Legal & Compliance Framework

overview thissofire is a fully on chain, non custodial defi protocol that automates index fund creation, management, and governance through smart contracts no centralized entity holds user assets, executes trades manually, or guarantees financial outcomes all actions — deposits, redemptions, rebalancing, and governance — occur transparently via immutable code deployed on the bnb chain the thissofire framework is built around three foundational compliance pillars non custodial infrastructure users always retain ownership and control of their assets autonomous operation vaults execute predefined logic without discretionary management transparency and disclosure all parameters, holdings, and fees are publicly verifiable on chain these principles position thissofire as a technological service — not a managed investment company or broker — under many global regulatory definitions note nothing here is legal or tax advice users should consult local counsel legal nature of thissofire 1\) protocol vs entity thissofire protocol an open source set of smart contracts deployed on bnb chain it functions autonomously and permissionlessly it is not an incorporated entity, fund manager, or broker dealer thissofire foundation (optional governance entity) a non profit foundation may later be established to support protocol development, legal clarity, audits, and partnerships the foundation would not hold user funds nor intervene in on chain vault governance 2\) legal characterization under many frameworks, thissofire can be characterized as a software protocol facilitating decentralized, automated index construction a non custodial system, not issuing or selling securities directly a community governed platform where all actions are transparent and automated vaults are fully autonomous smart contracts; their logic defines investment actions rather than human discretion, distancing them from traditional “managed investment schemes ” user custody & control non custodial mechanism all user deposits and redemptions are executed via self custody wallets (e g , trust wallet , metamask , walletconnect ) funds move directly between the user and the vault contract no administrator or third party ever has access to private keys deposited assets vault held liquidity fundvault contracts hold assets under immutable conditions defined at deployment require no human signature or multisig to execute swaps or rebalances can only transfer funds back to the depositing user or through predefined functions this guarantees full user sovereignty and asset safety nature of fundshare tokens each fundshare token represents a digital claim on a pool of on chain assets , not a contractual promise from any centralized party key legal properties feature legal interpretation ownership direct, proportional share of vault assets held in smart contracts issuance programmatic minting upon deposit (no discretionary issuance) redemption fully algorithmic, user initiated process no counterparty no entity responsible for returns or repayment governance utility right to propose/vote on vault level decisions speculative nature prices may vary with market demand; no guaranteed yield given these characteristics, fundshare tokens are generally viewed as utility governed digital assets , not securities, in many jurisdictions — assuming decentralization is maintained and there are no profit promises standard bep 20 (with transfer tax logic for dex transfers on pancakeswap ) regulatory positioning 1\) securities law considerations thissofire does not offer or solicit investment contracts guarantee fixed returns or profit distributions exercise discretionary control over user funds pool external capital under a managerial entity accordingly, under frameworks such as howey (u s ) — reduced indicators of a “common enterprise” or “expectation of profit from managerial efforts ” mica (eu) — likely treated as a crypto asset/utility token , not an asset referenced or e money token uk fca — tends toward the “unregulated tokens” category given decentralized governance and lack of counterparty obligations thissofire will monitor evolving defi regulation and may adopt additional disclosures or optional access controls if required in specific jurisdictions 2\) aml / kyc considerations thissofire itself does not collect or process user data; interactions are wallet based and pseudonymous if partnerships with regulated institutions (e g , cexs or fiat on ramps) are formed, those integrations may require optional kyc layers (implemented by partners) whitelisted fund variants (for institutional users) off chain record keeping for transparency these would be modular extensions , preserving the base protocol’s permissionless nature 3\) taxation perspective from a general perspective (jurisdiction dependent) depositing bnb into a vault (swaps to constituents) may be a taxable disposal holding fundshares resembles holding bep 20 tokens representing a diversified basket redeeming fundshares (assets sold back for bnb) may be a capital realization event thissofire does not offer tax advice; users are responsible for local obligations compliance practices & disclosures thissofire emphasizes voluntary transparency as a proxy for compliance readiness current practices area implementation smart contract audits independent third party reviews for all deployments open source code public github repository public data access subgraph & api endpoints for nav, fees, burns, holdings governance records on chain proposals and treasury transactions risk disclosures published clearly in dapp and docs legal review ongoing consultation with web3 legal advisors planned additions automated audit verification badge system transparency portal for fund composition and treasury movements compliance module for institutional users (optional whitelisting) user jurisdiction filter in the front end to block restricted regions risk disclosures to users all users should understand and accept the following risks smart contract risk audits reduce but do not eliminate vulnerabilities market risk fundshare value fluctuates with underlying assets and trading conditions liquidity risk thin secondary markets can cause slippage/price impact oracle risk inaccurate/delayed data can misstate nav or rebalance ratios governance risk malicious/poor proposals could affect vault operations regulatory risk changes in law may restrict access in some regions user key security loss of private keys = permanent loss of access thissofire provides no guarantees of profit, protection, or recourse engagement is voluntary and at the user’s discretion jurisdictional policy thissofire operates under a jurisdiction agnostic, open source model smart contracts are globally accessible, while the web interface may enforce access limitations based on regional regulations restricted jurisdictions (at launch) united states (retail users) canada china ofac sanctioned countries access from these regions may be blocked at the front end , though contracts remain publicly verifiable and accessible on chain intellectual property & licensing protocol code mit license (open source) branding / website assets cc by nc 4 0 documentation free for educational and integration use forks are permitted under mit; the thissofire trademark may be used only for official deployments verified by core maintainers or dao governance data privacy & gdpr thissofire does not collect or store personal data front end analytics are anonymized and gdpr compliant, limited to session logs for performance debugging aggregated, non identifiable usage metrics no wallet addresses are linked to ips or off chain identifiers users remain anonymous unless they opt in to kyc enabled integrations (future, optional) audit & compliance reporting framework to reinforce transparency and regulatory confidence, thissofire will maintain the following reporting structure report type frequency published by smart contract audit report before each fund deployment independent auditor on chain proof of assets (nav) continuous (real time) oracle + subgraph treasury report quarterly vault governance governance report quarterly dao snapshot/subgraph protocol risk assessment annual thissofire foundation (if established) all reports will be accessible via thissofire’s transparency dashboard regulatory engagement strategy engage early with defi friendly jurisdictions (e g , switzerland, singapore, uae) collaborate with legal firms focused on decentralized governance (e g , lexdao, dlx law) publish educational materials for policymakers explaining non custodial , autonomous design adopt self regulatory standards aligned with defi associations (e g , gdf code of conduct ) emergency & legal contingency framework in the unlikely event of a major issue (exploit, oracle manipulation, governance attack) guardian multisig may temporarily pause affected vaults dao vote may allocate treasury funds for recovery/compensation incident report published within 48 hours audit replay and patch deployment after governance approval this preserves user trust and accountability, even in crisis scenarios summary thissofire’s legal and compliance framework anticipates regulation without sacrificing decentralization it ensures users own their assets funds are governed by code , not people operations are transparent , auditable, and permissionless by maintaining open source transparency, modular compliance, and non custodial architecture, thissofire aligns with the ethos of web3 and the expectations of regulators and investors entering on chain finance thissofire isn’t built to avoid regulation — it’s built to outlive it