🏛️ Section 7: DAO Governance & Wallet Infrastructure — Layers 7 & 8

---

✅🏛️ SECLayers CATEGORY7 1& COMPLIANT8 |— Issuer-SponsoredDecentralized TokenizedAutonomous SecuritiesOrganization pursuantgovernance toprotecting SECsecurity Divisioncontrols offrom Corporationunilateral Finance, Division of Investment Management,modification, and Divisionthe ofnative TradingWeb3 andwallet Marketsinfrastructure Jointfor Statementcompliant datedST22 Januarytoken 28, 2026management.

---

🏛️ SECTION 7: DAO GOVERNANCE & WALLET INFRASTRUCTURE

🏗️ 7.1 🏛️DAO TheGovernance CategoryArchitecture 1— ComplianceLayer Framework

7

🔹 7.1.1 ⚖️Governance Foundational Principle: ST22s ARE Securities — And That's Our Advantage

Philosophy

PursuantThe OTCM DAO Governance layer exists for a specific and limited purpose: to prevent any single party from unilaterally altering the SECsecurity Divisioncontrols ofthat Corporationprotect Finance,investor Division of Investment Management, and Division of Trading and Markets Joint Statement on Tokenized Securities issued January 28, 2026, Security Tokens 2022 (ST22s) are structured as issuer-authorized tokenized securities representing true equity ownership backed 1:1 by Preferred Series "M" shares held at an SEC-registered transfer agent.

🎯 Strategic Position: OTCM Protocol embraces securities classification for ST22 tokens.assets. This is not agovernance regulatorytheater burden—— it is oura competitivestructural advantageconstraint underon OTCM Protocol, Inc. itself. The company that built the SEC'sprotocol Categorycannot, 1without framework.

on-chain

TheDAO SEC'sapproval January 2026 guidance affirms the technology-neutral principle that has governed securities regulation for decades:

"The format in whichand a security48-hour istimelock, issued orchange the methods by which holders are recorded does not affect application of the federal securities laws." — SEC Joint Statement on Tokenized Securities, January 28, 2026

This regulatory clarification establishes that digital assets backed by real securities are securities regardless of how they are marketed, distributed, or traded. The Commission drew a decisive distinction between two fundamentally different tokenization models:

Category	Description	SEC Treatment
✅ Category 1	Issuer-Sponsored Tokenized Securities	Favored  — True equity ownership with full shareholder rights
❌ Category 2	Third-Party Tokenized Securities	Disfavored  — Heightened scrutiny, retail trading restrictions

OTCM Protocol operates exclusively within Category 1. Our architecture was designed from inception to satisfy the issuer-authorization requirements now formally endorsed by the Commission.

---

7.1.2 📜 Strategic Compliance Objectives

The Category 1 Compliance Framework implements genuine regulatory alignment through four critical strategies designed to satisfy—not circumvent—federal securities law requirements:

✅ Category 1 Requirement Satisfaction

The primary objective requires satisfying all Category 1 requirements through genuine structural measures and institutional-grade infrastructure. Under the SEC's January 2026 guidance, Category 1 tokenized securities must demonstrate:

SEC Requirement	OTCM Implementation	Status
🏛️ Direct issuer authorization	Board resolution required for Series M creation	✅ Compliant
📝 Official shareholder register	Certificate of Designation filed with Secretary of State	✅ Compliant
🔐 Regulated custody	Empire Stock Transfer (SEC-registered transfer agent)	✅ Compliant
💎 True equity backing	1:1 preferred shares with conversion rights	✅ Compliant
🔗 Clear ownership chain	CUSIP assignment + Golden Medallion Guarantee	✅ Compliant
🛡️ Investor protection mechanisms	Protective conversion triggers + 42 Transfer Hook controlsparameters governing the 42 security controls.	✅ Compliant
⚙️ Token standard compliance	SPL Token-2022 with Transfer Hooks	✅ Compliant

🛡️ Investor Protection Excellence

The second objective focuses on implementing investor protections that exceed traditional securities market standards. The SEC's guidance emphasized investor protection as a critical element of compliant tokenization. OTCM's Transfer Hook architecture delivers programmatic, real-time protection that traditional markets cannot match:

Protection Type	Traditional Markets	OTCM Protocol
🔴 Circuit breakers	Exchange-level, discretionary	Protocol-level, automatic, atomic
📊 Concentration limits	Disclosure-based, after-the-fact	Enforced on every transfer
🔒 Insider restrictions	Policy-based, honor system	Code-enforced, mathematically guaranteed
🛡️ Manipulation prevention	Regulatory investigation	Programmatic, real-time prevention

📋 Documentary Compliance

The thirdgovernance objectivescope involvesis creatingdeliberately genuinebounded. complianceInvestors documentationneed supportingassurance that the securities characterization of ST22s. This documentation serves both regulatory compliance and investor protection purposes, providing:

• Contemporaneous evidence of Category 1 structural compliance
• Clear disclosure of securities status and associated risks
• Transparent communication of investor rights and protections
• Audit trails supporting regulatory examination

⚖️ Operational Consistency

The fourth objective requires alignment of all OTCM Protocol activities with securities law compliance in an authentic and sustained manner. This extends beyond marketing communications to encompass technical architecture, governance mechanisms, custody arrangements, and ongoing regulatory reporting.

---

7.1.3 ⚠️ Critical Distinction: What Changed in January 2026

The SEC's January 28, 2026 guidance fundamentally changed the regulatory landscape for tokenized securities. OTCM Protocol has updated its compliance framework accordingly:

❌ Prior Approach (Pre-January 2026)

Prior to the SEC's Category 1/Category 2 taxonomy, some market participants sought commodity or collectible classification for tokenized securities under the "Howey Shield" framework, arguing that tokens serving "entertainment and cultural purposes" might not constitute securities.

✅ Current Approach (Post-January 2026)

The SEC's January 2026 guidance explicitly clarifies that tokens backed by real securities are securities regardless of how they are marketed. The Commission stated:

"The format in which a security is issued or the methods by which holders are recorded does not affect application of the federal securities laws."

OTCM Protocol's Response:

Document/Feature	Pre-Guidance Position	Post-Guidance Position
ST22 Classification	"Digital collectibles" (Howey Shield)	Securities  (Category 1)
Regulatory Strategy	Seeking commodity exemption	Demonstrating Category 1 compliance
Competitive Position	Avoiding securities status	Embracing securities status as advantage
Marketing Language	"Entertainment and cultural purposes"	"SEC-compliant tokenized securities"
Investor Protection	Fraud prevention for collectibles	Securities law compliance

💡 Strategic Insight: Fighting for commodity classification when tokens have real equity backing is now the weaker position. The SEC is cracking down on third-party and synthetic products—OTCM's issuer-authorized model wins by being clearly securities-compliant.

---

7.2 📜 SEC January 2026 Tokenized Securities Guidance

7.2.1 ✅ Comprehensive Analysis of SEC Joint Statement Compliance

The SEC Division of Corporation Finance, Division of Investment Management, and Division of Trading and Markets Joint Statement issued January 28, 2026 represents the most significant regulatory clarification regarding the treatment of tokenized securities under federal securities law. This guidance establishes that issuer-authorized tokenization with regulated custody represents the favored regulatory pathway.

The Joint Statement identifies seven characteristics that, when present, establish Category 1 (Issuer-Sponsored Tokenized Securities) classification. OTCM Protocol has structured ST22s to satisfy each of these requirements:

---

🏛️ 1. Direct Issuer Authorization

SEC Requirement: Securities where the issuing company directly authorizes and integrates blockchain records into its official shareholder register.

OTCM Implementation:

• Board resolution required for all Series M creation
• Certificate of Designation filed with Secretary of State creating official share class
• Issuer actively participates in tokenization process
• Corporate governance documentation supports authorization chain

Compliance Evidence:

Board Resolution → Certificate of Designation → CUSIP Assignment → Token Minting
     ↓                      ↓                        ↓                  ↓
  Issuer Auth        Official Register         Ownership Chain     Category 1

---

📝 2. Official Shareholder Register Integration

SEC Requirement: Integration with official shareholder records through regulated channels.

OTCM Implementation:

• Series M specifications filed with Wyoming Secretary of State
• Empire Stock Transfer maintains official shareholder register
• Blockchain records supplement (not replace) official transfer agent records
• CUSIP assignment provides clear securities identification

---

🏦 3. Regulated Custody

SEC Requirement: Securities held by regulated custodians with appropriate investor protections.

OTCM Implementation:

• Empire Stock Transfer serves as SEC-registered transfer agent
• Qualified custody arrangement under Investment Advisers Act standards
• Permanent deposit mechanism prevents unauthorized withdrawal
• Multi-oracle verification confirms custody status on every transaction

---

💎 4. True Equity Backing

SEC Requirement: Tokens must represent actual ownership rights, not synthetic exposure.

OTCM Implementation:

• 1:1 backing byrequirement, PreferredKYC/AML Series "M" shares
• Real equity ownership with conversion rights
• Not synthetic instruments, derivatives, or mere economic exposure
• Token holders have rights against the issuer, not just intermediary claims

Category 2 Contrast: The SEC explicitly identified synthetic instruments providing "only economic exposure without ownership rights" as disfavored Category 2 products. OTCM's 1:1 preferred share backing provides true equity ownership.

---

🔗 5. Clear Ownership Chain

SEC Requirement: Traceable ownership from token to underlying security.

OTCM Implementation:

• CUSIP assignment for Series M shares
• Golden Medallion Guarantee for share transfers
• On-chain record linked to transfer agent records
• Complete audit trail from token to custody

---

🛡️ 6. Investor Protection Mechanisms

SEC Requirement: Mechanisms protecting investors from counterparty risk, bankruptcy risk,enforcement, and manipulation.

OFAC

OTCM Implementation:

SEC Concern	OTCM Protection
🔴 Counterparty Risk	Direct issuer authorization + SEC-registered custody eliminates intermediary failure
💣 Bankruptcy Risk	Protective conversion triggers ensure token holders receive common stock directly
📊 Manipulation Risk	42 Transfer Hook controls enforce compliance on every transaction
🔒 Custody Risk	Empire Stock Transfer (SEC-registered) provides institutional-grade security

Protective Conversion Triggers:

Trigger Event	Protection Provided
🚨 Issuer bankruptcy	Auto-conversion to common stock, avoiding general creditor status
🚨 Loss of transfer agent services	Automatic conversion preserves shareholder rights
🚨 Criminal indictment of officers	Immediate conversion protects token holders
🚨 Material breach of token holder rights	Enforcement mechanism for issuer obligations

---

⚙️ 7. Token Standard Compliance

SEC Requirement: Technical implementation supporting compliance controls.

OTCM Implementation:

• SPL Token-2022 standard with Transfer Hook extensions
• 42 security controls enforced on every transaction
• Compliance verificationscreening cannot be bypassedquietly ordisabled. disabled
• CEDEXAt tradingthe infrastructuresame maintainstime, fullthe Transferprotocol Hookneeds support

operational

---

flexibility

7.2.2to 🔑adjust Legalfee Foundationrates, graduation thresholds, and RegulatoryAPY Implications

parameters

Theas SEC Joint Statement establishes critical legal principles with direct implications for ST22 regulatory status and OTCM Protocol operations:

✅ Securities Classification Confirmed

ST22 Tokenized Securities are securities under federal securities laws. This classification:

• Provides regulatory clarity forthe market participants
• Enablesevolves. institutionalThe participation
• Createsgovernance architecture creates a clear investorseparation protection framework
• Positions OTCM as compliant infrastructure provider

⚖️ Technology-Neutral Principle

The SEC affirmed that the format in which a security is issued does not affect securities law application. This means:

• Blockchain-based securities are subject to same laws as traditional securities
• Tokenization changes infrastructure, not regulatory status
• Compliance obligations travel with the security regardless of format

🛡️ Category 1 Advantages

Category 1 classification provides significant advantages over Category 2 approaches:

Advantage	Description
🏛️ Regulatory Clarity	Clear framework eliminates classification uncertainty
🏦 Institutional Appeal	Regulated structure enables institutional participation
🛡️ Investor Protection	Full securities law protections apply
📊 Market Access	No retail trading restrictions (unlike Category 2)
🏆 Competitive Moat	Issuer authorization requirement creates barrier to entry

---

7.2.3 📋 Category 2 Distinctions: What OTCM Is NOT

The SEC's guidance explicitly identifies problematic tokenization approaches that OTCM avoids:

❌ Custodial Receipt Models (Category 2)

SEC Concern: Third-party custody arrangements creating "ADR-type" tokens without issuer involvement expose investors to counterparty risk and bankruptcy risk.

OTCM Difference: Direct issuer authorization + SEC-registered custody eliminates intermediary risk entirely.

❌ Synthetic Equity Products (Category 2)

SEC Concern: Security-based swaps or linked securities providing only economic exposure without ownership rights cannot trade off-exchange to retail.

OTCM Difference: True 1:1 equity backing provides actual ownership, not synthetic exposure.

❌ Unauthorized Tokenization (Category 2)

SEC Concern: Tokenization without issuer involvement creates legal uncertainty and investor confusion.

OTCM Difference: Board resolution required—issuer is active participant in tokenization process.

---

7.3 ⚖️ Token Classification Framework

7.3.1 📊 The Two-Token Structure

OTCM Protocol operates with two distinct token types, each with different regulatory treatment:

Token	Classification	Regulatory Framework	Backing
📜 ST22 Tokenized Securities	Securities	SEC Category 1	1:1 Preferred Series "M" shares
🎫 OTCM Utility Token	Utility Token	Non-securities (separate analysis)	None (utility and governance)

⚠️ Critical Distinction: The regulatory analysis forbetween these two tokens is completely different. ST22 tokens ARE securities. The OTCM Utility Token is analyzed separately under utility token principles.

---

7.3.2 📜 ST22 Tokenized Securities: Securities Classification

Why ST22s Are Securities

ST22 Tokenized Securities satisfy the securities classification because they:

1. Are backed by real securities (Series M preferred shares)
2. Convey ownership rights (1:1 equity backing with conversion rights)
3. Are issued with direct issuer authorization (board resolution required)
4. Are held in regulated custody (SEC-registered transfer agent)
5. Represent investment in the issuing company (equity ownership)

Under the Howey test framework, ST22s would satisfy all four prongs—and this is expected and intentional:

Howey Prong	ST22 Analysis	Implication
💰 Investment of Money	✅ Purchasers provide value for tokens	Securities characteristic
🏢 Common Enterprise	✅ Linked to issuing company's fortunes	Securities characteristic
📈 Expectation of Profits	✅ Token value tied to equity backing	Securities characteristic
👥 Efforts of Others	✅ Issuing company's business operations	Securities characteristic

🎯 Strategic Position: OTCM does not argue that ST22s fail the Howey test. We argue that Category 1 classification provides the clearest regulatory pathway for compliant tokenized securities.

Compliance Framework for ST22s

As securities, ST22s operate within established securities law frameworks:

Compliance Area	OTCM Implementation
📋 Registration	Regulation D 506(c) offering for qualified investors
🪪 Investor Verification	KYC/AML + accredited investor verification
📊 Disclosure	Comprehensive risk disclosures and offering documents
🏦 Custody	SEC-registered transfer agent
📈 Trading	CEDEX compliant trading venue with full Transfer Hook support

---

7.3.3 🎫 OTCM Utility Token: Separate Analysis

The OTCM Utility Token is structured and marketed as a utility token with functionality and governance rights, distinct from ST22 Tokenized Securities. This token requires separate regulatory analysis.categories.

OTCM🔹 Utility7.1.2 TokenGovernable Characteristics

vs.

Characteristic	Implementation
🗳️Non-Governable Governance Rights	DAO voting on protocol parameters
💰 Fee Discounts	10-50% trading fee reductions based on holdings
🥩 Staking Rewards	8-40% APY through issuer staking nodes
⚙️ Platform Utility	Access to premium features and services

Utility Token Analysis Under Howey

The OTCM Utility Token may be analyzed under traditional Howey principles, though the SEC's January 2026 guidance focused on tokenized securities rather than utility tokens:

Howey Prong	OTCM Utility Token Analysis
💰 Investment of Money	⚠️ Purchasers provide value (prong likely satisfied)
🏢 Common Enterprise	❓ Token economics independent of OTCM profitability
📈 Expectation of Profits	⚠️ Staking rewards create profit expectations
👥 Efforts of Others	❓ Value derived from utility, not primarily promoter efforts

⚠️ Compliance Note: OTCM maintains conservative compliance posture for the Utility Token, implementing appropriate investor verification and disclosure regardless of ultimate classification.

Utility Token Disclosure Framework

Even if the OTCM Utility Token does not constitute a security, OTCM implements comprehensive disclosures:

• Clear description of utility functions and governance rights
• Risk disclosures regarding token value volatility
• Explanation of staking mechanics and reward structures
• Acknowledgment that regulatory classification may evolve

---

7.4 🔧 Technical Implementation: Mathematically-Enforced Compliance

7.4.1 🔒 The 42 Security Controls Framework: Category 1 Investor Protection

The OTCM Protocol implements 42 comprehensive security controls enforced via SPL Token-2022 Transfer Hook on every transaction. These controls represent the technical foundation of Category 1 investor protection—mathematically-enforced compliance that exceeds traditional securities market standards.

🎯 Category 1 Alignment: The SEC's January 2026 guidance emphasized investor protection mechanisms as essential for compliant tokenization. OTCM's Transfer Hook architecture delivers protections that cannot be circumvented, satisfying this requirement through code rather than policy.

Control Categories and Category 1 PurposeParameters

Category	ControlsGovernable?	Category 1 PurposeRationale
🔍Transaction Balancefee Validationrate (5%)	9Yes controls— DAO vote	VerifyCommercial transactionparameter; eligibility,does detectnot anomaliesaffect security controls
📊Staking LimitsAPY &range Restrictions(8–60%)	11Yes controls— DAO vote	PreventEconomic concentration,parameter; ensureaffects fairtoken marketsholders proportionally
💹Graduation Poolthreshold & Trading($75K)	8Yes controls— DAO vote	MaintainMarket liquidity,parameter; preventreflects manipulationevolving liquidity conditions
🔐TWAP Authorizationwindow (15–60 min)	5Yes controls— DAO vote	EnforceOracle role-basedparameter access,with multi-sigconstrained requirementsbounds
🧮IDOS MathematicalAI Safetyscoring weights	3Yes controls— DAO vote	PreventCommercial overflow/underflow,intelligence ensure precisionparameter
⚙️1:1 Configurationbacking requirement	6NO controls— immutable	ProtectCore protocolinvestor parameters,protection; governcannot upgradesbe weakened
KYC/AML requirement	NO — immutable	Federal law compliance; cannot be bypassed
OFAC screening (Hook 2)	NO — immutable	Federal sanctions law; cannot be disabled
Transfer Hook logic	NO — requires supermajority + external audit	Security-critical code
Permanent LP lock	NO — requires 2/3 supermajority + 48h timelock	Investor asset protection

Key🔹 Investor Protection Controls

Control	Function	Category 1 Benefit
📊 4.99% Wallet Limit	Prevents any address from holding >4.99% of supply	Prevents whale manipulation
🔴 Circuit Breaker	Halts trading on 30% price drop for 24 hours	Prevents panic cascades
⏰ Vesting Enforcement	Enforces issuer token lockups on every transfer	Prevents insider dumps
🛡️ Protective Conversion	Auto-converts to common stock on adverse events	Bankruptcy protection
🤖 Anti-MEV Protection	Jito bundle integration prevents frontrunning	Fair execution
💧 Liquidity Ratio	Maintains minimum liquidity requirements	Market stability

---

7.4.2 ⚙️ Transfer Hook Program Implementation

The Transfer Hook is the foundational compliance layer that validates every token transfer against all 42 security controls. Implemented using the Solana SPL Token-2022 program's Transfer Hook extension, this mechanism operates at the protocol level—it is not possible to transfer ST22 tokens without triggering Transfer Hook validation.

Execution Flow

┌─────────────────────────────────────────────────────────────────┐
│                    TOKEN TRANSFER INITIATED                     │
└─────────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────────┐
│  🔍 TRANSFER HOOK INVOKED (Atomic, Cannot Be Bypassed)          │
├─────────────────────────────────────────────────────────────────┤
│  ✓ Hook 1: Custody Verification (1:1 backing confirmed)         │
│  ✓ Hook 2: OFAC Screening (sanctions compliance)                │
│  ✓ Hook 3: AML Verification (risk scoring)                      │
│  ✓ Hook 4: KYC/Accreditation Check (investor verification)      │
│  ✓ Hook 5: Price Impact Limit (anti-manipulation)               │
│  ✓ Hook 6: Liquidity Ratio (market stability)                   │
│  ✓ [36 additional controls...]                                  │
└─────────────────────────────────────────────────────────────────┘
                              ↓
              ┌───────────────┴───────────────┐
              ↓                               ↓
┌─────────────────────┐         ┌─────────────────────┐
│  ✅ ALL CHECKS PASS  │         │  ❌ ANY CHECK FAILS  │
│  Transfer Executes  │         │  Transfer Rejected  │
│                     │         │  (Investor Protected)│
└─────────────────────┘         └─────────────────────┘

Implementation Code

// Transfer Hook - Category 1 Investor Protection Implementation
pub fn process_transfer_hook(
    ctx: Context<TransferHook>,
    amount: u64,
) -> Result<()> {
    let transfer_context = TransferContext::from_accounts(&ctx)?;
    
    // Execute all 42 Category 1 compliance controls
    for control in SECURITY_CONTROLS.iter() {
        match control.validate(&transfer_context, amount) {
            ControlResult::Pass => continue,
            ControlResult::Fail(error) => {
                // Log compliance event for audit trail
                emit!(ComplianceRejection {
                    control_id: control.id,
                    error_code: error.code,
                    category1_violation: true,
                });
                // Atomic rejection - investor protected
                return Err(error.into());
            }
        }
    }
    
    // All controls passed - transfer compliant
    emit!(ComplianceVerified {
        transfer_id: ctx.accounts.transfer_id,
        controls_passed: 42,
        category1_compliant: true,
    });
    
    Ok(())
}

🛡️ Atomic Guarantee: If any control fails, the entire transaction reverts atomically. Non-compliant transfers cannot execute, even partially. This is investor protection that cannot be circumvented.

---

7.4.1.3 🐋Voting Maximum Wallet Limit: Preventing Concentration

The 4.99% maximum wallet limit prevents any single address from accumulating sufficient tokens to manipulate market prices or execute coordinated attacks. This control operates continuously on every transfer.

// Category 1 Investor Protection: Concentration Limit
pub fn validate_wallet_limit(
    destination:Tiers &Pubkey, amount:Token u64,
    mint_info: &MintInfo,
) -> Result<(), ComplianceError> {
    let current_balance = get_token_balance(destination)?;
    let post_transfer_balance = current_balance.checked_add(amount)
        .ok_or(ComplianceError::MathOverflow)?;
    
    // 4.99% maximum (499 basis points)
    let max_allowed = mint_info.supply
        .checked_mul(499)?
        .checked_div(10_000)?;
    
    require!(
        post_transfer_balance <= max_allowed,
        ComplianceError::WalletLimitExceeded // Error 6005
    );
    
    Ok(())
}

Category 1 Purpose: Prevents whale accumulation that enables market manipulation—a key investor protection mechanism.

---

7.4.4 🚨 Circuit Breaker: Automated Trading Halts

The circuit breaker monitors price movements and automatically halts trading when thresholds are breached, preventing flash crash scenarios and providing time for market assessment.

// Category 1 Investor Protection: Circuit Breaker
pub fn check_circuit_breaker(
    current_price: u64,
    reference_price: u64,
    config: &CircuitBreakerConfig,
) -> Result<(), ComplianceError> {
    // Calculate price drop percentage
    let price_drop = reference_price.saturating_sub(current_price);
    let drop_percentage = price_drop
        .checked_mul(10_000)?
        .checked_div(reference_price)?;
    
    // Default threshold: 30% (3000 basis points)
    if drop_percentage >= config.threshold_bps {
        emit!(CircuitBreakerTriggered {
            price_drop_bps: drop_percentage,
            cooldown_hours: 24,
            investor_protection: true,
        });
        return Err(ComplianceError::CircuitBreakerActive);
    }
    
    Ok(())
}

Category 1 Purpose: Prevents panic cascades and coordinated manipulation—protecting investors from flash crash losses.

---

7.4.5 📅 Vesting Schedule Enforcement

Vesting enforcement prevents market flooding through structured token release, ensuring that insiders cannot dump positions regardless of market conditions.

// Category 1 Investor Protection: Vesting Enforcement
pub fn validate_vesting(
    sender: &Pubkey,
    amount: u64,
    vesting_schedule: &VestingSchedule,
) -> Result<(), ComplianceError> {
    let vested_amount = vesting_schedule.calculate_vested(Clock::get()?.unix_timestamp);
    let already_transferred = vesting_schedule.transferred_amount;
    let available = vested_amount.saturating_sub(already_transferred);
    
    require!(
        amount <= available,
        ComplianceError::VestingViolation // Error 6008
    );
    
    Ok(())
}

Vesting Schedule:

Tranche	Release	Timing
1️⃣	20%	At token creation
2️⃣	20%	At graduation ($75K market cap)
3️⃣	20%	6 months post-graduation
4️⃣	20%	12 months post-graduation
5️⃣	20%	18 months post-graduation

Category 1 Purpose: Prevents insider dumps that harm retail investors—mathematically-enforced rather than policy-based.

---

7.4.6 🔄 CEDEX: Transfer Hook Compliant Trading Infrastructure

The discovery that major DEXs (Raydium, Orca, Meteora) disable Transfer Hooks upon graduation necessitated building custom trading infrastructure. Without Transfer Hook support, all 42 security controls would be eliminated—destroying Category 1 investor protections.

The Problem with External DEXsRequirements

ExternalProposal DEXType	Token-2022Min. SupportStake to Vote	Transfer HooksQuorum	CategoryPassage 1 CompliantThreshold
RaydiumStandard parameter change	PartialGold (50,000 OTCM)	❌10% Disabledof staked	❌Simple Nomajority (>50%)
OrcaFee structure change	PartialGold (50,000 OTCM)	❌15% Disabledof staked	❌Supermajority No(>60%)
MeteoraTransfer Hook parameter	PartialPlatinum (100,000 OTCM)	❌25% Disabledof staked	❌Supermajority No(>66%)
CEDEXLP lock override	FullPlatinum (100,000 OTCM)	✅33% Activeof staked	✅Supermajority Yes(>66%) + 48h timelock
Emergency security patch	3/4 of core team multi-sig	N/A	3-of-4 multi-sig + 48h timelock

CEDEX🔹 Solution7.1.4 Proposal Lifecycle

CEDEXAll governance proposals follow a standardized five-stage lifecycle:

• Stage 1 — Submission (CompliantDay Exchange)0): isProposer OTCM'sstakes customminimum AMMrequired thatOTCM nativelytokens supportsand submits proposal on-chain with full specification of parameter changes and rationale.
• Stage 2 — Discussion (Days 1–3): 72-hour community discussion period. Proposer may not amend the proposal during this window. Counter-proposals may be submitted.
• Stage 3 — Voting (Days 4–8): 5-day on-chain voting window. Token-2022weighted votes recorded immutably. Voting power snapshot taken at proposal submission time.
• Stage 4 — Timelock (Days 9–10): Passed proposals enter a mandatory 48-hour timelock before execution. This window allows community response to unexpected passages.
• Stage 5 — Execution (Day 11+): Timelock expires and proposal executes automatically on-chain. For Transfer Hook functionality,changes, ensuringexternal everyaudit trade executes under the same security model as bonding curve transactions.

  ┌─────────────────────────────────────────────────────────────────┐
  │                    USER SWAP REQUEST                            │
  └─────────────────────────────────────────────────────────────────┘
                                ↓
  ┌─────────────────────────────────────────────────────────────────┐
  │                    CEDEX AMM ENGINE                             │
  │              (Full Token-2022 Support)                          │
  └─────────────────────────────────────────────────────────────────┘
                                ↓
  ┌─────────────────────────────────────────────────────────────────┐
  │              TOKEN-2022 TRANSFER HOOK INVOKED                   │
  │              (All 42 Controls Verified)                         │
  └─────────────────────────────────────────────────────────────────┘
                                ↓
  ┌─────────────────────────────────────────────────────────────────┐
  │              COMPLIANT SWAP EXECUTED                            │
  │              (Category 1 Investor Protection Active)            │
  └─────────────────────────────────────────────────────────────────┘

  🛡️ Category 1 Guarantee: CEDEX ensures that investor protections remain active throughout the entire token lifecycle—from bonding curve through graduation to mature trading.

  ---

  7.5 🏦 Multi-Party Compliance Architecture

  7.5.1 📋 OTCM Protocol Compliance Components

  OTCM Protocol implements comprehensive compliance architecture addressing all aspects of Category 1 requirements:

  Component	Function	Category 1 Purpose
  📜 Securities Positioning	All materials clearly identify ST22s as tokenized securities	Clear regulatory classification
  🪪 Investor Verification	KYC/AML + accredited investor verification	Compliance with securities offering requirements
  ⚠️ Risk Disclosures	Comprehensive securities risk warnings	Informed investor consent
  ⚙️ Automated Compliance	Transfer Hooks enforce controls automatically	Mathematically-enforced investor protection
  🏦 Custody Integration	Oracle verification of 1:1 backing	True equity backing confirmation

  ---

  7.5.2 🏛️ Transfer Agent (Empire Stock Transfer) Compliance

  Empire Stock Transfer, serving as SEC-registered qualified custodian for underlying securities, implements institutional-grade custody satisfying Category 1 requirements.

  Transfer Agent Role

  Function	Description	Category 1 Requirement
  📋 Share Registration	Official shareholder register maintenance	✅ Official shareholder register
  🔐 Permanent Custody	Series M shares held under permanent deposit	✅ Regulated custody
  🔍 Oracle Verification	Real-time balance attestation	✅ True equity backing
  📊 Audit Support	Quarterly attestations, regulatory examination support	✅ Compliance documentation

  Custody Verification Integration

  // Empire Stock Transfer Custody Verification
  interface CustodyVerification {
      cusip: string;
      shareCount: bigint;
      lastVerified: Date;
      transferAgentSignature: string;
      category1Compliant: boolean;
      
      // Confirms 1:1 backing on every transaction
      async verifyBacking(tokenSupply: bigint): Promise<boolean>;
  }

  ---

  7.5.3 🏢 Issuer Compliance Requirements

  Participating issuers whose securities are tokenized through the ST22 mechanism implement Category 1 authorization requirements:

  Required Issuer Actions

  Requirement	Implementation	Category 1 Purpose
  🏛️ Board Resolution	Formal authorization of Series M creation	Direct issuer authorization
  📜 Certificate of Designation	Filed with Secretary of State	Official shareholder register
  🆔 CUSIP Application	Official securities identifier	Clear ownership chain
  📋 Disclosure Updates	SEC filings address tokenization	Investor disclosure

  Sample Board Resolution Language

  RESOLVED, that the Corporation hereby authorizes the creation of 
  1,000,000,000 shares of Preferred Series "M" Stock for the express 
  purpose of tokenization through OTCM Protocol pursuant to SEC 
  Category 1 (Issuer-Sponsored Tokenized Securities) guidelines;
  
  FURTHER RESOLVED, that such shares shallmust be depositedcompleted withbefore Empire 
  Stock Transfer, an SEC-registered transfer agent, under permanent 
  custody arrangements supporting the issuance of ST22 Tokenized 
  Securities backed 1:1 by said Preferred Series "M" shares;
  
  FURTHER RESOLVED, that ST22 tokens representing said shares 
  constitute securities under federal securities laws and shall be 
  marketed and traded as such.

  ---

  7.6 ✅ Category 1 Implementation Framework

  7.6.1 🎯 Compliance Checklist

  The following checklist confirms Category 1 compliance:

  Issuer Authorization ✅

  • [ ] Board resolution authorizing Series M creation
  • [ ] Certificate of Designation filed with Secretary of State
  • [ ] Corporate governance documentation complete
  • [ ] CUSIP application submitted and approvedexecution.

  Regulated🔹 Custody7.1.5 ✅Security Control Governance — Special Requirements

  • [

    Any ]proposal Empire Stock Transfer engagement agreement executed

  • [ ] Series M shares deposited under permanent custody
  • [ ] Oracle verification system operational
  • [ ] Custody attestation procedures established

  True Equity Backing ✅

  • [ ] 1:1 backing ratio maintained and verified
  • [ ] Conversion rights documented
  • [ ] Protective conversion triggers implemented
  • [ ] Oracle verification on every transaction

  Investor Protection ✅

  • [ ] 42affecting Transfer Hook controlslogic implemented
  • [— ]adding, Circuitremoving, breakeror configuredmodifying and tested
  • [ ] Wallet concentration limits enforced
  • [ ] Vesting schedules implemented

  Securities Compliance ✅

  • [ ] Regulation D 506(c) offering documentation
  • [ ] Accredited investor verification procedures
  • [ ] Risk disclosure documents prepared
  • [ ] Ongoing compliance monitoring established

  ---

  7.6.2 📋 Documentation Requirements

  Required Documents

  Document	Purpose	Category 1 Requirement
  📜 Board Resolution	Authorizes Series M creation	Direct issuer authorization
  📋 Certificateany of Designation	Createsthe official share class	Official shareholder register
  🏦 Custody Agreement	Establishes Empire Stock Transfer arrangement	Regulated custody
  📊 Offering Memorandum	Securities offering documentation	Securities compliance
  ⚠️ Risk Disclosures	Investor warnings and acknowledgments	Investor protection
  🔐 Transfer Hook Specification	42 security controls documentation— carries additional requirements beyond the standard proposal lifecycle:	Minimum 14-day advance notice broadcast before voting opens Independent security audit of proposed code changes required before execution Audit report published on-chain as part of the proposal record Platinum tier voting requirement (100,000 OTCM minimum stake) 66%+ supermajority passage threshold 48-hour timelock after passage regardless of urgency These requirements exist because Transfer Hook modifications affect every ST22 token transfer across every issuer on the platform simultaneously. A single flawed change could disable investor protections for thousands of token holders. The friction is intentional. 📐 7.2 Web3 Wallet Infrastructure — Layer 8 🔹 7.2.1 Wallet Architecture Philosophy TechnicalLayer 8 bridges the compliance

  ---

  architecture

  7.of Layers 2–7 📊with Riskthe Assessmentend Matrix

  investor

  experience. The OTCM wallet is not a generic Solana wallet with a whitelist — it is a purpose-built securities wallet where KYC/AML compliance is embedded in the onboarding flow, ST22 token interactions are the primary use case, and institutional custody requirements are first-class design considerations.

  The wallet is non-custodial: private keys are generated and stored on the user's device. OTCM Protocol never has access to user private keys. Hardware wallet support provides an additional custody option for institutional investors requiring air-gapped key storage.

  🔹 7.7.12.2 ✅KYC/AML CategoryEnforcement 1at the Wallet Layer

  Compliance Assessmentis enforced at two levels: at the wallet application layer during onboarding, and at the Transfer Hook layer during every on-chain transaction. The wallet layer check is a user experience optimization — it prevents investors from attempting transactions that Transfer Hooks would reject, reducing friction and eliminating failed transaction fees.

  RequirementCompliance Gate	StatusLayer	ConfidenceWhen Applied	EvidenceFail Behavior
  🏛️Identity Directverification issuer authorization(KYC)	✅Layer Compliant8 wallet	99%During account creation	BoardAccount resolutioncreation + Certificate of Designationblocked
  📝AML Officialrisk shareholder registerscoring	✅Layer Compliant8 wallet	99%During onboarding + periodic refresh	SecretaryAccount ofrestricted Statepending filing + CUSIPreview
  🏦OFAC Regulated custodyscreening	✅Layer Compliant8 wallet	99%Real-time on wallet activation	EmpireAccount Stockblocked; Transfercompliance (SEC-registered)team notified
  💎Accreditation True equity backingcheck	✅Layer Compliant8 wallet	99%Before ST22 purchase attempts	1:1Purchase backingblocked; +accreditation oracleflow verificationtriggered
  🔗Transfer ClearHook ownership chainexecution	✅Layer Compliant2	99%Every on-chain transfer	CUSIPTransaction + Golden Medallion
  🛡️ Investor protection	✅ Compliant	99%	42 Transfer Hook controls
  ⚙️ Token standard compliance	✅ Compliant	99%	SPL Token-2022reverts with Transfererror Hookscode

  Overall

  🔹 Category7.2.3 1Application Compliance: 99%

  ---

  7.7.2 📈 Competitive Position Analysis

  Dimension	Category 2 Competitors	OTCM Protocol (Category 1)
  ⚖️ Regulatory Status	Disfavored, heightened scrutiny	Favored, clear framework
  🏦 Institutional Access	Limited, compliance concerns	Enabled, regulatory clarity
  🛡️ Investor Protection	Counterparty/bankruptcy risk	Protected, conversion triggers
  📊 Market Access	Retail restrictions possible	Full market access
  🏆 Competitive Moat	Easily replicated	Issuer authorization barrier

  ---

  7.8 📜 Legal Citations and References

  7.8.1 ⚖️ Primary Legal Authorities

  SEC Joint Statement on Tokenized Securities (January 28, 2026)Features

  Citation: SEC Division of Corporation Finance, Division of Investment Management, and Division of Trading and Markets, Joint Statement on Tokenized Securities (January 28, 2026).

  URL: https://www.sec.gov/newsroom/speeches-statements/corp-fin-statement-tokenized-securities-012826

  Key Holdings:

  • Establishes Category 1 (Issuer-Sponsored) vs. Category 2 (Third-Party) taxonomy
  • Confirms technology-neutral principle for securities regulation
  • Identifies investor protection requirements for compliant tokenization
  • Clarifies that tokens backed by securities are securities

  SEC v. W.J. Howey Co., 328 U.S. 293 (1946)

  Citation: SEC v. W.J. Howey Co., 328 U.S. 293 (1946).

  Relevance: Establishes the investment contract test for securities classification. ST22 tokens satisfy Howey requirements as expected for securities-backed tokens.

  Securities Act of 1933

  Citation: 15 U.S.C. § 77a et seq.

  Relevance: Governs registration requirements for securities offerings. ST22 offerings operate under Regulation D 506(c) exemption.

  Securities Exchange Act of 1934

  Citation: 15 U.S.C. § 78a et seq.

  Relevance: Governs trading in securities. ST22 secondary trading operates within applicable frameworks.

  ---

  7.8.2 📋 Regulatory References

  ReferenceFeature	ApplicationDescription
  RegulationMulti-issuer D, Rules 501-508portfolio	ExemptionUnified frameworkdashboard for all ST22 offeringstoken holdings across all issuers on CEDEX
  RegulationTransaction Shistory	Non-U.S.Full investoraudit accesstrail frameworkof all ST22 transfers with compliance event log
  WyomingCompliance Digitalstatus	Real-time AssetKYC/AML Corporationverification Statutesstatus with renewal reminders
  CEDEX integration	Embedded CEDEX trading interface — buy/sell ST22 without leaving wallet
  Staking dashboard	OTCM corporateSecurity organizationToken staking management; epoch tracking; reward display
  SECRedemption Transfer Agent Rulesworkflow	EmpireGuided StockSeries TransferM share redemption process with EST confirmation
  Push notifications	Launch alerts for new ST22 issuers; compliance renewal reminders
  Institutional mode	Multi-sig approval flows; hardware wallet signing; bulk transaction management

  ---

  🔹

  7.92.4 📋Hardware SectionWallet Summary

  Integration

  ✅

  Institutional Keyinvestors Principles

  and high-net-worth individuals requiring air-gapped private key storage may connect Ledger or Trezor hardware wallets to the OTCM wallet application. All transaction signing is handled by the hardware device — the OTCM application constructs and serializes the transaction but never accesses the signing key. Transfer Hook execution occurs normally regardless of signing method; the hardware wallet provides signing security without affecting on-chain compliance enforcement.

  🔹 7.2.5 Performance Specifications

  PrincipleMetric	ImplementationSpecification
  ST22sPlatform are securitiessupport	CategoryiOS 116+ issuer-sponsoredand tokenizedAndroid securities12+ native apps
  ComplianceWallet iscreation competitive advantagetime	Category< 160 frameworkseconds providesincluding regulatorykey moatgeneration
  InvestorKYC/AML protection through codeonboarding	4215–30 Transferminutes Hook(document controlsupload enforce+ compliance mathematicallyverification)
  TrueTransaction equitysigning backinglatency	1:1< preferred200ms shares,software notwallet; synthetic< exposure3s hardware wallet (user confirmation required)
  RegulatedCEDEX custodyorder submission	SEC-registered< transfer100ms agentfrom order confirmation to network broadcast
  Balance sync cadence	Real-time via Helius RPC WebSocket subscription
  Supported tokens	All ST22 tokens listed on CEDEX + OTCM Security Token
  Hardware wallets supported	Ledger Nano S/X/S Plus, Trezor Model T/Safe

  🏆 Category 1 Advantages

  • ✅ Clear regulatory framework from SEC January 2026 guidance
  • ✅ Institutional participation enabled through regulatory certainty
  • ✅ Investor protections exceeding traditional market standards
  • ✅ Competitive moat from issuer authorization requirements
  • ✅ Full market access without Category 2 retail restrictions

  🎯 Strategic Position

  OTCM Protocol demonstrates that regulatory compliance and market innovation are complementary objectives. By embracing securities classification under the SEC's Category 1 framework, OTCM provides the compliant infrastructure that institutional participants require while delivering investor protections that exceed traditional market standards.

  ---

  © 2026 OTCM Protocol, Inc. | All Rights Reserved

  Aligned with SEC Division of Corporation Finance, Division of Investment Management, and Division of Trading and Markets Joint Statement dated January 28, 2026

  ST22 Tokenized Securities are securities under federal securities laws. This document is for informational purposes only and does not constitute an offer to sell or solicitation of an offer to buy any securities.