Luma Financial Technologies — Integration Playbook

---

How to Use This Playbook

This playbook governs all post-close integration activity — from Day 1 readiness through to the 12-month post-merger review. It is read alongside the M&A Strategy Playbook (which covers everything up to and including deal close) and the relevant Case Study playbook for the specific deal.

Companion playbooks:

• M&A Strategy Playbook — pre-close strategy, gates, DD, governance
• CANNEX Case Study / GenTwo Case Study — deal-specific integration parameters

Section numbers are preserved from the master framework. References to Section 6 (kill criteria) or Section 7 (governance) refer to the M&A Strategy Playbook.

---

Section 1 — Integration Planning

What happens after we sign? How do we avoid destroying the value we paid for?

1.1 Integration Management Office (IMO)

Completed: Virtual Boardroom session, 2026-04-21. Quick format — M&A Advisor, CTO, CFO, GC.

Reporting line: CEO (not COO). The IMO sits directly under the CEO. M&A integration failure is an existential risk at Luma's scale — it cannot be buried in operations. The CEO must personally own accountability for the two hires below.

---

VP Corporate Development

Profile: Hybrid banker-operator — someone who has both executed M&A transactions and managed post-close integration. Not a pure banker. Not a pure PM. This role must hold deal credibility with founders AND execution credibility with engineers.

30-day mandate (once hired):

1. Review CANNEX DD materials and flag any gaps
2. Align M&A legal counsel on transaction structure
3. Meet CTO and future Integration PM to define handoff protocol
4. Present Gate 1 recommendation to M&A Committee

---

Integration PM

Profile: Senior Technical Programme Manager — NOT an engineer. Must be technically fluent (can read API contracts, understand data migration risk, challenge engineers on timelines) but their job is programme delivery, not code. This is the single most time-sensitive hire in the M&A programme. The integration cannot start without them.

30-day mandate (once hired):

1. Build the Day 1 runbook (see Section 1.2)
2. Define the KPI dashboard and reporting cadence
3. Map all Luma systems that will interface with acquired platforms
4. Establish cross-functional communications cadence with CTO, CFO, GC, CMO

---

External Integration Advisor (CANNEX only)

For CANNEX specifically — where Luma has no prior acquisition experience — a fractional external advisor is warranted as a coaching layer. This is NOT an executor. This is someone who has run 5–10 SaaS integrations and can challenge the Integration PM's assumptions.

---

Day 1 Integration Brief

Before close, VP Corp Dev produces a 5–10 page Day 1 Integration Brief covering: deal rationale recap, integration thesis, top 5 risks, key person map, critical systems list, and first-week priorities. This brief is the formal handoff document.

Day 1 handoff meeting: 2-hour structured meeting within 4 hours of close. Attendees: VP Corp Dev, Integration PM, CTO, CEO. Agenda: brief walkthrough, risk flag review, authority assignments, comms plan sign-off.

Pre-close dry run: 2 weeks before CANNEX close, Integration PM runs a tabletop readiness exercise with all function leads (CTO, CFO, GC, CMO, CS Lead). The exercise tests: "If we closed tomorrow, what would break in the first 24 hours?" Any gaps identified must be resolved before close — not patched on Day 1.

1.2 Pre-Close: Day 1 Readiness Checklist

Completed: Virtual Boardroom session, 2026-04-21. Quick format — M&A Advisor, CTO, CFO, GC.

This checklist must be completed and signed off by each function lead BEFORE close. The Integration PM owns the master checklist. Any item marked incomplete at close is a Red flag — the CEO must decide whether to delay close or accept the risk explicitly.

---

Systems & Infrastructure (Owner: CTO)

• Repository access transferred and permissions audited
• Cloud infrastructure (DNS, CDN, SSL certificates) transfer plan confirmed with vendor contacts identified
• CI/CD pipeline documentation received and reviewed
• Monitoring and alerting live on Luma's infrastructure visibility tools
• Credential rotation plan in place — all acquired system credentials rotated within 48 hours of close
• Backup and disaster recovery verified and tested (not assumed)
• Incident response protocol and on-call rotation defined for acquired systems from Day 1

---

Engineering & People (Owner: CTO + Integration PM)

• 2–3 Luma engineers formally assigned to integration; notified and briefed
• Acquired engineering team onboarding pack ready (systems access, tools, Slack, wiki)
• Day 1 all-hands meeting scheduled within 4 hours of close (virtual OK)
• First-week technical assessment plan in place (not a sprint — an audit)
• Retention agreements for key engineers signed at or before close
• 72-hour deployment freeze in effect from close — no production deployments by acquired team without CTO sign-off

---

Legal & Compliance (Owner: GC)

• IP assignment agreements executed (patents, trademarks, code ownership)
• Employment continuity documented: offer letters issued or employment continuation notices served
  • GenTwo specifically: Swiss Art. 333 CO automatic transfer confirmed; consultation period completed if applicable
• Banking and signatory control transferred (acquired company bank accounts, authorised signatories updated)
• Insurance policies updated: D&O, cyber liability, professional indemnity — coverage confirmed from Day 1
• Customer contract notice obligations identified; any required notifications prepared for dispatch
• All NDAs and confidentiality obligations from DD process catalogued
• Regulatory filing calendar in place (any change-of-control notifications required)
• Data processing agreements reviewed; GDPR/data transfer obligations confirmed

---

Finance & Operations (Owner: CFO)

• Payroll confirmed: either migrated to Luma's payroll system OR transition plan in place with confirmed timeline
  • GenTwo specifically: Swiss payroll provider confirmed; first pay run date locked
• Vendor payment obligations mapped; no gaps in critical vendor relationships on Day 1
• Chart of accounts mapped to Luma's GL structure
• Working capital / locked-box mechanism activated; opening balance sheet agreed
• Integration budget loaded into financial systems with GL codes assigned; first tracking period begins Day 1

---

Customer & Commercial (Owner: VP Corp Dev + CMO)

• Day 1 customer communication drafted and approved: CEO-signed letter to all acquired customers, dispatched within 24 hours of close
• Customer Success team briefed on top 10 accounts — no customer should hear about the deal first from a press release
• Hard freeze on pricing changes: no price increases, renegotiations, or contract changes for 90 days post-close
• Sales team aligned on in-flight deals at acquired company — no disruption to pipeline in first 30 days
• Escalation path for any customer complaint in first 30 days defined (direct to VP Corp Dev, not to acquired team alone)

1.3 Phased Integration Plan (Template)

1.4 KPI Checkpoints

1.5 Integration Capacity Policy

• Maximum concurrent integrations: 2 (1 heavy + 1 light)
• Hard rule: No new deal signing while any active integration is in red status
• CANNEX is the training run — do not commit to GenTwo until CANNEX Day 90 milestone is met
• Engineering bandwidth rule: If integration consuming >20% of total engineering capacity, pause new deals
• Must hire 6–8 additional engineers BEFORE first deal closes

1.6 Integration Budget (Separate from Acquisition Price)

Completed: Virtual Boardroom session, 2026-04-21. Quick format — M&A Advisor, CTO, CFO, GC.

Budget by deal:

Programme total: $8.8–14.4M across all three Phase 1 integrations (including ~$1.2–2.4M for Priority 3 TBD). At the low end the $10M reserve covers the programme; at the high end it falls ~$4.4M short — confirming the venture debt facility ($10–15M undrawn) is necessary insurance. If CANNEX integration costs trend high, Luma draws on the facility before committing to GenTwo LOI.

Approval governance:

• Gate 2 (pre-LOI): Integration PM presents preliminary budget estimate. CFO validates against reserve capacity. M&A Committee approves a budget range. Budget is set here — not Gate 5
• Gate 3 (post-DD): Confirmed integration budget based on DD findings. CFO approves final number. This becomes the baseline for Gate 5 cost tracking and the 150% Red trigger
• Post-close tracking: Integration PM tracks spend weekly for first 60 days (shifting to monthly if Green at Day 60). CFO receives weekly budget vs actual for first 60 days — monthly reporting is too slow for the critical early integration period
• Contingency access: Integration PM can access contingency up to 10% of total without additional approval. Beyond 10% requires M&A Committee approval. Beyond 20% (full contingency) requires board notification

Gate 5 interface: Gate 5 Red trigger is integration costs >150% of the confirmed Gate 3 budget. Integration PM and CFO jointly track cost-to-complete at Day 30, Day 60, and Day 90. If cost-to-complete is trending toward 150% at Day 60, early warning goes to M&A Committee — do not wait for Day 90.

1.7 Escalation Path When Integration Goes Off-Track

Completed: Virtual Boardroom session, 2026-04-21. Quick format — M&A Advisor, CTO, CFO, GC.

Status framework:

Who calls it:

• Any one person can trigger Amber: Integration PM, CTO, VP Corp Dev, or CFO. Single voice sufficient — prevents red flags requiring consensus before escalation
• Red requires dual confirmation: Integration PM declares Red on KPI data; CTO confirms if trigger is technical; CFO confirms if trigger is financial. Exception: CTO can unilaterally declare technical Red, CFO can unilaterally declare financial Red (consistent with their veto authority in Section 6)
• CEO cannot downgrade Red to Amber — only the person who declared Red can downgrade, and only after the remediation plan has been executed and KPIs have recovered

Intervention menu (escalating order):

Board escalation threshold: Red at Day 90 = CEO must present a remediation plan to the board within 1 week. Red persisting at Day 120 = board takes decision authority. This is mandatory per the M&A Policy Resolution (Section 6.3).

Legal exposure during Red (GC):

• Earnout risk: If integration failure is partly Luma's fault (e.g. Luma failed to provide promised API access), sellers can claim implied covenant of good faith breach. Mitigation: earnout acceleration clause (Section 4.2) protects sellers and removes Luma's incentive to undermine integration
• Employment risk (GenTwo): Swiss employment law requires consultation periods and severance for integration-related redundancies. Budget for this in GenTwo contingency — it is not optional
• Customer risk: Integration disruption may allow customers to invoke termination clauses. Mitigation: the Day 1 freeze on customer-facing changes (Section 1.2) and 90-day pricing freeze reduce this risk in the critical early window

---

Section 2 — People & Organisation

How do we keep the people we paid for? How do we restructure without destroying morale?

2.1 Retention Package Framework

Principle: Retention agreements must be locked in writing BEFORE closing, not after. Verbal commitments during diligence are not enforceable and are routinely dishonoured post-close.

Who qualifies for a retention package:

• Founder/CEO of acquired company (always — they hold relationship capital)
• CTO or lead engineer with >30% of critical code commits
• Top 3 salespeople by revenue contribution
• Any individual with direct carrier, custodian, or strategic partner relationships that cannot be replicated

Standard package structure (from TB/AG strategy docs):

• Cash retention: 50–75% of annual compensation, paid in two tranches (50% at close, 50% at Month 18)
• Equity roll-over: 10–30% of acquisition consideration in Luma equity, 2-year cliff vest
• Earnout participation: 5–15% of earnout pool reserved for key employees (aligns incentives)
• Clawback: Full clawback if employee resigns within 12 months; 50% clawback months 12–24

Target retention rate: ≥90% of identified key persons through Month 18.

Known key persons (Luma side — pre-acquisition):

• David Wood (EMEA/APAC Engineering lead) — key-person risk flag
• Donald Pogan (Platform/CPO equivalent) — key-person risk flag
• Jeff Schwantz (CCO) — critical for cross-sell activation

[ BOARDROOM TO COMPLETE: specific compensation benchmarking vs. iCapital; equity structure for Swiss targets under Swiss employment law ]

2.2 Key Person Identification

Definition: A "key person" is anyone whose departure within 18 months would materially impair one or more of: (a) product capability, (b) customer relationships, (c) carrier/regulatory relationships, or (d) the earnout thesis.

Identification process (during DD):

1. Commit concentration analysis (CTO leads): Git blame / commit history review. Any engineer with >30% of critical codebase commits is a key person — single-engineer dependency is a platform risk.
2. Revenue concentration analysis (VP Corp Dev leads): Map top 10 customers by revenue to named relationship owners inside the target. If >50% of revenue traces to relationships held by ≤3 people, all 3 are key persons.
3. Founder dependency audit: Does the founder hold contractual relationships with carriers/clients that are personally dependent? Do they carry regulatory standing (e.g. FINMA registration, FCA CF30 approval) that must transfer to Luma post-close?
4. Reference check methodology: Ask top customers directly — "Who at [Target] do you work with most? What would change if they left?" This surfaces key persons the target company may not volunteer.

Known key persons — Luma (internal):

Known key persons — Targets (confirmed during DD):

Departure protocol: If a key person departs within the first 12 months post-close, Integration PM triggers immediate escalation to CEO and VP Corp Dev within 24 hours. A replacement or risk mitigation plan is required within 30 days of departure — no exceptions.

2.3 Org Design Options Post-Close

Three models, selected by deal type:

Model A — Full Integration (12–18 months)

• When: Technology tuck-ins where the product is absorbed into Luma's platform (e.g. CANNEX data layer)
• Structure: Acquired team folds into Luma org chart. Acquired brand retired at Month 12.
• Risk: Cultural friction, talent attrition if moved too fast
• Mitigation: 6-month "Protect Innovation" period before org restructure

Model B — Majority Stake with Local Management Retained (24 months)

• When: Regional platforms with strong local management and distribution (e.g. GenTwo EMEA)
• Structure: Luma owns 60–80%, management retains 20–40% equity. Local CEO stays. Luma provides platform and distribution, local team operates market.
• Risk: Misaligned incentives if earnout milestones not well-designed
• Mitigation: Clear milestone-based earnout; quarterly steering committee with Luma CCO

Model C — Strategic Partnership with Acquisition Option (12–24 months)

• When: Market entry testing where full acquisition risk is unacceptable (APAC)
• Structure: Revenue share + convertible equity stake. Option to acquire at pre-agreed multiple.
• Risk: Partner may receive competitive offer from iCapital or Halo; option may lapse
• Mitigation: Right of first refusal clause; non-compete on competing platform integrations

Decision matrix:

2.4 Engineering Talent Scaling Plan

[ TO BE COMPLETED — Boardroom Session: Engineering Talent Scaling ]

Key questions to address:

• Scaling from 8 to 22+ integration engineers
• Hiring timeline and sequencing
• Compensation benchmarking vs. iCapital
• Retention packages for existing Luma engineering leadership
• Recruitment strategy — build pipeline before first deal, not after

2.5 Communication Plan (Sequenced)

Mandatory communication sequence — do not deviate:

1. Employees first — acquired company staff, same day as close, pre-market hours
2. Key customers — top 20 by revenue, same day, personal phone call from acquired company CEO (not email)
3. Luma internal team — same day, before public announcement goes out
4. Press / public announcement — post-market or next business day, after employees and key customers have been personally notified
5. Regulators — as required by jurisdiction and filing timeline (see Section 5.2)

Day 1 announcement requirements:

• Acquired company CEO sends personal note to all staff. Luma CEO joins via live video (30 minutes, open Q&A)
• Integration PM named publicly to acquired team on Day 1 — "here is who owns your integration"
• No redundancy announcements for minimum 90 days — psychological safety is the most important retention tool in the first quarter
• FAQ document prepared pre-close: addresses compensation, benefits, equity vesting, product roadmap, office locations. CMO owns drafting.

Customer communication owner:

• Acquired company CEO delivers message to their own customers (continuity of voice is the priority)
• Luma CCO co-signs for strategic accounts (top 5 by revenue)
• Luma CMO prepares templates and key message framework pre-close
• Do NOT lead with Luma brand in customer communications until Month 3 co-brand phase begins

What NOT to say publicly (pre-Month 3):

• No integration cost figures or headcount changes
• No references to specific synergy targets (creates expectation before it can be delivered)
• No comment on future product roadmap until integration architecture is confirmed at Month 3

2.6 HR Integration Checklist

Pre-close (complete before Day 1):

• Benefits comparison completed — Luma vs. acquired company; identify gaps; plan harmonisation timeline
• Payroll system migration plan agreed — target: single payroll system by Month 3
• Employment law review complete by jurisdiction (US: at-will; CH: Swiss OR Art. 336 notice; UK: statutory notice; EU: local)
• Non-compete enforceability confirmed by jurisdiction — Swiss non-competes require financial compensation (CHF 50–100K for GenTwo founders per agreed deal terms)
• Non-solicitation agreements in place for all key persons
• Retention packages signed (not verbal) before Day 1
• Equity grants processed — 409A valuation for US grants; Swiss tax treatment for GenTwo equity rollover confirmed with tax advisor
• TUPE compliance (UK) or Swiss OR Art. 333 compliance (GenTwo) confirmed by local counsel

Days 1–30:

• All acquired employees onboarded to Luma HRIS system
• HR policy handbook distributed (local language for Swiss/EU staff)
• 1:1 check-ins scheduled for all key persons within first week — Integration PM coordinates
• Org chart updated and published
• Payroll transition timeline communicated to all staff

Days 31–90:

• Benefits harmonisation decision communicated — no benefit reductions without retention package top-up
• First payroll run on Luma system (or confirmed transition date)
• Performance review cycle alignment decided (roll into Luma cycle or keep existing for Year 1)
• Culture pulse survey — qualitative baseline on integration sentiment

Days 91–180:

• Final benefits harmonisation complete
• Single HRIS system live
• Non-compete / non-solicitation enforcement audit — confirm all agreements current and enforceable
• Day 90 retention tranche payments processed for all eligible key persons

---

Section 3 — Technology Integration

How do we combine the tech stacks without breaking either one?

3.1 Technical Integration Architecture Assessment

Written from established board framework and Luma technical context, 2026-04-21.

The architecture assessment is conducted during DD (Week 2–4) and produces a single output: the Technical Integration Architecture Document (TIAD), which must be signed off by the CTO before Gate 3. The TIAD is not a wish list — it is the binding technical commitment the integration plan is built on.

Assessment framework (five dimensions):

TIAD required sections:

1. Current-state architecture diagram (as-built, not aspirational)
2. Target integration architecture (post-integration steady state)
3. Integration sequence and dependencies (what must happen before what)
4. Risk register with severity ratings
5. Effort estimate with confidence interval
6. Hard stop items (anything that would force re-pricing or kill the deal)

CTO sign-off required before Gate 3. If the CTO cannot sign off, Gate 3 does not open.

---

3.2 API Contract Definition Process

The API contract is the technical equivalent of the commercial term sheet. It defines exactly how Luma's PDW2 layer will communicate with the acquired platform — and it must be agreed before the integration sprint begins, not discovered during it.

Step 1 — API discovery (during DD, Week 3):

• Luma's CTO team and acquired engineering lead conduct a joint technical session
• Document all existing APIs: endpoints, request/response formats, authentication, rate limits, error handling
• Identify gaps: what data Luma needs that is not currently exposed via API

Step 2 — PDW2 integration specification (Days 31–60 post-close):

• Luma's integration engineers draft the PDW2 adapter specification
• Defines: data models, transformation logic, field mappings, latency SLAs, error/retry behaviour
• Acquired engineering team reviews and flags any structural blockers

Step 3 — Contract lock (Day 60):

• API contract formally signed off by CTO (both sides)
• Becomes the baseline for the Days 61–90 integration build
• Any deviation from the contract after Day 60 requires CTO approval and Integration PM assessment for schedule impact

PDW2 integration principles:

• All acquired data must be accessible via PDW2's unified data layer — no direct platform-to-platform integrations that bypass PDW2
• Backward compatibility: Luma does not break existing advisor/issuer API contracts during integration
• Versioning: acquired APIs frozen at current version for 90 days post-close; deprecation schedule agreed at Day 60

For CANNEX specifically: The annuity pricing calculation engine may need to remain partially standalone (not fully migrated to PDW2) if real-time pricing latency cannot be met via API relay. The CTO must assess whether a direct integration or a PDW2 adapter is the right architecture — this decision must be made at Day 60, not deferred.

For GenTwo specifically: SP product catalogue data (EMEA issuers, term sheet data, ISIN-level product data) must map cleanly to Luma's existing SP data model. The likely integration point is PDW2's product ingestion layer. Confirm whether GenTwo's data model supports Luma's multi-issuer objectivity principle (no issuer-specific proprietary lock-in in the data layer).

---

3.3 Data Migration Methodology

Data migration is the highest-risk technical workstream. The rule: never migrate and integrate simultaneously. Complete the data migration first, validate, then integrate platform functionality.

Migration phases:

Data quality pre-conditions:

• No migration starts until data quality score ≥90% (assessed during DD)
• If data quality <90%, the seller is contractually required to remediate before close (build into purchase agreement)
• PII data: GDPR/CCPA compliance must be confirmed for any customer data migrating to Luma systems. GC signs off before PII migration begins

CANNEX data specifics:

• Annuity rate tables: structured, high-value, relatively small volume — migration risk is low but validation is critical (pricing errors are financially material)
• Carrier relationship data: confirm all carrier consent requirements for data portability

GenTwo data specifics:

• EMEA SP product data: likely larger volume, more complex schema (multi-currency, multi-jurisdiction)
• Swiss data residency: confirm whether Luma's cloud infrastructure supports Swiss data residency or whether GenTwo data must remain EU-hosted post-integration
• FINMA implications: GC must confirm whether customer data migration triggers any regulatory notification obligations

---

3.4 CI/CD Unification Approach

Do not force immediate CI/CD unification. Premature pipeline merging is a leading cause of integration-induced outages. The approach is phased: stabilise, align, then unify.

Phase 1 — Freeze and stabilise (Days 0–30):

• 72-hour deployment freeze from close (no production deployments by acquired team without CTO sign-off)
• Acquired team keeps their existing CI/CD pipeline — do not touch it
• Luma's integration engineers shadow the acquired deployment process
• Document: pipeline tooling, build triggers, environment structure, release cadence

Phase 2 — Align (Days 31–90):

• Introduce Luma's code quality gates into the acquired pipeline (linting, test coverage thresholds, security scanning)
• Do NOT force tool migration yet — add Luma's gates as overlays on their existing tooling
• Begin aligning branching strategies (agree on naming conventions, PR review requirements)
• Set up shared monitoring: acquired system metrics visible on Luma's observability stack

Phase 3 — Unify (Days 91–180):

• Migrate acquired team to Luma's CI/CD toolchain (only after Phase 2 alignment is stable)
• One pipeline, one set of gates, one deployment process
• Acquired team's release cadence normalised to Luma's release cadence

Non-negotiables from Day 1:

• Security scanning (SAST/DAST) active on all acquired code from Day 1
• No deployment to production without passing security scan — no exceptions
• Luma's vulnerability management SLAs apply to acquired systems immediately: critical CVE patched within 24hr, high within 7 days

---

3.5 Legacy System Sunset Criteria

The acquired standalone system is sunset when — and only when — all three conditions are met:

1. PDW2 is authoritative: All data that was in the standalone system is now live in PDW2 and validated (Section 3.3 migration complete)
2. Zero active dependencies: No customer, integration, or internal workflow is pointing at the standalone system. Confirmed by dependency mapping (not assumed)
3. Rollback window elapsed: 30-day monitoring period after cutover with no data integrity issues, no customer escalations, and uptime ≥99.9%

Sunset is not the same as deletion. Archived snapshots of the acquired system are retained for 12 months post-sunset minimum (longer if required by regulatory obligations). GC confirms the retention period.

Earned right to sunset: The Integration PM must table a formal sunset proposal to the M&A Committee. The proposal must include: dependency mapping confirming zero active dependencies, data reconciliation report, customer communication log, and GC sign-off on regulatory retention requirements.

What cannot be sunset early:

• Any system that has a regulatory record-keeping obligation (GC determines)
• Any system with an active earnout calculation dependency (VP Corp Dev determines)
• Any system where customers have been contractually promised continuity (CMO/CS determines)

For CANNEX: Annuity rate calculation engine may remain partially operational longer than other systems if the PDW2 adapter is not achieving equivalent pricing latency. CTO sets the sunset date for CANNEX engine — not the general 180-day template.

---

3.6 IP Transfer and Ownership Confirmation

Primary owner: GC, with CTO technical audit.

IP transfer is a Day 1 legal completion item. If IP has not transferred cleanly at close, the deal has not completed cleanly. GC is responsible for confirming transfer before the close checklist is signed off.

Code and software IP:

• Assignment of all code, algorithms, and software IP from founders and employees to the acquired entity (and then to Luma) — confirm all employment contracts include IP assignment clauses
• Contractor IP: any code written by contractors must have an explicit IP assignment agreement. Contractor code without clear IP assignment is a red flag — requires seller remediation pre-close or escrow arrangement
• Open-source licence audit: CTO conducts a licence scan (using automated tooling, e.g. FOSSA or Black Duck) during DD. Any copyleft licences (GPL, AGPL) that could contaminate Luma's proprietary codebase must be identified and a remediation plan agreed before close

Data IP and proprietary datasets:

• Confirm ownership of all proprietary datasets (pricing data, carrier data, product data) — these are frequently the most valuable IP in a fintech acquisition
• For CANNEX: confirm that annuity pricing data is owned by CANNEX, not licensed from a third party that would restrict Luma's use
• Data licence agreements: map all third-party data licences and confirm they are transferable to Luma. Any non-transferable licence is a deal risk — flagged at Gate 2 and priced accordingly

Patents and trademarks:

• Patent register: identify any filed or granted patents. Confirm they are assigned to the acquired entity
• Trademarks: confirm brand trademarks transfer with acquisition (relevant primarily for GenTwo's EMEA brand)

Employee IP confirmations:

• All key engineers sign updated IP assignment agreements at close (or confirm existing agreements are sufficient)
• For GenTwo: Swiss employment law applies — GC confirms Swiss IP assignment requirements are met

Post-close IP hygiene (first 30 days):

• CTO commissions a full codebase review of any IP ambiguities flagged during DD
• Any unresolved IP issues escalate to GC within 30 days — not deferred to the next gate

3.7 Security Audit Requirements Pre-Close

Hard technical kill criteria (from agreed integration playbook):

• Unpatched CVE 9+ vulnerabilities → deal killed
• No API layer → deal killed
• <20% test coverage + no CI/CD → deal killed

• 50% single-engineer commit concentration → escalate immediately

3.8 AI Strategy & Data Moat

[ TO BE COMPLETED — Boardroom Session: AI Strategy & Data Moat ]

Key questions to address:

• Does PDW2 architecture support ML training on proprietary SP/annuity data?
• Is the M&A strategy generating the data assets needed for defensible AI models?
• How does Luma's Aladdin integration ($300B+ SP data) feed into model training?
• What does iCapital's AI investment look like and where is Luma's counter-strategy?
• Data ownership, GDPR, and IP implications of training on acquired datasets

---

Section 4 — Commercial & GTM Integration

How do we protect customers, activate cross-sell, and migrate brands without losing revenue?

4.1 Customer Communication Playbook

[ TO BE COMPLETED — Boardroom Session: Customer Retention During Integration ]

Key questions to address:

• Day 1 announcement structure and tone
• 30-day follow-up protocol
• Who owns customer communication — acquired company CEO or Luma?
• Change-of-control consent requirements (which contracts require customer approval?)

4.2 Brand Migration Strategy

Standard three-phase approach:

Target-specific exceptions:

• CANNEX: Accelerated migration — data brand is less customer-facing than a product brand. CANNEX name may persist in B2B contexts (carrier relationships) even post-platform integration if it carries relationship value.
• GenTwo: Extended co-brand — EMEA relationships are brand-dependent. "GenTwo, powered by Luma" for 12 months before full migration. Assess at Month 12 whether the GenTwo brand in Geneva/Zurich carries ongoing commercial value; may persist permanently in the CH market.
• Acqui-hire (Priority 3 TBD): Typically rapid retirement — minimal brand equity. Luma-branded product launch within 30 days. Confirm once target is identified.

Trigger for brand migration delay: Any integration NPS score below baseline at the Month 3 checkpoint. Customer trust must be established before brand authority is transferred — do not rush Phase 3 if integration confidence is fragile.

4.3 Cross-Sell Activation Plan

Core opportunity: 300K+ existing Luma SP advisors represent built-in distribution for every acquired capability. Cross-sell is the primary revenue synergy lever — more valuable than any cost savings.

Activation sequence:

1. Month 1–3 (Identify): CCO maps acquired capability to existing Luma advisor segments. Identify the top 500 advisors most likely to adopt early (already active in annuity or life insurance).
2. Month 3–6 (Enable): Acquired product integrated into Luma platform (MVP level minimum — single sign-on, shared data). Train Luma customer success team on new product. Build joint pitch materials.
3. Month 6–12 (Activate): Structured outreach campaign to identified advisor cohort. Jeff Schwantz (CCO) owns the attach rate metric personally.
4. Month 12+ (Scale): Accelerate based on early adopter data. Build full-bundle pricing for advisors using ≥2 Luma-platform products.

Attach rate targets:

Known blockers (address pre-launch):

• Integration instability → advisors will not adopt a product that feels bolted-on; stabilise first
• Separate logins / fragmented UX → SSO integration is a Day 1 technical priority, not a Month 6 nice-to-have
• Sales team incentive misalignment → confirm Luma sales team earns credit for acquired product cross-sells from Day 1
• MFN clauses in existing customer contracts → GC must review all contracts pre-close for pricing provisions that could be triggered by new product bundling (see Section 4.4)

4.4 Pricing & Monetisation Alignment

[ TO BE COMPLETED — Boardroom Session: Post-Acquisition Pricing & Monetisation ]

Key questions to address:

• CANNEX revenue model: data licensing
• GenTwo revenue model: structuring/service fees on AuS
• Luma revenue model: platform subscription/transaction fees
• How do these three models co-exist? Which is the long-term master model?
• MFN (most favoured nation) clauses in existing CANNEX/GenTwo partnership agreements
• Contract assignment protocol — which customer contracts survive change-of-control?
• Unified pricing strategy timeline

4.5 Competitor Poaching Defense

Threat model:

• iCapital will target CANNEX customers and key engineering talent during Luma's integration window. With Hexure integration (March 2026) underway, they will actively pitch "end-to-end" as an alternative to a newly-acquired Luma/CANNEX stack.
• Halo will target EMEA prospects and GenTwo's existing structured products clients during the GenTwo integration period.
• FinIQ is expanding into EMEA — risk of approaching GenTwo EMEA prospects before Luma can activate them.

Defense — customers:

1. Day 1 personal call from acquired company CEO to all strategic accounts (top 20 by revenue) — "nothing changes for you"
2. Lock-in contract extensions pre-close where possible — VP Corp Dev identifies renewal dates during DD and extends 12+ months as part of deal negotiation (sellers are often amenable if framed as a transaction deliverable)
3. Watch list: any customer who was in active dialogue with iCapital or Halo prior to close → Integration PM flags immediately; CCO maintains weekly contact
4. Early win signal: fast-track one visible product improvement or integration within first 60 days — demonstrates that Luma ownership is additive, not disruptive

Defense — engineering talent (acquired company):

1. iCapital and Halo will approach key engineers within 30 days of announcement — treat this as certain, not possible
2. Retention packages must be signed before Day 1 (see Section 2.1) — waiting until after announcement is too late
3. Equity rollover timing: process equity grants without delay — uncertainty about vesting creates receptivity to outside offers
4. CTO schedules 1:1s with all senior engineers within the first two weeks — cultural integration is the most effective retention tool in this window

Early warning system:

• Integration PM reviews acquired company customer usage data weekly for first 90 days — usage decline >10% is an early warning flag requiring immediate customer contact
• Customer success team trained to flag any mention of competitor outreach within 24 hours to Integration PM
• LinkedIn monitoring for acquired company senior talent (VP Corp Dev owns — check weekly for first 90 days)

4.6 NPS Monitoring During Integration

Measurement cadence:

KPI thresholds (aligned with Section 1.4):

• Day 30: NPS ≥ baseline
• Day 90: NPS ≥ baseline — critical checkpoint; gates GenTwo LOI decision
• Day 180: NPS improving vs. baseline

If NPS drops below baseline at any checkpoint:

1. Integration PM escalates to CEO and VP Corp Dev within 24 hours
2. Integration PM + CCO conduct qualitative interviews with top 5 NPS detractors within 48 hours
3. Root cause report to CEO within 7 days with remediation plan and timeline
4. If NPS is ≥5 points below baseline at Day 90 → automatic red status → no new deal signing (hard rule, Section 1.5)

What this NPS is measuring: Customer confidence in Luma's stewardship — not product satisfaction in the abstract. The integration question is: "Do customers trust that the Luma acquisition was good for them?" Survey framing must reflect this; standard product NPS questions will not capture it.

---

Section 5 — Legal & Regulatory Execution

What filings, approvals, and consents do we need? Where are the legal landmines?

5.1 Antitrust and Merger Control

[ TO BE COMPLETED ]

Established positions:

• US horizontal SP acquisitions blocked — 54% share = presumptive monopoly under 2023 DOJ/FTC Merger Guidelines
• Adjacent-market and acqui-hire deals remain possible with antitrust counsel review
• Swiss targets (GenTwo): no merger control below CHF 2B — cleanest path
• EU: assess based on combined turnover thresholds

5.2 Sector-Specific Regulatory Approvals

[ TO BE COMPLETED ]

Known regulatory considerations:

• FINMA (Switzerland) — for any Swiss-regulated entity
• FCA (UK) — for any UK FCA-regulated business
• SEC/FINRA — for any US broker-dealer or RIA involvement
• State insurance regulators — Form A process (3–12 months per state) for carrier acquisitions
• DORA (EU, effective Jan 2025) — 2% turnover penalties, critical third-party risk
• MiFID II/III (March 2026 changes) — applicable to EMEA targets
• PRIIPs — KID requirements for structured products

5.3 Contract Assignment Protocol

[ TO BE COMPLETED ]

Key items:

• Identify change-of-control clauses in all material customer and vendor contracts pre-close
• Customer consent protocol where required
• Supplier contract continuity

5.4 IP Assignment and Protection Post-Close

[ TO BE COMPLETED ]

5.5 Data Privacy Compliance

[ TO BE COMPLETED ]

Key considerations:

• GDPR adequacy for Switzerland (simplifies data flows)
• Banking secrecy — material DD item for Swiss targets
• State-by-state AI regulation (Colorado most aggressive — insurance-specific)
• CCPA for US customer data

5.6 Non-Compete and Non-Solicitation

[ TO BE COMPLETED ]

5.7 Disclosure Obligations

[ TO BE COMPLETED ]

---

---

Section 6 — Reporting & Accountability

How do we know if the programme is working?

6.1 Integration Dashboard (Weekly → Monthly)

[ TO BE COMPLETED ]

6.2 Synergy Tracking

[ TO BE COMPLETED ]

6.3 Board Reporting Template and Cadence

[ TO BE COMPLETED ]

6.4 Escalation Protocol

[ TO BE COMPLETED ]

6.5 12-Month Post-Merger Review

[ TO BE COMPLETED ]

Key question: Did we get what we paid for?

6.6 Lessons Learned and Playbook Updates

[ TO BE COMPLETED ]

---