"Financial infrastructure requires zero-tolerance launch procedures. Every line of code, every regulatory filing, every system integration must be verified before a single transaction processes."

PRE-LAUNCH
 PHASE
LAUNCHWEEKPOST-LAUNCH









Weeks




🔹





Phase


Window


Focus


Pre-Launch


Days -−60 to -−1
──→

Security audits · Regulatory preparation · Infrastructure hardening


Launch Week


Days 1–7
──→

2–4
Contract Securitydeployment audits           Deployment            Stabilization
Regulatory prep· Canary testing Issuer onboarding
Infrastructure· Public mainnet on Day 3


Post-Launch Stabilization


Weeks 2–4


Volume monitoring · Issuer onboarding · Scaling preppreparation



 

13.1.12  Pre-Launch Phase (Days -−60 to -−1)

interface PreLaunchPhase {
  duration: {
    startDay:  -60;   // 60 days before launch
    endDay:    -1;    // Day before launch
    totalDays: 60;
  };

  workstreams: [
    {
      name:         'SECURITY_AND_AUDITING';
      duration:     45;      // Days -60 to -15
      dependencies: [];
      critical:     true;
    },
    {
      name:         'REGULATORY_COORDINATION';
      duration:     60;      // Full pre-launch period
      dependencies: [];
      critical:     true;
    },
    {
      name:         'INFRASTRUCTURE_PREPARATION';
      duration:     30;      // Days -30 to -1
      dependencies: ['SECURITY_AND_AUDITING'];
      critical:     true;
    },
  ];

  readinessGates: {
    securityAuditComplete: boolean;
    regulatoryApprovals:   boolean;
    infrastructureReady:   boolean;
    teamReadiness:         boolean;
    contingencyPlans:      boolean;
  };
}


🔹13.2.1 13.1.2 Security and AuditingAudit Program
OTCM Protocol commissions dual independent security audits with formal verification before any mainnet deployment. All critical and high-severity findings must be remediated before launch. Medium findings must be remediated within 30 days post-launch. There are no exceptions.

 












































Audit Type



Provider



Duration



Completion Target


Smart Contract Audit #1


Quantstamp


4 weeks


Day -−45


Smart Contract Audit #2


Halborn


4 weeks


Day -−40


Formal Verification


Certora


3 weeks


Day -−30


Dynamic Security Testing


Internal + External


2 weeks


Day -−20


Penetration Testing


White-hat Team


2 weeks


Day -−15


Manual Code Review


Senior Engineering


Continuous


Day -−7


interface
 SecurityAuditProgram
{auditScope:{contracts:




'STAKING_POOL',linesOfCode:'HIGH';};formalVerification:








[
Audit 'CEDEX_MAIN',Scope //— Contracts


Lines of Code


Complexity


CEDEX Core exchange· contractGlobal 'OTCM_LIQUIDITY_POOL',Unified 'TRANSFER_HOOK',Liquidity //Pool SPL· Token-2022Transfer hookHook program
'BONDING_CURVE',

'VESTING_CONTRACT',
~25,000
];

25_000;
HIGH
complexity:



{
Staking provider:Pool 'CERTORA';· specifications:1:1 [Attestation 'no_unauthorized_minting',Oracle 'backing_ratio_invariant',· //Protocol Governance parameters


~8,000


HIGH


 

























Severity


Remediation Requirement


Critical finding


Must fix before launch — no exceptions


High finding


Must fix before launch — no exceptions


Medium finding


Must fix within 30 days post-launch


Low finding


Must fix within 90 days post-launch


 








Formal Verification Scope (Certora)

Formal verification targets six mathematical invariants that must hold under all possible execution conditions: (1) no unauthorized minting; (2) 1:1 backing ratio invariant — token supply never exceeds Empire-custodied Series M shares; (3) no fund extraction from the Global Unified CEDEX Liquidity Pool; (4) Transfer Hook always maintainedexecutes 'no_fund_extraction',— 'transfer_hook_always_executes',no 'fee_collection_accurate',transfer 'circuit_breaker_triggers',path ];bypasses proofLevel:all 'MATHEMATICAL_CERTAINTY';42 };controls; remediation:(5) {5% criticalFindings:fee 'MUST_FIX_BEFORE_LAUNCH';collection highFindings:accuracy; 'MUST_FIX_BEFORE_LAUNCH';(6) mediumFindings:circuit 'FIX_WITHIN_30_DAYS';breaker lowFindings:trigger 'FIX_WITHIN_90_DAYS';correctness. };Proof }level: 
mathematical 
🔹certainty.


 

13.1.3  Regulatory Coordination
 (Days −60 to −1)
Regulatory coordination runs in parallel with security auditing across the full pre-launch period. All regulatory workstreams must be complete before Day 1 deployment authorization is granted by the CLO.

 





























Agency / Party



Coordination Activities
Target
Date

SECTarget


SEC — Division of Trading and Markets


Pre-filing meeting · Form D preparation · Rule 506(c) verification · Digital Securities classification confirmation per Release No. 33-11412


Day -−45


FinCEN


BSA compliance verification · SAR/CTR filing proceduresprocedure testing · 314(b) enrollment confirmation


Day -−30


OFAC / Treasury


SDN list integration verification · sanctionsChainalysis + TRM Labs screening provider coordination · three-layer matching test


Day -−30


Empire Stock Transfer


Custody integration testing · 1:1 attestation oracle verification · registryMaster Securityholder File sync testing · Transfer Hook whitelist sync


Day -−14


StateJDT Legal


Blue Sky
Noticesky notice filings in applicable states (506(c)· preemption verification)
Day -14

interface RegulatoryCoordination {
  secCoordination: {
    preFilingMeeting: {
      scheduled: true;
      purpose:   'ReviewRule 506(c) offeringfederal structure,preemption ST22confirmation · Form D final preparation



Day −14





Wyoming Secretary of State



Digital Securitiesasset classificationregistration under ReleaseW.S. No.34-29-101 33-11412';· attendees:Certificate ['SEC_CORP_FIN',of 'OTCM_LEGAL',Designation 'OTCM_COMPLIANCE'];filing targetDate:for 'DAY_MINUS_45';Series };M
formDPreparation:
{
exemption:
Day 'RULE_506C';−10
filingDeadline:
'15_DAYS_AFTER_FIRST_SALE';
preparationComplete:
'DAY_MINUS_7';
};
 };
fincenCoordination:
13.4 { bsaRegistration: {
      status:       'REGISTERED';
      filingSystem: 'BSA_EFILING';
      testFilings:  3;
    };
    section314b: {
      enrolled:             true;
      verificationComplete: 'DAY_MINUS_14';
    };
  };

  ofacCoordination: {
    sdnListIntegration: {
      provider:            'CHAINALYSIS';
      alternateProvider:   'TRM_LABS';
      updateFrequency:     'HOURLY';
      verificationComplete: 'DAY_MINUS_7';
    };
    sanctionsPrograms: ['IRAN', 'NORTH_KOREA', 'SYRIA', 'CUBA', 'CRIMEA', 'RUSSIA', 'VENEZUELA'];
  };

  empireIntegration: {
    custodyVerification: {
      testTransactions: 100;
      attestationOracle: true;
      syncFrequency:    'EVERY_SOLANA_SLOT';
    };
    failoverTesting: {
      scenarios: ['API_OUTAGE', 'DATA_MISMATCH', 'DELAYED_RESPONSE'];
      allPassed:  boolean;
    };
  };
}


🔹 13.1.4 Infrastructure Preparation
 (Days −30 to −1)
 






































Component
Requirements
Target

Component


Requirements


Target


Solana RPC Nodes


Helius RPC: 500 req/sec · 100 sendTx/sec · 3 geographic regions
Day -14
Validator Priority Fees
Jito bundle integration(US-East · priorityUS-West · EU)


Day −14


Jito Bundle Integration


Priority fee estimation · MEV protection · bundle submission for compliance-critical transactions


Day -−14


Database Cluster


PostgreSQL primary + 2 replicas · 10K TPS capacity · automatic failover · encrypted at rest (AES-256)


Day -−7


API Gateway


Load balancer · rate limiting · DDoS protection · TLS 1.3 · 99.99% availability SLA


Day -−7


Monitoring Stack


Prometheus ·+ Grafana · PagerDuty · 24/7 on-call rotation · <1 minute incident detection


Day -−7


Disaster Recovery


Cross-region backup · 15-minute RPO · 1-hour RTO · tested failover procedures


Day -−3


 
🔹

13.1.5 Launch Week Execution Plan

interface LaunchWeekPlan {
  parameters: {
    launchDay:    'MONDAY';
    timezone:     'UTC';
    teamLocation: 'DISTRIBUTED';
    warRoom:      true;
  };

  launchTeam: {
    commandCenter: { lead: 'CTO'; members: ['LEAD_ENGINEER', 'SECURITY_LEAD', 'DEVOPS_LEAD'] };
    engineering:   { smartContracts: 2; backend: 3; frontend: 2 };
    compliance:    { officers: 2; analysts: 2 };
    support:       { customerSuccess: 3; documentation: 1 };
  };

  communications: {
    internal:   'SLACK_WAR_ROOM';
    escalation: 'PAGERDUTY';
    external:   'STATUS_PAGE';
    regulatory: 'SECURE_EMAIL';
  };
}


🔹 13.1.6 Day 1 Deployment Timeline

Day 1 begins at 09:00 UTC with contract deployment. Six launch gates (G1–G6) must be passed sequentially. Any failed gate triggers halt and escalation to the CTO. No exceptions — financial infrastructure requires zero-defect launch procedures.

 











































price






















Time (UTC)



Milestone



Actions



Gate


09:00


Contract Deployment


Deploy CEDEX · LPGlobal Unified CEDEX Liquidity Pool · Transfer Hook program · IssuersIssuer PortalGateway backend


G1


09:15


Bytecode Verification


Verify all deployed bytecode hashes match audited versions — hash mismatch halts launch


—


10:00


Protocol Initialize


Configure CEDEX · initinitialize LPGlobal Pool with permanent lockLP burn · enableactivate Transfer Hook with all 42 controls


G2


10:15


Compliance Activation


Activate KYC/OFAC/SDN screening · AML monitoring · OFACEmpire screeningwhitelist sync · compliance1:1 dashboardattestation oracle


—


10:30


Canary Trading


Open to internalInternal accounts only · test all 642 Transfer Hook verificationscontrols · positive and negative test cases


G3


11:00


Fee Verification


Verify 5% fee collectioncollected andon distributiontest trades · confirm 0.44% routes to protocol/Global Pool · verify no issuer secondary share


—


12:00


Oracle Verification


Confirm 1:1 attestation oracle · TWAP price feed accuracy · EDGAR oracle functionalitypipeline
and

accuracy
—


—
15:00


Public Testnet


Open to 500–1,000 whitelisted testers · $100M simulated volume stress test · circuit breaker trigger test


G4


18:00


Load Testing


Simulate peak load · verify circuit breakers · stress test infrastructureAPI gateway · confirm RPC capacity


—


23:59


Day 1 Complete


All systems operational · monitoring active · Day 2 canary expansion handoff


—


interface
 CanaryTradingVerification
{testAccounts:{count:
🔹





10;
    types:       ['INTERNAL_TEAM', 'COMPLIANCE_OFFICER', 'SECURITY_TEAM'];
    preVerified: true;
  };

  transferHookTests: [
    { hook: 'KYC_VERIFICATION';    testCase: 'Verified wallet can transfer';          negativeTest: 'Unverified wallet blocked' },
    { hook: 'ACCREDITATION_CHECK'; testCase: 'Accredited investor can purchase';       negativeTest: 'Non-accredited blocked' },
    { hook: 'SANCTIONS_SCREENING'; testCase: 'Clean wallet can transfer';              negativeTest: 'SDN-listed wallet blocked' },
    { hook: 'CUSTODY_VERIFICATION'; testCase: 'Backing verified, transfer proceeds';   negativeTest: 'Backing mismatch blocked' },
    { hook: 'CIRCUIT_BREAKER';     testCase: 'Normal trade proceeds';                  negativeTest: '>2% price impact blocked' },
    { hook: 'FEE_COLLECTION';      testCase: '5% fee deducted correctly';              negativeTest: 'Fee bypass blocked' },
  ];

  passCriteria: {
    allTestsPassed:        true;
    zeroSecurityIssues:    true;
    performanceWithinSLA:  true;
  };
}

🔹 13.1.7 
Day 33: Public Mainnet Launch
 
— Gate G5 and G6

TimePublic (UTC)
Milestone
Actions
Gate
08:00
Finalmainnet launch occurs on Day 3 only after a final Go/No-Go
Review Dayreview 1–2at metrics08:00 ·UTC. confirmAll allgates systemsG1–G5 greenmust ·be finalgreen. approval
G5
09:00
PUBLICGate MAINNETG6 LAUNCH
Openis the public launch itself — CEDEX opens to all Empire-verified participants
G6
09:05
investors, the Issuer ApplicationsGateway Open
Beginbegins accepting ST22 Digitalapplications, Securities issuer applications
—
09:10
Full Compliance Active
Activateand full compliance monitoring · real-time alerts ·with SAR automation
—
12:00
First Tradingactivates. Review
ReviewAny firstgate 3failure hoursfrom ofG1–G5 tradingdelays ·public verifylaunch. metrics · address issues
—
18:00
Day 3 Review
Review first 9 hours · issue status report · plan Day 4 priorities
—

🚨 Launch Gate Requirements: Public mainnetNo launch requiresdate ALLis gatessacrosanct (G1–G5)— to pass. Any failed gate triggers launch delaysecurity and escalationcompliance tointegrity CTOtake for resolution. No exceptions — financial infrastructure requires zero-defect launch.precedence.



 

13.1.86  Post-Launch Stabilization (Weeks 2–4)

 






















Week



Activities



Success Metrics


Week 2


MonitorTransaction transactionvolume volumesmonitoring · verify Transfer HooksHook alert review · review compliance alertsalert triage · maintaininfrastructure performance tuning


99.9%+ uptime
99.9% uptime · <1s API latency · 0 security incidents


Week 3


Onboard 10–25 ST22 issuers via Issuer Gateway · process 500–1,000 KYCEmpire KYC/KYB verifications · launchfirst bondingST22 curvesofferings live


10+ issuers active · 500+ verified investors onboarded


Week 4


Analyze transaction patterns · optimize gasSolana CU usage · identify scaling bottlenecks · prepare for 2–4×Phase volume2
increase

Scaling plan completefinalized · bottlenecks identifieddocumented · Phase 2 kickoff ready


 
🔹 13.1.9 Launch Success Criteria

Metric
Target (Week 4)
Stretch Goal
System Uptime
99.9%
99.99%
Active ST22 Issuers
10–25
30+
Verified Investors
500–1,000
2,000+
Security Incidents
0
0
Compliance Violations
0
0


📈13.7 13.2 Four-Phase Growth PhasesPlan
OTCM Protocol follows a structured four-phase growth plan from Genesis through Maturity,Maturity. eachEach phase buildinghas upondefined entry criteria derived from the previous withphase's clearlysuccess definedmetrics. objectives,No metrics,phase begins until its entry criteria are confirmed by the CTO and dependencies.CLO.

 




MarketFullEstablishment

PHASE 1 — GENESIS  |  Q2 2026 Q3–Q4 2026| 2027 2028+
───────          ──────────        ────              ────
Phase 1          Phase 2           Phase 3           Phase 4
GENESIS          BOOTSTRAP         GROWTH            MATURITY
Foundation ScaleEstablishment
&



Partnerships
 Expansion         Ecosystem


🔹 13.2.1 Phase 1: Genesis (Q2 2026)
































Parameter
Specification

TimelineParameter


Specification


Timeline


Q2 2026 (April–June)


Target ST22 Issuers


10–25 initial issuers (— focus on OTC companies with trapped shareholders)shareholder value identified by IDOS


TradingInfrastructure
Volume

$50M–$200M initial trading volume capacity
Infrastructure
Core CEDEX · Transfer Hooks (all 42) · IssuersIssuer PortalGateway · Accredited Investors Gateway (Empire) · compliance monitoring


Regulatory posture


Rule 506(c) active · Form D filed per issuer · Empire Stock Transfer integrated · Release No. 33-11412 Digital Securities classification confirmed


Trading volume capacity


$50M–$200M


Primary Goalgoal


Establish foundation · prove technology · validate product-market fit · zero security incidents


interface
 Phase1Genesis
{deliverables:{infrastructure:'ISSUERS_PORTAL_LIVE',regulatory:'RULE_506C_COMPLIANCE','DIGITAL_SECURITIES_CLASSIFICATION_CONFIRMED',//'FINCEN_BSA_ACTIVE',['FIRST_GRADUATION_ACHIEVED',];};{target:investorsVerified:{min:};min:200_000_000};uptime:complianceViolations:riskFactors:'TECHNOLOGY_BUGS','LOW_INITIAL_ADOPTION','COMPETITOR_RESPONSE',
🔹








[
Genesis 'CEDEX_MAINNET_DEPLOYMENT',Success 'OTCM_LIQUIDITY_POOL_ACTIVE',Metrics
'TRANSFER_HOOK_OPERATIONAL',

'COMPLIANCE_MONITORING_ACTIVE',
Minimum
];

[
Target
'FORM_D_FILED',



Release
ST22 No.issuers 33-11412onboarded
'EMPIRE_STOCK_TRANSFER_LIVE',

];
10
business:

'FIRST_10_ISSUERS_ONBOARDED',
25
'FIRST_500_INVESTORS_VERIFIED',



successMetrics:
Empire-verified {investors
issuersOnboarded:

min:
500
10,

25
1,000
};



500,
System target:uptime
1000

tradingVolumeCapacity:
99.9%
{

50_000_000,
99.99%
target:



0.999;
Security securityIncidents:incidents
0;

0;
0
};

[
0
'REGULATORY_UNCERTAINTY',



];
Compliance }violations


13.2.
0


0


 








PHASE 2 Phase— 2:BOOTSTRAP Bootstrap (|  Q3–Q4 2026)2026  |  Scale and Partnerships


 



































Parameter
Specification

TimelineParameter


Specification


Timeline


Q3–Q4 2026 (July–December)


Target ST22 Issuers


50–150 issuers (4–6× growth from Phase 1)


Institutional partnerships


First institutional partnershipsinvestors · family offices · RIAsRIA partnerships for accreditation verification pipeline


MarketOTCM MakersSecurity Token listing


EnhancedApplication marketto makerCEX incentivelistings program(Binance, ·Kraken, liquidityCoinbase)
mining

Regulatory milestones


Regulatory
Regulation A+ Tier 2 preparation · additional state notice filings · internationalCEDEX explorationATS classification evaluation


Technical milestones


CEDEX v1.5 · enhanced AMM · limit order support · advanced analytics dashboard


Primary Goalgoal


Scale operations · establish institutional credibility · prepare for growth phase


 
🔹

13.2.
Phase 2 entry criteria: (1) 10+ issuers live and trading; (2) 500+ Empire-verified investors; (3) 3+ months clean operating history with zero critical security incidents; (4) all medium-severity audit findings remediated.

 








PHASE 3 Phase— 3:GROWTH Growth (2027)|  2027  |  Market Expansion


 












beyondOTCto
tradingvolume




















Parameter
Specification

TimelineParameter


Specification


Timeline


Full Yearyear 2027


Target ST22 Issuers


200–500 issuers
(expanding



broader Digital Securities)
Daily CEDEX Volume


$200M–$1B
daily


Regulation A+ Tier 2


GlobalSEC Compliance
Multi-jurisdictionqualification compliance architecturereceived · non-accredited investors eligible (10% limit) · $75M annual cap per issuer


Regulation S rollout


Non-U.S. investor participation active · 12-month compliance period enforced by Transfer Hook Control 24


NASDAQ Preplisting


Groovy Company, Inc. ($GROO) NASDAQ listing preparations · audited financials · institutional credibility milestone


Cross-chain


Wormhole read bridge (Phase 1) · EVM representation token evaluation (Phase 2 decision gate)


Primary Goalgoal


Achieve market leadership · establish global presence · prepare for full institutional adoption


 
🔹

13.2.
Phase 3 entry criteria: (1) 50+ issuers active; (2) $100M+ cumulative ST22 transaction volume; (3) Regulation A+ qualification in progress; (4) SOC 2 Type I certification complete.

 








PHASE 4 Phase— 4:MATURITY Maturity (|  2028+)  |  Full Ecosystem


 



































Parameter
Specification

TimelineParameter


Specification


Timeline


2028 and beyond


Institutional Adoptionadoption


Full institutional adoption:participation · banks · broker-dealers · asset managers · ATS registration finalized


OTCM ICO


$100M ICOtarget for· OTCMDutch utilityauction mechanism · public token distribution


International expansion


EU (Dutch auction)
DAO Governance
DAO governance activationMiCA) · decentralizedUK protocol management
International
EU(FCA) · Asia-PacificSingapore (MAS) · LatinJapan America(FSA)
expansion

Cross-chain


EVM compliance layer evaluation · ERC-3643 compatibility assessment


Protocol governance


Governance framework evolution · expanded multi-sig participant set · broader stakeholder participation


Primary Goalgoal


Protocol decentralizationmaturity · global regulatory acceptance · marketself-sustaining maturityecosystem


interface
 Phase4Maturity {
  otcmICO: {
    targetRaise: 100_000_000;  // $100M USD
    mechanism:   'DUTCH_AUCTION';
    tokenDistribution: {
      publicSale:  40;  // 40% to public
      ecosystem:   25;  // 25% ecosystem growth
      team:        15;  // 15% team (4-year vesting)
      treasury:    20;  // 20% protocol treasury
    };
  };

  daoGovernance: {
    activation:          'Q2_2028';
    votingPower:         'TOKEN_WEIGHTED';
    quorum:              0.10;
    proposalThreshold:   100_000;  // 100K OTCM to propose
    governableParameters: [
      'FEE_RATES', 'STAKING_APY_RANGES', 'CIRCUIT_BREAKER_THRESHOLDS',
      'ISSUER_REQUIREMENTS', 'TREASURY_ALLOCATION',
    ];
  };

  internationalExpansion: {
    regions: [
      { name: 'EU',        framework: 'MiCA',       timeline: 'Q1_2028' },
      { name: 'UK',        framework: 'FCA_SANDBOX', timeline: 'Q2_2028' },
      { name: 'SINGAPORE', framework: 'MAS',         timeline: 'Q3_2028' },
      { name: 'JAPAN',     framework: 'FSA',         timeline: 'Q4_2028' },
    ];
    localPartners: true;
    multiCurrency: true;
  };
}


🔹 13.2.5 Milestone Dependencies

Phase 1 (Genesis)
  ├── Security: 0 Critical/High findings in audits
  ├── Regulatory: Rule 506(c) active · Form D filed
  └── Technical: All 42 Transfer Hook controls operational
         ↓ ENABLES
Phase 2 (Bootstrap)
  ├── Business: 10+ issuers onboarded · 500+ verified investors
  ├── Technical: First graduation completed
  └── Financial: 3+ months clean operating history
         ↓ ENABLES
Phase 3 (Growth)
  ├── Business: 50+ issuers · $100M+ TVL
  ├── Regulatory: Reg A+ qualification · Reg S active
  └── Financial: NASDAQ listing preparations underway
         ↓ ENABLES
Phase 4 (Maturity)
  ├── Business: 200+ issuers · $1B+ annual volume
  ├── Governance: DAO activation ready
  └── International: MiCA/FCA applications filed


🎯13.8 13.3 Technical Development Milestones
🔹13.8.1 13.3.1 Smart Contract DevelopmentRoadmap
 














































Quarter
Component
Features
Status

Quarter


Component


Features


Status


Q1 2026


CEDEX Core v1.0 (dev)


BondingCPMM curveAMM · CPMMTransfer Hook foundation · basicstaking Transfer· HooksGlobal (6Pool
hooks)

Development


DEV
Q2 2026


Launch Release


FullAll 42 Transfer Hooks · staking1:1 ·attestation vestingoracle · circuit breakers · Issuer Gateway


LAUNCHLaunch


Q3 2026


CEDEX v1.5


Enhanced AMM · limit orders · advancedanalytics analyticsdashboard · bug bounty program


PLANPlanned


Q4 2026


Cross-chain BridgePhase 1


EthereumWormhole read bridge · multi-chaincustody liquidityattestation aggregationon EVM chains


PLANPlanned


2027


CEDEX v2.0


Full DEX feature parity · institutionalInstitutional trading · darkadvanced pools
PLAN
2028
DAOorder Contracts
Governancetypes · treasurydark managementpool evaluation


Planned


2028


Protocol Governance v2


Expanded multi-sig set · proposalbroader systemparameter governance · cross-chain expansion controls


PLANPlanned


 
🔹13.8.2 13.3.2 Infrastructure Scaling
 
































Phase



RPC Capacity



Database TPS



Geographic Regions
Genesis


Genesis (Q2 2026)


500 req/sec


10K TPS


3 (— US-East · US-West · EU)EU


Bootstrap (Q3–Q4 2026)


2,000 req/sec


50K TPS


5 (— + APAC · LATAM)LATAM


Growth (2027)


10,000 req/sec


200K TPS


8 (— global coverage)coverage


Maturity (2028+)


50,000+ req/sec


1M+ TPS


12+ (— full global)global


 
🔹13.8.3 13.3.3 Security Enhancement Roadmap
•       Q2 2026 — Initial dual-Dual-auditor security certification (Quantstamp + Halborn) + Certora formal verification

•       Q3 2026 — Bug bounty program launch (— $100K initial pool)pool

•       Q4 2026 — SOC 2 Type I certification

•       2027 — SOC 2 Type II certification · ISO 27001 · quarterly penetration testing program formalized

•       2028+ — Formal verification expansion to cross-chain components · insurance coverage ($50M+) target)

 
🌍13.9 13.4 Regulatory Expansion Roadmap
🔹13.9.1 13.4.1 USU.S. Regulatory Path
 



































Timeline



Regulatory Milestone
Impact

Impact


Q2 2026


Rule 506(c) Activeactive + Digital Securities Classificationclassification (Release No. 33-11412)


Accredited investors only · unlimited raise · general solicitation permitted


Q4 2026


Regulation A+ Tier 2 Filingfiling with SEC


Non-accredited investors eligible (10%pending limit)qualification · $75M annual cap


Q2 2027


Regulation A+ Qualification
SEC qualification received


Retail investor participation opens · retailsignificant investorsTAM canexpansion
participate

Q4 2027


NASDAQ Listinglisting ($GROO)


Groovy Company, Inc. listed on NASDAQ · institutional credibility unlocked


2028+


ATS Registrationregistration Evaluationevaluation


Evaluate SEC ATS registration for CEDEX as fully regulated exchange statusvenue


 
🔹13.9.2 13.4.2 International Expansion
 


































Region
Timeline
Framework
Approach

Region


Timeline


Regulatory Framework


Approach


European Union


Q1 2028


MiCA — Markets in Crypto-Assets Regulation


CASP registration · local legal entity formation


United Kingdom


Q2 2028


FCA — Financial Conduct Authority


SandboxRegulatory sandbox participation · full authorization pathway


Singapore


Q3 2028


MAS — Monetary Authority of Singapore


Capital Markets Services license · local partnership


Japan


Q4 2028


FSA/JFSAFSA — Financial Services Agency


Local partnership · Type I licenseFinancial Instruments Business


 
⚠️13.10 13.5 Risk Mitigation &and Contingency Planning
🔹13.10.1 13.5.1 Launch Risk Assessment
 































targetedoutreach















Risk Category
Likelihood
Impact
Mitigation

Likelihood


Impact


Primary Mitigation


Smart Contractcontract Bugvulnerability


LOWLow


CRITICALCritical


Dual audits ·+ formal verification ·+ bug bounty · no launch without all audits green


Regulatory Actionchallenge or inquiry


LOWLow


HIGHHigh


Pre-filing SEC meetingsmeeting · Digital Securities compliance-first design · CLO Jeff Turner (JDT Legal) engaged


Infrastructure Failurefailure


LOWLow


MEDIUMMedium


Multi-region redundancy · automatic failover · 15-min RPO · 1-hour RTO


Low Initialinitial Adoptionissuer adoption


MEDIUMMedium


MEDIUMMedium


IDOS priority queue drives targeted outreach · Groovy Company, Inc. as flagship issuer
·


Market Manipulationmanipulation attempt


MEDIUMMedium


MEDIUMMedium


Circuit breakers · 42 Transfer HooksHook controls · circuit breakers · real-time monitoring · Jito MEV protection


Empire Stock Transfer operational issue


Low


High


Documented failover procedures · contractual SLAs · direct Patrick Mokros escalation path


 
🔹13.10.2 13.5.2 Three-Level Rollback ProceduresFramework
interface
 RollbackProcedures
{triggerConditions:['CRITICAL_SECURITY_VULNERABILITY','PROLONGED_INFRASTRUCTURE_FAILURE',{action:decisionAuthority:true;};level2_freeze:decisionAuthority:








true;{action:'REVERT_TO_LAST_GOOD_STATE';false;'WITHIN_1_HOUR';}







'REGULATORY_STOP_ORDER',
Level
'CATASTROPHIC_DATA_CORRUPTION',

];
Action
rollbackLevels:

level1_pause:
Scope
{

'PAUSE_NEW_TRANSACTIONS';
Decision existingPositions:Authority
'PRESERVED';

'CTO';
Reversible?
reversible:



{
Level action:1 'FREEZE_ALL_OPERATIONS';— existingPositions:Pause
'FROZEN';

'
Pause new transactions only


Existing positions preserved and accessible


CTO (Frank Yglesias)


Yes


Level 2 — Freeze


Freeze all operations


All positions frozen · no transfers


CEO (Berj Abajian) + CTO';CTO
reversible:

};
Yes
level3_rollback:



existingPositions:
Level 'RESTORED_FROM_SNAPSHOT';3 decisionAuthority:— 'BOARD';Rollback
reversible:

};
Revert };to communication:last {verified internal:good 'IMMEDIATE_ALL_HANDS';state
regulators:

users:
Positions 'WITHIN_2_HOURS';restored public:from 'WITHIN_4_HOURS';snapshot
};

Full Board


No


 
🔹13.10.3 13.5.3 Crisis ManagementCommunication Protocol
•       Crisis Commander — CTO Frank Yglesias (primary) or· CEO Berj Abajian (secondary) has· full authority during declared crisis

•       War Room Activation — ImmediateFull team assembly within 15 minutes of incident detection via PagerDuty

•       CommunicationRegulatory CadenceNotification — Hourly status updates internally · 4-hour updates externally
Regulatory NotificationSEC —and SEC/FinCEN notification within 24 hours of any material incident affecting investor assets

•       Communication Cadence — Hourly internal status updates · 4-hour external status page updates during active incident

•       Post-Incident Review — Mandatory root cause analysis within 72 hours of full resolution · published within 30 days

 

13.11✓  Implementation Readiness: OTCM Protocol's implementation roadmap provides a methodical path from development through global maturity. Each phase builds upon proven foundations with clear success criteria, risk mitigation, and contingency planning. The security-first, compliance-always approach ensures sustainable growth while protecting all stakeholders.


🌐 13.6 Cross-Chain Interoperability Roadmap
🔸13.11.1 13.6.1 Strategic Position — Why Solana First Is Not Solana Only
OTCM Protocol launched on Solana as a deliberate architectural choice,choice. not a permanent constraint. This section documents the strategic rationale for the Solana-first approach, the phased cross-chain expansion plan, and the technical mechanisms under evaluation for interoperability.

The Solana-First Rationale

Property
Solana
Ethereum L1
EVM L2s
SPL Token-2022 Transfer Hook support
Native — built-in
Not available
Not available
Compliance enforcement at transfer primitive
Yes — Transfer Hooks
Application layer only
Application layer only
Transaction cost per compliance-verified transfer
~$0.00025
$1–$50+
$0.01–$0.50
Settlement finality
~400ms
12–15 seconds
Varies
42-control enforcement feasibility
Yes — within CU budget
Gas cost prohibitive
Partially feasible

The SPL Token-2022 Transfer Hook is the single most important capability in OTCM'the platform's architecture.design No— no equivalent mechanism exists on Ethereum L1 or any current EVM L2. This is why Solana is not just a preferredpreference: choice — it is the only chain where the OTCM Digital42-control Securitiescompliance architecture as specified can be built today.

 





Is


































Property

WhySolana
Multi-Chain

Still
Ethereum L1


EVM L2s


SPL Token-2022 Transfer Hook (native)


Yes — built-in


Not available


Not available


Compliance enforcement at transfer primitive


Yes — Transfer Hooks


Application layer only


Application layer only


Cost per compliance-verified transfer


~$0.00025


$1–$50+


$0.01–$0.50


Settlement finality


~400ms


12–15 seconds


Varies


42-control sequential enforcement


Yes — within CU budget


Gas cost prohibitive


Partially feasible


 

Despite Solana's architectural advantages, multi-chain expansion is a Strategicstrategic Imperative
imperative: 
Institutionalinstitutional custody infrastructure (FireblocksFireblocks, · BitGo ·BitGo, Anchorage) has deeper EthereumEVM integrationintegration; than Solana
Manymany institutional investors hold capital on EVM chains and prefer not to bridge for new asset exposure
ERC-3643 ($32B+ tokenized)bridge; and Securitize (operating on Ethereum) have established institutional familiarity with EVM-based security tokens
Regulatory frameworks in the EU (MiCA) and UK (FCA) regulatory frameworks have more Ethereum-specific guidanceguidance. thanCross-chain Solana-specificcapability guidance
expands 
the addressable investor base without compromising the Solana compliance architecture.

 
🔸13.11.2 13.6.2 Phased Cross-Chain Expansion Plan
 


























hooks











Phase



Timeline



Milestone



Technical Mechanism


Phase 0
 — Solana Native


Q2 2026


Mainnet launch —· all 42 controls enforced on Solana


SPL Token-2022 Transfer Hooks — no bridge


Phase 1
 — Wormhole Read Bridge


Q4 2026


Read-only custody attestation accessible on EVM chains


Wormhole — oracle message relay only


Phase 2
 — EVM Representation Tokens


Q2 2027


Wrapped ST22 tokens on Ethereum/Base — trading only · compliance enforced on Solana


Wormhole NTT (Native Token Transfers)


Phase 3
 — EVM Compliance Layer


Q4 2027


Subset of Transfer Hook controls ported to EVM via ERC-1363compliance ororacle
custom

ERC-1363 transfer-and-call + compliance oracle


Phase 4
 — Full Multi-Chain Parity


2028+


Independent compliance enforcement on EVM chains for jurisdictions requiring itjurisdictions


ERC-3643 compatibility layer evaluation


 








Critical principle:Principle: Solana remainsRemains theAuthoritative Settlement Layerauthoritative
settlement and compliance layer
 at all times. Cross-chain representations are settlement-linked to Solana state —at theyall times. EVM-side wrapped tokens cannot exist without a corresponding Solana position. No cross-chain architecture will createcreates a parallel token supply that diverges from theSolana. on-chainThe supplyMaster Securityholder File maintained by Empire Stock Transfer on Solana.the off-chain layer remains the legally authoritative ownership record regardless of which chain the token representation is trading on.

 
🔸13.11.3 13.6.3 Phase 1 — Wormhole Integration Architecture

Why Wormhole over alternatives:

Bridge Protocol
Solana Support
Formal Verification
Guardian Network
ST22 Compatibility
Wormhole
Native
Yes (guardian network)
19 validators
Evaluating
LayerZero
Solana support
Partial
Oracle + relayer
Evaluating
Axelar
Limited Solana
Partial
Proof-of-stake
Not preferred
Circle CCTP
USDC only
Yes
N/A
Not applicable


🔸 13.6.4 Phase 2 —EVM NativeInvestor Token Transfer (NTT) ArchitectureDisclosure
Wormhole's Native Token Transfer (NTT) framework enables genuine multi-chain token existence while maintaining a canonical supply on Solana.

Compliance implications of EVM wrapped tokens:

On EVM chains, wrapped ST22 Digital Securities tokens trade under the EVM chain's own transfer rules — OTCM's Transfer Hooks do not execute on EVM. This means:
 
EVM-side transfers are NOTnot subject to OTCM's 42 security controls
controls; EVM-side OFAC screening must be implemented at the application layerlayer; (not hook layer)
Thethe authoritative compliance record remains on Solana
ReturnSolana; and return to Solana (bridge-in) triggers full 42-control Transfer Hook enforcement
enforcement. 
This limitation willis beclearly documenteddisclosed in all investor materials for Phase 2.2 OTCMproducts.
will
 not
represent
13.11.4  Cross-Chain Control Applicability Matrix

 






having

Control Category


Solana (Phase 0)


EVM wrappedPhase tokens2
as

equivalent compliance enforcement to native Solana ST22 Digital Securities tokens until
EVM Phase 3 is complete.


🔸 13.6.5 Phase 3 — EVM Compliance Layer Evaluation

Option A — ERC-1363 Transfer-and-CallTarget


Feature
SPL
Token-2022 Transfer Hook
ERC-1363 transferAndCall
Compliance enforcement mandatory
Yes — cannot be bypassed
No — only if receiver implements interface
Gas cost per compliance check
~$0.00025
$1–$15 per check
Supports 42 sequential controls
Yes — within CU budget
Prohibitive gas cost
Atomic revert on compliance fail
Yes
Yes
DEX compatibility
Custom AMM required
Major DEXs not compatible
Option B — ERC-3643 Compatibility Layer

ERC-3643 (T-REX) is the leading Ethereum security token standard with $32B+ in deployed assets. OTCM is evaluating whether a compatibility wrapper could allow ST22 Digital Securities tokens to be represented as ERC-3643 tokens on Ethereum.

Consideration
Assessment
Institutional familiarity
High — $32B deployed · BlackRock/Hamilton Lane familiar
Compliance enforcement depth
Lower than SPL Transfer Hooks — application layer
Development cost
Medium — wrapper contract + ONCHAINID integration
Time to market
Faster than building custom EVM compliance
Strategic risk
Creates dependency on Tokeny ecosystem

Phase 3 decision gate (Q2 2027): OTCM will evaluate Options A and B based on EVM gas costs, institutional demand, and the state of Ethereum's programmable compliance primitives. A decision document will be published as a governance proposal before Phase 3 development begins.


🔸 13.6.6 Transfer Hook Compliance — Cross-Chain Applicability Summary













3)











5)





6)











Control Category
Enforced on Solana
Enforced on EVM (Phase 2)
Enforced on EVM (Phase 3 target)
Custody verification (Hook1:1 1)attestation)


✅ Every transfer


Via Wormhole read relay


Yes — via oracle


OFAC sanctions/ (HookSDN 2)screening


✅ Every transfer


Application layer only


Partial — gas constrained


AML risk scoring
(Hook

✅ Every transfer


Application layer only


Partial — gas constrained


KYC/KYC / accreditation (Hookcheck
4)

✅ Every transfer


Application layer only


Via ONCHAINID (if ERC-3643)


Circuit breakerbreakers
(Hook

✅ Every transfer


Not enforced


Evaluating


LPGlobal Pool sufficiency
(Hook

✅ Every transfer


Not applicable


Not applicable


Controls 7–42 (all remaining)


✅ Every transfer


Not enforced


Subset only


 

13.11.5⚠️  Investor disclosure: Until Phase 3 is complete, EVM-chain representations of ST22 Digital Securities tokens do not carry equivalent compliance enforcement to native Solana ST22 tokens. This distinction will be clearly disclosed in all marketing materials, token documentation, and investor agreements for cross-chain products.


🔸 13.6.7 Cross-Chain Expansion Governance Requirements
Any cross-chain expansion beyond Phase 1 (read-only) requires aauthorization DAOunder governancethe vote:Protocol Governance and Parameter Management framework (Section 7). The multi-sig thresholds and timelock requirements increase with the significance of the change:

 































Decision



VoteAuthorization ThresholdRequired



Timelock



Required Documentation


Phase 1 activation
— (Wormhole read relay)relay


Simple3-of-5 majoritymulti-sig


48 hours


Technical specification + security audit


Phase 2 activation
— (NTT wrapped tokens)tokens


2/35-of-9 supermajoritymulti-sig


7 days


Full audit + CLO legal opinion on EVM jurisdiction


Phase 3 activation
— (EVM compliance layer)layer


2/35-of-9 supermajoritymulti-sig


14 days


Full audit + compliance equivalence analysis


ERC-3643 compatibility layerevaluation


2/35-of-9 supermajoritymulti-sig


14 days


LegalCLO legal opinion + Tokeny partnership terms review


This governance requirement ensures that the decision to expand beyond Solana is a community decision, not a unilateral management choice, and that institutional investors are aware of and have approved any changes to the Digital Securities compliance architecture they rely upon.







Groovy Company, Inc. dba OTCM Protocol · Wyoming| Corporation ·CIK: invest@otcm.io1499275 · otcm.io|  Version 7.0  |  March 2026  |  Confidential




 
            
    

            
        
    

    

    

    

        

             Back to top