Note: A report made in good faith isare protected even if the investigation determines the concern was unfounded. Knowingly false, malicious, or fabricated allegations are not protected and may result in disciplinary action.

🚨 ARTICLEArticle III: REPORTABLEReportable CONCERNSConcerns

Section 3.1 — Financial and Accounting Matters

Section 3.2 — Securities Law Violations

Section 3.3 — Platform and Blockchain Concerns

Section 3.4 — Legal and Regulatory Violations

Section 3.5 — Workplace Concerns

Section 3.6 — Ethical Concerns

📞 ARTICLEArticle IV: REPORTINGReporting CHANNELSChannels

Section 4.1 — Internal Reporting Channels

📧

Channel	Contact	Best For
Option 1: Compliance Officer 📋 Details Information Email compliance@otcmprotocol.comcompliance@otcm.io — Subject line: “Whistleblower Report – Confidential” General concerns, platform/blockchain issues SubjectOption Line2: Legal Counsel "frank@otcm.io — Subject line: “Whistleblower Report -– Confidential" Response TimeConfidential” Acknowledgment within 48 hours 👔 Option 2: Chief Legal Officer 📋 Details Information Email legal@otcmprotocol.com Subject Line "Whistleblower Report - Confidential" Use For Legal/regulatory concerns, concerns about Compliance Officer 🏛️
Option 3: Audit Committee Chair 📋 Details Information Email auditcommittee@otcmprotocol.com Useauditcommittee@otcm.io For— Direct to independent directors Accounting/financialFinancial/accounting concerns, concerns about management Direct Access Reports go directly to independent directors 📞 Option 4: Ethics Hotline 📋 Details Information Phone 1-800-XXX-XXXXethics@otcm.io (24/7)— Anonymous reporting available. Operated by independent third party. Anonymous reporting, any concern Web https://otcmprotocol.ethicspoint.com Features Anonymous reporting available Operated By Independent third party 👤 Option 5: Direct Supervisor 📋 Details Information Use For Your immediate supervisor Routine workplace concerns Escalation If (escalate if not resolved, use other channelsresolved)   Section 4.2 — Anonymous Reporting ✅ Anonymous reports ARE accepted and will be investigated. investigated 📋with Anonymousthe Reporting Details 🔒 Available Through Ethics Hotline (phone or web) ✅ Fully Investigated Samesame process as identified reports ⚠️reports. Limitations MayAnonymous limitreporting abilityis toavailable followthrough upthe orEthics provideHotline. feedback 💡 Recommendation Consider providing a contact method for follow-up questionsquestions, as anonymity may limit the ability to provide feedback or request additional information.   Section 4.3 — Information to Include in Reports When making a report, include as much of the following as possible: 📋 Information Description 📝 Description Whatwhat happened or is happening 👤happening, Who Individualsindividuals involved 📅involved, When Datesdates and times 📍times, Where Locationlocation (physical or system) 🔗, Evidence Documents,documents transactionor hashes,evidence, screenshots 👁️witnesses, Witnesses Others who may have knowledge 📊 Impact Potentialpotential or actual harm 💡harm, Context Anyand any other relevant informationcontext.   Section 4.4 — Blockchain-Specific Reports For concerns involving blockchain or platform operations, also include: 🔗relevant Information Description 💳 Wallet Addresses RelevantSolana wallet addresses 🔗 Transaction Hashes Specificaddresses, transaction IDs 📜signatures Smart(hashes), Contract Contractsmart addressescontract involved 📊program Tokenaddresses, Symbol ST22 Digital Securities token symbol or OTCM token 📅token, Block Numbers Relevantrelevant block numbers 🔍 Exploreror Links slots, and Solscan or otherSolana explorerExplorer linkslinks.   🔒 ARTICLEArticle V: CONFIDENTIALITYConfidentiality Section 5.1 — Confidentiality Commitment 🔒 The Company will protect the confidentiality of whistleblowers to the fullest extent possible. 🔐 Protection Description 🔒 Identity Protection Reporter'Reporter’s identity is kept confidential 📁confidential, Securereports Storage Reportsare stored securely with limited access 👥access, Need-to-Know Informationinformation is shared only ason necessarya need-to-know basis, and anonymous reporting is available. 📋  Anonymous Option Anonymous reporting available Section 5.2 — Limits on Confidentiality Confidentiality may be limited inby: certain circumstances: ⚠️ Circumstance Explanation ⚖️ Legal Process Courtcourt order or subpoena 🔍subpoena, Investigationnecessity Needs Necessaryfor to conducta fair investigation 🚨investigation, Imminentprevention Harm Preventof imminent serious harmharm, to persons or property 📋 Regulatory Requirement Requiredrequired disclosure to regulators 👤regulators, Reporteror Consent Reporterreporter’s consentsconsent. to disclosure Section 5.3 — Confidentiality of Investigations 🔒 Requirement Application 📋 Investigation Details Keptdetails confidential 👤are Witnesskept Statements Notconfidential, witness statements are not disclosed to accused 📊the Findings Sharedaccused, findings are shared on a need-to-know basis ⚠️basis, Accusedand Rights Accusedthe accused is informed of allegations (but not source)the source.   🛡️ ARTICLEArticle VI: ANTI-RETALIATIONAnti-Retaliation PROTECTIONProtection Section 6.1 — Prohibition on Retaliation 🚫 RETALIATION AGAINST WHISTLEBLOWERS IS STRICTLY PROHIBITED AND WILL NOT BE TOLERATED. Any person who retaliates against a whistleblower will be subject to disciplinary action, up to and including termination.   Section 6.21 — Definition of Retaliation Retaliation includes any adverse action taken because of a protected activity: 🚫termination, Retaliationdemotion, Type Examples 🚪compensation Termination Firing,reduction, layoff,undesirable forcedassignments, resignation 📉involuntary Demotion Reductiontransfer, in rank, title,intimidation or responsibilities 💰 Compensation Reduction in pay, denial of bonus or raise 📋 Assignments Undesirable assignments, exclusion from projects 📍 Transfer Involuntary transfer or relocation 😠 Harassment Intimidation, threats, hostility 📊 Evaluation Negativenegative performance reviews 🚫reviews, Opportunities Denialdenial of promotion or training 🗣️training, Reputation Negativenegative references,references blacklisting ⚖️or Legalblacklisting, Threats Threatsand threats of legal actionaction.   Section 6.32 — Reporting and Investigating Retaliation If you believe you have experienced retaliation: ⚡ Step Action 1️⃣ Reportreport immediately to the Compliance Officer, CLO,Legal Counsel, or Audit Committee 2️⃣ DocumentCommittee; document all instancesinstances; ofidentify perceivedwitnesses; retaliation 3️⃣ Identifyand any witnesses 4️⃣ Preserve anypreserve relevant communications communications. Section 6.4 — Investigation of Retaliation Claims 📋 Process Description 🔍 Investigation All retaliation claims are investigated promptly ⚖️promptly, Independent Review Maymay involve outside counsel 🛡️counsel, Interimand Protection Interimmay measuresresult toin protectinterim reporter ⚠️protective Consequences measures. Retaliators are subject to discipline up to terminationand including termination.   Section 6.53 — Protection Period Anti-retaliation protections apply: apply ⏱️during Period Protection 📢reporting, Duringthroughout Reporting Whilethe makinginvestigation, report 🔍 During Investigation Throughout investigation ⚖️ After Resolution Indefinitelyindefinitely after the matter concluded 🤝is Participation Forconcluded, participatingand for participation in any investigationinvestigation.   🔍 ARTICLEArticle VII: INVESTIGATIONInvestigation PROCEDURESProcedures Section 7.1 — Receipt and Assessment ⚡ Step Timeline Action 1️⃣ Within 24 hours Report received and logged Within 24 hours 2️⃣ Within 48 hours Acknowledgment sent to reporter (if not anonymous) Within 48 hours 3️⃣Initial assessment completed Within 5 business days Initial assessment completed 4️⃣Decision on investigation scope Within 5 business days Decision on investigation scope   Section 7.2 — Investigation Assignment 📋 Concern Type Primary Investigator 💰Financial Financial// Accounting Audit Committee (may retain external counsel/forensics)counsel or forensic accountants) ⚖️Legal Legal// Regulatory Chief Legal OfficerCounsel (may involve external counsel) 👥HR HR// Workplace Human Resources (may involve external counsel) 🔗Platform Platform// Technical / Blockchain CTO + Compliance Officer (may involve blockchain security firm) 👔 Senior Management Audit Committee (external counsel required) 🏛️ Board Members Special Committee of independent directors   Section 7.3 — Investigation Process ⚡ Step Action 1️⃣ Plan •       Step 1: Plan — Developdevelop investigation plan and timeline 2️⃣ Preserve •       Step 2: Preserve — Preservepreserve relevant documentsdocuments, blockchain data, and dataplatform logs 3️⃣ Collect •       Step 3: Collect — Gathergather documents, records, blockchainon-chain datadata, Chainalysis/TRM reports 4️⃣ Interview •       Step 4: Interview — Interviewinterview witnesses and relevant parties 5️⃣ Analyze •       Step 5: Analyze — Analyzeanalyze evidence and identify findings 6️⃣ Report •       Step 6: Report — Prepareprepare written investigation report 7️⃣ Recommend •       Step 7: Recommend — Recommendrecommend corrective actions 8️⃣ Close •       Step 8: Close — Closeclose investigation and document resolution   Section 7.4 — Investigation Standards ⚖️ Standard Description 🔍 Thorough All relevant facts investigated ⚖️ Fair All parties treated fairly 🕐 Timely Completed as quickly as practicable 📋 Documented Findings and conclusions documented 🔒 Confidential Conducted confidentially 🎯 Objective Free from bias or prejudgment Section 7.5 — Blockchain Investigations For blockchain-related concerns, investigations may include: include 🔗on-chain Investigationtransaction Activity Description 📊 On-Chain Analysis Review of blockchain transactions 💳 Wallet Tracing Tracking ofanalysis, wallet activity 📜tracing Smartvia ContractChainalysis Audit ReviewKYT ofand TRM Labs, smart contract code audit and execution 🔍 Forensicreview, Analysis Blockchainblockchain forensicsforensics, tools 🔑Ledger Access Review Review ofEnterprise key management logs 📋log Platformreview, Logs Analysis ofCEDEX platform activity logslog analysis, and Transfer Hook event log review.   Section 7.65 — Communication with Reporter 📋 Communication Timing ✅ Acknowledgment Within 48 hours of report 📊 Status Updates Every 30 days (if investigation ongoing) 📋 Outcome Upon conclusion (to extent appropriate) ⚠️ Limitations May be limited for confidentiality/legal reasons Section 7.7 —and Corrective Actions IfReporters misconductreceive isacknowledgment substantiated,within corrective48 hours, status updates every 30 days during ongoing investigations, and outcome notification upon conclusion (to the extent appropriate). Corrective actions may include: include ⚠️disciplinary Action Examples 👤measures Disciplinary Warning,(warning suspension,through demotion,termination), termination 💰financial Financial Recoveryrecovery of losses, clawback ofor compensation 🔧 Process Policy/clawback, policy/procedure changes, enhanced controls 🎓 Training Additionaladditional training requirements ⚖️requirements, Legal Referralreferral to law enforcement or regulators 🔗 Platform Suspension(SEC, fromCFTC, platform,FinCEN, DOJ), or platform-level action (suspension, ST22 token freezing via Transfer Hook Control 42).   🏛️ ARTICLEArticle VIII: AUDIT COMMITTEE OVERSIGHT Section 8.1 — Audit Committee Role Oversight The Audit Committee of the Board of Directors has primary oversight responsibility for: 📋establishing Responsibility Description 📢 Complaint Procedures Establishing procedures forcomplaint receipt ofprocedures, complaints 💰 Financial Concerns Overseeingoverseeing investigation of financial/accounting concerns 👔concerns, Management Concerns Handlinghandling concerns involvingabout senior management 📊management, Reporting Receiving reports onreceiving whistleblower activity reports, and monitoring program effectiveness. 🔍  Monitoring Monitoring effectiveness of program Section 8.2 — Direct Access ✅ Any person may report directly to the Audit Committee at auditcommittee@otcm.io without going through management. 📋Reports Direct Access Channel Details Email auditcommittee@otcmprotocol.com Recipient Goesgo directly to the Audit Committee Chair Bypass Bypasses and bypass all management channelschannels. Section 8.3 — Audit Committee Reporting   The Compliance Officer shall reportreports to the Audit Committee: quarterly summary of reports received, quarterly investigation status, significant matters immediately, trends and patterns annually, and program effectiveness annually. 📊 Report Frequency 📋  Summary of Reports Quarterly 🔍 Investigation Status Quarterly ⚠️ Significant Matters Immediately 📊 Trends and Patterns Annually 🔧 Program Effectiveness Annually 🌐 ARTICLEArticle IX: EXTERNALExternal REPORTINGReporting RIGHTSRights Section 9.1 — Right to Report Externally ✅ Nothing in this Policy prevents any person from reporting concerns directly to government agencies or regulators. You have the right to report to: 🏛️ Agency Types of Concerns 📊 SEC Securities law violations — sec.gov/whistleblower — (202) 551-4790 💰 CFTC Commodities law violations — cftc.gov/whistleblower 🏦 FinCEN Money laundering, BSA violations — fincen.gov ⚖️ DOJ Criminal matters 👥 EEOC Employment discrimination — eeoc.gov 🛡️ OSHA Workplace safety, whistleblower retaliation — osha.gov 🏛️ State Regulators State law violations (Wyoming, New Jersey, others)   Section 9.2 — SEC Whistleblower Program The SEC Whistleblower Program provides: provides 🎯financial Benefit Description 💰awards Financial Awards 10-(10–30% of sanctions overexceeding $1 million 🛡️million), Retaliation Protection Federalfederal anti-retaliation protections 🔒protections, Confidentiality SECconfidentiality protectsof whistleblower identity ⚖️identity, Legaland Remedies Privateprivate right of action for retaliationretaliation. 📞  SEC Contact Information: 📋 Channel Details Website https://www.sec.gov/whistleblower Phone (202) 551-4790 Mail SEC Office of the Whistleblower, 100 F Street NE, Washington, DC 20549 Section 9.3 — No Prior Internal Reporting Required ✅ You are NOT required to report internally before reporting to a government agency. However, internal reporting may: may Allowallow faster resolution Provide opportunityand for Company to correct issues Demonstratedemonstrate good faith faith.   Section 9.4 — Protection for External Reporting 🛡️ Protection Description 🚫 No Retaliation Protected from Company retaliation 📜 Confidentiality May share confidential information with regulators ⚖️ Attorney-Client Does not waive privilege for internal communications 💰 Awards May be eligible for whistleblower awards Section 9.5 — Defend Trade Secrets Act Notice 📜 NOTICE: Pursuant to the Defend Trade Secrets Act of 2016 (18 U.S.C. § 1833(b)): Immunity: An individual shall not be held criminally or civilly liable under any federal or state trade secret law for the disclosure of a trade secret that is made: (i)made in confidence to a federal,government state,official or local government official, either directly or indirectly, or to an attorney,attorney solely for the purpose of reporting or investigating a suspected violation of law;law, or (ii) in a complaint or other document filed under seal in a lawsuit or other proceeding, if such filing is made under seal. Use in Anti-Retaliation Lawsuit:lawsuit. An individual who files a lawsuit for retaliation by an employer for reporting a suspected violation of lawlawsuit may disclose the trade secretsecrets to thetheir attorney and use the trade secret informationthem in the court proceeding,proceedings if the individual files any document containing the trade secretfiled under sealseal. and does  not disclose the trade secret except pursuant to court order. 🏛️ ARTICLEArticle X: ADMINISTRATIONAdministration Section 10.1 — Policy Owner The Compliance Officer is the owner of this Policy and is responsible for: for 📋 Duty Description 📋 Administration Day-day-to-day administrationadministration, of program 🔍 Intake Receivingreceiving and logging reports 📊reports, Tracking Trackingtracking investigations and outcomesoutcomes, reporting to the Audit Committee, conducting training, and recommending program improvements. 📋  Reporting Reporting to Audit Committee 🎓 Training Conducting whistleblower training 🔧 Improvements Recommending program improvements Section 10.2 — Training 🎓 Training Type Audience Frequency 📋 Policy Overview All employees Upon hire,hire + annually 🔍 Investigation Training InvestigatorsDesignated investigators Upon assignment,assignment + annually 🏛️ Audit Committee Training Committee members Annually 👔 Management Training Supervisors and managers Annually 🔗 Platform-Specific Technical staff (blockchain, CEDEX, Transfer Hooks) Annually   Section 10.3 — Recordkeeping 📁 Record Retention Period 📢 Reports Received 7 years 🔍 Investigation Files 7 years after closure 📊 Audit Committee Reports Permanent 📋 Training Records 5 years ⚠️ Retaliation Complaints 7 years after resolution   Section 10.4 — Annual Review and Amendments This Policy shall beis reviewed annually by the Compliance Officer and Audit Committee tocovering assess: legal 🔍compliance, Reviewprogram Area Consideration ⚖️effectiveness, Legalprocess Compliance Changesimprovements, inindustry laws/regulations 📊best Program Effectiveness Metricspractices, and outcomes 🔧 Process Improvements Lessons learned 🏆 Best Practices Industry developments 🔗 Platform Changes New platform features/risks changes. SectionAdministrative 10.5changes — Amendments 📋 Amendment Type Approval Required 📋 Administrative Compliance Officer 📞 Reporting Channels CLO approval 🏛️ Material Changes Audit Committee approval Section 10.6 — Questions 📧 Contact: compliance@otcmprotocol.com Questions regarding this Policy shouldmay be directedapproved toby the Compliance Officer.Officer; reporting channel changes require Legal Counsel approval; material changes require Audit Committee approval.   Questions: compliance@otcm.io   ✍️Acknowledgment ACKNOWLEDGMENTand AND CERTIFICATIONCertification   I acknowledge that I have received and read the Groovy Company, Inc. dba OTCM Protocol, Inc.Protocol Whistleblower Policy. I understand its contents and my rights and responsibilities under this Policy.   I understand that: that I may report concerns through any of the channels described in this Policy Policy, I may report anonymously through the Ethics Hotline Hotline, I will be protected from retaliation for good faith reports reports, and I may report directly to government agencies at any time time.   I agree to report any concerns about illegal, unethical, or improper conduct that I become aware of in connection with my relationship with the Company.     Field Value  Signature _________________________________ Date _________________________________ Printed Name _________________________________ Title/Title / Position _________________________________   📎 APPENDIXAppendix A: REPORTINGReporting QUICKQuick REFERENCEReference 📞 Internal Reporting Channels Channel Contact Best For 📧 Compliance Officer compliance@otcmprotocol.comcompliance@otcm.io General concerns ⚖️ Chief Legal OfficerCounsel legal@otcmprotocol.comfrank@otcm.io Legal/regulatory issues 🏛️ Audit Committee auditcommittee@otcmprotocol.comauditcommittee@otcm.io Financial, senior management 📞 Ethics Hotline 1-800-XXX-XXXXethics@otcm.io Anonymous reporting   External Agencies Agency Contact 🌐SEC Ethics Web PortalWhistleblower otcmprotocol.ethicspoint.com Anonymous reporting 🏛️ External Reporting Agencies Agency Contact Concerns 📊 SEC sec.gov/whistleblower Securities violations— (202) 551-4790 💰 CFTC Whistleblower cftc.gov/whistleblower Commodities violations 🏦 FinCEN fincen.gov Money laundering 👥 EEOC eeoc.gov Discrimination 🛡️ OSHA osha.gov Safety, retaliation ✅  What to Document Report Information ✅ Report ❌ Don't Report Through This Channel Fraud or theftField Routine HR issues (use HR)Value SecuritiesDocument violationsID General complaints about coworkersOTCM-POL-WBP-001 Financial irregularitiesVersion IT help desk issues8.0 RegulatoryEffective violationsDate CompensationMarch disputes2026 Safety concernsClassification Customer service mattersPUBLIC RetaliationLegal Entity GeneralGroovy suggestionsCompany, Inc. dba OTCM Protocol ConflictsEntity of interestType Wyoming Corporation PlatformGoverning manipulationLaw Federal Securities Law, SOX, Dodd-Frank, and New Jersey State Law Approved By Board of Directors OTCM Protocol, Inc. A Wyoming Digital Asset Corporation 📜© 2026 Groovy Company, Inc. dba OTCM Protocol  SEC| Category 1All Issuer-SponsoredRights Tokenized Securities InfrastructureReserved Document ID: OTCM-POL-WBP-001 | Version 1.0 | Effective: January 30, 2026 Back to top