⚖️ Section 11: Regulatory Compliance Framework

• Legal Certainty:Certainty Explicit— securitiesDigital Securities classification under Release No. 33-11412 eliminates regulatory ambiguity
• Investor Protection:Protection — Full disclosure requirements protect investors
• Institutional Acceptance:Acceptance — Traditional financial institutions can engage without regulatory risk
• Enforcement Cooperation:Cooperation — Proactive compliance reduces enforcement risk

🔹 11.1.2 Regulation D Rule 506(c) Implementation

The primary exemption utilized for ST22 Digital Securities offerings is Regulation D Rule 506(c), which permits unlimited-dollar offerings to verified accredited investors with general solicitation:

📋 17 CFR Section 230.506(c) — Conditions to be Met in Offerings Subject to Limitation on Manner of Offering

An issuer may offer and sell securities pursuant to section 4(a)(2) of the Securities Act if: (1) The issuer is not a disqualified issuer under § 230.506(d); (2) All purchasers of securities are accredited investors; (3) The issuer takes reasonable steps to verify that purchasers are accredited investors.

// Rule 506(c) Offering Structure (TypeScript)

interface Rule506cOffering {

// Offering identification

offeringId: string;

issuerId: string;

formDFileNumber: string;

// Regulatory classification

exemption: {

type: 'RULE_506C';

cfrReference: '17 CFR 230.506(c)';

generalSolicitationPermitted: true;

accreditedInvestorsOnly: true;

verificationRequired: true;

};

// Bad actor check

badActorCheck: {

completed: boolean;

checkDate: Date;

coveredPersons: CoveredPerson[];

disqualifyingEvents: DisqualifyingEvent[]; // Empty if clear

status: 'CLEAR' | 'DISQUALIFIED' | 'WAIVER_GRANTED';

};

// Verification method tracking

verificationMethods: {

income: {

documentsRequired: ['TAX_RETURN_Y1', 'TAX_RETURN_Y2'];

thirdPartyVerifier?: string;

};

netWorth: {

documentsRequired: ['ASSET_STATEMENT', 'LIABILITY_STATEMENT'];

excludePrimaryResidence: true;

};

professional: {

licenses: ['SERIES_7', 'SERIES_65', 'SERIES_82'];

finraVerification: boolean;

};

};

// Form D filing

formD: {

initialFilingDate: Date;

firstSaleDate: Date;

amendmentDates: Date[];

totalAmountSold: number;

totalNumberInvestors: number;

};

}

🔹 11.1.3 Rule 506(c) vsvs. 506(b) Comparison

OTCM Protocol exclusively utilizes Rule 506(c) rather than Rule 506(b) to enable general solicitation while maintaining full regulatory compliance:

💡 Strategic Choice: 506(c)

— OTCM Protocol uses 506(c) exclusively because general solicitation is essential for digital marketing, social media outreach, and public awareness campaigns. The verification burden is offset by automated third-party verification through the Issuers Portal.

🔹 11.1.4 Section 4(a)(1) Exemption

📋 15 U.S.C. Section 77d(a)(1) — Exempted Transactions

The provisions of section 77e of this title shall not apply to transactions by any person other than an issuer, underwriter, or dealer.

ST22 primary offerings utilize Section 4(a)(1) structure enabling issuing companies to distribute Digital Securities tokens directly to investors through portal infrastructure without intermediary broker-dealer involvement:

• Direct Distribution: Issuers distribute tokens directly to investors via Portal
• No Broker-Dealer: Eliminates BD commission structure (typically 5-10%)
• Portal as Technology: OTCM Portal provides technology infrastructure, not broker services
• Issuer Control: Companies maintain control over their capital raise

// Section 4(a)(1) Distribution Structure

interface Section4a1Distribution {

/**

• Section 4(a)(1) permits transactions by persons other than
• issuers, underwriters, or dealers without registration

*/

distributionType: 'DIRECT_ISSUER_TO_INVESTOR';

// No broker-dealer involvement

brokerDealer: null;

// Issuer distributes directly

distributor: {

type: 'ISSUER';

companyName: string;

cik: string;

};

// Portal provides technology only

portalRole: {

type: 'TECHNOLOGY_PLATFORM';

services: [

'KYC_VERIFICATION',

'ACCREDITATION_VERIFICATION',

'TRANSACTION_PROCESSING',

'COMPLIANCE_RECORDKEEPING',

];

isBrokerDealer: false;

earnsCommission: false;

};

// Fee structure (flat, not commission-based)

fees: {

mintingFee: '$1,000 - 000–$25,000'; // One-time

transactionFee: '5% of volume'; // Protocol fee, not broker commission

};

}

🔹 11.1.5 Regulation A+ Tier 2 Framework

For offerings targeting non-accredited investors, OTCM Protocol implements Regulation A+ Tier 2 compliance:

📋 17 CFR Section 230.251 — Scope of Exemption

Regulation A provides an exemption from registration for certain securities offerings. Tier 2 permits offerings up to $75,000,000 in any 12-month period to both accredited and non-accredited investors.

🔹 11.1.6 Regulation S Offshore Transactions

For non-USU.S. investor participation, OTCM Protocol implements Regulation S compliance:

📋 17 CFR Section 230.903 — Conditions to be Met

Securities offered or sold in an offshore transaction are not subject to the registration requirements of section 5 of the Act if (1) the offer or sale is made in an offshore transaction; (2) no directed selling efforts are made in the United States; and (3) applicable conditions are satisfied.

// Regulation S Structure

interface RegulationSOffering {

// Offshore transaction requirements

offshoreTransaction: {

buyerLocation: string; // Non-US jurisdiction

noUSPersonPurchasers: boolean;

transactionExecutedOffshore: boolean;

};

// No directed selling efforts

directedSellingEfforts: {

usMediaAdvertising: boolean; // Must be false

usTargetedWebsite: boolean; // Must be false

usInvestorMeetings: boolean; // Must be false

};

// Category determination

category: 'CATEGORY_1' | 'CATEGORY_2' | 'CATEGORY_3';

// Distribution compliance period (Category 3 - Equity)

distributionCompliance: {

period: 40; // 40 days for equity

flowbackRestriction: boolean;

legendRequired: boolean;

distributorCertification: boolean;

};

// Buyer certification

buyerCertification: {

nonUSPersonCertified: boolean;

residencyVerified: boolean;

verificationMethod: 'DOCUMENT' | 'IP_GEOLOCATION' | 'BOTH';

};

}

🔹 11.1.7 Form D Filing Requirements

SEC Form D filings are required for all Rule 506(c) offerings:

🔹 11.1.8 Information Provision Requirements

OTCM Protocol implements comprehensive disclosure through on-chain information provision:

• Quarterly Reports:Reports — 10-Q equivalent reports published on-chain within 45 days of quarter end
• Annual Reports:Reports — 10-K equivalent reports published on-chain within 90 days of fiscal year end
• Current Reports:Reports — 8-K equivalent reports for material events within 4 business days
• Financial Statements:Statements — Audited annual financials (GAAP or IFRS)
• Risk Factors:Factors — Comprehensive risk disclosure updated quarterly

// Issuer Disclosure Requirements

interface IssuerDisclosure {

// Quarterly disclosure (10-Q equivalent)

quarterlyReports: {

frequency: 'QUARTERLY';

deadline: '45_DAYS_AFTER_QUARTER_END';

contents: [

'FINANCIAL_STATEMENTS',

'MD&A',

'RISK_FACTORS_UPDATE',

'CAPITALIZATION_TABLE',

];

format: 'PDF_AND_STRUCTURED_DATA';

storageLocation: 'IPFS_WITH_ONCHAIN_HASH';

};

// Annual disclosure (10-K equivalent)

annualReports: {

frequency: 'ANNUAL';

deadline: '90_DAYS_AFTER_FISCAL_YEAR_END';

auditRequired: true;

auditStandard: 'PCAOB' | 'AICPA';

};

// Current reports (8-K equivalent)

currentReports: {

triggeringEvents: [

'MATERIAL_ACQUISITION_DISPOSITION',

'BANKRUPTCY_RECEIVERSHIP',

'CHANGE_IN_CONTROL',

'EXECUTIVE_OFFICER_CHANGE',

'MATERIAL_IMPAIRMENT',

];

deadline: '4_BUSINESS_DAYS';

};

}

✅ 11.2 Securities Exchange Act of 1934 Compliance

🔹 11.2.1 Exchange Act Overview

Pursuant to 15 U.S.C. Section 78a et seq., the Securities Exchange Act of 1934 regulates secondary trading of securities, including antifraud provisions, disclosure requirements, and market manipulation prohibitions. CEDEX achieves Exchange Act compliance through a portal-integrated regulatory framework.

📋 15 U.S.C. § 78j — Manipulative and Deceptive Devices

It shall be unlawful for any person, directly or indirectly, by the use of any means or instrumentality of interstate commerce or of the mails, or of any facility of any national securities exchange, to use or employ, in connection with the purchase or sale of any security, any manipulative or deceptive device or contrivance.

🔹 11.2.2 Rule 10b-5 Antifraud Provisions

OTCM Protocol implements Rule 10b-5 compliance through unprecedented on-chain transparency:

📋 17 CFR 240.10b-5 — Employment of Manipulative and Deceptive Devices

It shall be unlawful for any person: (a) To employ any device, scheme, or artifice to defraud; (b) To make any untrue statement of a material fact or to omit to state a material fact necessary in order to make the statements made, in the light of the circumstances under which they were made, not misleading;fact; or (c) To engage in any act, practice, or course of business which operates or would operate as a fraud or deceit upon any person.

// Rule 10b-5 Compliance Implementation

interface Rule10b5Compliance {

/**

• 10b-5 compliance through on-chain transparency

*/

// (a) No fraudulent schemes

transparencyMeasures: {

allTransactionsOnChain: true;

publicOrderBook: true; // No hidden orders

realTimePriceDiscovery: true;

noFrontRunning: true; // Transfer Hooks prevent

};

// (b) No material misstatements

disclosureIntegrity: {

disclosuresHashedOnChain: true;

immutableAfterPublication: true;

timestampProof: true;

contentAddressableStorage: 'IPFS';

};

// (c) No fraudulent acts

tradingConstraints: {

priceImpactCircuitBreaker: {

enabled: true;

maxImpact: 200;200 }; // 2% max price impact

};

volumeConstraints: {

enabled: true;

dailyLimit: true;

};

washTradingDetection: {

enabled: true;

selfTradeBlocked: true;

};

};

}

🔹 11.2.3 Rule 10b-5(b) Manipulative Trading Prevention

CEDEX implements multiple layers of manipulative trading prevention through smart contract constraints:

• Price Impact Circuit Breaker:Breaker — 2% maximum price impact per transaction prevents sudden price manipulation
• Volume Detection:Detection — Unusual volume patterns trigger enhanced monitoring and potential circuit breaker
• Wash Trading Prevention:Prevention — Self-trades blocked;blocked · coordinated trading detected through wallet clustering
• Front-Running Protection:Protection — Transfer Hooks execute before trade completion;completion · no advance knowledge available
• Spoofing Detection:Detection — Order cancellation patterns analyzed;analyzed · suspicious patterns flagged

🔹 11.2.4 Rule 13d-3 Beneficial Ownership Disclosure

OTCM Protocol implements beneficial ownership disclosure through public on-chain registries:

📋 17 CFR 240.13d-3 — Determination of Beneficial Owner

A beneficial owner of a security includes any person who, directly or indirectly, has or shares: (1) Voting power, including the power to vote or direct the voting of such security;power; and/or (2) Investmentinvestment power, including the power to dispose or direct the disposition of such security.

// Beneficial Ownership Disclosure

interface BeneficialOwnershipDisclosure {

// 5% threshold monitoring

thresholdMonitoring: {

threshold: 500; // 5% in basis points

monitoringFrequency: 'REAL_TIME';

automaticAlert: true;

};

// Disclosure triggers

disclosureTriggers: [

'CROSS_5_PERCENT', // Initial 5% crossing

'CROSS_10_PERCENT', // Major holder status

'MATERIAL_CHANGE', // 1%+ change

'CHANGE_IN_INTENT', // Passive vs active intent

];

// On-chain registry

publicRegistry: {

data: {

walletAddress: Pubkey;

percentOwnership: number;

lastUpdateTimestamp: i64;

disclosureType: 'SCHEDULE_13D' | 'SCHEDULE_13G';

filingStatus: 'CURRENT' | 'AMENDMENT_REQUIRED';

}[];

accessLevel: 'PUBLIC';

updateFrequency: 'EACH_BLOCK';

};

//filingAssistance: Automatic{
    filingschedule13DTemplate:     assistanceboolean;
    schedule13GTemplate:     boolean;
    edgarFilingIntegration:  boolean;
    deadlineReminders:       boolean;
  };
}

filingAssistance: {

schedule13DTemplate: boolean;

schedule13GTemplate: boolean;

edgarFilingIntegration: boolean;

deadlineReminders: boolean;

};

}

🔹 11.2.5 CEDEX Exchange Act Positioning

CEDEX operates as a protocol-level matching engine rather than a registered securities exchange, achieving this positioning through the following architectural decisions:exchange:

🔹 11.2.6 Section 12(g) Registration Considerations

Section 12(g) of the Exchange Act requires registration for issuers with total assets exceeding $10 million and a class of equity securities held by 2,000 or more persons (or 500 non-accredited investors). OTCM Protocol addresses this through:

• Accredited Investor Focus:Focus — Rule 506(c) offerings limited to accredited investors
• Investor Count Monitoring:Monitoring — Portal tracks holder count against 12(g) thresholds
• Voluntary Registration Support:Support — Portal assists issuers who choose or are required to register
• Rule 12g-4 Exit Procedures:Procedures — Guidance for deregistration when thresholds no longer met

🏦 11.3 Transfer Agent Regulation

🔹 11.3.1 Transfer Agent Requirements

Pursuant to 17 CFR Section 240.17a-1 et seq., transfer agents must be registered with the SEC and maintain comprehensive recordkeeping, reporting, and custody standards. OTCM Protocol integrates with Empire Stock Transfer to satisfy all transfer agent requirements.

📋 17 CFR 240.17Ad-2 — Turnaround, Processing, and Forwarding of Items

Every registered transfer agent shall (1) turnaround at least 90% of items within three business days and (2) process or reject items received in proper form within 30 days.

🔹 11.3.2 Empire Stock Transfer Partnership

Empire Stock Transfer provides SEC-registered transfer agent services for all ST22 issuers:

🔹 11.3.3 Series M Preferred Share Custody

The custody architecture for Series M preferred shares follows institutional standards:

// Series M Custody Architecture

interface SeriesMCustody {

/**

• Empire Stock Transfer custody of Series M preferred shares
• backing all ST22 tokens

*/

// Physical custody

physicalStorage: {

location: 'BANK_GRADE_VAULT';

accessControl: 'DUAL_CONTROL'; // Two authorized persons required

monitoring: '24_7_SURVEILLANCE';

insurance: {

coverageAmount: 50_000_000; // $50M

carrier: string;

policyNumber: string;

};

};

// Certificate details

certificateDetails: {

issuer: string;

shareClass: 'SERIES_M_PREFERRED';

cusip: string;

totalSharesIssued: number;

parValue: number;

certificateNumbers: string[];

};

// 1:1 backing verification

backingVerification: {

totalSharesCustodied: number;

totalST22Circulating: number;

discrepancy: number; // Should be 0

maxAllowedDiscrepancy: 0.0001; // 0.01% tolerance

lastVerification: Date;

verificationFrequency: 'EVERY_400MS'; // Each Solana slot

};

// Redemption capability

redemptionProcess: {

enabled: boolean;

minimumRedemption: number;

processingTime: '3_5_BUSINESS_DAYS';

deliveryMethod: 'DRS' | 'PHYSICAL_CERTIFICATE';

};

}

🔹 11.3.4 Shareholder Registry Architecture

The shareholder registry maintains authoritative records synchronized with on-chain token balances:

// Shareholder Registry Structure

interface ShareholderRegistry {

// Registry entry for each beneficial owner

entries: {

// Shareholder identification

shareholderId: string;

legalName: string;

taxId: string; // SSN/EIN (encrypted)

address: string;

// Ownership details

shareQuantity: number;

shareClass: 'SERIES_M_PREFERRED';

acquisitionDate: Date;

certificateNumbers?: string[];

// Blockchain linkage

walletAddress: Pubkey;

tokenBalance: number; // ST22 Digital Securities tokens

lastSyncTimestamp: Date;

syncStatus: 'SYNCED' | 'PENDING' | 'DISCREPANCY';

// Compliance status

kycStatus: 'VERIFIED' | 'PENDING' | 'EXPIRED';

accreditationStatus: 'ACCREDITED' | 'NON_ACCREDITED' | 'PENDING';

accreditationExpiration?: Date;

}[];

// Registry reconciliation

reconciliation: {

lastReconciliation: Date;

frequency: 'REAL_TIME';

totalShareholderCount: number;

totalSharesOutstanding: number;

discrepancies: Discrepancy[];

};

}

🔹 11.3.5 Monthly Audit and Reporting

Independent audits occur monthly with results published on-chain for public verification:

// Monthly Audit Report Structure

interface MonthlyAuditReport {

// Audit period

auditPeriod: {

startDate: Date;

endDate: Date;

};

// Independent auditor

auditor: {

firmName: string;

auditorName: string;

license: string;

signature: Ed25519Signature;

};

// Share reconciliation

shareReconciliation: {

physicalCertificatesHeld: number;

registrySharesRecorded: number;

tokensCirculating: number;

discrepancy: number;

discrepancyExplanation?: string;

status: 'RECONCILED' | 'DISCREPANCY_NOTED';

};

// Registry accuracy

registryAudit: {

totalBeneficialOwners: number;

recordsSampled: number;

recordsReconciled: number;

discrepanciesFound: number;

accuracyRate: number; // Target: 100%

};

// Custody verification

custodyVerification: {

physicalInspectionCompleted: boolean;

certificatesAccountedFor: boolean;

vaultSecurityConfirmed: boolean;

insuranceVerified: boolean;

};

// On-chain publication

onChainRecord: {

transactionSignature: string;

blockHeight: number;

ipfsHash: string; // Full report stored on IPFS

reportHash: string; // SHA-256 of report content

};

}

🔹 11.3.6 SEC Filing Requirements

Empire Stock Transfer maintains all required SEC filings:

🔍 11.4 Anti-Money Laundering Framework

OTCM Protocol implements comprehensive AML and KYC mechanisms exceeding statutory minimums,minimums, ensuring institutional-grade compliance with the Bank Secrecy Act, OFAC regulations, and FinCEN requirements.

🔹 11.4.1 Bank Secrecy Act Compliance

📋 31 U.S.C. § 5311 — Declaration of Purpose

It is the purpose of this subchapter to require certain reports or records where they have a high degree of usefulness in criminal, tax, or regulatory investigations or proceedings, or in the conduct of intelligence or counterintelligence activities to protect against international terrorism.proceedings.

🔹 11.4.2 OFAC Sanctions Implementation

Every CEDEX transaction checks both sender and recipient against the current OFAC Specially Designated Nationals (SDN) list:

// OFAC Screening Implementation

interface OFACScreening {

/**

• OFAC SDN list screening implementation
• Updated hourly from official OFAC publication

*/

// SDN list integration

sdnList: {

source: 'OFAC_OFFICIAL';

updateFrequency: 'HOURLY';

lastUpdate: Date;

entryCount: number;

cryptoAddressCount: number;

};

// Screening scope

screeningScope: {

directAddressMatch: boolean; // Direct SDN address

clusterAnalysis: boolean; // Related wallets

fundingSourceAnalysis: boolean; // Upstream exposure

transactionCounterparty: boolean; // Downstream exposure

};

// Screening execution

screeningExecution: {

timing: 'PRE_TRANSACTION';

blockingBehavior: 'AUTOMATIC_BLOCK';

appealProcess: 'NONE'; // Must resolve with OFAC directly

};

// Comprehensive sanctions programs

sanctionsPrograms: [

'IRAN', // 31 CFR Part 560

'NORTH_KOREA', // 31 CFR Part 510

'SYRIA', // 31 CFR Part 542

'CUBA', // 31 CFR Part 515

'CRIMEA', // 31 CFR Part 589

'RUSSIA', // 31 CFR Part 589

'VENEZUELA', // 31 CFR Part 591

];

}

🔹 11.4.3 FinCEN Integration

The Portal integrates directly with FinCEN's BSA E-Filing System for automated regulatory submissions:

• BSA E-Filing:Filing — Direct API integration for SAR and CTR submission
• FinCEN Form 114 (FBAR): — Annual filing for foreign financial accounts exceeding $10,000
• Beneficial Ownership Information:Information — BOI reporting for corporate entities
• Response to Law Enforcement:Enforcement — 314(a) and 314(b) information sharing

🔹 11.4.4 SAR Filing Automation

📋 31 CFR § 1010.320 — Reports by Financial Institutions of Suspicious Transactions

A financial institution shall file a SAR with FinCEN for any suspicious transaction relevant to a possible violation of law or regulation if the transaction involves funds or other assets of at least $5,000.

// SAR Filing Automation

interface SARFilingAutomation {

// SAR filing triggers

filingTriggers: {

minimumAmount: 5000; // $5,000 threshold

suspiciousIndicators: [

'STRUCTURING_DETECTED',

'HIGH_RISK_SCORE', // AML score > 70

'SANCTIONS_ADJACENT', // Near-SDN exposure

'CRIMINAL_EXPOSURE', // Darknet,Darknet ransomware,· ransomware · etc.

'UNUSUAL_PATTERN', // Deviation from baseline

];

};

// SAR content

sarContent: {

subjectInformation: SubjectInfo;

suspiciousActivityDescription: string;

transactionDetails: Transaction[];

narrativeExplanation: string;

supportingDocumentation: string[];

};

// Filing process

filingProcess: {

reviewPeriod: '30_DAYS_FROM_DETECTION';

filingDeadline: '30_DAYS_FROM_DETERMINATION';

extensionAvailable: '30_DAY_EXTENSION';

filingMethod: 'FINCEN_BSA_EFILING';

};

// Confidentiality

confidentiality: {

tippingOffProhibited: true;

safeHarborProtection: true;

recordRetention: '5_YEARS';

};

}

🔹 11.4.5 Currency Transaction Reporting

Currency Transaction Reports (CTRs) are filed automatically for qualifying transactions:

// CTR Filing Structure

interface CTRFiling {

// Filing threshold

threshold: {

amount: 10000; // $10,000

currency: 'USD_EQUIVALENT';

aggregation: 'SAME_DAY_MULTIPLE_TRANSACTIONS';

};

// CTR content (FinCEN Form 104)

reportContent: {

transactorIdentification: {

name: string;

address: string;

ssn: string;

dob: Date;

idType: string;

idNumber: string;

};

transactionDetails: {

date: Date;

amount: number;

transactionType: 'DEPOSIT' | 'WITHDRAWAL' | 'EXCHANGE';

};

filingInstitution: InstitutionInfo;

};

// Filing timeline

timeline: {

filingDeadline: '15_CALENDAR_DAYS';

filingMethod: 'FINCEN_BSA_EFILING';

};

}

🔹 11.4.6 Enhanced Due Diligence Procedures

Enhanced due diligence (EDD) applies to high-risk customers and transactions:

8.5 Immutable Compliance Records

The OTCM Portal records all compliance determinations immutably on the Solana blockchain with cryptographic signatures, enabling a permanent audit trail that regulatory inspectors can verify independently without relying on company-maintained records.

🔹 1.5.1 CEDEX — Layer 5 (See Section 5)

"SEC inspectors can directly verify compliance procedures through blockchain inspection without relying on company-maintained records subject to alteration risk."

// Immutable Compliance Record Architecture
┌---┐
│                  IMMUTABLE COMPLIANCE RECORD ARCHITECTURE               │
└---┘
┌---┐
│                    COMPLIANCE EVENT OCCURS                          │
│   (KYC Verification, Accreditation, AML Screening, Transaction)     │
└---┬---┘
│
▼
┌---┐
│                     RECORD GENERATION                               │
│  • Hash sensitive data (documents, PII)                             │
│  • Create compliance record with metadata                           │
│  • Sign with compliance officer Ed25519 key                         │
└---┬---┘
│
┌---┼---┐
│                       │                       │
▼                       ▼                       ▼
┌---┐      ┌---┐      ┌---┐
│   SOLANA      │      │     IPFS      │      │   ENCRYPTED   │
│  BLOCKCHAIN   │      │   STORAGE     │      │   DATABASE    │
│               │      │               │      │               │
│ • Record hash │      │ • Full docs   │      │ • PII data    │
│ • Timestamp   │      │ • Reports     │      │ • KYC docs    │
│ • Signature   │      │ • Audit logs  │      │ • Tax forms   │
│ • IPFS hash   │      │               │      │               │
└---┘      └---┘      └---┘
│                       │                       │
└---┼---┘
│
▼
┌---┐
│                    VERIFICATION CAPABILITIES                        │
│  • Timestamp proof via Solana slot                                  │
│  • Content integrity via SHA-256 hash                               │
│  • Officer authorization via Ed25519 signature                      │
│  • Document retrieval via IPFS hash                                 │
└---┘

🔹 11.5.2 Compliance Record Data Structures

// Compliance Record Data Structures

interface ComplianceRecord {

/**

• On-chain compliance record structure
• Provides immutable audit trail for regulatory verification

*/

// Record identification

recordId: string; // Unique identifier

recordType: ComplianceRecordType;

timestamp: i64; // Unix timestamp

solanaSlot: u64; // Blockchain slot (timestamp anchor)

// Subject identification

subject: {

walletAddress: Pubkey;

investorId: string; // Internal reference

issuerId?: string; // If issuer-related

};

// Compliance determination

determination: {

status: 'APPROVED' | 'REJECTED' | 'PENDING_REVIEW' | 'EXPIRED';

reasonCode: string;

reasonDescription: string;

reviewerType: 'AUTOMATED' | 'MANUAL';

reviewerId?: string;

};

// Evidence references (hashes only on-chain)

evidenceHashes: {

documentHash?: string; // SHA-256 of KYC documents

screeningHash?: string; // SHA-256 of AML screening result

verificationHash?: string; // SHA-256 of accreditation letter

transactionHash?: string; // SHA-256 of transaction details

};

// IPFS storage references

ipfsReferences: {

fullRecordCid?: string; // Complete record on IPFS

supportingDocsCid?: string; // Supporting documentation

};

// Cryptographic signature

signature: {

algorithm: 'Ed25519';

signerPublicKey: Pubkey; // Compliance officer key

signatureBytes: [u8; 64];

signatureTimestamp: i64;

};

}

enum ComplianceRecordType {

KYC_VERIFICATION = 'KYC_VERIFICATION',

KYC_EXPIRATION = 'KYC_EXPIRATION',

ACCREDITATION_VERIFICATION = 'ACCREDITATION_VERIFICATION',

ACCREDITATION_EXPIRATION = 'ACCREDITATION_EXPIRATION',

AML_SCREENING = 'AML_SCREENING',

AML_ALERT = 'AML_ALERT',

TRANSACTION_AUTHORIZATION = 'TRANSACTION_AUTHORIZATION',

TRANSACTION_BLOCK = 'TRANSACTION_BLOCK',

SAR_FILING_REFERENCE = 'SAR_FILING_REFERENCE',

SANCTIONS_CHECK = 'SANCTIONS_CHECK',

SANCTIONS_BLOCK = 'SANCTIONS_BLOCK',

BENEFICIAL_OWNERSHIP = 'BENEFICIAL_OWNERSHIP',

ACCOUNT_FREEZE = 'ACCOUNT_FREEZE',

ACCOUNT_UNFREEZE = 'ACCOUNT_UNFREEZE',

}

🔹 11.5.3 Regulatory Inspector Access

SEC and other regulatory inspectors can directly verify compliance procedures through multiple access methods:

🔹 11.5.4 Cryptographic Proof Standards

Each compliance record includes cryptographic proof enabling independent verification:

// Cryptographic Proof Standards

interface CryptographicProofStandards {

/**

• Cryptographic standards for compliance verification

*/

// Timestamp proof

timestampProof: {

method: 'SOLANA_SLOT_ANCHOR';

precision: '~400ms'; // Slot time

verifiability: 'BLOCKCHAIN_CONSENSUS';

tamperResistance: 'CRYPTOGRAPHICALLY_GUARANTEED';

};

// Document integrity proof

documentIntegrity: {

hashAlgorithm: 'SHA-256';

collisionResistance: '2^128'; // Security level

verification: 'RECOMPUTE_AND_COMPARE';

};

// Authorization proof

authorizationProof: {

signatureAlgorithm: 'Ed25519';

keySize: 256; // bits

publicKeyOnChain: true;

verification: 'SIGNATURE_VERIFICATION';

};

// Chain of custody proof

chainOfCustody: {

linkage: 'PREVIOUS_RECORD_HASH';

sequencing: 'SOLANA_SLOT_ORDER';

gapDetection: 'SEQUENCE_ANALYSIS';

};

}

🔹 11.5.5 Record Retention Requirements

OTCM Protocol maintains compliance records in accordance with regulatory retention requirements:

• KYC Records: 5 years after account closure (31 CFR 1010.430)
• Transaction Records: 5 years from transaction date
• SAR Records: 5 years from filing date (confidential)
• CTR Records: 5 years from filing date
• Accreditation Records: Duration of investment plus 5 years
• Blockchain Permanence: On-chain records retained indefinitely by network design ✓ Regulatory Advantage

Unlike traditional compliance records maintained in company databases (subject to alteration, loss, or destruction), OTCM's on-chain records are immutable by design. Regulators need not trust the company—they can independently verify compliance through blockchain inspection with cryptographic certainty.

📋 11.5 Immutable Audit Trail

🔹 1.5.1 CEDEX — Layer 5 (See Section 5)

Every ST22 tokenDigital Securities transfer, compliance verification event, and Transfer Hook execution generates an immutable on-chain record.record. These records cannot be altered, deleted, or selectively disclosed — they exist permanently on the Solana blockchain and are accessible to any regulatory inspector with the appropriate wallet address or block explorer access.

OTCM's audit trail exceeds SEC Rule 17a-4 requirements for electronic records retention by providing cryptographic proof of every compliance decision at transaction level.

"SEC inspectors can directly verify compliance procedures through blockchain inspection without relying on company-maintained records subject to alteration risk."

🔹 11.5.21 On-Chain Compliance RecordRecords Databy StructuresType

🔹 11.5.2 Compliance Record Data Structure

interface ComplianceRecord {
  recordId:    string;
  recordType:  ComplianceRecordType;
  timestamp:   i64;   // Unix timestamp
  solanaSlot:  u64;   // Blockchain slot anchor (~400ms precision)

  subject: {
    walletAddress: Pubkey;
    investorId:    string;
    issuerId?:     string;
  };

  determination: {
    status:             'APPROVED' | 'REJECTED' | 'PENDING_REVIEW' | 'EXPIRED';
    reasonCode:         string;
    reasonDescription:  string;
    reviewerType:       'AUTOMATED' | 'MANUAL';
  };

  evidenceHashes: {
    documentHash?:    string;   // SHA-256 of KYC documents
    screeningHash?:   string;   // SHA-256 of AML screening result
    verificationHash?: string;  // SHA-256 of accreditation letter
    transactionHash?: string;   // SHA-256 of transaction details
  };

  ipfsReferences: {
    fullRecordCid?:      string;  // Complete record on IPFS
    supportingDocsCid?:  string;
  };

  signature: {
    algorithm:         'Ed25519';
    signerPublicKey:   Pubkey;
    signatureBytes:    [u8; 64];
    signatureTimestamp: i64;
  };
}

enum ComplianceRecordType {
  KYC_VERIFICATION         = 'KYC_VERIFICATION',
  KYC_EXPIRATION           = 'KYC_EXPIRATION',
  ACCREDITATION_VERIFICATION = 'ACCREDITATION_VERIFICATION',
  ACCREDITATION_EXPIRATION = 'ACCREDITATION_EXPIRATION',
  AML_SCREENING            = 'AML_SCREENING',
  AML_ALERT                = 'AML_ALERT',
  TRANSACTION_AUTHORIZATION = 'TRANSACTION_AUTHORIZATION',
  TRANSACTION_BLOCK        = 'TRANSACTION_BLOCK',
  SAR_FILING_REFERENCE     = 'SAR_FILING_REFERENCE',
  SANCTIONS_CHECK          = 'SANCTIONS_CHECK',
  SANCTIONS_BLOCK          = 'SANCTIONS_BLOCK',
  BENEFICIAL_OWNERSHIP     = 'BENEFICIAL_OWNERSHIP',
  ACCOUNT_FREEZE           = 'ACCOUNT_FREEZE',
  ACCOUNT_UNFREEZE         = 'ACCOUNT_UNFREEZE',
}

🔹 11.5.3 Regulatory Inspector Access

OTCM Protocol provides SEC, FINRA, and FinCEN inspectors with dedicated read-only wallet addresses enabling direct on-chain audit access without requiring OTCM Protocol cooperation for data production.

🔹 11.5.4 Cryptographic Proof Standards

🔹 11.5.5 Record Retention Requirements

✓ Regulatory Advantage: Unlike traditional compliance records maintained in company databases (subject to alteration, loss, or destruction), OTCM's on-chain records are immutable by design. Regulators need not trust the company — they can independently verify compliance recordthrough isblockchain signedinspection with OTCM Protocol's program keypair, providing cryptographic non-repudiation.certainty.

⚠️ 11.6 Regulatory Risk Matrix

This section provides a comprehensive regulatory risk assessment for OTCM Protocol operations:

💡 Overall Regulatory Risk Assessment

Assessment:

OTCM Protocol's compliance-first designdesign, combined with formal Digital Securities classification under SEC Release No. 33-11412 (March 17, 2026), results in LOW overall regulatory risk.risk. The explicit securities structure, established exemptions, SEC-registered transfer agent partnership, and comprehensive AML framework provide strongthe strongest regulatory foundation.foundation available for a tokenized securities platform. Medium risks in Exchange Act positioning and international compliance are actively managed through ongoing legal counsel engagement.

Groovy Company, Inc. dba OTCM Protocol · Wyoming Corporation · invest@otcm.io · otcm.io