not, and shall not permit any Authorized User, Affiliate, or third party to:
(a) sublicense, resell, rent, lease, lend, distribute, or otherwise make the Platform or any portion thereof available to any third party, except that Meridian may permit access by Meridian Affiliates with the prior written consent of Skybridge, which consent shall not be unreasonably withheld, conditioned, or delayed;
(b) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, object code, algorithms, data structures, or underlying ideas or architecture of the Platform, except to the extent expressly permitted by applicable law notwithstanding this restriction;
(c) modify, adapt, translate, or create derivative works based upon the Platform or the Documentation, in whole or in part;
(d) remove, alter, or obscure any proprietary notices, labels, trademarks, or branding displayed on or within the Platform or the Documentation;
(e) circumvent, disable, or otherwise interfere with any access controls, security features, authentication mechanisms, or usage limitations implemented by Skybridge in connection with the Platform;
(f) use the Platform in violation of the Acceptable Use Policy (Exhibit D) or any applicable law, rule, regulation, or governmental order;
(g) use the Platform to process data or perform services on behalf of any third party (including any entity that is not a Meridian Affiliate) or to operate a service bureau;
(h) introduce any Malicious Code into the Platform or Skybridge's systems; or
(i) access the Platform for the purpose of building a competitive product or service, or for benchmarking or competitive analysis purposes.
2.5 Reservation of Rights. Skybridge retains all right, title, and interest in and to the Platform, the Documentation, and all intellectual property rights embodied therein, including all patents, copyrights, trademarks, trade secrets, and other proprietary rights. No rights or licenses are granted to Licensee except as expressly set forth in this Agreement. All rights not expressly granted herein are reserved by Skybridge.
2.6 Feedback. In the event that Licensee provides Skybridge with any suggestions, ideas, enhancement requests, recommendations, feature requests, or other feedback regarding the Platform or any Skybridge product or service (collectively, "Feedback"), Licensee hereby assigns to Skybridge all right, title, and interest in and to such Feedback. Skybridge shall be free to use, incorporate, modify, and commercialize such Feedback in any manner and for any purpose, without any obligation, restriction, or compensation to Licensee. Nothing in this Section 2.6 shall be construed to require Licensee to provide any Feedback to Skybridge.
ARTICLE 3 — IMPLEMENTATION SERVICES
3.1 Implementation. Skybridge shall perform the Implementation Services described in the Order Form during the Implementation Period, which shall commence on September 15, 2025 and end on February 28, 2026, unless the Parties mutually agree in writing to extend the Implementation Period. The Implementation Services shall include, without limitation: (a) project planning and governance establishment; (b) onboarding and environment provisioning; (c) platform configuration, including the configuration of rules engines, risk models, alert thresholds, workflow automation, and reporting templates to align with Meridian's policies and procedures; (d) data migration from Meridian's legacy systems, including historical transaction data, customer records, case files, and regulatory reports; (e) integration with Meridian's core banking systems, data warehouses, and other enterprise applications via APIs and secure file transfer protocols; (f) user acceptance testing, including the development and execution of test plans, test scripts, and defect tracking; (g) end-user training, including training for compliance analysts, investigators, supervisors, administrators, and IT support personnel; and (h) deployment to production and go-live support.
3.2 Implementation Fee. In consideration of the Implementation Services, Licensee shall pay Skybridge a one-time implementation fee of Three Million Six Hundred Thousand Dollars ($3,600,000) (the "Implementation Fee"), as set forth in the Order Form. The Implementation Fee shall be invoiced and payable in accordance with the payment milestones set forth in the Order Form. The Implementation Fee is non-refundable except as expressly provided in Section 6.6 of this Agreement.
3.3 Cooperation. Licensee acknowledges that successful implementation of the Platform depends on Licensee's timely and reasonable cooperation with Skybridge during the Implementation Period. Licensee shall: (a) designate a project manager and implementation team to work with Skybridge's implementation team; (b) provide reasonable and timely access to Licensee's systems, networks, data, and facilities as necessary for Skybridge to perform the Implementation Services; (c) provide complete and accurate data for data migration in the formats and within the timelines specified in the implementation plan; (d) make available appropriate Licensee personnel for training sessions, workshops, design reviews, and user acceptance testing; (e) provide timely decisions and approvals as reasonably requested by Skybridge; and (f) perform such other cooperation obligations as are set forth in the Order Form or the implementation plan. Skybridge shall not be responsible for any delays in implementation to the extent such delays are attributable to Licensee's failure to fulfill its cooperation obligations under this Section 3.3.
3.4 Go-Live Date. The targeted Go-Live Date is March 1, 2026. The Parties shall use commercially reasonable efforts to achieve Go-Live by the targeted date. In the event that the Go-Live Date is delayed beyond the targeted date, the Parties shall discuss the reasons for such delay and agree on a revised timeline. Delays caused by Licensee's failure to fulfill its cooperation obligations under Section 3.3 shall not constitute a breach by Skybridge and shall not give rise to any claim by Licensee for damages, credits, or other remedies. If the Go-Live Date is delayed beyond May 31, 2026 for reasons primarily attributable to Skybridge, Licensee shall have the right to terminate this Agreement upon thirty (30) days' written notice to Skybridge, and Skybridge shall refund all prepaid fees (including the Implementation Fee) to Licensee within thirty (30) days of such termination.
3.5 Acceptance. Following Skybridge's notification to Licensee that the Platform has been deployed and is ready for production use, Licensee shall have a period of thirty (30) calendar days (the "Acceptance Period") to conduct acceptance testing to verify that the Platform conforms in all material respects to the Documentation and the specifications set forth in the Order Form. If the Platform does not so conform, Licensee shall provide Skybridge with written notice specifying in reasonable detail the nature of each non-conformity (a "Deficiency Notice") prior to the expiration of the Acceptance Period. Upon receipt of a Deficiency Notice, Skybridge shall use commercially reasonable efforts to cure the identified non-conformities within thirty (30) days following receipt of such notice. If Skybridge cures the identified non-conformities within such cure period, the Platform shall be deemed accepted as of the date of cure. If Skybridge fails to cure the identified non-conformities within such cure period, Licensee may, at its option: (a) extend the cure period by an additional thirty (30) days; or (b) terminate this Agreement in accordance with Section 3.4. If Licensee does not deliver a Deficiency Notice prior to the expiration of the Acceptance Period, the Platform shall be deemed accepted as of the last day of the Acceptance Period, and the Go-Live Date shall be deemed to have occurred.
ARTICLE 4 — FEES AND PAYMENT
4.1 Fees. In consideration of the license, services, and other rights granted hereunder, Licensee shall pay to Skybridge the fees set forth in the Order Form, which are summarized as follows:
(a) Platform Subscription Fee. The annual subscription fee for access to the Platform for up to 32,000 named Authorized Users, as specified in the Order Form.
(b) Implementation Fee (Year 1 Only). A one-time implementation fee of Three Million Six Hundred Thousand Dollars ($3,600,000), payable in accordance with the payment milestones set forth in the Order Form.
(c) Support and Managed Services Fee. An annual fee of One Million Eight Hundred Thousand Dollars ($1,800,000) per year for ongoing technical support and managed services during the Term (Years 1 through 5).
(d) Year 1 Total (Post-discount). The total fees for Year 1 (including the Implementation Fee, Platform subscription fee, and support and managed services fee), as adjusted for the applicable volume discount, are Twelve Million Seven Hundred Thousand Dollars ($12,700,000), as set forth in the Order Form.
(e) Years 2 through 5 Annual Fees. The total annual fees for each of Years 2 through 5 (including the Platform subscription fee and support and managed services fee), as adjusted for the applicable volume discount, are Nine Million Three Hundred Twenty-Five Thousand Dollars ($9,325,000) per year, as set forth in the Order Form.
(f) Total Contract Value. The Total Contract Value over the five (5)-year Initial Term is Fifty Million Dollars ($50,000,000).
(g) Volume discount. A volume discount of six and seventy-two hundredths percent (6.72%) has been applied to the gross undiscounted Total Contract Value of Fifty-Three Million Six Hundred Thousand Dollars ($53,600,000) to arrive at the discounted Total Contract Value of Fifty Million Dollars ($50,000,000).
4.2 Payment Terms. All fees under this Agreement are payable quarterly in advance. Skybridge shall issue invoices to Licensee on or before the first day of each calendar quarter (or such other invoicing schedule as set forth in the Order Form). All invoices shall be due and payable within thirty (30) days of the date of invoice (the "Payment Due Date"). Payments shall be made by wire transfer or ACH to the bank account designated by Skybridge on the applicable invoice, in United States Dollars.
4.3 Annual Escalator. Beginning in Year 3 of the Initial Term (i.e., the third contract year following the Go-Live Date), the Annual Fees (excluding the Implementation Fee, which is a one-time charge) shall be subject to an annual escalation based on the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, All Items, as published by the U.S. Bureau of Labor Statistics. The annual escalation rate shall be equal to the percentage change in CPI-U for the twelve (12)-month period ending June 30 of the preceding calendar year, subject to a floor of three percent (3.0%) and a cap of three and one-half percent (3.5%) per annum. In the event that the applicable CPI-U increase is less than three percent (3.0%), the escalation rate shall default to three percent (3.0%). In the event that the applicable CPI-U increase exceeds three and one-half percent (3.5%), the escalation rate shall be capped at three and one-half percent (3.5%). For the avoidance of doubt, the CPI-based escalation shall be applied cumulatively, with each year's escalation calculated on the escalated fee from the prior year.
4.4 Incremental Users. If Licensee desires to add Authorized Users in excess of the Licensed User Count of thirty-two thousand (32,000) at any time during the Term, Licensee may do so by submitting a written request to Skybridge. Each additional Authorized User shall be billed at a rate of Two Hundred Seventy-Five Dollars ($275) per user per year, pro-rated for any partial year. No volume discount shall apply to fees for incremental users added in excess of the Licensed User Count. Incremental user fees shall be invoiced quarterly in arrears for each calendar quarter in which such incremental users are active.
4.5 Taxes. All fees stated in this Agreement and the Order Form are exclusive of any and all applicable sales, use, value-added, goods and services, withholding, excise, or similar taxes, levies, duties, or governmental charges of any kind (collectively, "Taxes"). Licensee shall be responsible for the payment of all such Taxes arising in connection with this Agreement, except for taxes imposed on Skybridge's net income, capital, or franchise taxes assessed against Skybridge based on Skybridge's business operations. If Skybridge is required by law to collect any Taxes from Licensee, Skybridge shall include such Taxes on the applicable invoice, and Licensee shall pay such amounts in addition to the fees otherwise due. If Licensee is required by law to withhold any Taxes from payments to Skybridge, Licensee shall provide Skybridge with an official tax receipt or other documentation evidencing such withholding.
4.6 Late Payment. Any amounts not paid by Licensee when due shall bear interest from the Payment Due Date until the date of actual payment at the lesser of: (a) one and one-half percent (1.5%) per month (eighteen percent (18%) per annum); or (b) the maximum rate of interest permitted by applicable law. The accrual of interest under this Section 4.6 shall not relieve Licensee of its obligation to make timely payment and shall be in addition to, and not in lieu of, any other remedies available to Skybridge under this Agreement or at law.
4.7 Disputed Invoices. If Licensee disputes any amount on an invoice in good faith, Licensee shall provide Skybridge with written notice of such dispute within thirty (30) days of receipt of the applicable invoice, specifying in reasonable detail the nature and basis of the dispute and the amount disputed. The Parties shall work together in good faith to resolve any billing dispute within thirty (30) days of Skybridge's receipt of Licensee's dispute notice. Notwithstanding the pendency of any billing dispute, all undisputed amounts shall remain due and payable in accordance with the payment terms of this Agreement. Licensee's failure to dispute an invoiced amount within the thirty (30)-day dispute period shall constitute Licensee's acceptance of such invoiced amount.
ARTICLE 5 — TERM AND RENEWAL
5.1 Initial Term. The Initial Term of this Agreement shall commence on the Go-Live Date (targeted: March 1, 2026) and shall continue for a period of five (5) years, expiring on the fifth (5th) anniversary of the Go-Live Date (targeted: February 28, 2031), unless earlier terminated in accordance with the provisions of Article 6. For the avoidance of doubt, Skybridge's obligations to perform Implementation Services under Article 3 shall commence on the Effective Date and shall continue during the Implementation Period, regardless of whether the Go-Live Date has occurred.
5.2 Renewal. Following the expiration of the Initial Term, this Agreement shall automatically renew for up to two (2) successive one (1)-year Renewal Terms, unless either Party provides the other Party with written notice of non-renewal at least one hundred eighty (180) days prior to the expiration of the then-current term (whether the Initial Term or a Renewal Term). If neither Party provides timely notice of non-renewal, the Agreement shall automatically renew for the next successive Renewal Term on the same terms and conditions then in effect, subject to the annual fee escalation provisions of Section 4.3. For the avoidance of doubt, the maximum term of this Agreement (absent mutual written agreement to further extend) shall be the five (5)-year Initial Term plus two (2) successive one (1)-year Renewal Terms, for a maximum aggregate term of seven (7) years.
5.3 Effect of Expiration or Termination. Upon expiration or termination of this Agreement for any reason, the following provisions shall survive and continue in full force and effect in accordance with their respective terms: Article 1 (Definitions, to the extent necessary to interpret surviving provisions), Article 10 (Data Export and Deletion), Article 11 (Confidentiality), Article 13 (Indemnification, with respect to claims arising prior to or in connection with the termination or expiration), Article 14 (Limitation of Liability), Article 15 (Intellectual Property), Article 17 (Regulatory Compliance and Examination Rights, to the extent relating to the period during which services were performed), Article 18 (Governing Law; Dispute Resolution), Article 19 (General Provisions), and Article 20 (Source Code Escrow, to the extent applicable following a release event). The expiration or termination of this Agreement shall not relieve either Party of any obligations accrued prior to the effective date of such expiration or termination.
ARTICLE 6 — TERMINATION
6.1 Termination for Cause. Either Party may terminate this Agreement upon written notice to the other Party in the event that:
(a) the other Party materially breaches any provision of this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice from the non-breaching Party specifying the nature of the breach in reasonable detail; provided, however, that in the case of non-payment by Licensee, the cure period shall be sixty (60) days after receipt of written notice; or
(b) the other Party: (i) becomes insolvent or is generally unable to pay its debts as they become due; (ii) files a voluntary petition in bankruptcy or has an involuntary petition in bankruptcy filed against it that is not dismissed within sixty (60) days; (iii) makes a general assignment for the benefit of creditors; (iv) has a receiver, trustee, or custodian appointed for all or a substantial portion of its assets; or (v) is subject to any proceeding under any bankruptcy, insolvency, reorganization, or similar law that is not dismissed within sixty (60) days.
6.2 Termination for Convenience by Licensee. Licensee may terminate this Agreement for convenience at any time after the end of Year 2 of the Initial Term (i.e., after the second anniversary of the Go-Live Date) upon twelve (12) months' prior written notice to Skybridge and payment of an early termination fee (the "ETF"). The ETF shall be equal to fifty percent (50%) of the remaining Annual Fees that would have been payable by Licensee for the balance of the then-current term (whether the Initial Term or a Renewal Term) had the Agreement not been terminated. For illustrative purposes only: if Licensee delivers a termination for convenience notice effective as of the end of Year 3 of the Initial Term (with two (2) years remaining in the Initial Term), the ETF would be calculated as fifty percent (50%) multiplied by Nine Million Three Hundred Twenty-Five Thousand Dollars ($9,325,000) multiplied by two (2) years, yielding an ETF of Nine Million Three Hundred Twenty-Five Thousand Dollars ($9,325,000). The ETF shall be payable within thirty (30) days of the effective date of termination. The Parties acknowledge that the ETF represents a reasonable pre-estimate of Skybridge's damages and is not a penalty.
6.3 Termination for Chronic SLA Failure. Notwithstanding any other provision of this Agreement, Licensee shall have the right to terminate this Agreement upon sixty (60) days' written notice to Skybridge if Platform availability (as measured in accordance with Exhibit A) falls below ninety-eight percent (98.0%) in three (3) of any consecutive six (6) calendar months. In the event of termination pursuant to this Section 6.3, no ETF shall be payable by Licensee, and Skybridge shall refund prepaid fees allocable to the post-termination period in accordance with Section 6.6.
6.4 Termination for Regulatory Event. Licensee may terminate this Agreement upon ninety (90) days' written notice to Skybridge if a federal banking regulator (including but not limited to the OCC, the Federal Reserve, or the FDIC) issues a material adverse finding, enforcement action, formal or informal supervisory action, consent order, cease-and-desist order, or similar regulatory determination relating to the Platform, Skybridge's services under this Agreement, or Skybridge's fitness to serve as a technology service provider to Licensee. In the event of termination pursuant to this Section 6.4, no ETF shall be payable by Licensee, and Skybridge shall refund prepaid fees allocable to the post-termination period in accordance with Section 6.6.
6.5 Effect of Termination. Upon the effective date of termination or expiration of this Agreement:
(a) Licensee's right to access and use the Platform shall immediately cease, and Skybridge shall disable Licensee's and all Authorized Users' access credentials;
(b) Skybridge shall perform its data export and deletion obligations in accordance with Article 10;
(c) Licensee shall pay all fees accrued and owing through the effective date of termination, including any applicable early termination fee under Section 6.2;
(d) each Party shall, at the Disclosing Party's election, promptly return or destroy all Confidential Information of the other Party in its possession or control, in accordance with Section 11.5, subject to any regulatory retention requirements and data export rights under Article 10; and
(e) the provisions identified in Section 5.3 shall survive in accordance with their terms.
6.6 Refund of Prepaid Fees. In the event of termination for cause by Licensee under Section 6.1, termination for chronic SLA failure under Section 6.3, or termination for a regulatory event under Section 6.4, Skybridge shall refund to Licensee any prepaid fees allocable to the post-termination period on a pro-rata basis, calculated from the effective date of termination through the end of the period for which such fees were prepaid. Such refund shall be paid by Skybridge within thirty (30) days of the effective date of termination. For the avoidance of doubt, no refund of prepaid fees shall be due in the event of termination for cause by Skybridge or termination for convenience by Licensee under Section 6.2.
ARTICLE 7 — SUPPORT AND MANAGED SERVICES
7.1 Support Services. Throughout the Term, Skybridge shall provide Licensee with ongoing technical support and managed services as described in the Order Form. Support services shall include, without limitation: (a) a dedicated support team for incident management, problem resolution, and service request fulfillment; (b) access to Skybridge's online support portal for ticket submission, status tracking, and knowledge base resources; (c) telephone and email support during business hours (Monday through Friday, 8:00 AM to 8:00 PM Eastern Time, excluding federal holidays); (d) twenty-four (24) hours per day, seven (7) days per week ("24/7") critical incident support for Severity 1 issues; and (e) ongoing system monitoring, performance optimization, and proactive alert management. The annual support and managed services fee is One Million Eight Hundred Thousand Dollars ($1,800,000) per year, payable as part of the Annual Fees in accordance with Section 4.1.
7.2 Service Levels. Skybridge's support services are subject to the service levels and incident response time commitments set forth in Exhibit A (Service Level Agreement), which are incorporated herein by reference and summarized as follows:
(a) Severity 1 (Platform Down / Critical Business Impact): Acknowledgment within fifteen (15) minutes; first response within one (1) hour; resolution target of four (4) hours. Severity 1 incidents are those in which the Platform is completely unavailable or a critical production function is inoperable, resulting in a material impact on Licensee's ability to conduct its compliance operations.
(b) Severity 2 (Major Feature Impaired / Significant Business Impact): Acknowledgment within thirty (30) minutes; first response within two (2) hours; resolution target of eight (8) hours. Severity 2 incidents are those in which a major feature or function of the Platform is significantly impaired or degraded, but a workaround may be available.
(c) Severity 3 (Minor Impact / Low Business Impact): Acknowledgment within four (4) hours; first response within one (1) business day; resolution target of five (5) business days. Severity 3 incidents are those involving minor issues, cosmetic defects, or documentation errors that do not materially affect Platform functionality.
Skybridge shall assign severity levels in good faith in consultation with Licensee. In the event of a disagreement regarding the appropriate severity level for an incident, Licensee's reasonable classification shall prevail, subject to subsequent good-faith review and reclassification by the Parties.
7.3 Updates and Upgrades. During the Term, Skybridge shall make available to Licensee, at no additional charge, all updates, patches, bug fixes, maintenance releases, and version upgrades to the Platform that are generally released by Skybridge to its customer base. Skybridge shall provide Licensee with reasonable advance notice of any major version upgrades, including release notes describing new features, changes, and any known issues. Skybridge shall ensure that all updates and upgrades are backward-compatible with Licensee's existing configurations and integrations, or, in the event that backward compatibility cannot be maintained, Skybridge shall provide Licensee with at least sixty (60) days' advance notice and reasonable migration assistance.
7.4 Scheduled Maintenance. Skybridge shall perform all scheduled maintenance during the Scheduled Maintenance Window, which is Saturdays from 2:00 AM to 6:00 AM Eastern Time, for a maximum of four (4) hours per week. Skybridge shall provide Licensee with at least forty-eight (48) hours' advance written notice (via email to Licensee's designated technical contact) of all scheduled maintenance activities, including a description of the work to be performed and the expected duration. Downtime during the Scheduled Maintenance Window shall not count against the Platform availability target under the SLA. In the event that Skybridge determines that emergency maintenance is required outside of the Scheduled Maintenance Window to address a critical security vulnerability or system stability issue, Skybridge shall provide Licensee with as much advance notice as is reasonably practicable under the circumstances and shall use commercially reasonable efforts to minimize the duration and impact of such emergency maintenance.
ARTICLE 8 — SERVICE LEVEL AGREEMENT
8.1 Incorporation. The service level terms applicable to the Platform are set forth in Exhibit A (Service Level Agreement), which is attached hereto and incorporated herein by reference. In the event of any conflict between the provisions of this Article 8 and the provisions of Exhibit A, the provisions of Exhibit A shall control with respect to the specific service level metrics, measurement methodologies, credit calculations, and exclusions set forth therein, and the provisions of this Article 8 shall control with respect to all other matters.
8.2 Platform Availability. Skybridge shall use commercially reasonable efforts to maintain Platform availability of ninety-nine and nine-tenths percent (99.9%) monthly uptime (the "Availability Target"), measured on a calendar-month basis exclusive of downtime occurring during the Scheduled Maintenance Window and any downtime attributable to force majeure events, Licensee's systems or network infrastructure, or Licensee's breach of this Agreement. Platform availability shall be calculated as follows:
Availability % = ((Total Minutes in Calendar Month – Scheduled Maintenance Minutes – Downtime Minutes) / (Total Minutes in Calendar Month – Scheduled Maintenance Minutes)) × 100
Note to Meridian: Skybridge's initial position is 99.9% monthly uptime. Meridian's position as communicated in preliminary discussions is 99.95% monthly uptime. This remains an open negotiation point.
8.3 SLA Credits. In the event that Skybridge fails to meet the Availability Target in any calendar month, Licensee shall be entitled to receive service level credits ("SLA Credits") as set forth in the credit schedule in Exhibit A. SLA Credits shall be calculated as a percentage of the applicable monthly subscription fee (i.e., the Annual Fees, excluding the Implementation Fee, divided by twelve (12)) based on the degree to which actual availability falls below the Availability Target. The credit schedule is as follows:
8.4 Credit Caps. SLA Credits are subject to the following caps:
(a) Monthly Cap: SLA Credits shall not exceed thirty percent (30%) of the applicable monthly subscription fee in any single calendar month. Based on the fee structure set forth in Article 4, the estimated monthly credit caps are: approximately Three Hundred Seventeen Thousand Five Hundred Dollars ($317,500) in Year 1, and approximately Two Hundred Thirty-Three Thousand One Hundred Twenty-Five Dollars ($233,125) in each of Years 2 through 5.
(b) Annual Cap: SLA Credits shall not exceed fifteen percent (15%) of the applicable annual subscription fee in any contract year. Based on the fee structure set forth in Article 4, the estimated annual credit caps are: approximately One Million Nine Hundred Five Thousand Dollars ($1,905,000) in Year 1, and approximately One Million Three Hundred Ninety-Eight Thousand Seven Hundred Fifty Dollars ($1,398,750) in each of Years 2 through 5.
8.5 Sole Remedy. The issuance of SLA Credits as set forth in this Article 8 and Exhibit A, together with Licensee's right to terminate this Agreement for chronic SLA failure under Section 6.3, shall constitute Licensee's sole and exclusive remedy, and Skybridge's sole and exclusive liability, for Skybridge's failure to meet the Availability Target, except in cases of Skybridge's gross negligence or willful misconduct. Nothing in this Section 8.5 shall limit Licensee's rights or Skybridge's obligations under any other provision of this Agreement with respect to claims not arising from a failure to meet the Availability Target.
8.6 Credit Requests. To receive SLA Credits, Licensee must submit a written credit request to Skybridge within thirty (30) calendar days following the end of the calendar month in which the Availability Target was not met. Each credit request shall specify the dates and times of the alleged downtime and any supporting documentation reasonably available to Licensee. Skybridge shall review each credit request and, within fifteen (15) business days of receipt, shall either approve the credit request and apply the approved SLA Credits against the next invoice issued to Licensee, or provide Licensee with a written explanation of its determination that the credit request does not meet the criteria for SLA Credits, including Skybridge's availability data for the applicable month. In the event of a dispute regarding Platform availability during any month, Skybridge's monitoring systems and records shall be the primary source of measurement data, subject to Licensee's right to present its own monitoring data for Skybridge's good-faith consideration.
ARTICLE 9 — DATA SECURITY AND PRIVACY
9.1 Security Obligations. Skybridge shall implement and maintain a comprehensive information security program consisting of administrative, technical, and physical safeguards designed to: (a) ensure the security, confidentiality, integrity, and availability of Licensee Data; (b) protect against any anticipated threats or hazards to the security or integrity of Licensee Data; (c) protect against unauthorized access to or use of Licensee Data that could result in substantial harm to Licensee or any of its customers; and (d) comply with the requirements of the Gramm-Leach-Bliley Act, the Interagency Guidelines Establishing Information Security Standards, and all other applicable federal and state data security laws and regulations. Skybridge's security obligations are further described in Exhibit B (Security Exhibit) and Exhibit C (Data Processing Addendum), each of which is incorporated herein by reference.
9.2 Security Certifications. Skybridge shall obtain and maintain throughout the Term the following security certifications and audit reports:
(a) SOC 2 Type II Report: Skybridge shall maintain a current SOC 2 Type II report (Service Organization Control report) covering the Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy, as applicable, issued by an independent third-party auditor. The SOC 2 Type II audit shall be conducted annually, and Skybridge shall provide Licensee with a copy of each SOC 2 Type II report within thirty (30) days of issuance. Skybridge's current SOC 2 Type II report is dated March 15, 2025, and was issued by Crestfield Cyber Advisors, Inc.
(b) ISO 27001 Certification: Skybridge shall maintain ISO/IEC 27001 certification for its information security management system covering the Platform and related operations. Recertification shall be obtained on a triennial basis, with annual surveillance audits conducted in the interim years. Skybridge shall provide Licensee with a copy of its ISO 27001 certificate and the results of any surveillance audits upon request. Skybridge's current ISO 27001 certificate is dated January 22, 2025, and was issued by Crestfield Cyber Advisors, Inc.
In the event that Skybridge's SOC 2 Type II report or ISO 27001 certification lapses, is revoked, or contains a qualified opinion or material finding, Skybridge shall promptly notify Licensee and shall use commercially reasonable efforts to remediate any identified deficiencies and obtain a renewed or unqualified report or certification within ninety (90) days.
9.3 Encryption Standards. Skybridge shall encrypt all Licensee Data as follows:
(a) Data at Rest: All Licensee Data stored within the Platform, databases, backups, and archival storage shall be encrypted using the Advanced Encryption Standard with a key length of 256 bits (AES-256) or a substantially equivalent or stronger encryption standard.
(b) Data in Transit: All Licensee Data transmitted between Licensee's systems and the Platform, and between components of the Platform, shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher.
(c) Key Management: Encryption keys shall be managed using Skybridge-managed hardware security modules (HSMs) in accordance with industry best practices. Skybridge shall offer Licensee the option to implement a bring-your-own-key ("BYOK") arrangement, under which Licensee retains control of its encryption keys while Skybridge manages the Platform infrastructure. The terms and conditions of any BYOK arrangement shall be as mutually agreed by the Parties.
9.4 Data Residency. All Licensee Data shall be stored, processed, and maintained exclusively within the continental United States. Skybridge's primary infrastructure provider for the Platform is Orion Cloud Services, Inc. Licensee Data shall be hosted in Orion Cloud Services, Inc.'s US-East (Virginia) and US-West (Oregon) regions. Skybridge shall not store, process, transfer, or otherwise make Licensee Data accessible outside the continental United States without Licensee's prior written consent. In the event that Skybridge desires to change its data center locations or infrastructure provider, Skybridge shall provide Licensee with at least ninety (90) days' prior written notice and shall not proceed with such change without Licensee's prior written consent if such change would result in Licensee Data being stored or processed outside the continental United States.
9.5 Penetration Testing. Skybridge shall engage a qualified, independent third-party security firm to conduct penetration testing of the Platform at least once per calendar year. The scope of such testing shall include, at a minimum, application-layer vulnerability assessment, web application testing, and API security testing. Skybridge shall provide Licensee with an executive summary of the results of each penetration test within thirty (30) days of completion, including a description of any identified vulnerabilities and the remediation plan and timeline for each. In addition to Skybridge's own penetration testing program, Licensee may conduct its own annual penetration test of the Platform at Licensee's sole expense, subject to the following conditions:
(a) Application-layer testing may be conducted by Licensee upon at least fifteen (15) business days' prior written notice to Skybridge, coordination with Skybridge's security team, and execution of Skybridge's standard penetration testing agreement;
(b) Infrastructure-layer testing (including testing of Skybridge's or Orion Cloud Services, Inc.'s underlying network, server, and storage infrastructure) shall require Skybridge's prior written consent, which shall not be unreasonably withheld but may be conditioned on reasonable scope limitations, scheduling requirements, and the execution of appropriate confidentiality and liability agreements.
Note to Meridian: Skybridge's initial position is that Licensee's penetration testing is limited to application-layer testing, with infrastructure-layer testing requiring Skybridge's prior written consent. Meridian has requested the right to conduct both application-layer and infrastructure-layer testing. This remains an open negotiation point.
9.6 Audit Rights. Licensee (or its designated independent third-party auditor, subject to reasonable confidentiality obligations) shall have the right to audit Skybridge's security controls, practices, and compliance with this Agreement and the Security Exhibit once per calendar year, upon not less than thirty (30) business days' prior written notice to Skybridge. Skybridge may satisfy Licensee's audit request by delivering to Licensee: (a) Skybridge's then-current SOC 2 Type II report; (b) Skybridge's then-current ISO 27001 certificate; and (c) a completed supplemental Security Assessment Questionnaire in a form reasonably acceptable to Licensee. If, after reviewing the foregoing materials, Licensee reasonably determines that an on-site audit is necessary based on a material security concern, a Security Incident, or a deficiency identified in the SOC 2 report, ISO 27001 certificate, or Security Assessment Questionnaire, Licensee may conduct an on-site audit of Skybridge's relevant facilities, systems, and records, subject to reasonable scheduling, scope limitations, and confidentiality requirements. Skybridge shall cooperate fully with any such audit and shall provide reasonable access to relevant personnel, systems, records, and facilities. Each Party shall bear its own costs in connection with any audit, except that if an audit reveals a material non-compliance with this Agreement or the Security Exhibit, Skybridge shall bear the reasonable costs of the audit.
9.7 Background Checks. Skybridge shall ensure that all Skybridge employees, contractors, and agents who have access to Licensee Data or to systems used to process, store, or transmit Licensee Data undergo background checks prior to being granted such access. Background checks shall be consistent with the standards set forth in the Federal Financial Institutions Examination Council (FFIEC) guidelines, including criminal history checks, employment verification, and, where applicable, credit checks. Skybridge shall maintain records of such background checks and shall make such records available for regulatory examination upon request.
9.8 Security Incident Notification. Skybridge shall notify Licensee of any confirmed Security Incident affecting Licensee Data as promptly as practicable, and in any event within twenty-four (24) hours of Skybridge's discovery or reasonable determination that a Security Incident has occurred. Such notification shall be provided to Licensee's designated security contact (as identified in the Order Form or as otherwise communicated in writing by Licensee) by telephone and in writing (via email with confirmation), and shall include the following information, to the extent known at the time of notification:
(a) the nature and scope of the Security Incident, including the categories of data and records affected;
(b) the specific Licensee Data affected or reasonably believed to have been affected;
(c) the remediation steps that have been taken or are planned to contain and resolve the Security Incident;
(d) the measures being implemented to prevent recurrence; and
(e) a designated point of contact at Skybridge for ongoing communication regarding the Security Incident.
Skybridge shall provide supplemental updates to Licensee as additional information becomes available, and shall cooperate fully with Licensee in investigating and remediating the Security Incident. Skybridge shall not make any public statement regarding a Security Incident affecting Licensee Data without Licensee's prior written consent, except as required by applicable law.
Note to Meridian: Skybridge's initial position is twenty-four (24) hours for Security Incident notification. Meridian has demanded a twelve (12)-hour notification window. This remains an open negotiation point.
9.9 Data Processing. The processing of Licensee Data by Skybridge shall be governed by the Data Processing Addendum (Exhibit C), which is incorporated herein by reference. Without limiting the generality of the DPA, Skybridge acknowledges that Licensee Data may include: (a) data classified as "Confidential" and "Highly Restricted" under Licensee's data classification policy; (b) Non-Public Personal Information subject to the Gramm-Leach-Bliley Act; and (c) Personally Identifiable Information subject to applicable federal and state privacy laws. Skybridge shall process Licensee Data solely as necessary to perform its obligations under this Agreement and as instructed by Licensee, and shall not process, access, use, or disclose Licensee Data for any other purpose, including for Skybridge's own business purposes, except as expressly permitted by Section 15.3 (Aggregated/De-Identified Data).
9.10 Subprocessors. Skybridge shall not engage

MASTER SOFTWARE-AS-A-SERVICE AGREEMENT

SKYBRIDGE FINTECH LTD.

MERIDIAN NATIONAL BANK, NATIONAL ASSOCIATION

PREAMBLE

Record

Parties

Dates

Amounts