Skip to main content

Section 11: Regulatory Compliance Framework

🏒 The compliance gateway through which issuers onboard, investors verify eligibility, and all KYC/AML requirements are enforced before any ST22 token interaction.


⚠️ 9.1 Institutional Purpose & Problem Statement

Prior to OTCM Protocol development, companies seeking to issue tokenized securities confronted a prohibitive compliance burden that effectively excluded smaller and mid-tier issuers from the digital securities market. The complexity, cost, and specialized expertise required created an insurmountable barrier for companies lacking substantial legal and compliance infrastructure.

πŸ”Ή 9.1.1 The Traditional Compliance Burden

Companies attempting independent securities tokenization must establish and maintain comprehensive regulatory infrastructure across six critical domains:

  • KYC/AML Infrastructure: Build or license identity verification platforms with document authentication, biometric matching, and sanctions screening capabilities
  • Securities Counsel: Retain specialized securities law firms with digital asset expertise for offering documentation, regulatory filings, and ongoing compliance advice
  • Transfer Agent Services: Engage SEC-registered transfer agents for shareholder registry maintenance, custody verification, and regulatory reporting
  • Custody Arrangements: Establish relationships with qualified custodians for physical certificate storage and digital asset custody
  • Regulatory Reporting: Hire compliance staff for SEC filings, Form D submissions, and ongoing disclosure requirements
  • Transaction Monitoring: License blockchain analytics platforms for AML screening, suspicious activity detection, and regulatory reporting

πŸ”Ή 9.1.2 Cost Analysis: Independent vs. OTCM Portal

The following analysis compares the annual cost of establishing independent compliance infrastructure versus utilizing the OTCM Issuers Portal:

 | March2026 | GroovyCompany,Inc.dbaProtocol

Compliance FunctionIndependent (Low)Independent (High)OTCM Portal
KYC/AML

OTCM PROTOCOL

Comprehensive Technical Whitepaper  β€”  Version 7.0

ST22 Digital Securities Platform

$150,000 $500,000Included
Securities Counsel$200,000 $750,000 Included
TransferOTCM Agent $50,000$150,000Included
Custody Services$75,000$200,000Included
Regulatory Reporting$100,000$300,000Included
Transaction Monitoring$75,000$200,000Included
TOTAL ANNUAL COST$650,000$2,100,000$1K-$25K*

 

  • One-time

    Section SMT11: mintingRegulatory fee;Compliance ongoing compliance included in 5% transaction fee structure

Framework

πŸ’‘ Cost Reduction Impact

For a company raising $5M through tokenized securities, traditional compliance costs ($650K-$2.1M) could consume 13-42% of capital raised. OTCM Portal reduces this to 0.02-0.5%, making tokenization economically viable for mid-market issuers.

πŸ”Ή 9.1.3 OTCM Solution Architecture

OTCM Protocol eliminatesis issuerdesigned from the ground up to operate within the full weight of U.S. securities law. The platform does not seek regulatory burdenexemptions from investor protection requirements β€” it automates those requirements with mathematical precision across every layer of the architecture. This section documents the complete regulatory framework to which the platform is subject and demonstrates how each applicable requirement is satisfied.

 

11.1  Regulatory Foundation and Philosophy

OTCM Protocol's foundational regulatory principle is that tokenization is a delivery mechanism for securities β€” not a transformation of their legal character. The SEC's technology-neutral principle, affirmed in the January 28, 2026 Joint Staff Statement, states: "The format in which a security is issued or the methods by which holders are recorded does not affect application of the federal securities laws." OTCM Protocol applies this principle operationally: every ST22 Digital Security is a security under federal securities law, subject to the full Securities Act and Exchange Act regardless of its blockchain format.

This philosophy produces an architecture that the SEC's Category 1 Model B framework was designed to describe: issuer-authorized tokenization with an SEC-registered transfer agent maintaining the authoritative securityholder file, blockchain serving as the notification and enforcement layer, and all investor protection requirements enforced programmatically on every transaction through aTransfer purpose-builtHook Issuers Portal that consolidates all compliance, identity verification, transaction monitoring, and regulatory reporting functions under a single, standardized, institutional-grade framework:controls.

"Issuers utilize our portal rather than developing independent compliance infrastructure, achieving full regulatory compliance without requiring specialized securities law expertise or expensive external counsel."

πŸ”Ή 9.1.4 Portal Component Overview

// OTCM Issuers Portal Architecture Diagram
β”Œ---┐
β”‚                    OTCM ISSUERS PORTAL ARCHITECTURE                         β”‚
β”‚                         (Unified Compliance Gateway)                        β”‚
β””---β”˜
β”Œ---┐
β”‚                      ISSUER ADMINISTRATION DASHBOARD                    β”‚
β”‚  β”Œ---┐ β”Œ---┐ β”Œ---┐ β”Œ---┐  β”‚
β”‚  β”‚ Company       β”‚ β”‚ Token         β”‚ β”‚ Investor      β”‚ β”‚ Compliance  β”‚  β”‚
β”‚  β”‚ Profile       β”‚ β”‚ Analytics     β”‚ β”‚ Registry      β”‚ β”‚ Dashboard   β”‚  β”‚
β”‚  β””---β”˜ β””---β”˜ β””---β”˜ β””---β”˜  β”‚
β””---β”˜
β”‚
β”Œ---β”Ό---┐
β”‚                             β”‚                             β”‚
β–Ό                             β–Ό                             β–Ό
β”Œ---┐    β”Œ---┐    β”Œ---┐
β”‚    KYC MODULE    β”‚    β”‚  ACCREDITATION   β”‚    β”‚   AML/SCREENING  β”‚
β”‚                  β”‚    β”‚     MODULE       β”‚    β”‚      MODULE      β”‚
β”‚ β€’ ID Verificationβ”‚    β”‚ β€’ 506(c) Verify  β”‚    β”‚ β€’ Risk Scoring   β”‚
β”‚ β€’ Biometrics     β”‚    β”‚ β€’ Self-Cert      β”‚    β”‚ β€’ OFAC Check     β”‚
β”‚ β€’ Doc Auth       β”‚    β”‚ β€’ Third-Party    β”‚    β”‚ β€’ SAR Filing     β”‚
β”‚ β€’ Address Proof  β”‚    β”‚ β€’ Reg A+ Limits  β”‚    β”‚ β€’ Tx Monitoring  β”‚
β”‚ β€’ Source of Fundsβ”‚    β”‚ β€’ Expiration Mgmtβ”‚    β”‚ β€’ Account Freeze β”‚
β””---┬---β”˜    β””---┬---β”˜    β””---┬---β”˜
β”‚                       β”‚                       β”‚
β””---β”Ό---β”˜
β”‚
β–Ό
β”Œ---┐
β”‚                    THIRD-PARTY INTEGRATION LAYER                        β”‚
β”‚  β”Œ---┐ β”Œ---┐ β”Œ---┐ β”Œ---┐ β”Œ---┐  β”‚
β”‚  β”‚ Jumio   β”‚ β”‚ Onfido  β”‚ β”‚ Socure  β”‚ β”‚Chainalysisβ”‚ β”‚   TRM Labs      β”‚  β”‚
β”‚  β”‚ (ID)    β”‚ β”‚ (Docs)  β”‚ β”‚ (Fraud) β”‚ β”‚  (AML)    β”‚ β”‚  (Forensics)    β”‚  β”‚
β”‚  β””---β”˜ β””---β”˜ β””---β”˜ β””---β”˜ β””---β”˜  β”‚
β””---β”˜
β”‚
β–Ό
β”Œ---┐
β”‚                   ON-CHAIN COMPLIANCE RECORD LAYER                      β”‚
β”‚               (Immutable Audit Trail on Solana Blockchain)              β”‚
β””---β”˜
β”‚
β”Œ---β”Ό---┐
β”‚                           β”‚                           β”‚
β–Ό                           β–Ό                           β–Ό
β”Œ---┐       β”Œ---┐       β”Œ---┐
β”‚ Empire Stock  β”‚       β”‚   SEC EDGAR   β”‚       β”‚   FinCEN BSA  β”‚
β”‚   Transfer    β”‚       β”‚    Filings    β”‚       β”‚   E-Filing    β”‚
β”‚  (Custody)    β”‚       β”‚  (Form D, etc)β”‚       β”‚  (SAR, CTR)   β”‚
β””---β”˜       β””---β”˜       β””---β”˜

πŸ”Ή 9.1.5 Issuer Onboarding Workflow

The Portal implements a structured onboarding workflow for new issuers:

Regulatory

Protocol not layer compliance onto finished are product. KYC/AML enforcement on transfer, Rule holding period enforcement by Control can
StepPhaseActionsTimeline
1 ApplicationSubmitCompliance companyas info,Infrastructure

share structure, tokenization goals
Day 1
2Due DiligenceCorporate verification, officer KYC, AML screeningDays 2-5
3Legal SetupSeries M preferred authorization,

OTCM agreements

Daysdoes 5-10
4Transfera AgentEmpireproduct Stockas an afterthought. The 42 Transfer custodyHook setup,security sharecontrols issuanceDaysthe 10-15
5Tokenevery MintingST22OFAC creationscreening withon Transferevery Hooks,wallet liquidityinteraction, setupDay144 15-17
6LIVEBonding24 curveβ€” active,these are not checks that run before trading enabledDaybegin. 17+They are the mechanism through which trading occurs. Compliance cannot be bypassed because compliance is the execution path.

 

πŸͺͺ11.2 9. SEC Category 1 Model B Classification

11.2.1  The January 28, 2026 Joint Staff Statement

On January 28, 2026, the SEC's Division of Corporation Finance, Division of Investment Management, and Division of Trading and Markets issued a joint statement on tokenized securities establishing a two-category taxonomy for the regulatory treatment of blockchain-based representations of securities. Category 1 (Issuer-Sponsored) covers tokenization occurring by or on behalf of the issuing company itself, with the issuer retaining control over the tokenization architecture and its SEC-registered transfer agent maintaining the authoritative ownership records. Category 2 Integrated(Third-Party KYCSponsored) Frameworkcovers tokenization by unaffiliated third parties.

The OTCM PortalProtocol's implementsST22 comprehensivearchitecture identityis verificationCategory pursuant1 in both structure and substance. Every tokenization on the platform requires explicit board authorization by the issuing company, formal Certificate of Designation filed with the Wyoming Secretary of State, irrevocable custody of underlying Series M preferred shares by Empire Stock Transfer, and CUSIP assignment. No third party can tokenize an issuer's securities on the platform without the issuer's formal corporate authorization.

 

11.2.2  Model B β€” Blockchain as Notification Layer

Within Category 1, the Joint Staff Statement distinguishes two sub-models. Under Model A, the blockchain constitutes or is directly integrated into the master securityholder file. Under Model B, the issuer issues the security off-chain and uses the blockchain as a notification layer: transfers of the token notify the issuer or its agent to federalrecord regulatorythe requirements,transfer ensuringon the off-chain master securityholder file.

OTCM Protocol operates under Model B. Empire Stock Transfer maintains the authoritative Master Securityholder File for all investorsSeries areM properlypreferred identifiedshares beforeunderlying participatingST22 intokens. securitiesThe offerings.

Solana

πŸ”Ήblockchain 9.2.1and Regulatorythe Foundation

SPL

πŸ“‹Token-2022 31Transfer CFRHook Β§infrastructure 1010serve β€”as Bankthe Secrecyoperational Actnotification KYClayer. RequirementsWhen an ST22 token transfer executes on CEDEX, the Transfer Hook validates all 42 security controls; upon successful validation, the transaction is recorded on-chain and simultaneously notifies Empire's systems to update the off-chain Master Securityholder File.

Financial institutions must establish Customer Identification Programs (CIP) that verify customer identity through documentary or non-documentary methods, including collection of name, date of birth, address, and identification number.

The Portal exceeds minimum BSA/AML requirements by implementing enhanced due diligence measures appropriate for securities offerings to accredited and qualified investors.

πŸ”Ή 9.2.2 Four-Pillar Identity Verification

The Portal requires four primary identity verification components before investment eligibility is confirmed:

// Four-Pillar KYC Verification Interface (TypeScript)

interface KYCVerificationPillars {

/**

*/

legalName: {

firstName: string;

middleName?: string;

lastName: string;

suffix?: string;

verificationMethod: 'OCR_EXTRACTION' | 'MANUAL_REVIEW';

matchConfidence: number; // 0-100%

};

/**

  • Pillar 2: Residential Address Verification
  • Confirms current physical residence through official documents

*/

residentialAddress: {

street: string;

city: string;

state: string;

postalCode: string;

country: string;

verificationDocument: 'UTILITY_BILL' | 'BANK_STATEMENT' | 'GOVT_CORRESPONDENCE';

documentDate: Date; // Must be within 90 days

documentHash: string;

};

/**

  • Pillar 3: Beneficial Ownership Confirmation
  • Identifies ultimate beneficial owner of investment funds

*/

beneficialOwnership: {

ownershipType: 'INDIVIDUAL' | 'JOINT' | 'CORPORATE' | 'TRUST' | 'IRA';

ultimateBeneficiary: string;

ownershipPercentage: number; // For entities

controlPerson?: boolean; // For entities

supportingDocuments: string[]; // Document hashes

};

/**

  • Pillar 4: Source of Funds Declaration
  • Documents origin of investment capital

*/

sourceOfFunds: {

primarySource: 'EMPLOYMENT' | 'BUSINESS' | 'INVESTMENTS' | 'INHERITANCE' | 'OTHER';

description: string;

estimatedAmount: number;

supportingEvidence?: string; // Document hash if provided

riskLevel: 'LOW' | 'MEDIUM' | 'HIGH';

};

}

PillarRequirementAcceptable Documents
1. Legal

Category Name1 Model B Element

Full legal

Status

name as appears on government ID
Passport, Driver's

Notes

License, National ID, Residence Permit
2. Address

Issuer Authorization

Current physical

βœ“

residence verified within 90 days
Utility bill,

Board Bankresolution statement,+ GovernmentCertificate letter,of TaxDesignation documentfor every ST22 issuance

3. Beneficial

SEC-Registered OwnerTransfer Agent Custody

Ultimate beneficial

βœ“

owner of funds
Articles of

Empire incorporation,Stock TrustTransfer certificate,(SEC IRAΒ§17A custodianregistered) letterholds all Series M preferred shares

4. Source

DLT ofas FundsOfficial Notification Layer

Origin of

βœ“

investment capital documented
Pay stubs,

Solana Businessblockchain financials,notifies InvestmentEmpire statements,on Inheritanceevery docstransfer via Transfer Hook oracle

Direct Beneficial Ownership

βœ“

ST22 token = 1:1 direct interest in underlying Series M share β€” no entitlement structure

No Third-Party Counterparty Risk

βœ“

No unaffiliated intermediary between holder and underlying equity

Regulatory Recordkeeping

βœ“

Rules 17Ad-2 through 17Ad-13 compliance maintained by Empire Stock Transfer

1:1 Attestation Oracle

βœ“

Cryptographic attestation published every Solana slot (~400ms) confirming 1:1 ratio

 

πŸ”Ή 9.2.3 Document Authentication Pipeline

The Portal employs a multi-layer document authentication pipeline to prevent identity fraud and ensure document authenticity:

// Document Authentication Pipeline Interface

interface DocumentAuthenticationResult {

// Document Classification

documentType: DocumentType;

issuingCountry: string;

documentNumber: string;

expirationDate: Date;

isExpired: boolean;

// Machine-Readable Zone (MRZ) Validation

mrzPresent: boolean;

mrzValid: boolean;

mrzChecksumPass: boolean;

mrzDataExtracted: {

surname: string;

givenNames: string;

nationality: string;

dateOfBirth: string;

documentNumber: string;

};

// Security Feature Detection

securityFeatures: {

hologramDetected: boolean;

uvFeaturesValid: boolean;

microTextPresent: boolean;

opticalVariableDevice: boolean;

laserPerforation: boolean;

};

// Tampering Detection

tamperingAnalysis: {

fontConsistency: number; // 0-100 score

edgeAnalysis: number; // 0-100 score

colorConsistency: number; // 0-100 score

compressionArtifacts: boolean; // JPEG artifact detection

digitalManipulation: boolean; // Photoshop detection

};

// OCR Data Extraction

extractedData: {

fullName: string;

dateOfBirth: Date;

address?: string;

documentNumber: string;

issuanceDate: Date;

expirationDate: Date;

};

// Final Determination

overallScore: number; // 0-100 composite score

status: 'APPROVED' | 'MANUAL_REVIEW' | 'REJECTED';

rejectionReasons?: string[];

}

enum DocumentType {

PASSPORT = 'PASSPORT',

DRIVERS_LICENSE = 'DRIVERS_LICENSE',

NATIONAL_ID = 'NATIONAL_ID',

RESIDENCE_PERMIT = 'RESIDENCE_PERMIT',

UTILITY_BILL = 'UTILITY_BILL',

BANK_STATEMENT = 'BANK_STATEMENT',

}

πŸ”Ή 9.2.4 Biometric Verification System

Liveness verification prevents identity fraud through real-time biometric analysis:

SEC

β€” was built in with No. 33-11412.

VerificationTechnologyAccuracy
Facial RecognitionAI-poweredRelease comparisonNo. between33-11412 selfieβ€” March 17, 2026

SEC Release No. 33-11412 (March 17, 2026) provides updated guidance on Digital Securities that OTCM Protocol's architecture satisfies. The platform's design β€” particularly the 42-control Transfer Hook enforcement, the Category 1 Model B Master Securityholder File architecture, and IDEmpire documentStock photoTransfer's usingrole 128-pointas facialSEC-registered geometrycustodian analysis

99.6%
Livenessalignment DetectionActivethe challengesregulatory (blink,direction turnthe head,Commission smile)subsequently preventformalized photo/videoin replayRelease attacks99.8%
3D Depth AnalysisInfrared depth mapping detects flat images, printed photos, or screen displays99.9%
Anti-SpoofingDetection of masks, deepfakes, synthetic media, and injection attacks99.5%

 

πŸ”Ή 9.2.5 Third-Party Provider Integration

OTCM Portal integrates with industry-leading identity verification providers to ensure comprehensive coverage and redundancy:

ProviderPrimary FunctionCoverageSLA
JumioID verification, liveness, facial match5,000+ ID types, 200+ countries95% auto-verification, <60s avg
OnfidoDocument verification, AI analysis4,500+ document types, 195 countries98% accuracy, <30s processing
SocureGraph analysis, fraud detectionUS-focused, device intelligence98.7% accuracy, 0.1% false positive

πŸ”Ή 9.2.6 KYC Data Architecture

// KYC Verification Flow Implementation (TypeScript)
// Complete KYC Verification Flow Implementation

async function performKYCVerification(

investor: InvestorApplication

): Promise<KYCVerificationResult> {

// Step 1: Document Verification via Jumio

const docResult = await jumio.verifyDocument({

frontImage: investor.idFrontImage,

backImage: investor.idBackImage,

documentType: investor.documentType,

issuingCountry: investor.country,

});

if (!docResult.isAuthentic || docResult.overallScore < 80) {

return {

status: 'REJECTED',

reason: 'DOCUMENT_VERIFICATION_FAILED',

details: docResult.rejectionReasons,

};

}

// Step 2: Liveness Check with Active Challenges

const livenessResult = await jumio.performLivenessCheck({

selfieVideo: investor.selfieVideo,

challengeType: 'ACTIVE', // Blink, turn, smile

minimumFrames: 30,

});

if (!livenessResult.isLive || livenessResult.spoofScore > 20) {

return {

status: 'REJECTED',

reason: 'LIVENESS_CHECK_FAILED',

details: ['Potential spoofing detected'],

};

}

// Step 3: Facial Match (ID Photo vs Selfie)

const matchResult = await jumio.compareFaces(

docResult.extractedPhoto,

livenessResult.capturedFace,

{ minimumConfidence: 85 }

);

if (matchResult.confidence < 85) {

// Queue for manual review if match is uncertain

return {

status: 'MANUAL_REVIEW',

reason: 'FACIAL_MATCH_UNCERTAIN',

matchScore: matchResult.confidence,

};

}

// Step 4: Address Verification

const addressResult = await verifyAddressDocument({

document: investor.addressProofDocument,

claimedAddress: investor.residentialAddress,

maxDocumentAge: 90, // Days

});

if (!addressResult.verified) {

return {

status: 'REJECTED',

reason: 'ADDRESS_VERIFICATION_FAILED',

details: [addressResult.failureReason],

};

}

// Step 5: PEP/Sanctions Screening via Socure

const screeningResult = await socure.screenIndividual({

name: docResult.extractedData.fullName,

dateOfBirth: docResult.extractedData.dateOfBirth,

nationality: docResult.mrzDataExtracted.nationality,

address: investor.residentialAddress,

});

if (screeningResult.pepMatch || screeningResult.sanctionsMatch) {

return {

status: 'REJECTED',

reason: screeningResult.sanctionsMatch ? 'SANCTIONS_MATCH' : 'PEP_MATCH',

details: screeningResult.matchDetails,

};

}

// Step 6: Record KYC Completion On-Chain

const onChainRecord = await recordKYCCompletion(investor.walletAddress, {

verificationDate: Date.now(),

documentHash: hash(docResult.documentData),

facialMatchScore: matchResult.confidence,

screeningHash: hash(screeningResult),

provider: 'JUMIO_SOCURE',

expirationDate: calculateKYCExpiration(docResult),

});

return {

status: 'APPROVED',

kycRecordId: onChainRecord.transactionSignature,

expirationDate: onChainRecord.expirationDate,

verificationDetails: {

documentScore: docResult.overallScore,

livenessScore: 100 - livenessResult.spoofScore,

facialMatchScore: matchResult.confidence,

},

};

}

πŸ”Ή 9.2.7 Verification Status Lifecycle

// KYC Status Lifecycle

enum KYCStatus {

PENDING = 'PENDING', // Application submitted, not started

IN_PROGRESS = 'IN_PROGRESS', // Verification underway

MANUAL_REVIEW = 'MANUAL_REVIEW', // Requires human review

APPROVED = 'APPROVED', // KYC passed, eligible to invest

REJECTED = 'REJECTED', // KYC failed, not eligible

EXPIRED = 'EXPIRED', // KYC expired, re-verification needed

SUSPENDED = 'SUSPENDED', // Account suspended pending investigation

}

// Status Transition Rules

const validTransitions: Record<KYCStatus, KYCStatus[]> = {

PENDING: ['IN_PROGRESS', 'REJECTED'],

IN_PROGRESS: ['APPROVED', 'REJECTED', 'MANUAL_REVIEW'],

MANUAL_REVIEW: ['APPROVED', 'REJECTED'],

APPROVED: ['EXPIRED', 'SUSPENDED'],

REJECTED: ['PENDING'], // Can reapply

EXPIRED: ['IN_PROGRESS'], // Re-verification

SUSPENDED: ['APPROVED', 'REJECTED'], // After investigation

};

πŸ“œ11.3 9.3 AccreditationRegulation StatusD DeterminationRule 506(c) β€” Primary Offering Compliance

TheAll OTCMST22 Portalprimary implementsofferings dual-pathwayβ€” accreditedthe investorcapital verificationraise pursuantphase toin SECwhich investors purchase newly issued ST22 tokens directly from the issuer β€” are conducted under Regulation D Rule 506(c) requirements,(for enablingU.S. bothinvestors) third-partyor professionalRegulation confirmationS and(for self-certificationnon-U.S. subject to audit review.

πŸ”Ή 9.3.1 Regulatory Requirements

πŸ“‹ 17 CFR 230.506(c) β€” Accredited Investor Verification

In offerings conducted underinvestors). Rule 506(c), issuerspermits mustgeneral takesolicitation 'and advertising of securities offerings provided that all purchasers are verified accredited investors and the issuer takes reasonable steps to verify'confirm that status.

 

11.3.1  Rule 506(c) Requirements and Platform Satisfaction

 

// Regulation S Compliance Interface
false; // No US media advertising

false;//No US investor meetings

Rule 506(c) Requirement

Platform Satisfaction

General solicitation permitted

OTCM Protocol's Predictive Marketing AI Module (Layer 9) conducts general solicitation within Rule 506(c) parameters

All purchasers are accredited investors. Verification methods include: (1) income verification through IRS forms, (2) net worth verification through asset statements, (3) written confirmation from registered broker-dealer, investment adviser, licensed attorney, or CPA.investors

Unlike Rule 506(b) offerings where issuer may rely on investor representations, Rule 506(c) requires affirmative verification through documented methods, justifying general solicitation privileges.

πŸ”Ή 9.3.2 Accredited Investor Categories

record workflow

after
CategoryQualification CriteriaVerification Method
Income (Individual) $200,000+ annual

Empire incomeStock inTransfer eachverifies ofall lastinvestors 2before yearstoken withdelivery reasonableβ€” expectationverified ofaccreditation same

Taxrequired

returns, W-2s, 1099s, or CPA letter
Income (Joint)

Reasonable steps to verify accreditation

$300,000+ joint

Empire incomeperforms withdocumented spouseverification: inthird-party eachprofessional of last 2 years with reasonable expectation

Joint tax returnsattestation or CPAsupporting letterdocumentation review

Net Worth

Form D filing within 15 days of first sale

$1,000,000+ net

Form worthD excludingfiled valueby issuer (coordinated by JDT Legal) as part of primaryStage residence4 (individualof orthe jointnine-stage withonboarding spouse)

Bank/brokerage statements, property appraisals
Professional Certification

No integration with other offerings

Hold in

Each goodST22 standing:issuance is a standalone offering with its own Form D, CUSIP, and Series 7M (Generaldesignation

Securities), Series 65 (Investment Adviser), or Series 82 (Private Placement)
FINRA BrokerCheck verification
Knowledgeable Employee

No resale restriction on accredited investors

Director, executive

Rule officer,144 or6-month generalholding partnerperiod ofenforced issueron-chain ORby employeeTransfer participatingHook inControl investments24 ofβ€” issuerallows withsecondary appropriatesale knowledge

Employmenthold

verification letter
Entity - Bank/InsuranceBank, insurance company, registered investment company, business development company, or small business investment companyRegulatory registration verification
Entity - AssetsEntity with $5,000,000+ in total assets not formed for specific purpose of acquiring securities offeredAudited financial statements
Family OfficeFamily office with $5,000,000+ in AUM not formed for specific purpose of acquiring securities offeredAUM verification, entity documents

 

πŸ”Ή11.3.2 9.3.3 Third-PartyFee VerificationStructure Pathwayβ€” Regulation D Offering Phase

TheOTCM preferredProtocol verificationcharges pathwaya involves5% third-partyplatform professionalfee confirmationon fromthe qualifiedgross professionals:

subscription
amount
of
every
primary
offering
transaction
β€”
applied
at
the
point
of
investor
//purchase, Third-Partybefore Verificationproceeds Interface
are

interfaceremitted ThirdPartyAccreditationVerificationto {the issuer. This fee structure applies across the entire lifecycle of ST22 transactions, including both the primary offering phase and all subsequent secondary market trading on CEDEX.

/** 

  • Verification pathway utilizing third-party professionals
  • as permitted under 17 CFR 230.506(c)

*/

pathway: 'THIRD_PARTY';

// Verifier information

verifier: {

type: 'RIA' | 'CPA' | 'ATTORNEY' | 'BROKER_DEALER';

name: string;

licenseNumber: string;

licensingAuthority: string; // e.g., 'SEC', 'State Bar of California'

firmName: string;

firmAddress: string;

contactPhone: string;

contactEmail: string;

};

// Attestation details

attestation: {

date: Date;

accreditationMethod: 'INCOME' | 'NET_WORTH' | 'PROFESSIONAL' | 'ENTITY';

verificationPeriod: { // Time period reviewed

start: Date;

end: Date;

};

documentsReviewed: string[]; // e.g., ['Tax Return 2023', 'Tax Return 2024']

attestationStatement: string;

};

// Document evidence

attestationLetter: {

documentHash: string; // SHA-256 hash

uploadTimestamp: Date;

fileSize: number;

mimeType: 'application/pdf';

};

// Verification status

status: 'PENDING' | 'VERIFIED' | 'REJECTED';

expirationDate: Date; // Typically 90 days from verification

// On-chain record

onChainRecord: {

transactionSignature: string;

blockHeight: number;

recordTimestamp: Date;

};

}

Acceptable third-party verifiers include:

  • Registered Investment Advisers (RIAs): SEC or state-registered investment advisers with fiduciary duty
  • Certified Public Accountants (CPAs): Licensed accounting professionals in good standing
  • Securities Attorneys: Attorneys in good standing specializing in securities law
  • FINRA-Registered Broker-Dealers: Broker-dealer firms registered with FINRA

πŸ”Ή 9.3.4 Self-Certification Pathway

For investors unable to obtain third-party verification, the Portal enables self-certification subject to enhanced review and audit procedures:

// Self-Certification Interface

interface SelfCertificationAccreditation {

/**

  • Self-certification pathway with enhanced scrutiny
  • Subject to audit review confirming consistency

*/

pathway: 'SELF_CERTIFICATION';

// Certification details

certification: {

date: Date;

method: 'INCOME' | 'NET_WORTH' | 'PROFESSIONAL';

selfDeclaredValues: {

// For income method

annualIncome?: {

year1: number;

year2: number;

expectedCurrent: number;

};

// For net worth method

netWorth?: {

totalAssets: number;

totalLiabilities: number;

primaryResidenceValue: number; // Excluded

netWorthExcludingResidence: number;

};

};

};

// Required supporting documents

supportingDocuments: {

required: [

'BANK_STATEMENTS_3_MONTHS',

'BROKERAGE_STATEMENTS_3_MONTHS',

];

optional: [

'TAX_RETURNS_2_YEARS', // Strongly recommended

'PROPERTY_VALUATIONS', // If net worth claim

'BUSINESS_FINANCIALS', // If business income

];

uploadedDocuments: {

documentType: string;

documentHash: string;

uploadTimestamp: Date;

}[];

};

// Consistency validation (ML-powered)

consistencyAnalysis: {

liquidAssetsDetected: number; // From bank/brokerage statements

incomePatternDetected: number; // From deposit patterns

consistentWithClaim: boolean;

confidenceScore: number; // 0-100

flags: string[]; // Any inconsistencies

};

// Audit risk assessment

auditRisk: {

priority: 'LOW' | 'MEDIUM' | 'HIGH';

factors: string[];

nextAuditDate?: Date;

};

acknowledgments: {

perjuryWarning: boolean; // 'I understand false statements may result in...'

rescissionRisk: boolean; // 'I understand investment may be rescinded if...'

auditConsent: boolean; // 'I consent to audit of accreditation status...'

signatureTimestamp: Date;

signatureHash: string;

};

}

⚠️ Audit Risk

Self-certified investors are subject to random audit review. Inconsistencies between self-certified status and demonstrated liquid assets trigger manual compliance review and potential investment rescission. False certification constitutes securities fraud.

πŸ”Ή 9.3.5 Non-Accredited Investor Pathways

For investors unable to satisfy accreditation requirements, the Portal enables participation through Regulation A+ Tier 2 offerings:

πŸ“‹ 15 U.S.C. Section 77b(b) and 17 CFR Section 230.251

Regulation A+ Tier 2 permits offerings up to $75,000,000 annually to both accredited and non-accredited investors, subject to investment limits for non-accredited investors.

Investor TypeAnnual Investment LimitCalculation Basis
Accredited Investor

Transaction Phase

UNLIMITED

Fee Rate

No limit

Issuer appliesProceeds

Platform Fee Allocation

Non-Accredited Individual

Primary offering (Reg D / Reg S)

10%

5% of greatergross of:subscription

Annual income

95% ORof netgross worthsubscription in USD

0.44% permanently locked to Global Unified CEDEX Liquidity Pool; remainder to OTCM Protocol

Example: $80K

Secondary income,market $150K(CEDEX)

NW
$15,000/year

5% of trade value

10% Γ—

No $150Kissuer (greaterparticipation ofin two)secondary fees

0.44% permanently locked to Global Unified CEDEX Liquidity Pool; remainder to OTCM Protocol

 

πŸ”Ή 9.3.6 Accreditation Expiration & Renewal

Accreditation status is not permanent and requires periodic renewal:

  • Standard Expiration: 90 days from date of third-party verification
  • Self-Certification: 90 days, subject to earlier audit-triggered review
  • Professional Certification: Valid while license remains in good standing (verified monthly via FINRA BrokerCheck)
  • Renewal Process: Same verification requirements as initial accreditation; prior accreditation does not expedite process

πŸ” 9.4 Automated AML Screening

The OTCM Portal integrates with blockchain analytics providers to implement comprehensive anti-money laundering screening, analyzing 200+ transaction features to identify suspicious activity patterns and ensure compliance with Bank Secrecy Act requirements.

πŸ”Ή 9.4.1 200+ Feature Risk Analysis

The AML screening system analyzes over 200 distinct features across six primary categories:

Fee

in USD. Issuers no trading
CategoryFeatures AnalyzedFeature Count
Wallet ClusteringGraphStructure analysisβ€” V7 Authoritative Model

OTCM Protocol charges a 5% transaction fee on ALL ST22 transactions β€” both pre-CEDEX primary offering purchases and post-CEDEX secondary market trades. Issuers receive 95% of fundingprimary sources, common ownership patterns, coordinated behavior, entity resolution

45+
Temporal PatternsTransaction timing analysis, velocity patterns, burst detection, scheduling regularity, time-of-day anomalies35+
Volume AnalysisTransaction amounts, cumulative volumes, structuring detection, round number analysis, threshold avoidance30+
Mixing DetectionTornado Cash exposure, CoinJoin detection, cross-chain bridges, privacy protocol usage, peeling chains25+
Exchange PatternsCEX/DEX interaction, KYC exchange usage, non-KYC exchange exposure, nested exchange detection35+
Criminal DatabaseKnown ransomware addresses, darknet markets, fraud rings, stolen fund tracing, exploitraise proceeds 30+
TOTALreceive FEATURESComprehensiveshare behavioralof andsecondary exposuremarket analysis200+fees. The 0.44% permanent lock to the Global Unified CEDEX Liquidity Pool applies on every transaction in both phases. This is the authoritative fee model as of V7.0.

 

11.4  Regulation S β€” Non-U.S. Investor Framework

Regulation S (17 CFR Β§Β§230.901–905) provides a safe harbor from Securities Act registration requirements for offers and sales of securities to non-U.S. persons in offshore transactions. OTCM Protocol implements Regulation S alongside Rule 506(c) to enable global investor participation in ST22 primary offerings while maintaining full compliance.

 

πŸ”Ή11.4.1 9.4.2 RiskRegulation ScoringS ModelRequirements

Each investor and transaction receives a composite risk score based on weighted feature analysis:

// AML Risk Scoring Model

interface AMLRiskAssessment {

// Composite risk score (0-100)

overallRiskScore: number;

// Category-level scores

categoryScores: {

walletClustering: number; // 0-100, weight: 25%

temporalPatterns: number; // 0-100, weight: 15%

volumeAnalysis: number; // 0-100, weight: 15%

mixingExposure: number; // 0-100, weight: 20%

exchangePatterns: number; // 0-100, weight: 10%

criminalDatabase: number; // 0-100, weight: 15%

};

// Risk classification

riskTier: 'LOW' | 'MEDIUM' | 'HIGH' | 'SEVERE';

// Specific flags triggered

triggeredFlags: {

flag: string;

severity: 'INFO' | 'WARNING' | 'CRITICAL';

description: string;

evidence: string[];

}[];

recommendedAction: 'AUTO_APPROVE' | 'ENHANCED_REVIEW' | 'MANUAL_REVIEW' | 'AUTO_REJECT' | 'SAR_REQUIRED';

}

// Risk Tier Thresholds

const RISK_THRESHOLDS = {

LOW: { min: 0, max: 30, action: 'AUTO_APPROVE' },

MEDIUM: { min: 31, max: 50, action: 'ENHANCED_REVIEW' },

HIGH: { min: 51, max: 70, action: 'MANUAL_REVIEW' },

SEVERE: { min: 71, max: 100, action: 'AUTO_REJECT' },

};

ScoreRisk TierAutomated ActionFollow-Up Required
0-30

Reg S Element

LOW

Requirement

Auto-approve None

Platform Implementation

31-50

Offshore transaction

MEDIUM

Offer and sale must occur outside the United States

Approve + Enhanced monitoringQuarterly review
51-70HIGHHold for manual reviewAnalyst review within 24h
71-100SEVEREAuto-reject + Account freezeSAR filing evaluation

πŸ”Ή 9.4.3 Real-Time Transaction Monitoring

TheEmpire Portal implements real-time monitoring of all investor transactions post-issuance:

// Transaction Monitoring Configuration

interface TransactionMonitoringConfig {

// Real-time triggers (per-transaction)

realTimeRules: {

// Large transaction alert

largeTransactionThreshold: number; // $10,000 USD equivalent

// Rapid succession detection

rapidSuccession: {

transactionCount: number; // 3+ transactions

timeWindowMinutes: number; // within 10 minutes

};

// Structuring detection

structuringDetection: {

targetThreshold: number; // $10,000 (CTR threshold)

toleranceRange: { min: number; max: number }; // $9,000 - $9,999

transactionCount: number; // 2+ transactions in range

timeWindowHours: number; // within 24 hours

};

// Round number detection

roundNumberAlert: {

enabled: boolean;

threshold: number; // e.g., $5,000+

consecutiveCount: number; // 3+ round amounts

};

};

// Batch analysis (daily)

batchRules: {

velocityAnalysis: boolean; // Transaction frequency vs baseline

peerGroupComparison: boolean; // Deviation from similar investors

geographicAnomalies: boolean; // Unusual IP/location patterns

networkAnalysis: boolean; // New connections to flagged wallets

behaviorProfiling: boolean; // Deviation from established pattern

};

}

πŸ”Ή 9.4.4 Suspicious Activity Detection

The system identifies suspicious activity patterns that may indicate money laundering, fraud, or sanctions evasion:

  • Structuring: Breaking transactions into smaller amounts to avoid reporting thresholds
  • Layering: Rapid movement of funds through multiple addresses to obscure origin
  • Velocity Anomalies: Sudden increase in transaction frequency or volume
  • Geographic Inconsistencies: Transactions from unusual locations or VPN usage
  • Coordinated Activity: Multiple accounts acting in concert
  • Criminal Exposure: Transactions with addresses associated with known criminal activity

πŸ”Ή 9.4.5 SAR Filing Automation

When suspicious activity is detected, the Portal automates Suspicious Activity Report filing with FinCEN:

πŸ“‹ 31 CFR Β§ 1010.320 β€” SAR Filing Requirements

Financial institutions must file SARs for transactions involving $5,000 or more if the institution knows, suspects, or has reason to suspect the transaction involves funds derived from illegal activity, is designed to evade reporting requirements, or has no lawful purpose.

// SAR Filing Automation

async function evaluateSARRequirement(

investor: Investor,

suspiciousActivity: SuspiciousActivityDetection

): Promise<SARFilingResult> {

// Evaluate SAR filing criteria

const sarCriteria = {

amountThreshold: suspiciousActivity.totalAmount >= 5000,

suspiciousPattern: suspiciousActivity.patternConfidence >= 70,

criminalExposure: suspiciousActivity.criminalExposure > 0,

structuringDetected: suspiciousActivity.structuringScore >= 50,

sanctionsRisk: suspiciousActivity.sanctionsRisk > 0,

};

const requiresSAR = Object.values(sarCriteria).some(c => c === true);

if (requiresSAR) {

// Build SAR report

const sarReport: SARReport = {

filingInstitution: {

name: 'OTCM Protocol, Inc.',

ein: 'XX-XXXXXXX',

address: '...',

},

subjectInformation: {

name: investor.legalName,

address: investor.residentialAddress,

identificationNumber: investor.kycDocumentNumber,

walletAddresses: investor.associatedWallets,

},

suspiciousActivity: {

dateRange: suspiciousActivity.dateRange,

totalAmount: suspiciousActivity.totalAmount,

activityType: suspiciousActivity.activityTypes,

narrative: generateSARNarrative(suspiciousActivity),

},

transactionDetails: suspiciousActivity.transactions,

};

// Submit to FinCEN BSA E-Filing

const filingResult = await fincenAPI.submitSAR(sarReport);

// Record SAR filing on-chain (hash only, not content)

await recordSARFiling(investor.walletAddress, {

filingDate: Date.now(),

bsaId: filingResult.bsaId,

reportHash: hash(sarReport),

// Note: SAR content is confidential and not stored on-chain

});

return {

filed: true,

bsaId: filingResult.bsaId,

filingDate: new Date(),

};

}

return { filed: false, reason: 'SAR criteria not met' };

}

πŸ”Ή 9.4.6 Account Freezing Procedures

When high-risk activity is detected, accounts may be frozen pending investigation:

Freeze TypeTriggerResolution
Temporary HoldRisk score 51-70, pending review24-hour analyst review; auto-release if cleared
Investigation FreezeRisk score 71+, SAR filedFrozen until investigation complete; compliance team decision
Regulatory FreezeOFAC match, law enforcement requestFrozen indefinitely; regulatory/legal authorization required to release

🌍 9.5 Global Investor Eligibility

The OTCM Portal accommodates global investor participation while implementing jurisdiction-based restrictions to ensure compliance with US sanctions laws and international AML standards.

πŸ”Ή 9.5.1 Regulation S Framework

The Portal enablesverifies non-USU.S. nationalperson investor participation through the Regulation S framework:

πŸ“‹ 17 CFR Section 230.903 β€” Regulation S Offshore Transactions

Permits securities offerings to foreign persons in offshore transactions without SEC registration, provided (1)status; no directed selling efforts ininto theU.S. United States, (2) the issuer reasonably believes all offerees are outside the United States, and (3) appropriate offering restrictions are implemented.markets

interface RegulationSCompliance {

// Offshore transaction requirements

offeringLocation: 'OFFSHORE'; // Must be outside United States

buyerLocation: string; // Non-US jurisdiction

sellerLocation: string; // Any jurisdiction

// No directed selling efforts

directedSellingEfforts:No {conditioning of the U.S. market for the securities

usMediaAdvertising:

usDirectedWebsite:AI false;Module //(Layer No9) enforces Rule 506(c) targeting for U.S. wallets; Reg S outreach targets non-U.S. wallets only

Non-U.S. person certification

Investor certifies non-U.S. person status under Rule 902(k)

Empire Stock Transfer KYC includes IP geolocation and document verification of US IPsresidency

usRoadshows:

usBrokerEngagement: false; // No US broker solicitation

};

// Buyer certification requirements

buyerCertification: {

nonUSPersonCertification: boolean; // Required

residencyVerification: {

method: 'DOCUMENT' | 'IP_GEOLOCATION' | 'BOTH';

verificationDate: Date;

documentType?: string;

ipCountry?: string;

};

};

// Distribution compliance (Category 3 - Equity)

distributionCompliance: {

restrictionPeriod: 40; // 40-day12-month distribution compliance period

flowbackRestriction:Non-U.S. boolean;investors //may not offer or sell to U.S. persons for 12 months

Transfer Hook Control 24 enforces 12-month lock on Reg S investor wallets β€” Error 6024 on premature transfer

Restrictive legend

Securities must bear restrictive legend during compliance period

ST22 token metadata includes Reg S restriction flag readable by CEDEX matching engine

Flowback restriction

Prevents immediate USresale resaleinto U.S. markets

Transfer Hook Control 18 screens Reg S transfers against U.S.-person buyer wallets during compliance period

 

11.5  Transfer Hook Compliance Architecture

The 42 SPL Token-2022 Transfer Hook controls described in Section 3 are the operational mechanism through which all regulatory requirements are enforced on every ST22 transaction. This section maps the regulatory obligations to the specific controls that satisfy them.

legendRequirement: boolean; // Restrictive legend on certificates

distributorAgreement: boolean; // Written agreements with distributors

};

// OFAC compliance (required regardless of Reg S)

ofacCompliance: {

sdnScreeningPassed: boolean;

sanctionedCountryCheck: boolean;

screeningTimestamp: Date;

};

}

πŸ”Ή11.5.1 9.5.2 ProhibitedRegulatory-to-Control JurisdictionsMapping

The Portal implements absolute restrictions preventing investor participation from jurisdictions subject to comprehensive US sanctions:

JurisdictionSanctions ProgramCFR ReferenceStatus
Iran

Regulatory Requirement

Satisfied By

Control Numbers

Accredited investor verification β€” Reg D 506(c)

Empire whitelist verification on every transfer

Controls 1–5 (KYC/AML status)

Rule 144 6-month holding period β€” U.S. investors

On-chain holding period enforcement

Control 24 (HoldingPeriodAccount)

Reg S 12-month distribution compliance β€” non-U.S.

On-chain Reg S period enforcement

Control 24 (Reg S flag variant)

OFAC SDN screening β€” all transfers

Real-time SDN check on every transfer

Controls 8–10 (OFAC / sanctions)

AML transaction monitoring β€” BSA

Risk scoring on every transfer event

Controls 11–15 (AML risk)

Wallet whitelist β€” Empire-verified only

Wallet authorization gate on every transfer

Control 15 (wallet registry)

Wallet concentration limits

Maximum holding enforcement

Controls 16–20 (concentration)

Circuit breakers β€” market manipulation

Velocity and volume controls

Controls 21–26 (circuit breakers)

1:1 custody attestation β€” Model B

Oracle attestation on every slot

Controls 27–30 (custody oracle)

Regulatory freeze β€” Control 42

CLO authorization + 3-of-5 multi-sig

Control 42 (regulatory compliance freeze)

 

11.5.2  Immutability of Transfer Hook Controls

All 42 Transfer Hook controls are immutable β€” they cannot be altered, suspended, or bypassed by any party, including OTCM Protocol itself. This immutability is a regulatory design choice: it means that platform operators cannot be pressured, compromised, or incentivized to weaken investor protections. The controls are deployed as a fixed program; governance authority extends only to adjustable operating parameters within hard-coded bounds, never to the existence or logic of the controls themselves.

 

11.6  Bank Secrecy Act and AML Compliance

OTCM Protocol and Empire Stock Transfer operate an Anti-Money Laundering compliance program consistent with the Bank Secrecy Act (31 U.S.C. Β§5311 et seq.) and FinCEN regulations at 31 CFR Part 1010. The program operates at three layers: investor onboarding screening by Empire Stock Transfer, continuous transaction monitoring through Transfer Hook AML controls, and platform-level analytics through Chainalysis KYT and TRM Labs integrations.

 

11.6.1  BSA / AML Program Elements

 

BSA/AML Program Element

Implementation

Regulatory Basis

Customer Identification Program (CIP)

Empire Stock Transfer performs four-pillar identity verification at onboarding for all investors

31 CFR Β§1020.220

Beneficial Ownership

KYB verification by Empire for all entity investors β€” UBO identification at β‰₯25% threshold

31 CFR Β§1010.230

Ongoing Transaction Monitoring

Transfer Hook Controls 11–15 screen every transaction; 200+ features analyzed by Chainalysis/TRM Labs

31 CFR Β§1010.210

Suspicious Activity Reporting

Empire files SARs with FinCEN for transactions of $5,000+ meeting BSA SAR criteria

31 CFR Β§1010.320

Currency Transaction Reports

Fiat on-ramp transactions of $10,000+ trigger CTR filing requirements

31 CFR Β§1010.311

Recordkeeping

Empire maintains all KYC/KYB/AML records per BSA retention requirements (5 years)

31 CFR Β§1010.410

Independent Testing

Annual compliance audit of AML program effectiveness

31 CFR Β§1010.210(b)

 

11.7  OFAC Sanctions Compliance

OTCM Protocol maintains a sanctions compliance program consistent with regulations administered by the U.S. Treasury Office of Foreign Assets Control (OFAC). Sanctions compliance is enforced at three independent checkpoints: Empire Stock Transfer onboarding screening, Transfer Hook real-time screening on every transaction, and the platform's AI Module pre-outreach wallet screening.

 

β€”

Sanctions Program

CFR Reference

Enforcement Mechanism

Iran β€” Iranian Transactions & Sanctions Regulations

31 CFR Part 560

PROHIBITED

Investor prohibited at onboarding; Transfer Hook Controls 8–10 block on every transfer

North Korea

β€” North Korea Sanctions Regulations

31 CFR Part 510

PROHIBITED

Same as above

Syria

β€” Syrian Sanctions Regulations

31 CFR Part 542

PROHIBITED

Same as above

Cuba

β€” Cuban Assets Control Regulations

31 CFR Part 515

PROHIBITED

Same as above

Crimea Region

Ukraine-Related Sanctions (SSIDES)

31 CFR Part 589

PROHIBITED

Same as above

SDN List β€” All Programs

50 Fed. Reg. 5342

Three-layer wallet matching: exact address + fuzzy name + 2-hop clustering

 

πŸ”Ή 9.5.3 FATF High-Risk Handling

Jurisdictions designated as high-risk by the Financial Action Task Force (FATF) receive enhanced due diligence:

  • Enhanced KYC: Additional documentation and verification requirements beyond standard KYC
  • Mandatory Source of Funds: Detailed source of funds documentation with supporting evidence
  • Enhanced Monitoring: Lower thresholds for transaction alerts and more frequent review
  • Senior Approval: Manual compliance officer approval required before investment eligibility confirmed
  • Regular Review: Quarterly re-verification of investor status and activity

πŸ”Ή 9.5.4 Regulation A+ Tier 2 for Non-Accredited

For global non-accredited investors, the Portal implements Regulation A+ Tier 2 investment limits:

  • Offering Limit: Up to $75,000,000 annually per issuer
  • Non-Accredited Limit: 10% of greater of annual income or net worth
  • SEC Qualification: Requires SEC Form 1-A qualification
  • Ongoing Reporting: Semi-annual (Form 1-SA) and annual (Form 1-K) reports required

πŸ”Ή 9.5.5 Country-Specific Requirements

The Portal implements country-specific additional requirements as needed:

Continuous

Hook Controls 8–10 every who cleared OFAC at the SDN list is
JurisdictionAdditional Requirements
European UnionMiCAOFAC complianceRe-Screening

evaluation;

OFAC GDPRscreening datais handling;not EUa retailone-time investmentonboarding limitsevent. whereTransfer applicable

Unitedre-screen KingdomFCAwallet promotionalon restrictions;every certified/sophisticatedST22 transfer against the current SDN list. An investor classification
SingaporeMASonboarding accreditedbut investoris statussubsequently verification;added SFAto compliance
CanadaProvincialblocked securitiesautomatically lawon compliance;their accreditednext investortransfer attempt β€” with no administrative action required by OTCM Protocol or privateEmpire issuerStock exemptionTransfer. verificationThe Transfer Hook returns Error 6008 (SanctionsMatch) and the transaction reverts.

 

πŸ—οΈ11.8 9.6 PortalWyoming TechnicalState ArchitectureLaw Framework

ThisGroovy sectionCompany, detailsInc. dba OTCM Protocol is incorporated in Wyoming under the technicalWyoming implementationBusiness Corporation Act (W.S. 17-16-101 et seq.). Wyoming was selected as the jurisdiction of incorporation for three structural reasons: statutory recognition of digital assets as property, a comprehensive Digital Asset Statute providing legal certainty for tokenized securities operations, and a corporate law framework that accommodates the dual-layer securities structure (Series M preferred shares + ST22 tokens on Solana).

 

11.8.1  Wyoming Digital Asset Statute

Wyoming's Digital Asset Statute (W.S. 34-29-101 et seq.) provides legal recognition of digital asset transfers and ownership, property law protection equivalent to traditional assets, and regulatory clarity for digital asset businesses. For OTCM Protocol, the statute's most operationally significant provision is the recognition of digital asset transfers as legally effective transfers of the OTCMunderlying Issuersproperty Portal,rights β€” supporting the Model B architecture by ensuring that an ST22 token transfer on Solana constitutes a legally effective transfer notification to Empire Stock Transfer under Wyoming law.

 

11.8.2  Series M Preferred Share Structure

Each ST22 issuance requires the issuing company to authorize a new series of preferred shares β€” Series M β€” through a Certificate of Designation filed with the Wyoming Secretary of State. The Certificate of Designation specifies: the number of authorized Series M shares, the non-voting and non-dividend characteristics, the irrevocable custody requirement with Empire Stock Transfer, the 1:1 tokenization ratio, and the protective conversion mechanism that converts Series M shares to common shares upon a mandatory redemption event if the issuer ceases platform participation.

 

11.9  UCC Article 8 Transfer Compliance

The SEC's January 28, 2026 Joint Staff Statement (footnote 5) assumes that transfers of crypto assets representing tokenized securities comply with Article 8 of the Uniform Commercial Code, including systemeffective components,indorsement, APIinstruction, specifications,or securityentitlement architecture,order as applicable. OTCM Protocol's Transfer Hook mechanism is designed to satisfy these requirements.

Each ST22 transfer on CEDEX triggers a programmatic instruction to Empire Stock Transfer to update the Master Securityholder File, constituting an effective entitlement order under UCC Β§8-102(a)(8). The Transfer Hook's 42 controls β€” including KYC/AML verification, wallet concentration limits, and performancecircuit metrics.

breakers

πŸ”Ήβ€” 9.6.1operate Systemas Components

programmatic
conditions
precedent
that
must
be
satisfied
before
the
transfer
instruction
is
effective,
ensuring
//that Portalonly Systemlawful Architectureand //compliant OTCMtransfers Portalare Systemrecorded Architecturein β”Œ---┐the β”‚securityholder CLIENT LAYER                                  β”‚
β”‚  β”Œ---┐  β”Œ---┐  β”Œ---┐  β”Œ---┐     β”‚
β”‚  β”‚ Issuer Web  β”‚  β”‚  Investor   β”‚  β”‚   Admin     β”‚  β”‚   Mobile    β”‚     β”‚
β”‚  β”‚  Dashboard  β”‚  β”‚   Portal    β”‚  β”‚   Console   β”‚  β”‚    Apps     β”‚     β”‚
β”‚  β”‚  (React)    β”‚  β”‚  (React)    β”‚  β”‚  (React)    β”‚  β”‚ (React Nat) β”‚     β”‚
β”‚  β””---β”˜  β””---β”˜  β””---β”˜  β””---β”˜     β”‚
β””---β”˜
β”‚
β–Ό
β”Œ---┐
β”‚                           API GATEWAY                                   β”‚
β”‚                    (AWS API Gateway / Cloudflare)                       β”‚
β”‚         Rate Limiting | DDoS Protection | SSL Termination               β”‚
β””---β”˜
β”‚
β–Ό
β”Œ---┐
β”‚                        APPLICATION LAYER                                β”‚
β”‚  β”Œ---┐    β”‚
β”‚  β”‚                    Node.js / TypeScript API                     β”‚    β”‚
β”‚  β”‚                      (Express / Fastify)                        β”‚    β”‚
β”‚  β””---β”˜    β”‚
β”‚  β”Œ---┐ β”Œ---┐ β”Œ---┐ β”Œ---┐    β”‚
β”‚  β”‚ KYC Service   β”‚ β”‚ Accred Svc    β”‚ β”‚ AML Service   β”‚ β”‚ Reporting β”‚    β”‚
β”‚  β””---β”˜ β””---β”˜ β””---β”˜ β””---β”˜    β”‚
β””---β”˜
β”‚
β”Œ---β”Ό---┐
β”‚                          β”‚                          β”‚
β–Ό                          β–Ό                          β–Ό
β”Œ---┐       β”Œ---┐       β”Œ---┐
β”‚   PostgreSQL  β”‚       β”‚     Redis     β”‚       β”‚  Solana RPC   β”‚
β”‚  (User Data)  β”‚       β”‚   (Cache)     β”‚       β”‚  (Blockchain) β”‚
β””---β”˜       β””---β”˜       β””---β”˜

πŸ”Ή 9.6.2 API Specifications

// API Endpoints
// Core API Endpoints
// KYC Module

POST /api/v1/kyc/initiate // Start KYC processfile.

POST /api/v1/kyc/document/upload // Upload ID document

POST /api/v1/kyc/liveness/start // Start liveness check

GET /api/v1/kyc/status/:investorId // Get KYC status

POST /api/v1/kyc/address/verify // Submit address proof

// Accreditation Module

POST /api/v1/accreditation/third-party // Submit third-party verification

POST /api/v1/accreditation/self-cert // Submit self-certification

GET /api/v1/accreditation/status/:id // Get accreditation status

POST /api/v1/accreditation/renewal // Renew expiring accreditation

// AML Module

GET /api/v1/aml/risk-score/:walletAddress // Get wallet risk score

POST /api/v1/aml/screen // Initiate AML screening

GET /api/v1/aml/monitoring/:investorId // Get monitoring alerts

// Issuer Dashboard

GET /api/v1/issuer/investors // List all investors

GET /api/v1/issuer/analytics // Token analytics

GET /api/v1/issuer/compliance-report // Compliance summary

// Investor Portal

GET /api/v1/investor/profile // Get investor profile

GET /api/v1/investor/investments // List investments

POST /api/v1/investor/invest // Initiate investment

πŸ”Ή 9.6.3 Security Architecture

The Portal implements enterprise-grade security across all layers:

  • Encryption at Rest: AES-256 encryption for all stored data
  • Encryption in Transit: TLS 1.3 for all API communications
  • Authentication: OAuth 2.0 + JWT with hardware key support (WebAuthn)
  • Authorization: Role-based access control (RBAC) with least-privilege principles
  • Audit Logging: Immutable audit trail for all actions with cryptographic signatures
  • Penetration Testing: Quarterly third-party penetration testing

πŸ”Ή 9.6.4 Performance Specifications

1)the validatethattheislegallypermissible;(2)uponvalidation,thetransferexecutes;(3)oraclesimultaneously
MetricTargetCurrent
API Response

UCC TimeΒ§8-102(a)(8) Effective Entitlement Order

The Transfer Hook architecture produces a legally effective entitlement order under UCC Article 8 on every ST22 transfer: (p95)

<200ms 145ms
KYC Verification Time<60 seconds42 secondscontrols avg
Systemtransfer Uptime 99.9% 99.97%
Concurrentsuccessful Users 10,000+ 25,000+on-chain tested
AMLthe Screeningcustody Latency <500ms 350msnotifies avgEmpire Stock Transfer's systems to update the off-chain Master Securityholder File; (4) Empire's update constitutes the official transfer of record. This four-step sequence satisfies the UCC Article 8 requirements that the SEC's guidance contemplates for Model B notification layer architectures.

 

11.10  CEDEX Trading Venue β€” Regulatory Considerations

CEDEX, OTCM Protocol's proprietary Centralized-Decentralized Exchange, operates as the exclusive secondary market venue for ST22 Digital Securities trading. The appropriate regulatory classification of CEDEX as a trading venue is under active evaluation by OTCM Protocol's Chief Legal Officer, Jeff Turner (JDT Legal). The company is engaged with the SEC's Division of Trading and Markets and the Crypto Task Force to determine the appropriate registration pathway.

 

11.10.1  ATS Evaluation

CEDEX may qualify as an Alternative Trading System (ATS) under Regulation ATS (17 CFR Part 242), which requires registration as a broker-dealer and filing with the SEC. OTCM Protocol's CLO is evaluating the ATS pathway, including potential operation under a broker-dealer partnership. Until regulatory classification is finalized, CEDEX operates within the existing compliance framework, and the 42 Transfer Hook controls enforce compliance requirements that exceed those of traditional trading venues.

 

CEDEX Regulatory Classification β€” Pending

OTCM Protocol will engage with the SEC Crypto Task Force to confirm the appropriate regulatory classification for CEDEX prior to full secondary market launch. The platform has been designed to accommodate any resulting registration requirement without architectural changes β€” the compliance infrastructure exceeds ATS requirements. Institutional participants and issuers should note that secondary market trading will not open until CLO Jeff Turner has confirmed the regulatory status of CEDEX with the SEC.

 

11.11  Compliance Governance β€” Officers and Responsibilities

 

Officer

Role

Compliance Responsibilities

Jeff Turner

Chief Legal Officer, JDT Legal

SEC filings (Form D, EDGAR), regulatory submissions to SEC Crypto Task Force, CEDEX ATS classification, Transfer Hook legal review, blue sky filings, CLO authorization for Control 42 regulatory freeze

Patrick Mokros

COO Β· President of Empire Stock Transfer

Investor onboarding authority (KYC/KYB/AML/OFAC/Wallet Verification), Master Securityholder File maintenance, SAR filings with FinCEN, BSA recordkeeping, custodian compliance

Frank Yglesias

CTO

Transfer Hook immutable parameter oversight, AI model governance (CTO sign-off on new model promotion), smart contract upgrade governance (5-of-9 multi-sig), annual technical security audit

Berj Abajian

CEO

Board-level regulatory strategy, SEC Crypto Task Force engagement, Wyoming corporate law compliance, issuer relationship management

 

11.12  Annual Compliance Audit Framework

OTCM Protocol maintains an annual compliance audit cycle covering all regulatory programs. The audit program is administered by the CLO and is independent of routine operational compliance monitoring.

 

Audit Domain

Scope

Frequency

Responsible Party

AML / BSA Program

CIP effectiveness, SAR filing completeness, transaction monitoring coverage

Annual + event-triggered

Empire Stock Transfer + external auditor

Transfer Hook Controls

Verification that all 42 controls remain deployed, unmodified, and functioning as specified

Annual + post-upgrade

CTO (Frank Yglesias) + independent security firm

1:1 Attestation Oracle

Verification that on-chain token supply equals Series M shares in Empire custody

Continuous (per Solana slot) + annual audit

Empire Stock Transfer + Chainalysis

Accreditation Records

Sample review of investor accreditation documentation for Rule 506(c) compliance

Annual

Empire Stock Transfer + CLO

OFAC Screening

Retroactive screening of investor wallet universe against updated SDN list

Annual + on SDN list updates

Transfer Hook Controls 8–10 (automated)

AI Model Governance

Drift detection, retraining compliance, governance gate documentation

Quarterly (drift) + annual (full audit)

CTO sign-off

Penetration Testing

Web portal, API layer, wallet application security

Quarterly

Third-party security firm

 

11.13  Regulatory Citation Reference

 

Regulation / Authority

Citation

Applicability to OTCM Protocol

SEC Joint Staff Statement on Tokenized Securities

January 28, 2026 β€” Div. Corp. Fin., Div. Inv. Mgmt., Div. Trading & Markets

Category 1 Model B classification; technology-neutral principle; UCC Article 8 assumption

SEC Release No. 33-11412

March 17, 2026

Digital Securities guidance β€” platform architecture satisfies all stated requirements

Regulation D Rule 506(c)

17 CFR Β§230.506(c)

Primary offering framework for all ST22 issuances to U.S. accredited investors

Regulation S Rules 901–905

17 CFR Β§Β§230.901–905

Offshore offering framework for non-U.S. investor participation

Securities Act of 1933

15 U.S.C. Β§77a et seq.

ST22 tokens are securities subject to full Securities Act obligations

Securities Exchange Act of 1934

15 U.S.C. Β§78a et seq.

Transfer agent registration (Section 17A); ongoing Exchange Act obligations

Bank Secrecy Act

31 U.S.C. Β§5311 et seq.; 31 CFR Part 1010

CIP, AML program, SAR and CTR filing obligations

OFAC Sanctions Programs

31 CFR Parts 510, 515, 542, 560, 589

Prohibited jurisdiction and SDN list enforcement

Wyoming Business Corporation Act

W.S. 17-16-101 et seq.

Corporate formation and governance law

Wyoming Digital Asset Statute

W.S. 34-29-101 et seq.

State-law recognition of digital asset transfers and property rights

UCC Article 8

Uniform Commercial Code Β§8-102

Effective entitlement order framework for token transfer notification architecture

Rule 144

17 CFR Β§230.144

Resale restriction (6-month holding period) enforced by Transfer Hook Control 24

Form D

17 CFR Β§239.500

Filed within 15 days of first sale for each ST22 Reg D issuance

 

Groovy Company, Inc. dba OTCM Protocol  |  CIK: 1499275  |  Version 7.0  |  March 2026  |  Confidential