Extract to table

As discussed in greater detail in Sections III and IV below, the NPI and PII classification of this data triggers specific federal and state regulatory requirements that must be reflected in the MSA, DPA, and Security Exhibit

This statutory examination authority is non-waivable and must be acknowledged in the MSA

The practical significance of this provision is that federal banking regulators may examine Skybridge's operations, security controls, and records at any time in connection with their supervision of Meridian, and the MSA must not contain any provision that would impede or restrict such examination

This requirement is the direct statutory and regulatory basis for the contractual security obligations that must be included in the MSA and DPA

Implications for the MSA Skybridge, as a service provider receiving NPI from Meridian, must contractually commit to maintaining an information security program that meets or exceeds the standards established under the Interagency Guidelines

The MSA and the Data Processing Addendum (Exhibit C) must include the following provisions, at minimum: (a) Safeguards Obligation