knarf 👑🏴‍☠️ | 🪝

PART 39 — ComTech Gold (CGO) Unregulated Gold Token on XDC With Misleading Compliance Claims 1. Executive Summary ComTech Gold (CGO) positions itself as a “vault-backed”, “Sharia-compliant”, and “institutional-grade” gold token on the XDC Network. However, all available documentation — including company registration, terms & conditions, privacy policy, and responses from VARA — confirms the opposite: CGO is an unregulated token issued by an unlicensed Free Zone entity, operating without financial supervision, without commodity licensing, and without custody approval. Despite this, CGO is repeatedly showcased by XDC Network as part of its “RWA ecosystem”. 2. Company Structure – No Financial License The ComTech – Company Registration Details document confirms: • The company is registered as a DAFZA FZCO (Free Zone Company). • No financial services license. • No commodity trading license. • No VARA license. • No DMCC license. • No regulatory approval for issuing asset-backed tokens. ➡️ CGO is legally a normal Free Zone company, not a regulated gold issuer. VARA confirmed separately via email: “For information regarding companies licensed by VARA, please refer to the Public Register.” CGO does not appear on that register. 3. Token Structure – Legal Responsibility Avoidance The CGO Terms & Conditions contain multiple red-flag clauses: • CGO provides the token “as is”, with no warranty of value, no guarantee of redemption. • No legal obligation to deliver physical gold to token holders. • CGO disclaims all liability, including price risk, custody risk, operational risk, and smart-contract risk. • The user bears all responsibility, even though CGO markets itself as “1:1 gold-backed”. ➡️ The token is not a legally enforceable gold claim. It is a marketing representation, not a regulated financial instrument. 4. Custody & Audit – No Regulatory Oversight CGO promotes: • “audited vaults” • “secure physical gold” • “Sharia-board approval” • “institutional grade custodian” But: • None of the custodians listed in the ecosystem are licensed under UAE SCA, VARA, or DMCC Gold Rules. • Audits are private, not regulatory. • No proof of mandatory oversight for gold-backed instruments. • No evidence of segregated custody or insurance. ➡️ The backing is unverifiable and not subject to any regulator. 5. Data Handling – No Consumer Protection The Privacy Policy shows: • User data can be shared with external parties without regulatory limits. • No reference to GDPR, DIFC DP Law, ADGM DP Law, or UAE Consumer Protection Law. • No commitment to independent audits or secure data processes. ➡️ Even user data is unprotected, and CGO acknowledges no legal accountability. 6. High-Risk Promotion – Misleading Communication CGO and associated influencers have repeatedly pushed: • high-yield pools • “gold-backed staking” • 351% APR on XSwap • vault-backed DeFi narratives • insinuations of “institutional adoption” This violates the standards that licensed gold token issuers must follow in the UAE. 7. XDC Network Ecosystem Problem Despite the lack of licensing: • CGO is still listed on xdc.org under “RWA”. • No disclosure that the token is not regulated. • No warning that gold tokens in the UAE require licensing. • XDC Foundation presents CGO as ecosystem adoption, not as a high-risk unregulated project. ➡️ The ecosystem presentation creates the false impression that CGO is officially approved. 8. Risk Assessment Based on all documents and regulatory context, the risk profile is: High Legal Risk • No enforceable gold claim • No regulatory protection • No investor rights High Custody Risk • No licensed vault operator confirmed • No insurance required by law High Operational & Smart Contract Risk • CGO disclaims all responsibility in the T&Cs High Reputational Risk for XDC • Unregulated token promoted as RWA use case 9. Conclusion CGO is not a regulated gold product. It is a Free Zone token with no regulatory oversight, no enforceable backing, and disclaimers that remove all legal responsibility from the issuer. The presentation of CGO as a compliant RWA product is misleading, especially when the issuer is unlicensed and the token offers no actual consumer protection. This raises broader governance questions on the XDC ecosystem’s due diligence and its handling of high-risk partners. 10. Documents stored in the archive The following PDFs support this Part: • ComTech – Company Registration Details • ComTech Gold – Privacy Policy • ComTech Gold – Terms & Conditions • CGO Whitepaper v1

The debate should not be about AI versus developers. AI can improve security, but it cannot replace accountability. For a company handling encrypted emails, passwords and sensitive documents, three questions matter: Who independently verifies AI-generated code? Can security engineers reject changes without pressure from management? Will Proton provide verifiable evidence that security reviews are becoming stronger, not weaker? Trust is not established by defending AI or attacking its critics. It is established through transparent processes, independent verification and accountability. Security must be demonstrated, not assumed.

45 DAYS. @DCENTWALLETS @IOTrust You sell SECURITY. You sell TRUST. Yet after 45 days, your customers still have no independently verifiable explanation of what went wrong. Security warnings are NOT accountability. Where is the root-cause analysis? Where is the independent forensic report? Which wallet versions and components were compromised? What evidence rules out hardware-wallet exposure? Where is the verified damage assessment? Where is the compensation plan? Your customers trusted you with their assets — not with excuses, vague assurances, or indefinite silence. A hardware-wallet company that cannot publicly demonstrate the security of its own products has a fundamental credibility problem. 45 days. No comprehensive post-mortem. No adequate answers. Trust is not a marketing slogan. It must be earned through evidence. Publish the findings. Address the victims. Take responsibility.Your failure to provide transparent, verifiable answers is no longer just a D’CENT problem. You are undermining confidence in the entire hardware-wallet industry. People buy hardware wallets because they are promised stronger protection for their assets. When a security company cannot publicly explain what failed, what remains secure, and why customers should trust its products, the damage extends far beyond your brand. You are not just losing customers' trust. You are damaging trust in self-custody itself. Publish the evidence. Explain the failures. Address the victims.

This is an important point. D’CENT publicly states that it is working with law enforcement, security experts, blockchain projects and exchanges to trace stolen assets and pursue freezing or recovery. It makes me ask the same question about the Globiance incident: Was there comparable cooperation with law enforcement, forensic/security specialists and the XDC ecosystem and if so, what were the results? More than a year later, we still have no detailed public post-mortem explaining what happened. Refunds are important, but refunds are not an incident investigation. @globiance @XDCNetwork @XDCFoundation

Thanks for all the congratulations. But this isn’t just about me getting my XDC back. Some users are still waiting for their funds. They should not be forgotten. And even for those who have been refunded, the documented questions surrounding the incident, the refund process and what happened remain. Refunds do not replace transparency and answers. The questions remain.

XDC back.🔒 No deal. No agreement. No conditions.

Globiance remains listed on the Monetary Authority of Singapore (MAS) Investor Alert List. The entry was originally listed on 4 April 2025 and is still searchable on the official MAS website as of 17 September 2026. This is not a new MAS warning — it confirms that the existing Globiance entry remains active on the list. #Globiance #MAS #InvestorAlert #Crypto

Interesting timing. ESMA is focusing its supervisory action on CASP custody — including governance, key/storage management, transaction controls, and incident detection & response. These are precisely the areas where transparency matters after a major incident. In the Globiance case, fundamental questions remain unanswered: Who investigated the incident? What actually failed? Who is legally responsible for custody? And where is the post-mortem? More than a year later, these are reasonable questions. @ESMAComms @globiance

Elliptic is not raising new questions. It confirms why the questions repeatedly raised in the Globiance Transparency Review matter: due diligence does not end with KYC or a questionnaire. It requires on-chain verification and continuous monitoring.