⚖️ Section 11: Regulatory Compliance Framework

📜 Section 11: Conclusion

✅⚖️ SECOTCM CATEGORYProtocol's 1comprehensive COMPLIANTlegal |framework Issuer-Sponsored Tokenized— Securities pursuantAct tocompliance, SECExchange DivisionAct ofobligations, CorporationTransfer Finance,Agent Divisionregulations, ofAML/BSA Investment Management,requirements, and Divisionimmutable ofaudit Tradingtrail and Markets Joint Statement dated January 28, 2026architecture.

⚖️ SECTION 11: REGULATORY COMPLIANCE FRAMEWORK

✅ 11.1 🌍Securities TransformativeAct Marketof Infrastructure

🔹 11.1.1 Regulatory Foundation

Pursuant to comprehensive15 technical,U.S.C. financial,Section and77a regulatoryet analysisseq. presented(Securities inAct of 1933), any offer or sale of securities within the precedingUnited sectionsStates ofrequires thiseither whitepaper,SEC registration or an applicable exemption. OTCM Protocol representsexplicitly transformativestructures institutional-gradeST22 markettokens infrastructureas addressingsecurities offerings, relying upon established exemptions rather than attempting regulatory arbitrage or circumvention.

📋 15 U.S.C. § 77e — Prohibitions Relating to Interstate Commerce and the Mails

It shall be unlawful for any person, directly or indirectly, to make use of any means or instruments of transportation or communication in interstate commerce or of the mails to sell a fundamentalsecurity failureunless a registration statement is in globaleffect as to such security, or the security or transaction is exempt from registration.

"OTCM Protocol embraces securities regulation rather than attempting to circumvent it. ST22 tokens are securities by design, utilizing established exemptions that have enabled capital markets:formation thefor systematicdecades."

This ofcompliance-first illiquidapproach provides several strategic advantages:

• Legal Certainty: Explicit securities fromclassification efficient price discovery and liquidity mechanisms.

  💡 "We're not disrupting functioning markets. We're creating permanent, Category 1 compliant markets where none exist."

  ---

  11.1.1 🔍 The Problem We Solve

  Thousands of publicly traded companies exist ineliminates regulatory limbo—theirambiguity

• Investor sharesProtection: legallyFull tradeabledisclosure butrequirements practicallyprotect impossibleinvestors
• Institutional toAcceptance: buyTraditional orfinancial sell.institutions Thesecan companiesengage completedwithout SECregulatory registration,risk
• Enforcement filedCooperation: periodicProactive reports,compliance andreduces maintainenforcement legitimaterisk

🔹 bases.11.1.2 YetRegulation whenD theyRule lost506(c) 15c2-11 eligibility, their shareholders lost access to functioning markets.

Implementation

The currentprimary situationexemption createsutilized for ST22 offerings is Regulation D Rule 506(c), which permits unlimited-dollar offerings to verified accredited investors with general solicitation:

📋 17 CFR Section 230.506(c) — Conditions to be Met in Offerings Subject to Limitation on Manner of Offering

An issuer may offer and sell securities pursuant to section 4(a)(2) of the Securities Act if: (1) The issuer is not a paradox:disqualified issuer under § 230.506(d); (2) All purchasers of securities are accredited investors; (3) The issuer takes reasonable steps to verify that purchasers are accredited investors.

// Rule 506(c) Offering Structure (TypeScript)

Traditionalinterface solutions—regainingRule506cOffering 15c2-11 eligibility, reverse mergers, going-private transactions—require $100,000+ in legal and accounting fees, 6-12 months of effort, and often fail due to regulatory complexity. Shareholders remain trapped.{

// 
11.1.2Offering 💰 The Magnitude of Trapped Value

Market Segment
💰 Estimated Trapped Value
🇺🇸 
U.S. OTC Markets (Expert Market)
$25-30 Billion
🇺🇸 
U.S. OTC Markets (Grey Market)
$10-15 Billion
🌍 
International Illiquid Securities
$15-20 Billion
💰 
TOTAL ADDRESSABLE MARKET
$50+ BILLION
identification

ThisofferingId: represents real shareholder value—retirement accounts, employee compensation, inheritance, and investment capital—rendered practically worthless by market structure failure, not by any deficiency in the underlying businesses.string;

issuerId:

string;

formDFileNumber: string;

// Regulatory classification

exemption: {

type: 'RULE_506C';

cfrReference: '17 CFR 230.506(c)';

generalSolicitationPermitted: true;

accreditedInvestorsOnly: true;

verificationRequired: true;

};

// Bad actor check

badActorCheck: {

completed: boolean;

checkDate: Date;

coveredPersons: CoveredPerson[];

disqualifyingEvents: DisqualifyingEvent[]; // Empty if clear

status: 'CLEAR' | 'DISQUALIFIED' | 'WAIVER_GRANTED';

};

// Verification method tracking

verificationMethods: {

income: {

documentsRequired: ['TAX_RETURN_Y1', 'TAX_RETURN_Y2'];

thirdPartyVerifier?: string;

};

netWorth: {

documentsRequired: ['ASSET_STATEMENT', 'LIABILITY_STATEMENT'];

excludePrimaryResidence: true;

};

professional: {

licenses: ['SERIES_7', 'SERIES_65', 'SERIES_82'];

finraVerification: boolean;

};

};

// Form D filing

formD: {

initialFilingDate: Date;

firstSaleDate: Date;

amendmentDates: Date[];

totalAmountSold: number;

totalNumberInvestors: number;

};

}

🔹 11.1.3 🔺Rule The506(c) Trilemmavs Solution

Prior to OTCM Protocol and the SEC's January 28, 2026 Category 1 framework, securities markets faced an impossible trilemma. Any platform could achieve at most two of three critical objectives:

PERMISSIONLESS ACCESS
                           /\
                          /  \
                         /    \
                        /      \
                       /   ❌    \
                      /  Traditional \
                     /   Markets      \
                    /     Cannot       \
                   /      Achieve       \
                  /        All Three     \
                 /________________________\
    REGULATORY                              COUNTERPARTY
    COMPLIANCE                              RISK ELIMINATION
         \                                      /
          \              OTCM                  /
           \           PROTOCOL              /
            \             ✅                /
             \     Category 1             /
              \    Compliant            /
               \________________________/

The SEC's Category 1 framework changed everything. By establishing clear regulatory guidance for issuer-authorized tokenized securities, the Commission created a pathway to achieve all three objectives simultaneously.

11.1.4 🎯 Simultaneous Objective Achievement Through Category 1

OTCM Protocol achieves simultaneous satisfaction of three historically contradictory objectives through SEC Category 1 compliant architecture:

💡 Architecture Philosophy: OTCM Protocol combines centralized compliance infrastructure for Category 1 requirements with decentralized token-level security for transaction execution. This hybrid approach captures the benefits of both paradigms while satisfying the SEC's investor protection objectives.

11.2 💡 Key Innovations

OTCM Protocol introduces five foundational innovations that together create the first Category 1 compliant, permanent, and liquid trading infrastructure for securities excluded from traditional markets.

11.2.1 🏦 CEDEX: Purpose-Built Category 1 Securities Exchange

The Compliant Exchange for Digital Securities (CEDEX) represents the first purpose-built decentralized exchange architecture designed specifically for Category 1 compliant tokenized securities trading.

⚠️ Why CEDEX Exists: The External DEX ProblemComparison

Major decentralized exchanges (Raydium, Orca, Meteora) disable Transfer Hooks upon graduation, eliminating all 42 security controls and removing Category 1 investor protections. CEDEX was built specifically to maintain full Transfer Hook compliance throughout the token lifecycle.

11.2.2 💧 OTCM Liquidity Pool: Permanent Capital Foundation

The OTCM Liquidity Pool introduces a four-mechanism capital accumulation architecture that creates permanent, non-withdrawable trading liquidity:

┌─────────────────────────────────────────────────────────────────┐
│              OTCM LIQUIDITY POOL ACCUMULATION                   │
│                  (Category 1 Market Stability)                  │
└─────────────────────────────────────────────────────────────────┘

    ┌──────────────┐    ┌──────────────┐    ┌──────────────┐
    │  GRADUATION  │    │   TRADING    │    │   STAKING    │
    │    FUNDS     │    │    FEES      │    │  REINVEST    │
    │     40%      │    │     2%       │    │     2%       │
    └──────┬───────┘    └──────┬───────┘    └──────┬───────┘
           │                   │                   │
           └───────────────────┼───────────────────┘
                               ▼
                    ┌──────────────────────┐
                    │   PERMANENT LOCKED   │
                    │   LIQUIDITY POOL     │
                    │                      │
                    │   LP Tokens Burned   │
                    │   (0x000...dead)     │
                    │                      │
                    │   WITHDRAWAL:        │
                    │   IMPOSSIBLE         │
                    └──────────────────────┘

Category 1 Significance: Unlike Category 2 models where intermediary failure can strand investors, OTCM's permanent liquidity locks ensure markets cannot be "rugged"—counterparty risk eliminated.

11.2.3 🪝 SPL Token-2022 Transfer Hooks: Category 1 Investor Protection

OTCM Protocol leverages Solana's SPL Token-2022 standard to implement 42 built-in security controls that execute atomically with every transaction—mathematically-enforced Category 1 investor protection:

Category 1 Advantage: Mathematical vs. Policy Protection

11.2.4 🏢 Issuers Portal: Democratized Category 1 Tokenization

The Issuers Portal democratizes Category 1 compliant securities tokenization by eliminating the prohibitive compliance burden that previously limited tokenization to well-funded issuers:

11.2.5 ⚔️ The Alesia Doctrine: Mathematical Category 1 Security

OTCM Protocol's security architecture follows the Alesia Doctrine—a strategic framework inspired by Julius Caesar's legendary siege of Alesia, where dual fortifications simultaneously contained internal threats and repelled external attacks.

┌─────────────────────────────────────────────────────────────────┐
│                    THE ALESIA DOCTRINE                          │
│              (Category 1 Mathematical Security)                 │
└─────────────────────────────────────────────────────────────────┘

     EXTERNAL THREATS                    INTERNAL THREATS
     (Contravallation)                   (Circumvallation)
           │                                   │
           ▼                                   ▼
    ┌─────────────┐                     ┌─────────────┐
    │ Bot Attacks │                     │ Insider     │
    │ MEV/Sandwich│                     │ Manipulation│
    │ Flash Loans │                     │ Rugpulls    │
    └──────┬──────┘                     └──────┬──────┘
           │                                   │
           └───────────────┬───────────────────┘
                           ▼
              ┌─────────────────────────┐
              │   42 TRANSFER HOOKS     │
              │   (Category 1 Defense)  │
              │                         │
              │   • Circuit Breakers    │
              │   • Wallet Limits       │
              │   • Custody Verification│
              │   • Vesting Enforcement │
              │   • OFAC Screening      │
              │   • MEV Protection      │
              └─────────────────────────┘

💡 "Mathematical certainty takes precedence over policy-based protections. Our 42 built-in security controls, permanent liquidity locks, and circuit breakers create Category 1 investor protection that cannot be circumvented through smart contract enforcement rather than relying on human oversight alone."

11.3 🔮 Vision Statement

11.3.1 🏗️ Creating Category 1 Markets Where None Exist

OTCM Protocol isexclusively notutilizes competingRule with506(c) existingrather marketthan infrastructure.Rule We are not attempting506(b) to disruptenable NASDAQ,general NYSE,solicitation orwhile OTCmaintaining Marketsfull Group.regulatory These platforms serve their constituencies effectively.

Instead, OTCM Protocol creates permanent, Category 1 compliant markets for securities that currently have no market at all. When a company loses 15c2-11 eligibility, when shares become trapped in the Grey Market, when international securities lack U.S. trading venues—OTCM Protocol provides the SEC-endorsed solution.

💡 "We're not disrupting functioning markets. We're creating permanent, Category 1 compliant markets where none exist."

11.3.2 🌐 The Fully Tokenized Future

OTCM Protocol envisions a future where every illiquid micro-cap company has access to permanent, Category 1 compliant, and liquid trading infrastructure:compliance:

💡 eliminatedStrategic Choice: 506(c)

OTCM Protocol uses 506(c) exclusively because general solicitation is essential for digital marketing, social media outreach, and public awareness campaigns. The verification burden is offset by automated third-party verification through the Issuers Portal.

🔹 11.1.4 Section 4(a)(1) Exemption

📋 15 U.S.C. Section 77d(a)(1) — Exempted Transactions

The provisions of section 77e of this title shall not apply to transactions by any person other than an issuer, underwriter, or dealer.

ST22 primary offerings utilize Section 4(a)(1) structure enabling issuing companies to distribute tokens directly to investors through portal infrastructure without intermediary broker-dealer involvement:

• Direct Distribution: Issuers distribute tokens directly to investors via Portal
• No Broker-Dealer: Eliminates BD commission structure (typically 5-10%)
• Portal as Technology: OTCM Portal provides technology infrastructure, not broker services
• Issuer Control: Companies maintain control over their capital raise

// Section 4(a)(1) Distribution Structure

interface Section4a1Distribution {

/**

• Section 4(a)(1) permits transactions by persons other than
• issuers, underwriters, or dealers without registration

*/

distributionType: 'DIRECT_ISSUER_TO_INVESTOR';

// No broker-dealer involvement

brokerDealer: null;

// Issuer distributes directly

distributor: {

type: 'ISSUER';

companyName: string;

cik: string;

};

// Portal provides technology only

portalRole: {

type: 'TECHNOLOGY_PLATFORM';

services: [

'KYC_VERIFICATION',

'ACCREDITATION_VERIFICATION',

'TRANSACTION_PROCESSING',

'COMPLIANCE_RECORDKEEPING',

];

isBrokerDealer: false;

earnsCommission: false;

};

// Fee structure (flat, not commission-based)

fees: {

mintingFee: '$1,000 - $25,000'; // One-time

transactionFee: '5% of volume'; // Protocol fee, not broker commission

};

}

🔹 11.1.5 Regulation A+ Tier 2 Framework

For offerings targeting non-accredited investors, OTCM Protocol implements Regulation A+ Tier 2 compliance:

📋 17 CFR Section 230.251 — Scope of Exemption

Regulation A provides an exemption from registration for certain securities offerings. Tier 2 permits offerings up to $75,000,000 in any 12-month period to both accredited and non-accredited investors.

🔹

11.3.31.6 🔐Regulation S Offshore Transactions

For non-US investor participation, OTCM Protocol implements Regulation S compliance:

📋 17 CFR Section 230.903 — Conditions to be Met

Securities offered or sold in an offshore transaction are not subject to the registration requirements of section 5 of the Act if (1) the offer or sale is made in an offshore transaction; (2) no directed selling efforts are made in the United States; and (3) applicable conditions are satisfied.

// Regulation S Structure

interface RegulationSOffering {

// Offshore transaction requirements

offshoreTransaction: {

buyerLocation: string; // Non-US jurisdiction

noUSPersonPurchasers: boolean;

transactionExecutedOffshore: boolean;

};

// No directed selling efforts

directedSellingEfforts: {

usMediaAdvertising: boolean; // Must be false

usTargetedWebsite: boolean; // Must be false

usInvestorMeetings: boolean; // Must be false

};

// Category 1: Mathematical Certainty Over Policydetermination

Traditionalcategory: investor'CATEGORY_1' protection| relies'CATEGORY_2' on| policies,'CATEGORY_3';

// andDistribution humancompliance oversight.period Policies(Category can3 be- ignored.Equity)

distributionCompliance: can be bypassed. Human oversight fails.{

period: 40; // 40 days for equity

flowbackRestriction: boolean;

legendRequired: boolean;

distributorCertification: boolean;

};

// Buyer certification

buyerCertification: {

nonUSPersonCertified: boolean;

residencyVerified: boolean;

verificationMethod: 'DOCUMENT' | 'IP_GEOLOCATION' | 'BOTH';

};

}

🔹 11.1.7 Form D Filing Requirements

OTCMSEC Protocol'sForm CategoryD 1filings architectureare replacesrequired policy-basedfor protectionall withRule mathematical506(c) certainty:offerings:

🔹

11.3.41.8 💪Information EmpoweringProvision Companies and Shareholders

OTCM Protocol existsimplements comprehensive disclosure through on-chain information provision:

• Quarterly Reports: 10-Q equivalent reports published on-chain within 45 days of quarter end
• Annual Reports: 10-K equivalent reports published on-chain within 90 days of fiscal year end
• Current Reports: 8-K equivalent reports for material events within 4 business days
• Financial Statements: Audited annual financials (GAAP or IFRS)
• Risk Factors: Comprehensive risk disclosure updated quarterly

// Issuer Disclosure Requirements

interface IssuerDisclosure {

// Quarterly disclosure (10-Q equivalent)

quarterlyReports: {

frequency: 'QUARTERLY';

deadline: '45_DAYS_AFTER_QUARTER_END';

contents: [

'FINANCIAL_STATEMENTS',

'MD&A',

'RISK_FACTORS_UPDATE',

'CAPITALIZATION_TABLE',

];

format: 'PDF_AND_STRUCTURED_DATA';

storageLocation: 'IPFS_WITH_ONCHAIN_HASH';

};

// Annual disclosure (10-K equivalent)

annualReports: {

frequency: 'ANNUAL';

deadline: '90_DAYS_AFTER_FISCAL_YEAR_END';

auditRequired: true;

auditStandard: 'PCAOB' | 'AICPA';

};

// Current reports (8-K equivalent)

currentReports: {

triggeringEvents: [

'MATERIAL_ACQUISITION_DISPOSITION',

'BANKRUPTCY_RECEIVERSHIP',

'CHANGE_IN_CONTROL',

'EXECUTIVE_OFFICER_CHANGE',

'MATERIAL_IMPAIRMENT',

];

deadline: '4_BUSINESS_DAYS';

};

}

✅ 11.2 Securities Exchange Act of 1934 Compliance

🔹 11.2.1 Exchange Act Overview

Pursuant to serve15 twoU.S.C. constituenciesSection 78a et seq., the Securities Exchange Act of 1934 regulates secondary trading of securities, including antifraud provisions, disclosure requirements, and market manipulation prohibitions. CEDEX achieves Exchange Act compliance through Categorya 1portal-integrated compliantregulatory infrastructure:framework.

📋 15 U.S.C. § 78j — Manipulative and Deceptive Devices

It shall be unlawful for any person, directly or indirectly, by the use of any means or instrumentality of interstate commerce or of the mails, or of any facility of any national securities exchange, to use or employ, in connection with the purchase or sale of any security, any manipulative or deceptive device or contrivance.

🏢🔹 For11.2.2 Companies:Rule 10b-5 Antifraud Provisions

OTCM Protocol implements Rule 10b-5 compliance through unprecedented on-chain transparency:

📋 17 CFR 240.10b-5 — Employment of Manipulative and Deceptive Devices

It shall be unlawful for any person: (a) To employ any device, scheme, or artifice to defraud; (b) To make any untrue statement of a material fact or to omit to state a material fact necessary in order to make the statements made, in the light of the circumstances under which they were made, not misleading; or (c) To engage in any act, practice, or course of business which operates or would operate as a fraud or deceit upon any person.

👥

// ForRule Shareholders:

// (a) No fraudulent schemes

// (b) No material misstatements

// (c) No fraudulent acts

// Beneficial Ownership Disclosure

// 5% threshold monitoring

// Disclosure triggers

// On-chain registry

// Automatic filing assistance

// Series M Custody Architecture

// Physical custody

// Certificate details

// 1:1 backing verification

// Redemption capability

// Shareholder Registry Structure

// Registry entry for each beneficial owner

// Shareholder identification

// Ownership details

// Blockchain linkage

// Compliance status

// Registry reconciliation

// Monthly Audit Report Structure

// Audit period

// Independent auditor

// Share reconciliation

// Registry accuracy

// Custody verification

// On-chain publication

// OFAC Screening Implementation

// SDN list integration

// Screening scope

// Screening execution

// Comprehensive sanctions programs

// SAR Filing Automation

// SAR filing triggers

// SAR content

// Filing process

// Confidentiality

// CTR Filing Structure

// Filing threshold

// CTR content (unlikeFinCEN CategoryForm 2104)

// Filing timeline

// Immutable Compliance Record Architecture
┌─────────────────────────────────────────────────────────────────────────────┐
│                  OTCMIMMUTABLE PROTOCOLCOMPLIANCE │RECORD │              SEC Category 1 Compliant Infrastructure                        │
│           for Issuer-Sponsored Tokenized SecuritiesARCHITECTURE               │
└─────────────────────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────────────┐
│                    COMPLIANCE EVENT OCCURS                          │
│   (KYC Verification, Accreditation, AML Screening, Transaction)     │
└───────────────────────────────┬─────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────┐
│                     THERECORD PROBLEMGENERATION                               │
│  • Hash sensitive data (documents, PII)                             │
│  • Create compliance record with metadata                           │
│  • Sign with compliance officer Ed25519 key                         │
└───────────────────────────────┬─────────────────────────────────────┘
│
┌───────────────────────┼───────────────────────┐
│                       │                       $50+│
billion▼                       in▼                       shareholder▼
value┌───────────────┐      trapped┌───────────────┐      in┌───────────────┐
illiquid│   securitiesSOLANA      │      │     withIPFS      no│      functioning│   marketsENCRYPTED   │
│  BLOCKCHAIN   │      │   STORAGE     │      │   DATABASE    │
│               │      │               │      │               │
│ • Record hash │      │ • Full docs   │      │ • PII data    │
│ • Timestamp   │      │ • Reports     │      │ • KYC docs    │
│ • Signature   │      │ • Audit logs  │      │ • Tax forms   │
│ • IPFS hash   │      │               │      │               │
└───────────────┘      └───────────────┘      └───────────────┘
│                       │                       │
└───────────────────────┼───────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────┐
│                    VERIFICATION CAPABILITIES                        │
│  • Timestamp proof via Solana slot                                  │
│  • Content integrity via SHA-256 hash                               │
│  • Officer authorization via Ed25519 signature                      │
│  • Document retrieval via IPFS hash                                 │
└─────────────────────────────────────────────────────────────────────────────┘

// ────────────Compliance │Record │Data CategoryStructures

// Record identification

// │Subject │identification

// Compliance determination

// Evidence references (hashes only on-chain)

// IPFS storage references

// Cryptographic signature

// Cryptographic Proof Standards

// Timestamp proof

// Document integrity proof

// Authorization proof

// Chain of custody proof

OTCM Protocol's compliance-first design results in LOW overall regulatory risk. The explicit securities structure, established exemptions, SEC-registered transfer agent partnership, and investorcomprehensive protectionAML exceedingframework traditionalprovide marketsstrong │regulatory └─────────────────────────────────────────────────────────────────────────────┘foundation. ↓Medium ┌─────────────────────────────────────────────────────────────────────────────┐ │ THE OPPORTUNITY │ │ ─────────────── │ │ • Issuers: Category 1 tokenizationrisks in 2-4Exchange weeksAct forpositioning $1K-$25Kand │international │compliance •are Investors:actively Accessmanaged tothrough compliantongoing tokenizedlegal securitiescounsel globally │ │ • Partners: Build on Category 1 compliant infrastructure │ │ │ │ Contact: issuers@otcm.io | invest.otcm.io | partners@otcm.io │ └─────────────────────────────────────────────────────────────────────────────┘

© 2026 OTCM Protocol, Inc. | All Rights Reservedengagement.

Aligned with SEC Division of Corporation Finance, Division of Investment Management, and Division of Trading and Markets Joint Statement dated January 28, 2026━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

ST22 Tokenized Securities are securities under federal securities laws. The OTCM Utility Token is a utility token that is NOT backed by securities. This document is for informational purposes only and does not constitute an offer to sell or solicitation of an offer to buy any securities.