🏢 Section 9: Issuers Portal Compliance Gateway
🏢 The compliance gateway through which issuers onboard, investors verify eligibility, and all KYC/AML requirements are enforced before any ST22 token interaction.
🏢 SECTION 9: ISSUERS PORTAL COMPLIANCE GATEWAY
⚠️ 9.1 Institutional Purpose & Problem Statement
Prior to OTCM Protocol development, companies seeking to issue tokenized securities confronted a prohibitive compliance burden that effectively excluded smaller and mid-tier issuers from the digital securities market. The complexity, cost, and specialized expertise required created an insurmountable barrier for companies lacking substantial legal and compliance infrastructure.
🔹 9.1.1 The Traditional Compliance Burden
Companies attempting independent securities tokenization must establish and maintain comprehensive regulatory infrastructure across six critical domains:
- KYC/AML Infrastructure: Build or license identity verification platforms with document authentication, biometric matching, and sanctions screening capabilities
- Securities Counsel: Retain specialized securities law firms with digital asset expertise for offering documentation, regulatory filings, and ongoing compliance advice
- Transfer Agent Services: Engage SEC-registered transfer agents for shareholder registry maintenance, custody verification, and regulatory reporting
- Custody Arrangements: Establish relationships with qualified custodians for physical certificate storage and digital asset custody
- Regulatory Reporting: Hire compliance staff for SEC filings, Form D submissions, and ongoing disclosure requirements
- Transaction Monitoring: License blockchain analytics platforms for AML screening, suspicious activity detection, and regulatory reporting
🔹 9.1.2 Cost Analysis: Independent vs. OTCM Portal
The following analysis compares the annual cost of establishing independent compliance infrastructure versus utilizing the OTCM Issuers Portal:
| Compliance Function | Independent (Low) | Independent (High) | OTCM Portal |
|---|---|---|---|
| KYC/AML Platform | $150,000 | $500,000 | Included |
| Securities Counsel | $200,000 | $750,000 | Included |
| Transfer Agent | $50,000 | $150,000 | Included |
| Custody Services | $75,000 | $200,000 | Included |
| Regulatory Reporting | $100,000 | $300,000 | Included |
| Transaction Monitoring | $75,000 | $200,000 | Included |
| TOTAL ANNUAL COST | $650,000 | $2,100,000 | $1K-$25K* |
- One-time SMT minting fee; ongoing compliance included in 5% transaction fee structure
💡 Cost Reduction Impact
For a company raising $5M through tokenized securities, traditional compliance costs ($650K-$2.1M) could consume 13-42% of capital raised. OTCM Portal reduces this to 0.02-0.5%, making tokenization economically viable for mid-market issuers.
🔹 9.1.3 OTCM Solution Architecture
OTCM Protocol eliminates issuer regulatory burden through a purpose-built Issuers Portal that consolidates all compliance, identity verification, transaction monitoring, and regulatory reporting functions under a single, standardized, institutional-grade framework:
"Issuers utilize our portal rather than developing independent compliance infrastructure, achieving full regulatory compliance without requiring specialized securities law expertise or expensive external counsel."
🔹 9.1.4 Portal Component Overview
// OTCM Issuers Portal Architecture Diagram
┌─────────────────────────────────────────────────────────────────────────────┐
│ OTCM ISSUERS PORTAL ARCHITECTURE │
│ (Unified Compliance Gateway) │
└─────────────────────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────────────────┐
│ ISSUER ADMINISTRATION DASHBOARD │
│ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌─────────────┐ │
│ │ Company │ │ Token │ │ Investor │ │ Compliance │ │
│ │ Profile │ │ Analytics │ │ Registry │ │ Dashboard │ │
│ └───────────────┘ └───────────────┘ └───────────────┘ └─────────────┘ │
└─────────────────────────────────────────────────────────────────────────┘
│
┌─────────────────────────────┼─────────────────────────────┐
│ │ │
▼ ▼ ▼
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ KYC MODULE │ │ ACCREDITATION │ │ AML/SCREENING │
│ │ │ MODULE │ │ MODULE │
│ • ID Verification│ │ • 506(c) Verify │ │ • Risk Scoring │
│ • Biometrics │ │ • Self-Cert │ │ • OFAC Check │
│ • Doc Auth │ │ • Third-Party │ │ • SAR Filing │
│ • Address Proof │ │ • Reg A+ Limits │ │ • Tx Monitoring │
│ • Source of Funds│ │ • Expiration Mgmt│ │ • Account Freeze │
└────────┬─────────┘ └────────┬─────────┘ └────────┬─────────┘
│ │ │
└───────────────────────┼───────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────────┐
│ THIRD-PARTY INTEGRATION LAYER │
│ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌───────────┐ ┌─────────────────┐ │
│ │ Jumio │ │ Onfido │ │ Socure │ │Chainalysis│ │ TRM Labs │ │
│ │ (ID) │ │ (Docs) │ │ (Fraud) │ │ (AML) │ │ (Forensics) │ │
│ └─────────┘ └─────────┘ └─────────┘ └───────────┘ └─────────────────┘ │
└─────────────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────────┐
│ ON-CHAIN COMPLIANCE RECORD LAYER │
│ (Immutable Audit Trail on Solana Blockchain) │
└─────────────────────────────────────────────────────────────────────────┘
│
┌───────────────────────────┼───────────────────────────┐
│ │ │
▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ Empire Stock │ │ SEC EDGAR │ │ FinCEN BSA │
│ Transfer │ │ Filings │ │ E-Filing │
│ (Custody) │ │ (Form D, etc)│ │ (SAR, CTR) │
└───────────────┘ └───────────────┘ └───────────────┘
🔹 9.1.5 Issuer Onboarding Workflow
The Portal implements a structured onboarding workflow for new issuers:
| Step | Phase | Actions | Timeline |
|---|---|---|---|
| 1 | Application | Submit company info, share structure, tokenization goals | Day 1 |
| 2 | Due Diligence | Corporate verification, officer KYC, AML screening | Days 2-5 |
| 3 | Legal Setup | Series M preferred authorization, OTCM agreements | Days 5-10 |
| 4 | Transfer Agent | Empire Stock Transfer custody setup, share issuance | Days 10-15 |
| 5 | Token Minting | ST22 creation with Transfer Hooks, liquidity setup | Day 15-17 |
| 6 | LIVE | Bonding curve active, trading enabled | Day 17+ |
🪪 9.2 Integrated KYC Framework
The OTCM Portal implements comprehensive identity verification pursuant to federal regulatory requirements, ensuring all investors are properly identified before participating in securities offerings.
🔹 9.2.1 Regulatory Foundation
📋 31 CFR § 1010 — Bank Secrecy Act KYC Requirements
Financial institutions must establish Customer Identification Programs (CIP) that verify customer identity through documentary or non-documentary methods, including collection of name, date of birth, address, and identification number.
The Portal exceeds minimum BSA/AML requirements by implementing enhanced due diligence measures appropriate for securities offerings to accredited and qualified investors.
🔹 9.2.2 Four-Pillar Identity Verification
The Portal requires four primary identity verification components before investment eligibility is confirmed:
// Four-Pillar KYC Verification Interface (TypeScript)
interface KYCVerificationPillars {
/**
-
Pillar 1: Legal Name Verification
-
Matches user-provided name against government-issued ID
*/
legalName: {
firstName: string;
middleName?: string;
lastName: string;
suffix?: string;
verificationMethod: 'OCR_EXTRACTION' | 'MANUAL_REVIEW';
matchConfidence: number; // 0-100%
};
/**
-
Pillar 2: Residential Address Verification
-
Confirms current physical residence through official documents
*/
residentialAddress: {
street: string;
city: string;
state: string;
postalCode: string;
country: string;
verificationDocument: 'UTILITY_BILL' | 'BANK_STATEMENT' | 'GOVT_CORRESPONDENCE';
documentDate: Date; // Must be within 90 days
documentHash: string;
};
/**
-
Pillar 3: Beneficial Ownership Confirmation
-
Identifies ultimate beneficial owner of investment funds
*/
beneficialOwnership: {
ownershipType: 'INDIVIDUAL' | 'JOINT' | 'CORPORATE' | 'TRUST' | 'IRA';
ultimateBeneficiary: string;
ownershipPercentage: number; // For entities
controlPerson?: boolean; // For entities
supportingDocuments: string[]; // Document hashes
};
/**
-
Pillar 4: Source of Funds Declaration
-
Documents origin of investment capital
*/
sourceOfFunds: {
primarySource: 'EMPLOYMENT' | 'BUSINESS' | 'INVESTMENTS' | 'INHERITANCE' | 'OTHER';
description: string;
estimatedAmount: number;
supportingEvidence?: string; // Document hash if provided
riskLevel: 'LOW' | 'MEDIUM' | 'HIGH';
};
}
| Pillar | Requirement | Acceptable Documents |
|---|---|---|
| 1. Legal Name | Full legal name as appears on government ID | Passport, Driver's License, National ID, Residence Permit |
| 2. Address | Current physical residence verified within 90 days | Utility bill, Bank statement, Government letter, Tax document |
| 3. Beneficial Owner | Ultimate beneficial owner of funds | Articles of incorporation, Trust certificate, IRA custodian letter |
| 4. Source of Funds | Origin of investment capital documented | Pay stubs, Business financials, Investment statements, Inheritance docs |
🔹 9.2.3 Document Authentication Pipeline
The Portal employs a multi-layer document authentication pipeline to prevent identity fraud and ensure document authenticity:
// Document Authentication Pipeline Interface
interface DocumentAuthenticationResult {
// Document Classification
documentType: DocumentType;
issuingCountry: string;
documentNumber: string;
expirationDate: Date;
isExpired: boolean;
// Machine-Readable Zone (MRZ) Validation
mrzPresent: boolean;
mrzValid: boolean;
mrzChecksumPass: boolean;
mrzDataExtracted: {
surname: string;
givenNames: string;
nationality: string;
dateOfBirth: string;
documentNumber: string;
};
// Security Feature Detection
securityFeatures: {
hologramDetected: boolean;
uvFeaturesValid: boolean;
microTextPresent: boolean;
opticalVariableDevice: boolean;
laserPerforation: boolean;
};
// Tampering Detection
tamperingAnalysis: {
fontConsistency: number; // 0-100 score
edgeAnalysis: number; // 0-100 score
colorConsistency: number; // 0-100 score
compressionArtifacts: boolean; // JPEG artifact detection
digitalManipulation: boolean; // Photoshop detection
};
// OCR Data Extraction
extractedData: {
fullName: string;
dateOfBirth: Date;
address?: string;
documentNumber: string;
issuanceDate: Date;
expirationDate: Date;
};
// Final Determination
overallScore: number; // 0-100 composite score
status: 'APPROVED' | 'MANUAL_REVIEW' | 'REJECTED';
rejectionReasons?: string[];
}
enum DocumentType {
PASSPORT = 'PASSPORT',
DRIVERS_LICENSE = 'DRIVERS_LICENSE',
NATIONAL_ID = 'NATIONAL_ID',
RESIDENCE_PERMIT = 'RESIDENCE_PERMIT',
UTILITY_BILL = 'UTILITY_BILL',
BANK_STATEMENT = 'BANK_STATEMENT',
}
🔹 9.2.4 Biometric Verification System
Liveness verification prevents identity fraud through real-time biometric analysis:
| Verification | Technology | Accuracy |
|---|---|---|
| Facial Recognition | AI-powered comparison between selfie and ID document photo using 128-point facial geometry analysis | 99.6% |
| Liveness Detection | Active challenges (blink, turn head, smile) prevent photo/video replay attacks | 99.8% |
| 3D Depth Analysis | Infrared depth mapping detects flat images, printed photos, or screen displays | 99.9% |
| Anti-Spoofing | Detection of masks, deepfakes, synthetic media, and injection attacks | 99.5% |
🔹 9.2.5 Third-Party Provider Integration
OTCM Portal integrates with industry-leading identity verification providers to ensure comprehensive coverage and redundancy:
| Provider | Primary Function | Coverage | SLA |
|---|---|---|---|
| Jumio | ID verification, liveness, facial match | 5,000+ ID types, 200+ countries | 95% auto-verification, <60s avg |
| Onfido | Document verification, AI analysis | 4,500+ document types, 195 countries | 98% accuracy, <30s processing |
| Socure | Graph analysis, fraud detection | US-focused, device intelligence | 98.7% accuracy, 0.1% false positive |
🔹 9.2.6 KYC Data Architecture
// KYC Verification Flow Implementation (TypeScript)
// Complete KYC Verification Flow Implementation
async function performKYCVerification(
investor: InvestorApplication
): Promise<KYCVerificationResult> {
// Step 1: Document Verification via Jumio
const docResult = await jumio.verifyDocument({
frontImage: investor.idFrontImage,
backImage: investor.idBackImage,
documentType: investor.documentType,
issuingCountry: investor.country,
});
if (!docResult.isAuthentic || docResult.overallScore < 80) {
return {
status: 'REJECTED',
reason: 'DOCUMENT_VERIFICATION_FAILED',
details: docResult.rejectionReasons,
};
}
// Step 2: Liveness Check with Active Challenges
const livenessResult = await jumio.performLivenessCheck({
selfieVideo: investor.selfieVideo,
challengeType: 'ACTIVE', // Blink, turn, smile
minimumFrames: 30,
});
if (!livenessResult.isLive || livenessResult.spoofScore > 20) {
return {
status: 'REJECTED',
reason: 'LIVENESS_CHECK_FAILED',
details: ['Potential spoofing detected'],
};
}
// Step 3: Facial Match (ID Photo vs Selfie)
const matchResult = await jumio.compareFaces(
docResult.extractedPhoto,
livenessResult.capturedFace,
{ minimumConfidence: 85 }
);
if (matchResult.confidence < 85) {
// Queue for manual review if match is uncertain
return {
status: 'MANUAL_REVIEW',
reason: 'FACIAL_MATCH_UNCERTAIN',
matchScore: matchResult.confidence,
};
}
// Step 4: Address Verification
const addressResult = await verifyAddressDocument({
document: investor.addressProofDocument,
claimedAddress: investor.residentialAddress,
maxDocumentAge: 90, // Days
});
if (!addressResult.verified) {
return {
status: 'REJECTED',
reason: 'ADDRESS_VERIFICATION_FAILED',
details: [addressResult.failureReason],
};
}
// Step 5: PEP/Sanctions Screening via Socure
const screeningResult = await socure.screenIndividual({
name: docResult.extractedData.fullName,
dateOfBirth: docResult.extractedData.dateOfBirth,
nationality: docResult.mrzDataExtracted.nationality,
address: investor.residentialAddress,
});
if (screeningResult.pepMatch || screeningResult.sanctionsMatch) {
return {
status: 'REJECTED',
reason: screeningResult.sanctionsMatch ? 'SANCTIONS_MATCH' : 'PEP_MATCH',
details: screeningResult.matchDetails,
};
}
// Step 6: Record KYC Completion On-Chain
const onChainRecord = await recordKYCCompletion(investor.walletAddress, {
verificationDate: Date.now(),
documentHash: hash(docResult.documentData),
facialMatchScore: matchResult.confidence,
screeningHash: hash(screeningResult),
provider: 'JUMIO_SOCURE',
expirationDate: calculateKYCExpiration(docResult),
});
return {
status: 'APPROVED',
kycRecordId: onChainRecord.transactionSignature,
expirationDate: onChainRecord.expirationDate,
verificationDetails: {
documentScore: docResult.overallScore,
livenessScore: 100 - livenessResult.spoofScore,
facialMatchScore: matchResult.confidence,
},
};
}
🔹 9.2.7 Verification Status Lifecycle
// KYC Status Lifecycle
enum KYCStatus {
PENDING = 'PENDING', // Application submitted, not started
IN_PROGRESS = 'IN_PROGRESS', // Verification underway
MANUAL_REVIEW = 'MANUAL_REVIEW', // Requires human review
APPROVED = 'APPROVED', // KYC passed, eligible to invest
REJECTED = 'REJECTED', // KYC failed, not eligible
EXPIRED = 'EXPIRED', // KYC expired, re-verification needed
SUSPENDED = 'SUSPENDED', // Account suspended pending investigation
}
// Status Transition Rules
const validTransitions: Record<KYCStatus, KYCStatus[]> = {
PENDING: ['IN_PROGRESS', 'REJECTED'],
IN_PROGRESS: ['APPROVED', 'REJECTED', 'MANUAL_REVIEW'],
MANUAL_REVIEW: ['APPROVED', 'REJECTED'],
APPROVED: ['EXPIRED', 'SUSPENDED'],
REJECTED: ['PENDING'], // Can reapply
EXPIRED: ['IN_PROGRESS'], // Re-verification
SUSPENDED: ['APPROVED', 'REJECTED'], // After investigation
};
📜 9.3 Accreditation Status Determination
The OTCM Portal implements dual-pathway accredited investor verification pursuant to SEC Regulation D Rule 506(c) requirements, enabling both third-party professional confirmation and self-certification subject to audit review.
🔹 9.3.1 Regulatory Requirements
📋 17 CFR 230.506(c) — Accredited Investor Verification
In offerings conducted under Rule 506(c), issuers must take 'reasonable steps to verify' that purchasers are accredited investors. Verification methods include: (1) income verification through IRS forms, (2) net worth verification through asset statements, (3) written confirmation from registered broker-dealer, investment adviser, licensed attorney, or CPA.
Unlike Rule 506(b) offerings where issuer may rely on investor representations, Rule 506(c) requires affirmative verification through documented methods, justifying general solicitation privileges.
🔹 9.3.2 Accredited Investor Categories
| Category | Qualification Criteria | Verification Method |
|---|---|---|
| Income (Individual) | $200,000+ annual income in each of last 2 years with reasonable expectation of same | Tax returns, W-2s, 1099s, or CPA letter |
| Income (Joint) | $300,000+ joint income with spouse in each of last 2 years with reasonable expectation | Joint tax returns or CPA letter |
| Net Worth | $1,000,000+ net worth excluding value of primary residence (individual or joint with spouse) | Bank/brokerage statements, property appraisals |
| Professional Certification | Hold in good standing: Series 7 (General Securities), Series 65 (Investment Adviser), or Series 82 (Private Placement) | FINRA BrokerCheck verification |
| Knowledgeable Employee | Director, executive officer, or general partner of issuer OR employee participating in investments of issuer with appropriate knowledge | Employment verification letter |
| Entity - Bank/Insurance | Bank, insurance company, registered investment company, business development company, or small business investment company | Regulatory registration verification |
| Entity - Assets | Entity with $5,000,000+ in total assets not formed for specific purpose of acquiring securities offered | Audited financial statements |
| Family Office | Family office with $5,000,000+ in AUM not formed for specific purpose of acquiring securities offered | AUM verification, entity documents |
🔹 9.3.3 Third-Party Verification Pathway
The preferred verification pathway involves third-party professional confirmation from qualified professionals:
// Third-Party Verification Interface
interface ThirdPartyAccreditationVerification {
/**
-
Verification pathway utilizing third-party professionals
-
as permitted under 17 CFR 230.506(c)
*/
pathway: 'THIRD_PARTY';
// Verifier information
verifier: {
type: 'RIA' | 'CPA' | 'ATTORNEY' | 'BROKER_DEALER';
name: string;
licenseNumber: string;
firmName: string;
firmAddress: string;
contactPhone: string;
contactEmail: string;
};
// Attestation details
attestation: {
date: Date;
accreditationMethod: 'INCOME' | 'NET_WORTH' | 'PROFESSIONAL' | 'ENTITY';
verificationPeriod: { // Time period reviewed
start: Date;
end: Date;
};
documentsReviewed: string[]; // e.g., ['Tax Return 2023', 'Tax Return 2024']
attestationStatement: string;
};
// Document evidence
attestationLetter: {
documentHash: string; // SHA-256 hash
uploadTimestamp: Date;
fileSize: number;
mimeType: 'application/pdf';
};
// Verification status
status: 'PENDING' | 'VERIFIED' | 'REJECTED';
expirationDate: Date; // Typically 90 days from verification
// On-chain record
onChainRecord: {
transactionSignature: string;
blockHeight: number;
recordTimestamp: Date;
};
}
Acceptable third-party verifiers include:
- Registered Investment Advisers (RIAs): SEC or state-registered investment advisers with fiduciary duty
- Certified Public Accountants (CPAs): Licensed accounting professionals in good standing
- Securities Attorneys: Attorneys in good standing specializing in securities law
- FINRA-Registered Broker-Dealers: Broker-dealer firms registered with FINRA
🔹 9.3.4 Self-Certification Pathway
For investors unable to obtain third-party verification, the Portal enables self-certification subject to enhanced review and audit procedures:
// Self-Certification Interface
interface SelfCertificationAccreditation {
/**
-
Self-certification pathway with enhanced scrutiny
-
Subject to audit review confirming consistency
*/
pathway: 'SELF_CERTIFICATION';
// Certification details
certification: {
date: Date;
method: 'INCOME' | 'NET_WORTH' | 'PROFESSIONAL';
selfDeclaredValues: {
// For income method
annualIncome?: {
year1: number;
year2: number;
expectedCurrent: number;
};
// For net worth method
netWorth?: {
totalAssets: number;
totalLiabilities: number;
primaryResidenceValue: number; // Excluded
netWorthExcludingResidence: number;
};
};
};
// Required supporting documents
supportingDocuments: {
required: [
'BANK_STATEMENTS_3_MONTHS',
'BROKERAGE_STATEMENTS_3_MONTHS',
];
optional: [
'TAX_RETURNS_2_YEARS', // Strongly recommended
'PROPERTY_VALUATIONS', // If net worth claim
'BUSINESS_FINANCIALS', // If business income
];
uploadedDocuments: {
documentType: string;
documentHash: string;
uploadTimestamp: Date;
}[];
};
// Consistency validation (ML-powered)
consistencyAnalysis: {
liquidAssetsDetected: number; // From bank/brokerage statements
incomePatternDetected: number; // From deposit patterns
consistentWithClaim: boolean;
confidenceScore: number; // 0-100
flags: string[]; // Any inconsistencies
};
// Audit risk assessment
auditRisk: {
priority: 'LOW' | 'MEDIUM' | 'HIGH';
factors: string[];
nextAuditDate?: Date;
};
// Legal acknowledgments
acknowledgments: {
perjuryWarning: boolean; // 'I understand false statements may result in...'
rescissionRisk: boolean; // 'I understand investment may be rescinded if...'
auditConsent: boolean; // 'I consent to audit of accreditation status...'
signatureTimestamp: Date;
signatureHash: string;
};
}
⚠️ Audit Risk
Self-certified investors are subject to random audit review. Inconsistencies between self-certified status and demonstrated liquid assets trigger manual compliance review and potential investment rescission. False certification constitutes securities fraud.
🔹 9.3.5 Non-Accredited Investor Pathways
For investors unable to satisfy accreditation requirements, the Portal enables participation through Regulation A+ Tier 2 offerings:
📋 15 U.S.C. Section 77b(b) and 17 CFR Section 230.251
Regulation A+ Tier 2 permits offerings up to $75,000,000 annually to both accredited and non-accredited investors, subject to investment limits for non-accredited investors.
| Investor Type | Annual Investment Limit | Calculation Basis |
|---|---|---|
| Accredited Investor | UNLIMITED | No limit applies |
| Non-Accredited Individual | 10% of greater of: | Annual income OR net worth |
| Example: $80K income, $150K NW | $15,000/year | 10% × $150K (greater of two) |
🔹 9.3.6 Accreditation Expiration & Renewal
Accreditation status is not permanent and requires periodic renewal:
- Standard Expiration: 90 days from date of third-party verification
- Self-Certification: 90 days, subject to earlier audit-triggered review
- Professional Certification: Valid while license remains in good standing (verified monthly via FINRA BrokerCheck)
- Renewal Process: Same verification requirements as initial accreditation; prior accreditation does not expedite process
🔍 9.4 Automated AML Screening
The OTCM Portal integrates with blockchain analytics providers to implement comprehensive anti-money laundering screening, analyzing 200+ transaction features to identify suspicious activity patterns and ensure compliance with Bank Secrecy Act requirements.
🔹 9.4.1 200+ Feature Risk Analysis
The AML screening system analyzes over 200 distinct features across six primary categories:
| Category | Features Analyzed | Feature Count |
|---|---|---|
| Wallet Clustering | Graph analysis of funding sources, common ownership patterns, coordinated behavior, entity resolution | 45+ |
| Temporal Patterns | Transaction timing analysis, velocity patterns, burst detection, scheduling regularity, time-of-day anomalies | 35+ |
| Volume Analysis | Transaction amounts, cumulative volumes, structuring detection, round number analysis, threshold avoidance | 30+ |
| Mixing Detection | Tornado Cash exposure, CoinJoin detection, cross-chain bridges, privacy protocol usage, peeling chains | 25+ |
| Exchange Patterns | CEX/DEX interaction, KYC exchange usage, non-KYC exchange exposure, nested exchange detection | 35+ |
| Criminal Database | Known ransomware addresses, darknet markets, fraud rings, stolen fund tracing, exploit proceeds | 30+ |
| TOTAL FEATURES | Comprehensive behavioral and exposure analysis | 200+ |
🔹 9.4.2 Risk Scoring Model
Each investor and transaction receives a composite risk score based on weighted feature analysis:
// AML Risk Scoring Model
interface AMLRiskAssessment {
// Composite risk score (0-100)
overallRiskScore: number;
// Category-level scores
categoryScores: {
walletClustering: number; // 0-100, weight: 25%
temporalPatterns: number; // 0-100, weight: 15%
volumeAnalysis: number; // 0-100, weight: 15%
mixingExposure: number; // 0-100, weight: 20%
exchangePatterns: number; // 0-100, weight: 10%
criminalDatabase: number; // 0-100, weight: 15%
};
// Risk classification
riskTier: 'LOW' | 'MEDIUM' | 'HIGH' | 'SEVERE';
// Specific flags triggered
triggeredFlags: {
flag: string;
severity: 'INFO' | 'WARNING' | 'CRITICAL';
description: string;
evidence: string[];
}[];
// Recommended action
recommendedAction: 'AUTO_APPROVE' | 'ENHANCED_REVIEW' | 'MANUAL_REVIEW' | 'AUTO_REJECT' | 'SAR_REQUIRED';
}
// Risk Tier Thresholds
const RISK_THRESHOLDS = {
LOW: { min: 0, max: 30, action: 'AUTO_APPROVE' },
MEDIUM: { min: 31, max: 50, action: 'ENHANCED_REVIEW' },
HIGH: { min: 51, max: 70, action: 'MANUAL_REVIEW' },
SEVERE: { min: 71, max: 100, action: 'AUTO_REJECT' },
};
| Score | Risk Tier | Automated Action | Follow-Up Required |
|---|---|---|---|
| 0-30 | LOW | Auto-approve | None |
| 31-50 | MEDIUM | Approve + Enhanced monitoring | Quarterly review |
| 51-70 | HIGH | Hold for manual review | Analyst review within 24h |
| 71-100 | SEVERE | Auto-reject + Account freeze | SAR filing evaluation |
🔹 9.4.3 Real-Time Transaction Monitoring
The Portal implements real-time monitoring of all investor transactions post-issuance:
// Transaction Monitoring Configuration
interface TransactionMonitoringConfig {
// Real-time triggers (per-transaction)
realTimeRules: {
// Large transaction alert
largeTransactionThreshold: number; // $10,000 USD equivalent
// Rapid succession detection
rapidSuccession: {
transactionCount: number; // 3+ transactions
timeWindowMinutes: number; // within 10 minutes
};
// Structuring detection
structuringDetection: {
targetThreshold: number; // $10,000 (CTR threshold)
toleranceRange: { min: number; max: number }; // $9,000 - $9,999
transactionCount: number; // 2+ transactions in range
timeWindowHours: number; // within 24 hours
};
// Round number detection
roundNumberAlert: {
enabled: boolean;
threshold: number; // e.g., $5,000+
consecutiveCount: number; // 3+ round amounts
};
};
// Batch analysis (daily)
batchRules: {
velocityAnalysis: boolean; // Transaction frequency vs baseline
peerGroupComparison: boolean; // Deviation from similar investors
geographicAnomalies: boolean; // Unusual IP/location patterns
networkAnalysis: boolean; // New connections to flagged wallets
behaviorProfiling: boolean; // Deviation from established pattern
};
}
🔹 9.4.4 Suspicious Activity Detection
The system identifies suspicious activity patterns that may indicate money laundering, fraud, or sanctions evasion:
- Structuring: Breaking transactions into smaller amounts to avoid reporting thresholds
- Layering: Rapid movement of funds through multiple addresses to obscure origin
- Velocity Anomalies: Sudden increase in transaction frequency or volume
- Geographic Inconsistencies: Transactions from unusual locations or VPN usage
- Coordinated Activity: Multiple accounts acting in concert
- Criminal Exposure: Transactions with addresses associated with known criminal activity
🔹 9.4.5 SAR Filing Automation
When suspicious activity is detected, the Portal automates Suspicious Activity Report filing with FinCEN:
📋 31 CFR § 1010.320 — SAR Filing Requirements
Financial institutions must file SARs for transactions involving $5,000 or more if the institution knows, suspects, or has reason to suspect the transaction involves funds derived from illegal activity, is designed to evade reporting requirements, or has no lawful purpose.
// SAR Filing Automation
async function evaluateSARRequirement(
investor: Investor,
suspiciousActivity: SuspiciousActivityDetection
): Promise<SARFilingResult> {
// Evaluate SAR filing criteria
const sarCriteria = {
amountThreshold: suspiciousActivity.totalAmount >= 5000,
suspiciousPattern: suspiciousActivity.patternConfidence >= 70,
criminalExposure: suspiciousActivity.criminalExposure > 0,
structuringDetected: suspiciousActivity.structuringScore >= 50,
sanctionsRisk: suspiciousActivity.sanctionsRisk > 0,
};
const requiresSAR = Object.values(sarCriteria).some(c => c === true);
if (requiresSAR) {
// Build SAR report
const sarReport: SARReport = {
filingInstitution: {
name: 'OTCM Protocol, Inc.',
ein: 'XX-XXXXXXX',
address: '...',
},
subjectInformation: {
name: investor.legalName,
address: investor.residentialAddress,
identificationNumber: investor.kycDocumentNumber,
walletAddresses: investor.associatedWallets,
},
suspiciousActivity: {
dateRange: suspiciousActivity.dateRange,
totalAmount: suspiciousActivity.totalAmount,
activityType: suspiciousActivity.activityTypes,
narrative: generateSARNarrative(suspiciousActivity),
},
transactionDetails: suspiciousActivity.transactions,
};
// Submit to FinCEN BSA E-Filing
const filingResult = await fincenAPI.submitSAR(sarReport);
// Record SAR filing on-chain (hash only, not content)
await recordSARFiling(investor.walletAddress, {
filingDate: Date.now(),
bsaId: filingResult.bsaId,
reportHash: hash(sarReport),
// Note: SAR content is confidential and not stored on-chain
});
return {
filed: true,
bsaId: filingResult.bsaId,
filingDate: new Date(),
};
}
return { filed: false, reason: 'SAR criteria not met' };
}
🔹 9.4.6 Account Freezing Procedures
When high-risk activity is detected, accounts may be frozen pending investigation:
| Freeze Type | Trigger | Resolution |
|---|---|---|
| Temporary Hold | Risk score 51-70, pending review | 24-hour analyst review; auto-release if cleared |
| Investigation Freeze | Risk score 71+, SAR filed | Frozen until investigation complete; compliance team decision |
| Regulatory Freeze | OFAC match, law enforcement request | Frozen indefinitely; regulatory/legal authorization required to release |
🌍 9.5 Global Investor Eligibility
The OTCM Portal accommodates global investor participation while implementing jurisdiction-based restrictions to ensure compliance with US sanctions laws and international AML standards.
🔹 9.5.1 Regulation S Framework
The Portal enables non-US national investor participation through the Regulation S framework:
📋 17 CFR Section 230.903 — Regulation S Offshore Transactions
Permits securities offerings to foreign persons in offshore transactions without SEC registration, provided (1) no directed selling efforts in the United States, (2) the issuer reasonably believes all offerees are outside the United States, and (3) appropriate offering restrictions are implemented.
// Regulation S Compliance Interface
interface RegulationSCompliance {
// Offshore transaction requirements
offeringLocation: 'OFFSHORE'; // Must be outside United States
buyerLocation: string; // Non-US jurisdiction
sellerLocation: string; // Any jurisdiction
// No directed selling efforts
directedSellingEfforts: {
usMediaAdvertising: false; // No US media advertising
usDirectedWebsite: false; // No targeting of US IPs
usRoadshows: false; // No US investor meetings
usBrokerEngagement: false; // No US broker solicitation
};
// Buyer certification requirements
buyerCertification: {
nonUSPersonCertification: boolean; // Required
residencyVerification: {
method: 'DOCUMENT' | 'IP_GEOLOCATION' | 'BOTH';
verificationDate: Date;
documentType?: string;
ipCountry?: string;
};
};
// Distribution compliance (Category 3 - Equity)
distributionCompliance: {
restrictionPeriod: 40; // 40-day distribution compliance period
flowbackRestriction: boolean; // Prevents immediate US resale
legendRequirement: boolean; // Restrictive legend on certificates
distributorAgreement: boolean; // Written agreements with distributors
};
// OFAC compliance (required regardless of Reg S)
ofacCompliance: {
sdnScreeningPassed: boolean;
sanctionedCountryCheck: boolean;
screeningTimestamp: Date;
};
}
🔹 9.5.2 Prohibited Jurisdictions
The Portal implements absolute restrictions preventing investor participation from jurisdictions subject to comprehensive US sanctions:
| Jurisdiction | Sanctions Program | CFR Reference | Status |
|---|---|---|---|
| Iran | Iranian Transactions & Sanctions Regulations | 31 CFR Part 560 | PROHIBITED |
| North Korea | North Korea Sanctions Regulations | 31 CFR Part 510 | PROHIBITED |
| Syria | Syrian Sanctions Regulations | 31 CFR Part 542 | PROHIBITED |
| Cuba | Cuban Assets Control Regulations | 31 CFR Part 515 | PROHIBITED |
| Crimea Region | Ukraine-Related Sanctions (SSIDES) | 31 CFR Part 589 | PROHIBITED |
🔹 9.5.3 FATF High-Risk Handling
Jurisdictions designated as high-risk by the Financial Action Task Force (FATF) receive enhanced due diligence:
- Enhanced KYC: Additional documentation and verification requirements beyond standard KYC
- Mandatory Source of Funds: Detailed source of funds documentation with supporting evidence
- Enhanced Monitoring: Lower thresholds for transaction alerts and more frequent review
- Senior Approval: Manual compliance officer approval required before investment eligibility confirmed
- Regular Review: Quarterly re-verification of investor status and activity
🔹 9.5.4 Regulation A+ Tier 2 for Non-Accredited
For global non-accredited investors, the Portal implements Regulation A+ Tier 2 investment limits:
- Offering Limit: Up to $75,000,000 annually per issuer
- Non-Accredited Limit: 10% of greater of annual income or net worth
- SEC Qualification: Requires SEC Form 1-A qualification
- Ongoing Reporting: Semi-annual (Form 1-SA) and annual (Form 1-K) reports required
🔹 9.5.5 Country-Specific Requirements
The Portal implements country-specific additional requirements as needed:
| Jurisdiction | Additional Requirements |
|---|---|
| European Union | MiCA compliance evaluation; GDPR data handling; EU retail investment limits where applicable |
| United Kingdom | FCA promotional restrictions; certified/sophisticated investor classification |
| Singapore | MAS accredited investor status verification; SFA compliance |
| Canada | Provincial securities law compliance; accredited investor or private issuer exemption verification |
🏗️ 9.6 Portal Technical Architecture
This section details the technical implementation of the OTCM Issuers Portal, including system components, API specifications, security architecture, and performance metrics.
🔹 9.6.1 System Components
// Portal System Architecture
// OTCM Portal System Architecture
┌─────────────────────────────────────────────────────────────────────────┐
│ CLIENT LAYER │
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │
│ │ Issuer Web │ │ Investor │ │ Admin │ │ Mobile │ │
│ │ Dashboard │ │ Portal │ │ Console │ │ Apps │ │
│ │ (React) │ │ (React) │ │ (React) │ │ (React Nat) │ │
│ └─────────────┘ └─────────────┘ └─────────────┘ └─────────────┘ │
└─────────────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────────┐
│ API GATEWAY │
│ (AWS API Gateway / Cloudflare) │
│ Rate Limiting | DDoS Protection | SSL Termination │
└─────────────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────────┐
│ APPLICATION LAYER │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │ Node.js / TypeScript API │ │
│ │ (Express / Fastify) │ │
│ └─────────────────────────────────────────────────────────────────┘ │
│ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌───────────┐ │
│ │ KYC Service │ │ Accred Svc │ │ AML Service │ │ Reporting │ │
│ └───────────────┘ └───────────────┘ └───────────────┘ └───────────┘ │
└─────────────────────────────────────────────────────────────────────────┘
│
┌──────────────────────────┼──────────────────────────┐
│ │ │
▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ PostgreSQL │ │ Redis │ │ Solana RPC │
│ (User Data) │ │ (Cache) │ │ (Blockchain) │
└───────────────┘ └───────────────┘ └───────────────┘
🔹 9.6.2 API Specifications
// API Endpoints
// Core API Endpoints
// KYC Module
POST /api/v1/kyc/initiate // Start KYC process
POST /api/v1/kyc/document/upload // Upload ID document
POST /api/v1/kyc/liveness/start // Start liveness check
GET /api/v1/kyc/status/:investorId // Get KYC status
POST /api/v1/kyc/address/verify // Submit address proof
// Accreditation Module
POST /api/v1/accreditation/third-party // Submit third-party verification
POST /api/v1/accreditation/self-cert // Submit self-certification
GET /api/v1/accreditation/status/:id // Get accreditation status
POST /api/v1/accreditation/renewal // Renew expiring accreditation
// AML Module
GET /api/v1/aml/risk-score/:walletAddress // Get wallet risk score
POST /api/v1/aml/screen // Initiate AML screening
GET /api/v1/aml/monitoring/:investorId // Get monitoring alerts
// Issuer Dashboard
GET /api/v1/issuer/investors // List all investors
GET /api/v1/issuer/analytics // Token analytics
GET /api/v1/issuer/compliance-report // Compliance summary
// Investor Portal
GET /api/v1/investor/profile // Get investor profile
GET /api/v1/investor/investments // List investments
POST /api/v1/investor/invest // Initiate investment
🔹 9.6.3 Security Architecture
The Portal implements enterprise-grade security across all layers:
- Encryption at Rest: AES-256 encryption for all stored data
- Encryption in Transit: TLS 1.3 for all API communications
- Authentication: OAuth 2.0 + JWT with hardware key support (WebAuthn)
- Authorization: Role-based access control (RBAC) with least-privilege principles
- Audit Logging: Immutable audit trail for all actions with cryptographic signatures
- Penetration Testing: Quarterly third-party penetration testing
🔹 9.6.4 Performance Specifications
| Metric | Target | Current |
|---|---|---|
| API Response Time (p95) | <200ms | 145ms |
| KYC Verification Time | <60 seconds | 42 seconds avg |
| System Uptime | 99.9% | 99.97% |
| Concurrent Users | 10,000+ | 25,000+ tested |
| AML Screening Latency | <500ms | 350ms avg |
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━