🏢 Section 9: Issuers Portal Compliance Gateway
Section 9: Tokenomics
✅🏢SECTheCATEGORYcompliance1gatewayCOMPLIANTthrough|whichIssuer-SponsoredissuersTokenizedonboard,Securitiesinvestorspursuantverifyto SEC Division of Corporation Finance, Division of Investment Management,eligibility, andDivisionallofKYC/AMLTradingrequirementsandareMarketsenforcedJointbeforeStatementanydatedST22Januarytoken28, 2026interaction.
🏢 SECTION 9: ISSUERS PORTAL COMPLIANCE GATEWAY
⚠️ Critical9.1 TokenInstitutional ClassificationPurpose Distinction& Problem Statement
Before examining tokenomics, it is essentialPrior to understand that OTCM Protocol operatesdevelopment, twocompanies distinctseeking tokento typesissue tokenized securities confronted a prohibitive compliance burden that effectively excluded smaller and mid-tier issuers from the digital securities market. The complexity, cost, and specialized expertise required created an insurmountable barrier for companies lacking substantial legal and compliance infrastructure.
🔹 9.1.1 The Traditional Compliance Burden
Companies attempting independent securities tokenization must establish and maintain comprehensive regulatory infrastructure across six critical domains:
- KYC/AML Infrastructure: Build or license identity verification platforms with
fundamentallydocumentdifferentauthentication,characteristicsbiometric matching, and sanctions screening capabilities - Securities Counsel: Retain specialized securities law firms with digital asset expertise for offering documentation, regulatory filings, and ongoing compliance advice
- Transfer Agent Services: Engage SEC-registered transfer agents for shareholder registry maintenance, custody verification, and regulatory
treatment:reporting - Custody Arrangements: Establish relationships with qualified custodians for physical certificate storage and digital asset custody
- Regulatory Reporting: Hire compliance staff for SEC filings, Form D submissions, and ongoing disclosure requirements
- Transaction Monitoring: License blockchain analytics platforms for AML screening, suspicious activity detection, and regulatory reporting
🔹 9.1.2 Cost Analysis: Independent vs. OTCM Portal
The following analysis compares the annual cost of establishing independent compliance infrastructure versus utilizing the OTCM Issuers Portal:
⚠️For the avoidance of doubt:This section addresses theOTCM Utility Token, which isNOT backed by securitiesand serves platform utility and governance functions. ST22 Tokenized Securities are addressed separately under Section 7 (Regulatory Framework) asCategory 1 compliant securities.
9.1 🎫 OTCM Utility Token Parameters
The OTCM Utility Token serves as the native utility currency of the OTCM Protocol ecosystem, providing governance rights, fee discounts, staking rewards, and access to premium platform features. Unlike ST22 Tokenized Securities, the OTCM Utility Token is NOT backed by preferred shares or any other securities.
9.1.1 📊 Total Supply & Denomination
// OTCM Utility Token Configuration
interface OTCMUtilityToken {
// Token Identity
name: 'OTCM Utility Token';
symbol: 'OTCM';
standard: 'SPL Token-2022';
// Supply Parameters
totalSupply: 1_000_000_000; // 1 billion tokens
decimals: 9;
mintAuthority: 'DISABLED'; // Immutable supply
// CRITICAL DISTINCTION
classification: 'UTILITY_TOKEN'; // NOT a security
assetBacking: 'NONE'; // NOT backed by securities
regulatoryFramework: 'Utility token analysis';
// Utility Functions
primaryFunctions: [
'Platform governance (DAO voting)',
'Trading fee discounts (10-50%)',
'Staking rewards (8-40% APY)',
'Premium feature access'
];
// Compliance Features
transferHook: true;
ofacScreening: true;
circuitBreakers: true;
}
9.1.2 🔧 Token Classification: Why OTCM Is a Utility Token
The OTCM Utility Token is structured and marketed as a utility token with functional purposes, distinct from ST22 Tokenized Securities:
❌ What OTCM Utility Token Is NOT
✅ What OTCM Utility Token IS
💡Regulatory Distinction:The OTCM Utility Token may be analyzed under the SEC's February 27, 2025 Staff Statement on Meme Coins, which established that tokens serving "entertainment and cultural purposes" with community-driven pricing may not constitute securities.This analysis applies ONLY to the OTCM Utility Token—NOT to ST22 Tokenized Securities, which ARE securities under Category 1.
9.1.3 🔧 Token Technical Specifications
// OTCM Utility Token - Solana SPL Token-2022 Implementation
pub struct OTCMUtilityToken {
// Token Metadata
pub mint: Pubkey,
pub name: String, // "OTCM Utility Token"
pub symbol: String, // "OTCM"
pub uri: String, // Metadata URI
// Supply Configuration
pub total_supply: u64, // 1,000,000,000 * 10^9
pub decimals: u8, // 9
pub mint_authority: Option<Pubkey>, // None (disabled)
pub freeze_authority: Option<Pubkey>, // Compliance authority
// Transfer Hook Configuration
pub transfer_hook_program: Pubkey,
pub transfer_hook_enabled: bool,
// Utility Token Attributes (NOT securities attributes)
pub governance_enabled: bool,
pub staking_enabled: bool,
pub fee_discount_enabled: bool,
// EXPLICIT: No asset backing
pub asset_backing: Option<AssetBacking>, // None
}
impl OTCMUtilityToken {
pub fn is_security(&self) -> bool {
false // OTCM Utility Token is NOT a security
}
pub fn has_asset_backing(&self) -> bool {
false // OTCM Utility Token is NOT backed by securities
}
}
9.1.4 💧 Initial Liquidity Pool Configuration
The OTCM Utility Token launches with an initial liquidity pool seeded with protocol capital to ensure immediate trading capability:
| $ | ||
9.1.5 🎓 Graduation Mechanism
The OTCM Utility Token utilizes a bonding curve structure with a graduation threshold:
9.1.6 📊 Post-Graduation Token Economics
Upon reaching the graduation threshold, accumulated bonding curve funds are permanently locked in the CPMM liquidity pool:
// Post-Graduation Liquidity Lock
interface GraduationMigration {
trigger: 'Market cap reaches $250,000';
migration: {
bondingCurveFunds: 'Transferred to CPMM LP';
lpTokens: 'Burned (sent to 0x000...dead address)';
liquidityStatus: 'PERMANENTLY_LOCKED';
withdrawalPossibility: 'MATHEMATICALLY_IMPOSSIBLE';
};
marketProtection: {
liquidityStability: 'Liquidity cannot be extracted by any party';
priceFloor: 'Permanent liquidity provides price stability';
};
}
✅Permanent Liquidity Lock:Post-graduation, LP tokens are sent to a burn address, making liquidity withdrawal mathematically impossible. This creates a structure where underlying liquidity can never be extracted by any party.
9.2 ⏰ Token Vesting Schedule
9.2.1 📜 Vesting Philosophy
OTCM Protocol implements a structured vesting schedule designed to:
✅ Align participant incentives with long-term platform success✅ Prevent market manipulation through sudden large sells✅ Create predictable supply dynamics that enable informed decisions✅ Protect all participants from dump scenarios
💡"Vesting ensures that token recipients maintain skin-in-the-game throughout the protocol's growth phase. Immediate large-scale selling is structurally impossible, protecting all participants."
9.2.2 📊 OTCM Utility Token Allocation
9.2.3 📅 Vesting Timeline
The team and investor allocations follow structured release schedules:
👥 Team Vesting (48 months)
💰 Investor Vesting (36 months)
9.2.4 📜 Vesting Smart Contract Implementation
// OTCM Utility Token Vesting Implementation
interface VestingSchedule {
beneficiary: PublicKey;
tokenMint: PublicKey; // OTCM Utility Token (NOT securities)
totalAllocation: bigint;
schedule: {
cliffDuration: number; // Seconds until first release
vestingDuration: number; // Total vesting period
releaseSchedule: 'LINEAR' | 'MILESTONE';
};
state: {
startTime: Date;
totalReleased: bigint;
lastClaimTime: Date;
};
// Vesting enforcement
calculateVested(currentTime: Date): bigint;
claim(): Promise<TransactionSignature>;
// Anti-manipulation
dailySellLimit: '1% of daily volume';
cooldownPeriod: '24 hours between claims';
}
9.2.5 🛑 Anti-Dump Mechanisms
Beyond vesting, additional mechanisms protect token holders:
9.2.6 📈 Vesting Visualization
OTCM UTILITY TOKEN VESTING SCHEDULE
(Team & Advisor Allocation)
100% ─────────────────────────────────────────────── ████████████
90% ─────────────────────────────────────────────── ████████████
80% ─────────────────────────────────────────────── ████████████
70% ─────────────────────────────────────────────── ████████████
60% ─────────────────────────────────────────────── ████████████
50% ─────────────────────────────── ████████████████████████████
40% ─────────────────────────────── ████████████████████████████
30% ─────────────────────────────── ████████████████████████████
25% ─────────────── ████████████████████████████████████████████
20% ─────────────── ████████████████████████████████████████████
10% ─────────────── ████████████████████████████████████████████
0% ─── ░░░░░░░░░░░░████████████████████████████████████████████
TGE 12mo 24mo 36mo 48mo
░░░ Cliff (Locked) ████ Vested
9.3 💵 Revenue Model: Perpetual 5% Transaction Fee
9.3.1 📊 Fee Structure Overview
The OTCM Protocol generates sustainable revenue through a 5% transaction fee applied to all trades executed on CEDEX. This fee applies to ST22 Tokenized Securities trading (Category 1 compliant) and provides predictable, volume-based revenue.
Category 1 Revenue Context
💡Revenue Source:Transaction fees are generated from trading ofST22 Tokenized Securities, which aresecurities under federal securities laws. This creates a sustainable revenue model where OTCM Protocol earns fees from facilitatingCategory 1 compliant securities trading.
9.3.2 🔄 Fee Distribution Mechanism
// Fee Collection and Distribution
interface FeeDistribution {
// Fee collection on every ST22 trade
tradeExecution: {
totalFee: '5.00%';
collection: 'Atomic with trade execution';
transferHookEnforced: true; // Cannot be bypassed
};
// Distribution breakdown
distribution: {
otcmProtocol: {
percentage: '4.00%';
destination: 'Protocol Treasury';
uses: [
'Category 1 compliance infrastructure',
'Transfer Hook operations',
'Custody oracle maintenance',
'Development',
'Staking rewards',
'LP growth'
];
};
st22Issuer: {
percentage: '1.00%';
destination: 'Issuer-designated wallet';
uses: ['Issuer revenue', 'Shareholder value'];
};
};
// Category 1 compliance
regulatoryStatus: 'Fees from Category 1 compliant securities trading';
}
9.3.3 📈 Revenue Projections by Volume
Revenue scales linearly with trading volume:
| $500,000 | |||
| Securities Counsel | $ |
$750,000 | Included |
| Transfer Agent | $50,000 | $ |
|
| $ |
$200,000 | ||
| Regulatory Reporting | $ |
$ |
Included |
| Transaction Monitoring | $75,000 | $ |
Included |
| TOTAL ANNUAL COST | $650,000 | $ |
$1K-$25K* |
Formula:
- One-time
ProtocolSMTRevenueminting=fee;Daily Volume × 4% × 3659.3.4 📜 Fee Collection Implementation// Fee Collection via Transfer Hook (Category 1 Compliant) pub fn collect_trading_fee( ctx: Context<CollectFee>, trade_amount: u64, ) -> Result<()> { // Calculate 5% total fee let total_fee = trade_amount .checked_mul(500) // 5.00% = 500 basis points .ok_or(ErrorCode::MathOverflow)? .checked_div(10_000) .ok_or(ErrorCode::MathOverflow)?; // Split: 4% to protocol, 1% to issuer let protocol_fee = total_fee.checked_mul(80).unwrap().checked_div(100).unwrap(); let issuer_fee = total_fee.checked_sub(protocol_fee).unwrap(); // Transfer fees atomically transfer_to_protocol_treasury(protocol_fee)?; transfer_to_issuer_wallet(ctx.accounts.issuer_wallet, issuer_fee)?; // Emitongoing complianceeventincludedemit!(FeeCollected { trade_amount, total_fee, protocol_fee, issuer_fee, category1_compliant: true, // Fees from securities trading }); Ok(()) }9.3.5 📊 Comparative Fee AnalysisOTCM'sin 5% transaction feecomparesstructure
💡 ValueCost Proposition:Reduction OTCM'sImpact
For feea includescompany comprehensiveraising Category$5M 1through tokenized securities, traditional compliance infrastructure:costs KYC/AML/accreditation($650K-$2.1M) verification,could SEC-registeredconsume transfer13-42% agentof custody,capital officialraised. shareholderOTCM registry,Portal 42reduces Transferthis Hookto security0.02-0.5%, controls,making immutabletokenization auditeconomically trail, and 24/7 trading. Traditional alternatives require separate feesviable for eachmid-market service.issuers.
🔹
9.1.3 9.3.6OTCM 📈 Five-Year Revenue Projections
9.4 🏦 Staking RewardsSolution Architecture
9.4.1 📋 Staking Model Overview
OTCM Protocol implementseliminates issuer regulatory burden through a stakingpurpose-built mechanismIssuers enablingPortal OTCMthat Utilityconsolidates Tokenall holderscompliance, toidentity earnverification, rewards through participation in the protocol's operations. Staking rewards are funded by transaction feesmonitoring, fromand ST22regulatory Tokenizedreporting Securitiesfunctions trading.under a single, standardized, institutional-grade framework:
"Issuers
💡utilize"Stakingourtransformsportalpassiverathertokenthanholdingdevelopingintoindependentactivecomplianceprotocolinfrastructure,participation,achievingaligningfullholderregulatoryincentivescompliancewithwithoutlong-termrequiringnetwork success while providing sustainable rewards funded by Category 1 compliantspecialized securitiestrading.law expertise or expensive external counsel."
🔹 Revenue Flow to Stakers
┌─────────────────────────────────────────────────────────────────┐
│ ST22 TOKENIZED SECURITIES TRADING │
│ (Category 1 Compliant) │
└─────────────────────────────────────────────────────────────────┘
↓
┌─────────────────────────────────────────────────────────────────┐
│ 5% TRANSACTION FEE COLLECTED │
└─────────────────────────────────────────────────────────────────┘
↓
┌───────────────┴───────────────┐
↓ ↓
┌─────────────────────┐ ┌─────────────────────┐
│ 4% → OTCM Protocol │ │ 1% → ST22 Issuer │
└─────────────────────┘ └─────────────────────┘
↓
┌─────────────────────────────────────────────────────────────────┐
│ PROTOCOL TREASURY ALLOCATION │
│ ┌────────────┐ ┌────────────┐ ┌────────────┐ ┌────────────┐ │
│ │ Operations │ │Development │ │ STAKING │ │ LP Growth │ │
│ │ 30% │ │ 25% │ │ REWARDS │ │ 15% │ │
│ │ │ │ │ │ 30% │ │ │ │
│ └────────────┘ └────────────┘ └────────────┘ └────────────┘ │
└─────────────────────────────────────────────────────────────────┘
↓
┌─────────────────────────────────────────────────────────────────┐
│ OTCM UTILITY TOKEN STAKERS │
│ (Rewards distributed every 2.6 days) │
└─────────────────────────────────────────────────────────────────┘
9.4.2 📊 APY Configuration & Ranges
┌─────────────────────────────────────────────────────────────────┐
│ ST22 TOKENIZED SECURITIES TRADING │
│ (Category 1 Compliant) │
└─────────────────────────────────────────────────────────────────┘
↓
┌─────────────────────────────────────────────────────────────────┐
│ 5% TRANSACTION FEE COLLECTED │
└─────────────────────────────────────────────────────────────────┘
↓
┌───────────────┴───────────────┐
↓ ↓
┌─────────────────────┐ ┌─────────────────────┐
│ 4% → OTCM Protocol │ │ 1% → ST22 Issuer │
└─────────────────────┘ └─────────────────────┘
↓
┌─────────────────────────────────────────────────────────────────┐
│ PROTOCOL TREASURY ALLOCATION │
│ ┌────────────┐ ┌────────────┐ ┌────────────┐ ┌────────────┐ │
│ │ Operations │ │Development │ │ STAKING │ │ LP Growth │ │
│ │ 30% │ │ 25% │ │ REWARDS │ │ 15% │ │
│ │ │ │ │ │ 30% │ │ │ │
│ └────────────┘ └────────────┘ └────────────┘ └────────────┘ │
└─────────────────────────────────────────────────────────────────┘
↓
┌─────────────────────────────────────────────────────────────────┐
│ OTCM UTILITY TOKEN STAKERS │
│ (Rewards distributed every 2.6 days) │
└─────────────────────────────────────────────────────────────────┘
9.4.3 🔄 Epoch Duration & Compounding
OTCM staking utilizes short epochs for maximized compounding benefit:
| 1.4 | Portal ||
9.4.4 🧮 Compounding Mathematics
The effective APY differs from nominal APY due to compounding frequency:
9.4.5 🏗️ Staking Pool Implementation
Overview
// OTCM UtilityIssuers Token Staking Pool
interface StakingPool {
// Pool Configuration
poolId: PublicKey;
stakingToken: PublicKey; // OTCM Utility Token (NOT securities)
rewardToken: PublicKey; // OTCM Utility Token
// APY Parameters
baseApy: number; // 8% minimum
maxApy: number; // 40% maximum
currentApy: number; // Volume-dependent
// Epoch Configuration
epochDuration: 224640; // 2.6 days in seconds
currentEpoch: number;
lastRewardDistribution: Date;
// Pool State
totalStaked: bigint;
rewardPool: bigint;
stakers: Map<PublicKey, StakerPosition>;
// Revenue Source (Category 1 Alignment)
rewardFunding: 'ST22 trading fees (Category 1 compliant securities)';
// Operations
stake(amount: bigint): Promise<void>;
unstake(amount: bigint): Promise<void>;
claimRewards(): Promise<bigint>;
// Auto-compound option
autoCompound: boolean;
}
9.4.6 💧 LP Reinvestment Mechanism
A portion of rewards automatically flows back to liquidity pools:
9.4.7 📜 Staking Rewards Distribution
// Staking Rewards Distribution (funded by ST22 trading fees)
pub fn distribute_staking_rewards(
ctx: Context<DistributeRewards>,
) -> Result<()> {
let pool = &mut ctx.accounts.staking_pool;
let current_time = Clock::get()?.unix_timestamp;
// Verify epoch complete
require!(
current_time >= pool.last_distribution + pool.epoch_duration,
StakingError::EpochNotComplete
);
// Calculate rewards from treasury (funded by Category 1 trading fees)
let epoch_rewards = calculate_epoch_rewards(pool)?;
// Distribute proportionally to all stakers
for (staker, position) in pool.stakers.iter_mut() {
let staker_share = position.staked_amount
.checked_mul(epoch_rewards)?
.checked_div(pool.total_staked)?;
if position.auto_compound {
position.staked_amount = position.staked_amount.checked_add(staker_share)?;
} else {
position.pending_rewards = position.pending_rewards.checked_add(staker_share)?;
}
}
// LP Reinvestment (2%)
let lp_reinvestment = epoch_rewards.checked_mul(2)?.checked_div(100)?;
transfer_to_liquidity_pool(lp_reinvestment)?;
// Update pool state
pool.last_distribution = current_time;
pool.current_epoch += 1;
emit!(RewardsDistributed {
epoch: pool.current_epoch,
total_rewards: epoch_rewards,
lp_reinvestment,
funding_source: "ST22_TRADING_FEES", // Category 1 compliant
});
Ok(())
}
9.5 ☀️ SOL Treasury Strategy
9.5.1 🎯 Strategic Rationale
OTCM Protocol allocates a significant portion of offering proceeds to building a SOL treasury, positioning the company among the first Category 1 compliant tokenized securities platforms to maintain significant blockchain asset reserves:
9.5.2 📊 Treasury Allocation
9.5.3 📈 Staking Yield Projections
The SOL treasury generates operational funding through native Solana staking:
Treasury Target:6-8% annual staking yields, generating $480,000-$640,000 in operational funding annually to supportCategory 1 compliance infrastructure.
9.5.4 📜 Treasury Management Policy
// SOL Treasury Management
interface TreasuryPolicy {
// Allocation
totalAllocation: '$8,000,000 in SOL';
// Staking Strategy
staking: {
targetYield: '6-8% APY';
validatorDiversification: 'Maximum 25% with any single validator';
slashingProtection: 'Only stake with validators having no slashing history';
};
// Liquidity Management
liquidity: {
liquidReserve: '10% maintained for operational needs';
rebalancingThreshold: '5% drift triggers rebalancing';
};
// Risk Management
riskControls: {
priceVolatility: 'Accepted as strategic Solana ecosystem exposure';
validatorRisk: 'Diversified across 10+ validators';
regulatoryCompliance: 'Treasury supports Category 1 infrastructure';
};
// Governance
governance: {
oversightBody: 'Board of Directors';
reportingFrequency: 'Quarterly treasury reports';
auditRequirement: 'Annual third-party audit';
};
}
9.5.5 🛡️ Risk Management Framework
⚠️Price Volatility Risk:SOL treasury value will fluctuate with SOL market price. This volatility is accepted as strategic exposure to the Solana ecosystem that powers OTCM's Category 1 infrastructure.
9.6 📊 Economic Sustainability Analysis
9.6.1 🔄 Value FlowPortal Architecture
TheDiagram
OTCM Protocol creates a self-sustaining economic ecosystem—all powered by Category 1 compliant securities trading:
┌─────────────────────────────────────────────────────────────────────────────┐
│ OTCM PROTOCOLISSUERS VALUEPORTAL FLOWARCHITECTURE │
│ (CategoryUnified 1Compliance Compliant Foundation)Gateway) │
└─────────────────────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────────────────┐
│ ISSUER ADMINISTRATION DASHBOARD │
│ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌─────────────┐ │
│ │ Company │ │ Token │ │ Investor │ │ Compliance │ │
│ │ Profile │ │ Analytics │ │ Registry │ │ Dashboard │ │
│ └───────────────┘ └───────────────┘ └───────────────┘ └─────────────┘ │
└─────────────────────────────────────────────────────────────────────────┘
│
┌─────────────────────────────┼─────────────────────────────┐
│ │ │
▼ ▼ ▼
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ ST22KYC ISSUERSMODULE │ │ INVESTORSACCREDITATION │ │ (Board-Authorized)AML/SCREENING │
│ (Verified)│ │ MODULE │ │ MODULE │
│ • ID Verification│ │ • 506(c) Verify │ │ • Risk Scoring │
│ • Biometrics │ │ • Self-Cert │ │ • OFAC Check │
│ • Doc Auth │ │ • Third-Party │ │ • SAR Filing │
│ • Address Proof │ │ • Reg A+ Limits │ │ • Tx Monitoring │
│ • Source of Funds│ │ • Expiration Mgmt│ │ • Account Freeze │
└────────┬─────────┘ └────────┬─────────┘ └────────┬─────────┘
│ │ │
Create Category 1└───────────────────────┼───────────────────────┘
│ Trade ST22
│ tokenized securities │ securities
│ │
▼
▼
┌─────────────────────────────────────────────────────────────────────────┐
│ CEDEXTHIRD-PARTY TRADINGINTEGRATION LAYER │
│ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌───────────┐ ┌─────────────────┐ │
│ │ Jumio │ │ Onfido │ │ Socure │ │Chainalysis│ │ TRM Labs │ │
│ │ (Full Transfer Hook Compliance)ID) │ │ 5%(Docs) Transaction│ Fee│ (Fraud) │ │ (AML) │ │ (Forensics) │ │
│ └─────────┘ └─────────┘ └─────────┘ └───────────┘ └─────────────────┘ │
└────────────────────────┬─────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────────┐
│ ON-CHAIN COMPLIANCE RECORD LAYER │
│ (Immutable Audit Trail on Solana Blockchain) │
└─────────────────────────────────────────────────────────────────────────┘
│
┌───────────────┴────────────┼───────────────────────────┐
│ │ │
▼ ▼ ▼
┌──────────────────┐ ┌───────────────┐ ┌───────────────┐
│ 4%Empire → OTCM PROTOCOL│ │ 1% → ST22 ISSUERStock │ │ TREASURYSEC EDGAR │ │ REVENUEFinCEN BSA │
│ Transfer │ │ Filings │ │ E-Filing │
│ (Custody) │ │ (Form D, etc)│ │ (SAR, CTR) │
└────────┬─────────┘ └──────────────────┘ │
┌────────┴────────┬└────────────┬───┘
🔹 9.1.5 Issuer Onboarding Workflow
The Portal implements a structured onboarding workflow for new issuers:
| Step | Phase | Actions | Timeline |
|---|---|---|---|
| 1 | Application | Submit company info, share structure, tokenization goals | Day 1 |
| 2 | Due Diligence | Corporate verification, officer KYC, AML screening | Days 2-5 |
| 3 | Legal Setup | Series M preferred authorization, OTCM agreements | Days 5-10 |
| 4 | Transfer Agent | Empire Stock Transfer custody setup, share issuance | Days 10-15 |
| 5 | Token Minting | ST22 creation with Transfer Hooks, liquidity setup | Day 15-17 |
| 6 | LIVE | Bonding curve active, trading enabled | Day 17+ |
🪪 9.2 Integrated KYC Framework
The OTCM Portal implements comprehensive identity verification pursuant to federal regulatory requirements, ensuring all investors are properly identified before participating in securities offerings.
🔹 9.2.1 Regulatory Foundation
📋 31 CFR § 1010 — Bank Secrecy Act KYC Requirements
Financial institutions must establish Customer Identification Programs (CIP) that verify customer identity through documentary or non-documentary methods, including collection of name, date of birth, address, and identification number.
The Portal exceeds minimum BSA/AML requirements by implementing enhanced due diligence measures appropriate for securities offerings to accredited and qualified investors.
🔹 9.2.2 Four-Pillar Identity Verification
The Portal requires four primary identity verification components before investment eligibility is confirmed:
// Four-Pillar KYC Verification Interface (TypeScript)
interface KYCVerificationPillars {
/**
-
Pillar 1: Legal Name Verification
-
Matches user-provided name against government-issued ID
*/
legalName: {
firstName: string;
middleName?: string;
lastName: string;
suffix?: string;
verificationMethod: 'OCR_EXTRACTION' | 'MANUAL_REVIEW';
matchConfidence: number; // 0-100%
};
/**
-
Pillar 2: Residential Address Verification
-
Confirms current physical residence through official documents
*/
residentialAddress: {
street: string;
city: string;
state: string;
postalCode: string;
country: string;
verificationDocument: 'UTILITY_BILL' | 'BANK_STATEMENT' | 'GOVT_CORRESPONDENCE';
documentDate: Date; // Must be within 90 days
documentHash: string;
};
/**
-
Pillar 3: Beneficial Ownership Confirmation
-
Identifies ultimate beneficial owner of investment funds
*/
beneficialOwnership: {
ownershipType: 'INDIVIDUAL' | 'JOINT' | 'CORPORATE' | 'TRUST' | 'IRA';
ultimateBeneficiary: string;
ownershipPercentage: number; // For entities
controlPerson?: boolean; // For entities
supportingDocuments: string[]; // Document hashes
};
/**
-
Pillar 4: Source of Funds Declaration
-
Documents origin of investment capital
*/
sourceOfFunds: {
primarySource: 'EMPLOYMENT' | 'BUSINESS' | 'INVESTMENTS' | 'INHERITANCE' | 'OTHER';
description: string;
estimatedAmount: number;
supportingEvidence?: string; // Document hash if provided
riskLevel: 'LOW' | 'MEDIUM' | 'HIGH';
};
}
| Pillar | Requirement | Acceptable Documents |
|---|---|---|
| 1. Legal Name | Full legal name as appears on government ID | Passport, Driver's License, National ID, Residence Permit |
| 2. Address | Current physical residence verified within 90 days | Utility bill, Bank statement, Government letter, Tax document |
| 3. Beneficial Owner | Ultimate beneficial owner of funds | Articles of incorporation, Trust certificate, IRA custodian letter |
| 4. Source of Funds | Origin of investment capital documented | Pay stubs, Business financials, Investment statements, Inheritance docs |
🔹 9.2.3 Document Authentication Pipeline
The Portal employs a multi-layer document authentication pipeline to prevent identity fraud and ensure document authenticity:
// Document Authentication Pipeline Interface
interface DocumentAuthenticationResult {
// Document Classification
documentType: DocumentType;
issuingCountry: string;
documentNumber: string;
expirationDate: Date;
isExpired: boolean;
// Machine-Readable Zone (MRZ) Validation
mrzPresent: boolean;
mrzValid: boolean;
mrzChecksumPass: boolean;
mrzDataExtracted: {
surname: string;
givenNames: string;
nationality: string;
dateOfBirth: string;
documentNumber: string;
};
// Security Feature Detection
securityFeatures: {
hologramDetected: boolean;
uvFeaturesValid: boolean;
microTextPresent: boolean;
opticalVariableDevice: boolean;
laserPerforation: boolean;
};
// Tampering Detection
tamperingAnalysis: {
fontConsistency: number; // 0-100 score
edgeAnalysis: number; // 0-100 score
colorConsistency: number; // 0-100 score
compressionArtifacts: boolean; // JPEG artifact detection
digitalManipulation: boolean; // Photoshop detection
};
// OCR Data Extraction
extractedData: {
fullName: string;
dateOfBirth: Date;
address?: string;
documentNumber: string;
issuanceDate: Date;
expirationDate: Date;
};
// Final Determination
overallScore: number; // 0-100 composite score
status: 'APPROVED' | 'MANUAL_REVIEW' | 'REJECTED';
rejectionReasons?: string[];
}
enum DocumentType {
PASSPORT = 'PASSPORT',
DRIVERS_LICENSE = 'DRIVERS_LICENSE',
NATIONAL_ID = 'NATIONAL_ID',
RESIDENCE_PERMIT = 'RESIDENCE_PERMIT',
UTILITY_BILL = 'UTILITY_BILL',
BANK_STATEMENT = 'BANK_STATEMENT',
}
🔹 9.2.4 Biometric Verification System
Liveness verification prevents identity fraud through real-time biometric analysis:
| Verification | Technology | Accuracy |
|---|---|---|
| Facial Recognition | AI-powered comparison between selfie and ID document photo using 128-point facial geometry analysis | 99.6% |
| Liveness Detection | Active challenges (blink, turn head, smile) prevent photo/video replay attacks | 99.8% |
| 3D Depth Analysis | Infrared depth mapping detects flat images, printed photos, or screen displays | 99.9% |
| Anti-Spoofing | Detection of masks, deepfakes, synthetic media, and injection attacks | 99.5% |
🔹 9.2.5 Third-Party Provider Integration
OTCM Portal integrates with industry-leading identity verification providers to ensure comprehensive coverage and redundancy:
| Provider | Primary Function | Coverage | SLA |
|---|---|---|---|
| Jumio | ID verification, liveness, facial match | 5,000+ ID types, 200+ countries | 95% auto-verification, <60s avg |
| Onfido | Document verification, AI analysis | 4,500+ document types, 195 countries | 98% accuracy, <30s processing |
| Socure | Graph analysis, fraud detection | US-focused, device intelligence | 98.7% accuracy, 0.1% false positive |
🔹 9.2.6 KYC Data Architecture
// KYC Verification Flow Implementation (TypeScript)
// Complete KYC Verification Flow Implementation
async function performKYCVerification(
investor: InvestorApplication
): Promise<KYCVerificationResult> {
// Step 1: Document Verification via Jumio
const docResult = await jumio.verifyDocument({
frontImage: investor.idFrontImage,
backImage: investor.idBackImage,
documentType: investor.documentType,
issuingCountry: investor.country,
});
if (!docResult.isAuthentic || docResult.overallScore < 80) {
return {
status: 'REJECTED',
reason: 'DOCUMENT_VERIFICATION_FAILED',
details: docResult.rejectionReasons,
};
}
// Step 2: Liveness Check with Active Challenges
const livenessResult = await jumio.performLivenessCheck({
selfieVideo: investor.selfieVideo,
challengeType: 'ACTIVE', // Blink, turn, smile
minimumFrames: 30,
});
if (!livenessResult.isLive || livenessResult.spoofScore > 20) {
return {
status: 'REJECTED',
reason: 'LIVENESS_CHECK_FAILED',
details: ['Potential spoofing detected'],
};
}
// Step 3: Facial Match (ID Photo vs Selfie)
const matchResult = await jumio.compareFaces(
docResult.extractedPhoto,
livenessResult.capturedFace,
{ minimumConfidence: 85 }
);
if (matchResult.confidence < 85) {
// Queue for manual review if match is uncertain
return {
status: 'MANUAL_REVIEW',
reason: 'FACIAL_MATCH_UNCERTAIN',
matchScore: matchResult.confidence,
};
}
// Step 4: Address Verification
const addressResult = await verifyAddressDocument({
document: investor.addressProofDocument,
claimedAddress: investor.residentialAddress,
maxDocumentAge: 90, // Days
});
if (!addressResult.verified) {
return {
status: 'REJECTED',
reason: 'ADDRESS_VERIFICATION_FAILED',
details: [addressResult.failureReason],
};
}
// Step 5: PEP/Sanctions Screening via Socure
const screeningResult = await socure.screenIndividual({
name: docResult.extractedData.fullName,
dateOfBirth: docResult.extractedData.dateOfBirth,
nationality: docResult.mrzDataExtracted.nationality,
address: investor.residentialAddress,
});
if (screeningResult.pepMatch || screeningResult.sanctionsMatch) {
return {
status: 'REJECTED',
reason: screeningResult.sanctionsMatch ? 'SANCTIONS_MATCH' : 'PEP_MATCH',
details: screeningResult.matchDetails,
};
}
// Step 6: Record KYC Completion On-Chain
const onChainRecord = await recordKYCCompletion(investor.walletAddress, {
verificationDate: Date.now(),
documentHash: hash(docResult.documentData),
facialMatchScore: matchResult.confidence,
screeningHash: hash(screeningResult),
provider: 'JUMIO_SOCURE',
expirationDate: calculateKYCExpiration(docResult),
});
return {
status: 'APPROVED',
kycRecordId: onChainRecord.transactionSignature,
expirationDate: onChainRecord.expirationDate,
verificationDetails: {
documentScore: docResult.overallScore,
livenessScore: 100 - livenessResult.spoofScore,
facialMatchScore: matchResult.confidence,
},
};
}
🔹 9.2.7 Verification Status Lifecycle
// KYC Status Lifecycle
enum KYCStatus {
PENDING = 'PENDING', // Application submitted, not started
IN_PROGRESS = 'IN_PROGRESS', // Verification underway
MANUAL_REVIEW = 'MANUAL_REVIEW', // Requires human review
APPROVED = 'APPROVED', // KYC passed, eligible to invest
REJECTED = 'REJECTED', // KYC failed, not eligible
EXPIRED = 'EXPIRED', // KYC expired, re-verification needed
SUSPENDED = 'SUSPENDED', // Account suspended pending investigation
}
// Status Transition Rules
const validTransitions: Record<KYCStatus, KYCStatus[]> = {
PENDING: ['IN_PROGRESS', 'REJECTED'],
IN_PROGRESS: ['APPROVED', 'REJECTED', 'MANUAL_REVIEW'],
MANUAL_REVIEW: ['APPROVED', 'REJECTED'],
APPROVED: ['EXPIRED', 'SUSPENDED'],
REJECTED: ['PENDING'], // Can reapply
EXPIRED: ['IN_PROGRESS'], // Re-verification
SUSPENDED: ['APPROVED', 'REJECTED'], // After investigation
};
📜 9.3 Accreditation Status Determination
The OTCM Portal implements dual-pathway accredited investor verification pursuant to SEC Regulation D Rule 506(c) requirements, enabling both third-party professional confirmation and self-certification subject to audit review.
🔹 9.3.1 Regulatory Requirements
📋 17 CFR 230.506(c) — Accredited Investor Verification
In offerings conducted under Rule 506(c), issuers must take 'reasonable steps to verify' that purchasers are accredited investors. Verification methods include: (1) income verification through IRS forms, (2) net worth verification through asset statements, (3) written confirmation from registered broker-dealer, investment adviser, licensed attorney, or CPA.
Unlike Rule 506(b) offerings where issuer may rely on investor representations, Rule 506(c) requires affirmative verification through documented methods, justifying general solicitation privileges.
🔹 9.3.2 Accredited Investor Categories
| Category | Qualification Criteria | Verification Method |
|---|---|---|
| Income (Individual) | $200,000+ annual income in each of last 2 years with reasonable expectation of same | Tax returns, W-2s, 1099s, or CPA letter |
| Income (Joint) | $300,000+ joint income with spouse in each of last 2 years with reasonable expectation | Joint tax returns or CPA letter |
| Net Worth | $1,000,000+ net worth excluding value of primary residence (individual or joint with spouse) | Bank/brokerage statements, property appraisals |
| Professional Certification | Hold in good standing: Series 7 (General Securities), Series 65 (Investment Adviser), or Series 82 (Private Placement) | FINRA BrokerCheck verification |
| Knowledgeable Employee | Director, executive officer, or general partner of issuer OR employee participating in investments of issuer with appropriate knowledge | Employment verification letter |
| Entity - Bank/Insurance | Bank, insurance company, registered investment company, business development company, or small business investment company | Regulatory registration verification |
| Entity - Assets | Entity with $5,000,000+ in total assets not formed for specific purpose of acquiring securities offered | Audited financial statements |
| Family Office | Family office with $5,000,000+ in AUM not formed for specific purpose of acquiring securities offered | AUM verification, entity documents |
🔹 9.3.3 Third-Party Verification Pathway
The preferred verification pathway involves third-party professional confirmation from qualified professionals:
// Third-Party Verification Interface
interface ThirdPartyAccreditationVerification {
/**
-
Verification pathway utilizing third-party professionals
-
as permitted under 17 CFR 230.506(c)
*/
pathway: 'THIRD_PARTY';
// Verifier information
verifier: {
type: 'RIA' | 'CPA' | 'ATTORNEY' | 'BROKER_DEALER';
name: string;
licenseNumber: string;
firmName: string;
firmAddress: string;
contactPhone: string;
contactEmail: string;
};
// Attestation details
attestation: {
date: Date;
accreditationMethod: 'INCOME' | 'NET_WORTH' | 'PROFESSIONAL' | 'ENTITY';
verificationPeriod: { // Time period reviewed
start: Date;
end: Date;
};
documentsReviewed: string[]; // e.g., ['Tax Return 2023', 'Tax Return 2024']
attestationStatement: string;
};
// Document evidence
attestationLetter: {
documentHash: string; // SHA-256 hash
uploadTimestamp: Date;
fileSize: number;
mimeType: 'application/pdf';
};
// Verification status
status: 'PENDING' | 'VERIFIED' | 'REJECTED';
expirationDate: Date; // Typically 90 days from verification
// On-chain record
onChainRecord: {
transactionSignature: string;
blockHeight: number;
recordTimestamp: Date;
};
}
Acceptable third-party verifiers include:
- Registered Investment Advisers (RIAs): SEC or state-registered investment advisers with fiduciary duty
- Certified Public Accountants (CPAs): Licensed accounting professionals in good standing
- Securities Attorneys: Attorneys in good standing specializing in securities law
- FINRA-Registered Broker-Dealers: Broker-dealer firms registered with FINRA
🔹 9.3.4 Self-Certification Pathway
For investors unable to obtain third-party verification, the Portal enables self-certification subject to enhanced review and audit procedures:
// Self-Certification Interface
interface SelfCertificationAccreditation {
/**
-
Self-certification pathway with enhanced scrutiny
-
Subject to audit review confirming consistency
*/
pathway: 'SELF_CERTIFICATION';
// Certification details
certification: {
date: Date;
method: 'INCOME' | 'NET_WORTH' | 'PROFESSIONAL';
selfDeclaredValues: {
// For income method
annualIncome?: {
year1: number;
year2: number;
expectedCurrent: number;
};
// For net worth method
netWorth?: {
totalAssets: number;
totalLiabilities: number;
primaryResidenceValue: number; // Excluded
netWorthExcludingResidence: number;
};
};
};
// Required supporting documents
supportingDocuments: {
required: [
'BANK_STATEMENTS_3_MONTHS',
'BROKERAGE_STATEMENTS_3_MONTHS',
];
optional: [
'TAX_RETURNS_2_YEARS', // Strongly recommended
'PROPERTY_VALUATIONS', // If net worth claim
'BUSINESS_FINANCIALS', // If business income
];
uploadedDocuments: {
documentType: string;
documentHash: string;
uploadTimestamp: Date;
}[];
};
// Consistency validation (ML-powered)
consistencyAnalysis: {
liquidAssetsDetected: number; // From bank/brokerage statements
incomePatternDetected: number; // From deposit patterns
consistentWithClaim: boolean;
confidenceScore: number; // 0-100
flags: string[]; // Any inconsistencies
};
// Audit risk assessment
auditRisk: {
priority: 'LOW' | 'MEDIUM' | 'HIGH';
factors: string[];
nextAuditDate?: Date;
};
// Legal acknowledgments
acknowledgments: {
perjuryWarning: boolean; // 'I understand false statements may result in...'
rescissionRisk: boolean; // 'I understand investment may be rescinded if...'
auditConsent: boolean; // 'I consent to audit of accreditation status...'
signatureTimestamp: Date;
signatureHash: string;
};
}
⚠️ Audit Risk
Self-certified investors are subject to random audit review. Inconsistencies between self-certified status and demonstrated liquid assets trigger manual compliance review and potential investment rescission. False certification constitutes securities fraud.
🔹 9.3.5 Non-Accredited Investor Pathways
For investors unable to satisfy accreditation requirements, the Portal enables participation through Regulation A+ Tier 2 offerings:
📋 15 U.S.C. Section 77b(b) and 17 CFR Section 230.251
Regulation A+ Tier 2 permits offerings up to $75,000,000 annually to both accredited and non-accredited investors, subject to investment limits for non-accredited investors.
| Investor Type | Annual Investment Limit | Calculation Basis |
|---|---|---|
| Accredited Investor | UNLIMITED | No limit applies |
| Non-Accredited Individual | 10% of greater of: | Annual income OR net worth |
| Example: $80K income, $150K NW | $15,000/year | 10% × $150K (greater of two) |
🔹 9.3.6 Accreditation Expiration & Renewal
Accreditation status is not permanent and requires periodic renewal:
- Standard Expiration: 90 days from date of third-party verification
- Self-Certification: 90 days, subject to earlier audit-triggered review
- Professional Certification: Valid while license remains in good standing (verified monthly via FINRA BrokerCheck)
- Renewal Process: Same verification requirements as initial accreditation; prior accreditation does not expedite process
🔍 9.4 Automated AML Screening
The OTCM Portal integrates with blockchain analytics providers to implement comprehensive anti-money laundering screening, analyzing 200+ transaction features to identify suspicious activity patterns and ensure compliance with Bank Secrecy Act requirements.
🔹 9.4.1 200+ Feature Risk Analysis
The AML screening system analyzes over 200 distinct features across six primary categories:
| Category | Features Analyzed | Feature Count |
|---|---|---|
| Wallet Clustering | Graph analysis of funding sources, common ownership patterns, coordinated behavior, entity resolution | 45+ |
| Temporal Patterns | Transaction timing analysis, velocity patterns, burst detection, scheduling regularity, time-of-day anomalies | 35+ |
| Volume Analysis | Transaction amounts, cumulative volumes, structuring detection, round number analysis, threshold avoidance | 30+ |
| Mixing Detection | Tornado Cash exposure, CoinJoin detection, cross-chain bridges, privacy protocol usage, peeling chains | 25+ |
| Exchange Patterns | CEX/DEX interaction, KYC exchange usage, non-KYC exchange exposure, nested exchange detection | 35+ |
| Criminal Database | Known ransomware addresses, darknet markets, fraud rings, stolen fund tracing, exploit proceeds | 30+ |
| TOTAL FEATURES | Comprehensive behavioral and exposure analysis | 200+ |
🔹 9.4.2 Risk Scoring Model
Each investor and transaction receives a composite risk score based on weighted feature analysis:
// AML Risk Scoring Model
interface AMLRiskAssessment {
// Composite risk score (0-100)
overallRiskScore: number;
// Category-level scores
categoryScores: {
walletClustering: number; // 0-100, weight: 25%
temporalPatterns: number; // 0-100, weight: 15%
volumeAnalysis: number; // 0-100, weight: 15%
mixingExposure: number; // 0-100, weight: 20%
exchangePatterns: number; // 0-100, weight: 10%
criminalDatabase: number; // 0-100, weight: 15%
};
// Risk classification
riskTier: 'LOW' | 'MEDIUM' | 'HIGH' | 'SEVERE';
// Specific flags triggered
triggeredFlags: {
flag: string;
severity: 'INFO' | 'WARNING' | 'CRITICAL';
description: string;
evidence: string[];
}[];
// Recommended action
recommendedAction: 'AUTO_APPROVE' | 'ENHANCED_REVIEW' | 'MANUAL_REVIEW' | 'AUTO_REJECT' | 'SAR_REQUIRED';
}
// Risk Tier Thresholds
const RISK_THRESHOLDS = {
LOW: { min: 0, max: 30, action: 'AUTO_APPROVE' },
MEDIUM: { min: 31, max: 50, action: 'ENHANCED_REVIEW' },
HIGH: { min: 51, max: 70, action: 'MANUAL_REVIEW' },
SEVERE: { min: 71, max: 100, action: 'AUTO_REJECT' },
};
| Score | Risk Tier | Automated Action | Follow-Up Required |
|---|---|---|---|
| 0-30 | LOW | Auto-approve | None |
| 31-50 | MEDIUM | Approve + Enhanced monitoring | Quarterly review |
| 51-70 | HIGH | Hold for manual review | Analyst review within 24h |
| 71-100 | SEVERE | Auto-reject + Account freeze | SAR filing evaluation |
🔹 9.4.3 Real-Time Transaction Monitoring
The Portal implements real-time monitoring of all investor transactions post-issuance:
// Transaction Monitoring Configuration
interface TransactionMonitoringConfig {
// Real-time triggers (per-transaction)
realTimeRules: {
// Large transaction alert
largeTransactionThreshold: number; // $10,000 USD equivalent
// Rapid succession detection
rapidSuccession: {
transactionCount: number; // 3+ transactions
timeWindowMinutes: number; // within 10 minutes
};
// Structuring detection
structuringDetection: {
targetThreshold: number; // $10,000 (CTR threshold)
toleranceRange: { min: number; max: number }; // $9,000 - $9,999
transactionCount: number; // 2+ transactions in range
timeWindowHours: number; // within 24 hours
};
// Round number detection
roundNumberAlert: {
enabled: boolean;
threshold: number; // e.g., $5,000+
consecutiveCount: number; // 3+ round amounts
};
};
// Batch analysis (daily)
batchRules: {
velocityAnalysis: boolean; // Transaction frequency vs baseline
peerGroupComparison: boolean; // Deviation from similar investors
geographicAnomalies: boolean; // Unusual IP/location patterns
networkAnalysis: boolean; // New connections to flagged wallets
behaviorProfiling: boolean; // Deviation from established pattern
};
}
🔹 9.4.4 Suspicious Activity Detection
The system identifies suspicious activity patterns that may indicate money laundering, fraud, or sanctions evasion:
- Structuring: Breaking transactions into smaller amounts to avoid reporting thresholds
- Layering: Rapid movement of funds through multiple addresses to obscure origin
- Velocity Anomalies: Sudden increase in transaction frequency or volume
- Geographic Inconsistencies: Transactions from unusual locations or VPN usage
- Coordinated Activity: Multiple accounts acting in concert
- Criminal Exposure: Transactions with addresses associated with known criminal activity
🔹 9.4.5 SAR Filing Automation
When suspicious activity is detected, the Portal automates Suspicious Activity Report filing with FinCEN:
📋 31 CFR § 1010.320 — SAR Filing Requirements
Financial institutions must file SARs for transactions involving $5,000 or more if the institution knows, suspects, or has reason to suspect the transaction involves funds derived from illegal activity, is designed to evade reporting requirements, or has no lawful purpose.
// SAR Filing Automation
async function evaluateSARRequirement(
investor: Investor,
suspiciousActivity: SuspiciousActivityDetection
): Promise<SARFilingResult> {
// Evaluate SAR filing criteria
const sarCriteria = {
amountThreshold: suspiciousActivity.totalAmount >= 5000,
suspiciousPattern: suspiciousActivity.patternConfidence >= 70,
criminalExposure: suspiciousActivity.criminalExposure > 0,
structuringDetected: suspiciousActivity.structuringScore >= 50,
sanctionsRisk: suspiciousActivity.sanctionsRisk > 0,
};
const requiresSAR = Object.values(sarCriteria).some(c => c === true);
if (requiresSAR) {
// Build SAR report
const sarReport: SARReport = {
filingInstitution: {
name: 'OTCM Protocol, Inc.',
ein: 'XX-XXXXXXX',
address: '...',
},
subjectInformation: {
name: investor.legalName,
address: investor.residentialAddress,
identificationNumber: investor.kycDocumentNumber,
walletAddresses: investor.associatedWallets,
},
suspiciousActivity: {
dateRange: suspiciousActivity.dateRange,
totalAmount: suspiciousActivity.totalAmount,
activityType: suspiciousActivity.activityTypes,
narrative: generateSARNarrative(suspiciousActivity),
},
transactionDetails: suspiciousActivity.transactions,
};
// Submit to FinCEN BSA E-Filing
const filingResult = await fincenAPI.submitSAR(sarReport);
// Record SAR filing on-chain (hash only, not content)
await recordSARFiling(investor.walletAddress, {
filingDate: Date.now(),
bsaId: filingResult.bsaId,
reportHash: hash(sarReport),
// Note: SAR content is confidential and not stored on-chain
});
return {
filed: true,
bsaId: filingResult.bsaId,
filingDate: new Date(),
};
}
return { filed: false, reason: 'SAR criteria not met' };
}
🔹 9.4.6 Account Freezing Procedures
When high-risk activity is detected, accounts may be frozen pending investigation:
| Freeze Type | Trigger | Resolution |
|---|---|---|
| Temporary Hold | Risk score 51-70, pending review | 24-hour analyst review; auto-release if cleared |
| Investigation Freeze | Risk score 71+, SAR filed | Frozen until investigation complete; compliance team decision |
| Regulatory Freeze | OFAC match, law enforcement request | Frozen indefinitely; regulatory/legal authorization required to release |
🌍 9.5 Global Investor Eligibility
The OTCM Portal accommodates global investor participation while implementing jurisdiction-based restrictions to ensure compliance with US sanctions laws and international AML standards.
🔹 9.5.1 Regulation S Framework
The Portal enables non-US national investor participation through the Regulation S framework:
📋 17 CFR Section 230.903 — Regulation S Offshore Transactions
Permits securities offerings to foreign persons in offshore transactions without SEC registration, provided (1) no directed selling efforts in the United States, (2) the issuer reasonably believes all offerees are outside the United States, and (3) appropriate offering restrictions are implemented.
// Regulation S Compliance Interface
interface RegulationSCompliance {
// Offshore transaction requirements
offeringLocation: 'OFFSHORE'; // Must be outside United States
buyerLocation: string; // Non-US jurisdiction
sellerLocation: string; // Any jurisdiction
// No directed selling efforts
directedSellingEfforts: {
usMediaAdvertising: false; // No US media advertising
usDirectedWebsite: false; // No targeting of US IPs
usRoadshows: false; // No US investor meetings
usBrokerEngagement: false; // No US broker solicitation
};
// Buyer certification requirements
buyerCertification: {
nonUSPersonCertification: boolean; // Required
residencyVerification: {
method: 'DOCUMENT' | 'IP_GEOLOCATION' | 'BOTH';
verificationDate: Date;
documentType?: string;
ipCountry?: string;
};
};
// Distribution compliance (Category 3 - Equity)
distributionCompliance: {
restrictionPeriod: 40; // 40-day distribution compliance period
flowbackRestriction: boolean; // Prevents immediate US resale
legendRequirement: boolean; // Restrictive legend on certificates
distributorAgreement: boolean; // Written agreements with distributors
};
// OFAC compliance (required regardless of Reg S)
ofacCompliance: {
sdnScreeningPassed: boolean;
sanctionedCountryCheck: boolean;
screeningTimestamp: Date;
};
}
🔹 9.5.2 Prohibited Jurisdictions
The Portal implements absolute restrictions preventing investor participation from jurisdictions subject to comprehensive US sanctions:
| Jurisdiction | Sanctions Program | CFR Reference | Status |
|---|---|---|---|
| Iran | Iranian Transactions & Sanctions Regulations | 31 CFR Part 560 | PROHIBITED |
| North Korea | North Korea Sanctions Regulations | 31 CFR Part 510 | PROHIBITED |
| Syria | Syrian Sanctions Regulations | 31 CFR Part 542 | PROHIBITED |
| Cuba | Cuban Assets Control Regulations | 31 CFR Part 515 | PROHIBITED |
| Crimea Region | Ukraine-Related Sanctions (SSIDES) | 31 CFR Part 589 | PROHIBITED |
🔹 9.5.3 FATF High-Risk Handling
Jurisdictions designated as high-risk by the Financial Action Task Force (FATF) receive enhanced due diligence:
- Enhanced KYC: Additional documentation and verification requirements beyond standard KYC
- Mandatory Source of Funds: Detailed source of funds documentation with supporting evidence
- Enhanced Monitoring: Lower thresholds for transaction alerts and more frequent review
- Senior Approval: Manual compliance officer approval required before investment eligibility confirmed
- Regular Review: Quarterly re-verification of investor status and activity
🔹 9.5.4 Regulation A+ Tier 2 for Non-Accredited
For global non-accredited investors, the Portal implements Regulation A+ Tier 2 investment limits:
- Offering Limit: Up to $75,000,000 annually per issuer
- Non-Accredited Limit: 10% of greater of annual income or net worth
- SEC Qualification: Requires SEC Form 1-A qualification
- Ongoing Reporting: Semi-annual (Form 1-SA) and annual (Form 1-K) reports required
🔹 9.5.5 Country-Specific Requirements
The Portal implements country-specific additional requirements as needed:
| Jurisdiction | Additional Requirements |
|---|---|
| European Union | MiCA compliance evaluation; GDPR data handling; EU retail investment limits where applicable |
| United Kingdom | FCA promotional restrictions; certified/sophisticated investor classification |
| Singapore | MAS accredited investor status verification; SFA compliance |
| Canada | Provincial securities law compliance; accredited investor or private issuer exemption verification |
🏗️ 9.6 Portal Technical Architecture
This section details the technical implementation of the OTCM Issuers Portal, including system components, API specifications, security architecture, and performance metrics.
🔹 9.6.1 System Components
// Portal System Architecture
// OTCM Portal System Architecture
┌─────────────────────────────────────────────────────────────────────────┐
│ │CLIENT LAYER │
│ ▼ ▼ ▼ ▼
┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐
│Operations│ │ Dev │
│ STAKING│ Issuer Web │ │ LPInvestor │ │ 30%Admin │ │ 25% │ │ REWARDS │ │ GROWTHMobile │ │
│ │ │ │ 30%Dashboard │ │ 15%Portal │ │ Console │ │ Apps │ │
│ │ (React) │ │ (React) │ │ (React) │ │ (React Nat) │ │
│ └─────────────┘ └─────────────┘ └────┬─────────┘ └─────────────┘ │
└─────────────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────────┐
│ OTCMAPI UTILITY │
│ TOKEN STAKERSGATEWAY │
│ (8-40%AWS APY)API Gateway / Cloudflare) │
│ Rate Limiting | DDoS Protection | SSL Termination │
└─────────────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────────┐
│ APPLICATION LAYER │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │ Node.js / TypeScript API │ │
│ │ (Express / Fastify) │ │
│ └─────────────────────────────────────────────────────────────────┘ │
│ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌───────────┐ │
│ │ KYC Service │ │ Accred Svc │ │ AML Service │ │ Reporting │ │
│ └───────────────┘ └───────────────┘ └───────────────┘ └───────────┘ │
└─────────────────────────────────────────────────────────────────────────┘
│
┌──────────────────────────┼──────────────────────────┐
│ │ │
▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ PostgreSQL │ │ Redis │ │ Solana RPC │
│ (User Data) │ │ (Cache) │ │ (Blockchain) │
└───────────────┘ └───────────────┘ └───────────────┘
🔹 9.6.2 🔄API Specifications
// API Endpoints
// Core API Endpoints
// KYC Module
POST /api/v1/kyc/initiate // Start KYC process
POST /api/v1/kyc/document/upload // Upload ID document
POST /api/v1/kyc/liveness/start // Start liveness check
GET /api/v1/kyc/status/:investorId // Get KYC status
POST /api/v1/kyc/address/verify // Submit address proof
// Accreditation Module
POST /api/v1/accreditation/third-party // Submit third-party verification
POST /api/v1/accreditation/self-cert // Submit self-certification
GET /api/v1/accreditation/status/:id // Get accreditation status
POST /api/v1/accreditation/renewal // Renew expiring accreditation
// AML Module
GET /api/v1/aml/risk-score/:walletAddress // Get wallet risk score
POST /api/v1/aml/screen // Initiate AML screening
GET /api/v1/aml/monitoring/:investorId // Get monitoring alerts
// Issuer Dashboard
GET /api/v1/issuer/investors // List all investors
GET /api/v1/issuer/analytics // Token Velocity Managementanalytics
ExcessiveGET token/api/v1/issuer/compliance-report velocity// canCompliance underminesummary
// OTCMInvestor managesPortal
velocityGET multiple/api/v1/investor/profile mechanisms:// Get investor profile
GET /api/v1/investor/investments // List investments
POST /api/v1/investor/invest // Initiate investment
🔹 9.6.3 Security Architecture
The Portal implements enterprise-grade security across all layers:
- Encryption at Rest: AES-256 encryption for all stored data
- Encryption in Transit: TLS 1.3 for all API communications
- Authentication: OAuth 2.0 + JWT with hardware key support (WebAuthn)
- Authorization: Role-based access control (RBAC) with least-privilege principles
- Audit Logging: Immutable audit trail for all actions with cryptographic signatures
- Penetration Testing: Quarterly third-party penetration testing
🔹 9.6.4 Performance Specifications
9.6.3 📉 Supply Dynamics
While OTCM maintains fixed supply, effective circulating supply is managed through:━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
9.6.4 📈 Long-Term Projections
9.6.5 ✅ Economic Sustainability Summary
✅Economic Sustainability:The OTCM Protocol creates a self-sustaining economic looppowered by Category 1 compliant securities trading:
ST22 trading generates fees→Fees fund operations and staking rewards→Staking rewards attract more OTCM stakers→Stakers reduce sell pressure→Reduced sell pressure supports OTCM price→Higher OTCM value attracts more issuers→More issuers create more ST22 trading→More trading generates more fees
The foundation of this economic model isCategory 1 compliant tokenized securities trading—sustainable revenue from legitimate securities market infrastructure.
📋 Section 9 Summary
© 2026 OTCM Protocol, Inc. | All Rights Reserved
Aligned with SEC Division of Corporation Finance, Division of Investment Management, and Division of Trading and Markets Joint Statement dated January 28, 2026
ST22 Tokenized Securities are securities under federal securities laws. The OTCM Utility Token is a utility token that is NOT backed by securities and serves platform utility and governance functions. This document is for informational purposes only and does not constitute an offer to sell or solicitation of an offer to buy any securities.