Monochrome Statement on Fund Security and Internal Control Standards

Monochrome has established an internal control system to safeguard user funds and maintain the highest risk control standards. We declare that all audit processes are built on a "zero trust" assumption and executed with "rigorous" discipline.

1. Fund Security: Our Core Commitment

The security of user funds is the sole reason for our platform's existence. We have implemented triple-layer protections—physical, technical, and institutional—that far exceed industry norms.

1.1 100% Asset Reserve and Segregation
User Fund Segregation: All fiat currencies and cryptocurrencies deposited by users are completely physically segregated from the platform's own operating funds in bank accounts and on blockchain addresses.
The platform shall never use user funds for operations, investment, or lending under any circumstances.

1.2 Multi-Layered Asset Storage Strategy
Cold Wallet Storage (~95%): The vast majority of user funds are stored in offline cold wallets protected by military-grade hardware encryption, physical isolation, and geographically distributed backups.
Hot Wallet Storage (~5%): Only sufficient liquidity to meet daily withdrawal demands is retained. Hot wallets employ multi-signature technology with a 3/5 (or higher) configuration, monitored 24/7 by an independent transaction risk monitoring system that automatically blocks abnormal large-scale or high-frequency withdrawals.

2. High Standards of Risk Control and Rigorous Internal Controls

Our risk management and internal control systems are designed as a combination of "defensive" and "offensive" measures, continuously challenging our own vulnerabilities.

2.1 "Four-Eyes Principle" and Segregation of Duties
Any critical operation (e.g., asset listing, limit approval, parameter adjustment, withdrawal release) requires mandatory independent confirmation by at least two authorized persons from different departments (e.g., Operations + Risk, or Risk + Compliance), with immutable system logs.
The permissions and responsibilities of the four core departments—Trading, Risk, Finance, and Technology—are completely segregated, forming a "back-to-back" checks-and-balances relationship. For example, traders cannot access private keys, and technical engineers cannot modify risk control thresholds.

2.2 Real-Time Dynamic Risk Monitoring System
Market Risk: The system monitors the liquidity and volatility of each RWA asset in real time. When collateral value falls below the warning line, automated margin calls or partial liquidation processes are triggered. All parameters are determined by risk models, not human intervention.
Operational Risk: An internal operational risk event library is maintained. Root cause analysis and company-wide reviews are conducted for all "near-miss" operational errors.
Compliance Risk: Integrated on-chain analysis tools monitor in real time whether any funds flow to known high-risk addresses (e.g., mixers, darknet markets). Any such discovery triggers immediate freezing of the associated accounts.

2.3 Rigorous Audit and Testing Processes
Quarterly Comprehensive Internal Control Audit: Independent external auditors conduct "walkthrough tests" of all platform processes (from user registration to asset withdrawal). The audit scope includes but is not limited to fund reconciliation, permission change records, and disaster recovery plans.
Random Surprise Audits: The internal audit department has the right to conduct in-depth random sample reviews of any department or transaction record without prior notice.
Red Team vs. Blue Team Drills: Quarterly internal live-fire exercises between a "Red Team" (attack simulation) and a "Blue Team" (defense response) test system resilience against cyberattacks, malicious insider actions, or physical disasters.

2.4 Disaster Recovery and Business Continuity
All critical data (including user asset mapping and transaction logs) follows a 1+2 backup strategy: one online hot backup, and two physically isolated cold backups in different geographic regions.
We maintain a written disaster recovery plan, rehearsed semi-annually, with the goal of rapidly restoring core trading functions and accessibility of all user asset data under extreme circumstances (e.g., complete destruction of the primary data center).

Conclusion
At Monochrome, internal controls are not just policies on a shelf—they are an instinct embedded in every employee, every line of code, and every transaction. Our pursuit of fund security and risk control has no finish line; only continuous iteration and unrelenting rigor.

Monochrome Risk Management & Internal Audit Department