ANTI-MONEY LAUNDERING (AML) POLICY V8
ANTI-MONEY LAUNDERING POLICY
VERSION 8.0 | MARCH 2026
GROOVY COMPANY, INC. DBA OTCM PROTOCOL
Wyoming Corporation | CIK: 1499275 | OTC: GROO | 12 Daniel Rd East, Fairfield, NJ 07004
BSA/FinCEN | OFAC | USA PATRIOT Act | Release No. 33-11412 | BOARD APPROVED | CONFIDENTIAL
Field | Value | ||
Document ID | OTCM-POL-AML-001 | ||
Version |
| ||
Effective Date |
| ||
Classification | CONFIDENTIAL | ||
Approved By | Board of Directors | ||
Legal Entity | Groovy Company, Inc. dba OTCM Protocol | ||
Governing Law | Bank Secrecy Act, USA PATRIOT Act, OFAC, FinCEN, Federal Securities Law, New Jersey State Law |
📋 TABLE OF CONTENTS
- Article I: Purpose and Regulatory Framework
Article II: AML Program StructureArticle III: Customer Identification Program (CIP)Article IV: Customer Due Diligence (CDD)Article V: Enhanced Due Diligence (EDD)Article VI: Beneficial OwnershipArticle VII: Transaction MonitoringArticle VIII: Suspicious Activity ReportingArticle IX: OFAC Sanctions ComplianceArticle X: Blockchain-Specific ControlsArticle XI: RecordkeepingArticle XII: Training ProgramArticle XIII: Independent TestingArticle XIV: Administration
🎯 ARTICLE I: PURPOSE AND REGULATORY FRAMEWORK
Section 1.1 — Purpose
This Anti-Money Laundering Policy (the "Policy"“Policy”) establishes Groovy Company, Inc. dba OTCM Protocol, Inc.'Protocol’s (the "Company"“Company”) program to prevent money laundering, terrorist financing, and other financial crimes.crimes The Policy is designed to:
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
Section 1.2 — Regulatory Framework
This Policy is adopted pursuant to and in compliance with:
| Description | ||
Bank Secrecy Act (BSA) | 31 U.S.C. § 5311 et seq. — Recordkeeping and reporting | ||
USA PATRIOT Act | Enhanced due diligence, CIP requirements | ||
FinCEN Regulations | 31 CFR Chapter X — AML program requirements | ||
OFAC Regulations | 31 CFR Parts | ||
SEC Rule 17a-8 | Broker-dealer SAR filing requirements | ||
FATF Recommendations | International AML/CFT standards | ||
|
| ||
FATF Travel Rule |
|
Section 1.3 — Scope
This Policy applies to:
|
|
|---|---|
|
|
|
|
| ST22 |
|
|
|
|
|
|
|
Section 1.4 — Money Laundering Defined
Money laundering is the process of disguising thecriminal proceeds ofthrough criminalthree activity:
|
|
|---|---|
|
|
|
|
and Integration |
|
🚨assets). Predicate Offensesoffenses Include:
include
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
🏛️ ARTICLEArticle II: AML PROGRAMProgram STRUCTUREStructure
Section 2.1 — ProgramFive ComponentsPillars
The Company's AML Program consists of five pillars:
| Description | ||
Internal Controls | Policies, procedures, and systems including 42 Transfer Hook controls and blockchain monitoring via Chainalysis KYT + TRM Labs | ||
BSA/AML Officer | Designated compliance officer with authority, Board access, and oversight of all AML operations | ||
Training | Ongoing employee training covering BSA, OFAC, blockchain AML, and SAR filing | ||
Independent Testing |
| ||
Customer Due Diligence | Risk-based CDD program including KYC, KYB, KYW, and beneficial ownership verification via Empire Stock Transfer |
Section 2.2 — BSA/AML Compliance Officer
👤 Designation
The Board of Directors designates a BSA/AML Compliance Officer (the "AML Officer") with overall responsibility for the AML Program.
|
|
|---|---|
|
|
|
|
|
|
|
|
📋access. Responsibilities
|
|
|---|---|
|
|
|
|
|
|
SAR |
|
|
|
|
|
|
|
|
|
Empire Stock Transfer is the sole investor onboarding authority for all ST22 issuers. The AML Officer coordinates with Empire on all KYC/KYB/KYW/AML/OFAC procedures but does not perform investor onboarding directly.
Section 2.3 — BoardRisk OversightAssessment
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
Section 2.4 — Risk Assessment
The AML Officer shall conduct an enterprise-wide AML risk assessment:
|
|
|---|---|
Customer Risk | Customer types, geographic |
Product Risk |
|
Geographic Risk | Countries and regions |
Channel Risk |
|
Transaction Risk | Transaction types, volumes, |
📊
Risk Rating
|
|
|
|---|---|---|
|
|
|
|
|
|
|
|
|
|
| Quarterly |
Prohibited (Black) | Unacceptable risk — sanctioned parties, FATF blacklist | No onboarding permitted |
👤 ARTICLEArticle III: CUSTOMERCustomer IDENTIFICATIONIdentification PROGRAMProgram (CIP)
Section 3.1 — CIP Requirements
Before establishing aany business relationship, theEmpire CompanyStock must:
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
Section 3.2 — RequiredIndividual Information — IndividualsCIP
| Required |
| |||
Full Legal Name |
|
| Government ID match | ||
Date of Birth |
|
| |||
Residential Address |
|
| Utility bill / bank statement < 90 days | ||
SSN/TIN |
|
| |||
Passport Number |
|
| |||
Email / Phone |
| Email confirmation / SMS verification | |||
|
|
| |||
|
|
|
Section 3.3 — RequiredEntity Information — EntitiesCIP
|
|
|
|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Section 3.4 — Identity Verification — IndividualsMethods
📄 Documentary Verification
|
|
|---|---|
|
|
|
|
| (U.S. or |
|
|
|
|
|
💻 Non-Documentary Verification
|
|
|---|---|
|
|
|
|
|
|
|
|
Section 3.5 — IdentityEnhanced VerificationIssuer — EntitiesCIP
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
Section 3.6 — CIP for Platform Issuers
Issuers onboarding to OTCM Protocol require enhanced CIP:
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
Section 3.7 — CIP Notice
TheIMPORTANT: following notice must be provided to all customers:
📢IMPORTANT INFORMATION ABOUT PROCEDURES FOR OPENING A NEW ACCOUNTTo help the government fight the funding of terrorism and money laundering activities, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account.
What this means for you:When youopen an account oraccess our platform, we will ask for your name, address, date of birth, and otherinformation that will allow us to identify you. We may also ask to see your driver's license or otheridentifyingdocuments.information.
🔍 ARTICLEArticle IV: CUSTOMERCustomer DUEDue DILIGENCEDiligence (CDD)
Section 4.1 — CDD RequirementsObjectives
The Company must conduct CDD on all customers to:
|
|
|---|---|
Understand |
|
|
|
|
|
|
|
|
|
Section 4.2 — Customer Risk Rating Factors
Each customer is assigned a risk rating based on:
|
|
|---|---|
Customer |
|
|
|
|
|
|
|
|
|
|
|
|
📊 Risk Categories
|
|
|
|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
Section 4.3 — Source of Funds/Wealth
|
|
|---|---|
Source of |
|
Source of |
|
📋customers. Acceptable Sources
sources
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
Section 4.4 — NatureOngoing Monitoring and PurposeCDD of RelationshipRefresh
|
| |
|---|---|---|
|
| Method |
|
| |
|
| |
|
|
Section 4.5 — Ongoing Monitoring
|
| |
|---|---|---|
Transaction Monitoring | Continuous | Chainalysis KYT + TRM Labs + Transfer Hook controls |
Profile Review | Per risk rating | Manual |
Negative News | Periodic | Automated adverse media screening |
Sanctions Screening | Daily | Three-layer OFAC architecture |
|
| TRM Labs 200+ behavioral features |
Section
4.6 — CDD Refresh
| CDD Refresh Frequency | ||
Low | Every 3 years | ||
Medium | Every 2 years | ||
High | Annually | ||
Trigger Event | Upon any material change in customer profile or activity |
🔴 ARTICLEArticle V: ENHANCEDEnhanced DUEDue DILIGENCEDiligence (EDD)
Section 5.1 — When EDD Is RequiredTriggers
Enhanced Due DiligenceEDD is required for:
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Section 5.2 — PoliticallyPEP Exposed Persons (PEPs)Requirements
👔 PEP Definition
A PEP is an individual who is or has been entrusted with a prominent public function:
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
📋of the above. PEP EDD Requirements
requires:
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
Section 5.3 — High-Risk Jurisdictions
🌍 FATF High-Risk Jurisdictions
Countries subject to FATF call to action or increased monitoring:
| Treatment | ||
FATF Blacklist |
| ||
FATF Grey List | EDD required, enhanced | ||
FinCEN Advisories | Heightened | ||
OFAC Comprehensively Sanctioned | PROHIBITED — North Korea, Iran, Syria, Cuba, Crimea/Donetsk/Luhansk |
📋 High-Risk Jurisdiction EDD
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
Section 5.4 — Complex OwnershipStructures Structuresand Documentation
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
Section 5.5 — EDD Documentation
All EDD must be documented including:with written risk assessment, procedures performed, findings, management approval with rationale, and all supporting documents.
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
👥 ARTICLEArticle VI: BENEFICIALBeneficial OWNERSHIPOwnership
Section 6.1 — Beneficial Ownership Requirements
For all legal entity customers, the Company (via Empire Stock Transfer) must identify and verify:
|
|
|---|---|
|
|
|
|
Section 6.2 — Ownership ThresholdThresholds
|
| |
|---|---|---|
|
| |
|
| |
|
| |
< 10% | Required if individual has significant management control |
Section 6.3 — ControlPlatform PersonIssuer Enhanced Requirements
AtFor leastissuers onetokenizing Controlequity Personas mustST22 beDigital Securities: all 10%+ owners identified —(lower anthreshold individualthan withstandard), significantall responsibilityofficers to(CEO, control,CTO, manage,COO orand directother theexecutives), entity:all directors, full cap table review, and ongoing reporting of material ownership changes.
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
Section 6.4 — CertificationExemptions
Entity customers must certify beneficial ownership on the Beneficial Ownership Certification Form:
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
Section 6.5 — Verification
|
|
|---|---|
|
|
|
|
|
|
|
|
Section 6.6 — Exemptions
Certain entities are exempt from beneficial ownership requirements:
|
|
|---|---|
| traded SEC reporting |
|
|
|
|
|
|
|
|
|
Section 6.7 — Platform Issuer Beneficial Ownership
For issuers on OTCM Protocol:
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
📊 ARTICLEArticle VII: TRANSACTIONTransaction MONITORINGMonitoring
Section 7.1 — Monitoring Program
The Company maintains a transaction monitoring program tousing detect:Chainalysis KYT (continuous on-chain monitoring), TRM Labs (weekly wallet risk rescoring across 200+ features), Transfer Hook Controls 11–15 (per-transaction AML risk scoring inside Solana runtime), rules-based automated systems, behavioral analytics, manual review of flagged transactions, and scheduled account reviews.
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
Section 7.2 — Monitoring Methods
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
Section 7.3 — Red Flags
💰 Transaction Red Flags
|
|
|---|---|
|
|
|
Round- |
|
|
Rapid |
|
|
Unusual |
|
|
High- |
|
|
| Unexplained third-party involvement |
👤 Customer Red Flags
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
🔗 Blockchain Red Flags
|
|
|---|---|
|
|
Darknet |
|
| Rapid transfers across many wallets |
|
Chain |
|
|
| Bot-driven |
|
| Interaction with OFAC-listed wallet addresses |
Section 7.43 — Alert Management
|
|
| |
|---|---|---|---|
|
|
| |
|
| ||
Alert assigned to analyst | Within 24 hours | ||
|
| Initial review completed | Within 5 business days |
| Within 15 business days |
| |
|
| SAR filed if warranted | Within 30 days of detection |
Section
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
📢 ARTICLEArticle VIII: SUSPICIOUSSuspicious ACTIVITYActivity REPORTINGReporting
Section 8.1 — SAR Filing ObligationObligations
The Company must file a Suspicious Activity Report (SAR) when:
|
| |
|---|---|---|
|
| |
|
| |
| $25,000+ with | SAR |
|
| |
Imminent threat | Immediate filing + law enforcement notification |
Section 8.2 — What Is SuspiciousTimeline
Activity is suspicious if it:
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
Section 8.3 — SAR Filing Timeline
|
|
|---|---|
30 |
|
60 |
|
Immediate |
|
Section 8.43 — SAR Content
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
Section 8.5 — SAR Confidentiality
CONFIDENTIAL.
🔒SARs are STRICTLYCONFIDENTIAL
|
|
|---|---|
| Cannot disclose SAR filing to |
| Cannot notify subject of |
| Share only with authorized |
| Must respond to FinCEN |
|
|
Section 8.6 — Continuing Activity
For ongoing suspicious activity:
|
|
|---|---|
|
|
|
|
|
|
Section 8.7 — SAR Safe Harbor
🛡️31 U.S.C. § 5318(g)(3) providesprotectionsafe harbor from liability for good faith SAR filings.
🏛️ ARTICLEArticle IX: OFAC SANCTIONSSanctions COMPLIANCECompliance
Section 9.1 — OFACThree-Layer ProgramScreening OverviewArchitecture
TheOTCM CompanyProtocol maintainsimplements athree-layer sanctionsOFAC compliancescreening: program(1) toEmpire ensure:Stock Transfer onboarding screening, (2) Chainalysis KYT + TRM Labs continuous wallet monitoring, (3) Transfer Hook Controls 8–10 real-time screening on every ST22 transaction inside the Solana runtime.
|
|
|---|---|
|
|
|
|
|
|
|
|
Section 9.2 — OFAC Lists Screened
|
|
|---|---|
|
|
|
|
|
|
SSI (Sectoral Sanctions) |
|
FSE (Foreign Sanctions Evaders) | As updated |
CAPTA List |
|
Country Programs | Cuba, Iran, North Korea, Syria, |
Section 9.3 — Screening RequirementsPoints
|
|
|---|---|
Customer |
|
|
|
|
|
|
|
|
|
|
Section 9.4 — Blockchain Sanctions Screening
|
|
|---|---|
Wallet |
|
|
|
|
|
|
|
🚨(Chainalysis OFAC-ListedKYT Wallet+ Addresses
TRM Labs). OFAC has designated specific blockchain addresses. The Company:
|
|
|---|---|
|
|
|
|
|
|
|
|
Section 9.5 — Potential Match Handling
| Action | ||
| Transaction/account placed on immediate hold | ||
| Compliance review within 24 hours | ||
|
| ||
| If true match: | ||
|
|
Section 9.6 — Blocking and Rejecting
|
|
|---|---|
|
|
|
|
|
|
Section 9.7 — OFAC Reporting
|
|
|---|---|
|
|
Annual Report |
|
|
|
🔗 ARTICLEArticle X: BLOCKCHAIN-SPECIFICBlockchain-Specific CONTROLSControls
Section 10.1 — BlockchainMonitoring and Analytics
Real-time on-chain monitoring via Chainalysis KYT. Wallet risk scoring and attribution. Transaction Automated alerts for suspicious For virtual asset transfers exceeding applicable thresholds: originator and beneficiary full legal name, wallet address, and institution (if applicable) must be collected and transmitted per FATF Recommendation 16. Requirement > $3,000 Collect and verify counterparty information > $10,000 Enhanced due diligence required High Risk • 42 Transfer Hook compliance checks on every transfer inside Solana runtime • Whitelist verification — only Empire-registered wallets can hold tokens • Volume monitoring for unusual trading patterns on CEDEX • Holding period enforcement (Rule 144: 6 months Reg D / 12 months Reg S) • Circuit breakers: >10% price move in 5 minutes = 15-minute halt Daily/monthly transaction limits • Wallet concentration limits • Large transfer monitoring and alerts CIP Records 5 years after account closure CDD/EDD Records 5 years after account closure KYW Wallet Records Transaction Records 5 years from transaction date SAR Records 5 years from filing date OFAC Screening Records 5 years from date of record Training Records 5 years Audit Reports 5 years Blockchain Records (off-chain) 5 years ( Beneficial Ownership Certifications 5 years after account closure Audience Frequency General AML All employees Annual Role-Specific AML AML Upon hire + annual Management Senior management Annual Board Board of Directors Annual Blockchain AML Technical staff (CEDEX, Transfer Hooks) Upon hire + annual SAR Training AML Upon hire + annual CIP/ At least annually (external firm with CAMS/CFE certification or independent internal audit). Scope Findings reported to AML Officer Committee. Remediation plan The BSA/AML Compliance Officer is the Contact: I acknowledge that I have received and read the Groovy Company, Inc. dba OTCM I understand Monitoring
🔗 ControlDescription📊 On-Chain MonitoringReal-time monitoring of blockchain transactions🔍 Wallet AnalysisRisk scoring of wallet addresses🔗 Transaction TracingSourcesource and destination tracking🚨tracking. Alert Generationpatternspatterns. Cluster analysis identifying related wallets. Mixer/tumbler detection. OFAC-listed address screening.Section 10.2
— Blockchain Analytics Tools
The Company utilizes blockchain analytics to:
🔍 CapabilityDescription💳 Wallet AttributionIdentify wallet owners where possible🔗 Cluster AnalysisIdentify related wallets📊 Risk ScoringAssign risk scores to addresses🌑 Illicit Activity DetectionIdentify connections to illicit activity🔀 Mixer DetectionIdentify mixing/tumbling services🏛️ Sanctions ScreeningScreen against OFAC-listed addresses
Section 10.3 — Travel Rule Compliance📋 InformationRequired👤 Originator NameFull legal name💳 Originator WalletWallet address🏦 Originator InstitutionIf applicable👤 Beneficiary NameFull legal name💳 Beneficiary WalletWallet address🏦 Beneficiary InstitutionIf applicableSection 10.
43 — Unhosted Wallet ControlsFor transactions with unhosted (self-custodied) wallets:
📋 Threshold💰 💰 🔴 May require additionalAdditional documentation and source of funds verificationSection 10.
54 — Token-Specific Controls🪙ST22 Digital Securities ControlsOTCM Utility Token Controls
📋 ControlDescription📊• Transaction Limits
🔍• Wash trading and manipulation pattern monitoringPattern
Section 10.5 — CEDEX and Liquidity Monitoring
MonitorGlobal Unified CEDEX Liquidity Pool monitoring for washmanipulation, trading,CPMM manipulationbonding curve monitoring for artificial price manipulation, swap and stablecoin conversion tracking, and cross-chain activity monitoring.
💳 Wallet
LimitsLimitsArticle
onXI: holdings per wallet🔗 Transfer MonitoringMonitor large transfers
Recordkeeping
🔗 ST22 Security Token Controls📋 ControlDescription🔐Record Transfer HooksTypeComplianceRetention checks on every transferPeriod✅ Whitelist VerificationOnly verified wallets can hold tokens📊 Volume MonitoringMonitor unusual trading volumes🔒 Lock EnforcementVesting and lock-up enforcement🚨 Circuit BreakersAutomatic trading halts for anomalies
Section 10.6 — DeFi and DEX Monitoring
🔗 Monitoring AreaDescription💧 Liquidity PoolsMonitor pool activity for manipulation📈 Bonding CurvesMonitor for artificial price manipulation🔄 Swap ActivityTrack swaps and conversions🌉 Bridge TransactionsMonitor cross-chain activity
📁 ARTICLE XI: RECORDKEEPING
Section 11.1 — General Requirements
All AML records must be:
📋 RequirementDescription✅ AccurateComplete and accurate🔒 SecureProtected from unauthorized access📂 RetrievableRetrievable within reasonable time📁 OrganizedSystematically organized
Section 11.2 — Retention Periods
📁 Record TypeRetention Period👤 🔍 📊5 years after wallet deregistration📢 🏛️ 🎓 🔍 🔗 off-on-chain copies)records are permanent/immutable)Section 11.3 — CIP Records
📋 RecordRequirement👤 Identifying InformationName, DOB, address, ID number📄 ID DocumentsCopies of documents used for verification💻 Verification MethodsDescription of methods used🔍 Verification ResultsResults of verification process⚠️ DiscrepanciesResolution of any discrepancies
Section 11.4 — Transaction Records
📋 RecordRequirement💰 AmountTransaction amount📅 DateDate and time of transaction👤 PartiesAll parties to transaction💳 Account/WalletAccount numbers, wallet addresses🔗 Transaction IDTransaction hash (for blockchain)📋 PurposeNature of transaction
Section 11.5 — SAR Records
📋 RecordRequirement📢 SAR CopyCopy of filed SAR📋 Supporting DocumentationAll supporting documents🔍 Investigation FileComplete investigation file📝 Narrative BackupDetailed narrative and analysis
🎓 ARTICLEArticle XII: TRAINING PROGRAM
Program
Section 12.1 — Training Requirements🎓 Training Type📋 🔍 staffstaff, analysts👔 🏛️ 🔗 📢 analystsanalysts, Compliance OfficerSection 12.2 — Training Content
📋 TopicCoverage⚖️Content Legalcovers FrameworkBSA, BSA/USA PATRIOT Act,Act/OFAC OFAC🔍legal Redframework, FlagsRecognizingred suspiciousflag activity📢recognition ReportingInternal(transaction, escalation,customer, blockchain), internal escalation and SAR filing👤filing, CDDCustomerCDD/KYW identificationprocedures, sanctions compliance and duethree-layer diligence🏛️screening, SanctionsOFAC compliance🔗 BlockchainCrypto-blockchain-specific AML concerns (mixers, chain hopping, darknet), and this Policy.
📜 Company PolicyThis Policy and procedures
Section 12.3 — Training Documentation
📋 DocumentationRequired📅 DateDate of training👤 AttendeesList of participants📋 ContentTraining materials/agenda✅ CompletionAttestation of completion📊 AssessmentTest results (if applicable)
Section 12.4 — Ongoing Education
📋 MethodDescription📧 AlertsRegulatory updates and alerts📰 NewslettersAML compliance newsletters🎓 WebinarsIndustry webinars and conferences📋 Case StudiesReview of enforcement actions
🔍 ARTICLEArticle XIII: INDEPENDENTIndependent TESTINGTestingSection 13.1 — Testing Requirements
sample 📋 RequirementDescription🔄 Frequency👤 IndependenceConducted by an independent party📊 All aspectscovers ofall AML program📋 DocumentationWrittenaspects: reportpolicies, ofCIP/CDD/KYW findingsSectiontesting, 13.2 — Testing Scope
🔍 AreaTesting Activities📋 PoliciesReview of policies and procedures🔍 CIP/CDDSample testing of customer files📊 Transaction MonitoringEffectiveness oftransaction monitoring📢 SAR ProcessReview ofeffectiveness, SAR filing processprocess, OFAC screening effectiveness, training adequacy, and blockchain-specific controls.
🏛️ OFACSanctions
screening effectiveness🎓 TrainingTraining program adequacy🔗 Blockchain ControlsBlockchain-specific controls
Section 13.3 — Qualified Auditors
Independent testing must be conducted by:
✅ Qualified AuditorDescription🏢 External FirmThird-party audit firm with AML expertise👤 Internal AuditInternal audit (if independent)🎓 QualificationsCAMS, CFE, or equivalent certification📊 ExperienceDemonstrated AML audit experience
Section 13.4 — Findings and Remediation
⚡ StepAction1️⃣2️⃣Findings reported toand Board/Audit Committee3️⃣developed4️⃣Remediationdeveloped, implemented5️⃣Follow-implemented, and follow-up testingtested.ofremediation
🏛️ ARTICLEArticle XIV: ADMINISTRATIONAdministration
Section 14.1 — Policy OwnerownerPolicy ofowner. thisAnnual Policyreview covers regulatory changes, industry best practices, audit findings, updated risk assessment, and is responsible for:
📋 DutyDescription📋 MaintenanceKeeping Policy current🔍 InterpretationProviding authoritative interpretation📊 ReportingReporting to Board on AML matters🎓 TrainingEnsuring adequate training🔧 UpdatesRecommending Policy updates
Section 14.2 — Annual Review
This Policy shall be reviewed annually and updated to reflect:
features. 🔄 Review AreaConsideration⚖️ Regulatory ChangesNew laws, regulations, guidance🏆 Best PracticesIndustry developments🔍 Audit FindingsInternal and external audit results📊 Risk AssessmentUpdated risk assessment🔗 Technology ChangesNewnew blockchain/platform featuresSectionAdministrative 14.3changes — Amendments
📋 Amendment TypeApproval Required📋 AdministrativeAML Officer📊 SubstantiveBoard of Directors🚨 EmergencyCEO (with Board ratification)
Section 14.4 — Regulatory Examinations
📋 Examination SupportResponsibility🏛️ Primary ContactAML Officer📋 Document ProductionCoordinatedapproved by AML Officer👤Officer; Interviewsubstantive PreparationAMLchanges Officerrequire andBoard Legal📊approval; Findingsemergency ResponseAMLchanges Officerby CEO with Board oversightratification.Section 14.5 — Questions
📧 aml@otcmprotocol.comaml@otcm.io or compliance@otcmprotocol.comcompliance@otcm.ioQuestions regarding this Policy should be directed to the AML Officer.✍️Acknowledgment ACKNOWLEDGMENTand AND CERTIFICATIONCertificationProtocol, Inc.Protocol Anti-Money Laundering Policy. I understand its contents and my responsibilities under this Policy.responsibilities.that:
liability.✅that I must comply with all AML/BSA requirements✅ I mustrequirements, report suspicious activity✅ I mustactivity, complete required AML training✅ I musttraining, maintain confidentiality of SAR information✅confidentiality, Failureand that failure to comply may result in disciplinary action and personal liability
I commit to:
✅ Following all CIP/CDD procedures✅ Reporting suspicious activity promptly✅ Completing required training✅ Cooperating with AML investigations✅ Maintaining required records
Field |
| ||
Signature | _________________________________ | ||
Date | _________________________________ | ||
Printed Name | _________________________________ | ||
| _________________________________ | ||
Department | _________________________________ |
📎 APPENDIXAppendix A: RED FLAGS QUICK REFERENCE
💰 Transaction Red Flags
Quick Reference
Transaction
|
|
|---|---|
Transactions just below $10,000 reporting thresholds | → Escalate to AML |
|
• Rapid | hours → Escalate to AML |
|
|
|
• High-risk jurisdiction involvement | → EDD required |
|
|
|
Round-trip transactions | with no economic purpose → Escalate to AML |
👤
Customer
• Reluctance to provide documentation → Cannot onboard • Inconsistent or false information → Cannot onboard Requests to avoid reporting thresholds → Report to AML • Multiple accounts with no business purpose → Investigate Escalate to AML connections → Block and report wallet interactions → Block and report immediately • Rapid multi-wallet transfers • Cross-chain transfers to obscure source → Investigate All wallet addresses Chainalysis + TRM Labs continuous monitoring Entity Type Governing BSA, USA PATRIOT Act, OFAC, FinCEN, Federal Securities Law, New Jersey State Law Approved By Board of DirectorsFlags
🚨 Red FlagAction
Unusual• secrecy about businessEscalate to AML
Investigate
Blockchain
Frequent• changesMixer/tumbler totransactions account→ informationInvestigate
🔗 Blockchain Red Flags
🚨 Red FlagActionTransactions through mixers/tumblers
Connections• toDarknet darknetmarket markets
Interactions• with OFAC-listed wallets
across→ manyInvestigatewalletsInvestigate
Investigate Unusual smart contract interactionsInvestigate
📎 APPENDIXAppendix B: OFAC SCREENINGScreening QUICKQuick REFERENCEReference
🏛️ When to Screen📋 TriggerScreening RequiredNewWhen customerto onboardingScreen✅ YesActionEveryNew transactioncustomer onboarding✅Screen Yesbefore any account activity via EmpireDailyEvery listST22 updatestransaction✅Transfer YesHook Controls 8–10 — automaticCustomerDaily informationlist changesupdates✅Re-screen Yesall active customers and walletsCounterpartyCustomer transactionsinfo changes✅Re-screen YesimmediatelyWalletAll address interactionscounterparties✅Screen Yesbefore transaction processes🚨PotentialMatchDocument
ResponseInformation⚡ StepTimelineAction1️⃣FieldImmediateStop transaction/hold accountValue2️⃣Document ID< 24 hoursCompliance reviewOTCM-POL-AML-0013️⃣Version< 48 hoursDetermination (true/false match)8.04️⃣Effective DateIfMarch true matchBlock and file report20265️⃣Legal EntityIfGroovy falseCompany, positiveInc. dba OTCM ProtocolDocumentWyoming andCorporationreleaseLaw
OTCM Protocol, Inc. A Wyoming Digital Asset Corporation📜© 2026 Groovy Company, Inc. dba OTCM Protocol SEC| Category 1All Issuer-SponsoredRights TokenizedReserved Securities Infrastructure| CONFIDENTIAL
Document ID: OTCM-POL-AML-001 | Version 1.0 | Effective: January 30, 2026