Regulatory position statement

Effective date: 13th September 2026

1. Operator and service

Layer Flow Gateway, Inc., a Delaware corporation, provides LFG’s software to eligible personal and business users. Company incorporation is not a financial-services licence. Our registered address is 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Regulatory enquiries: [e-mail].

LFG provides software for users to manage their own wallets, create payment requests, approve blockchain transactions and access enabled integrations. It earns software subscription fees from business users and the disclosed referral commission from Owl. Personal LFG accounts are currently free, although external transaction costs may apply.

2. Customer control and backups

Users control the keys for their wallets and sign their ordinary transfers and every swap through their devices. Neither LFG nor Web3Auth can sign alone. Web3Auth wallet infrastructure handles the signing flow and broadcast without giving LFG independent signing authority. LFG does not hold assets for customers, possess or reconstruct their private keys, alter transaction instructions or have usable customer keys allowing it to sign independently. The current architecture includes device-encrypted server backup material that LFG cannot independently decrypt. A backup of encrypted information is not the same as an ability to control the underlying wallet.

Customers must export and preserve the recovery phrase or appropriate private key for every wallet before account closure, app deletion or loss of required device data. Under the current service, LFG cannot recover the wallet afterwards: its encrypted server backup cannot be independently decrypted by LFG, and identity verification or an email code cannot reconstruct the keys. No future social-recovery design is represented as deployed or capable of recovering access already lost under the present system.

3. Swaps and ordinary payments

For the present 1inch Classic Swap Aggregation API v6.0 integration, 1inch returns the route and transaction data directly to the user. The user reviews and signs every swap, and Web3Auth wallet infrastructure handles the broadcast. LFG does not receive or transmit the order, select the route, sign or broadcast a swap, operate Fusion, provide limit-order execution or exercise discretionary portfolio management. LFG’s swap fee is disabled and LFG receives no transaction-based compensation from swaps or payments.

Ordinary payments are customer-controlled transactions in supported USDC or USDT. For customers in the European Union or European Economic Area, USDT payments and swaps into USDT are disabled and payments are USDC-only. In all other eligible countries, payments may use USDC or USDT where enabled. LFG does not take a mandate to execute a customer’s third-party recurring bill payments. The customer remains responsible for the underlying commercial transaction and the instructions they authorise, subject to LFG’s responsibility for its own software and representations.

4. Collection of LFG’s fees

Each business user has an LFG Vault, a non-custodial wallet for receiving business payments and paying LFG subscription fees. The user alone controls its private keys and is responsible for maintaining enough supported USDC in it on each billing date. The first and later subscription payments are collected from the LFG Vault.

Paid business subscriptions use EIP-3009 subscription payment authorisations for LFG’s own fees. When the user confirms a subscription, the user signs the first payment and the stated later billing cycles. The wallet infrastructure may broadcast a valid, user-signed authorisation for an agreed subscription collection. LFG cannot independently sign or broadcast it, change its amount or recipient, or use it to pay anyone other than LFG. This arrangement is not a bank direct debit and does not give LFG control of the wallet.

The current programme covers up to six signed billing cycles as disclosed in the subscription flow, with amounts, recipients and validity windows fixed by the relevant signatures. There is no general authority to change signed amounts or spend for other purposes. Cancellation and retries are governed by the Terms. The deployed arrangement is not Coinbase Spend Permissions.

5. Conversion providers and verification

Enabled fiat-to-crypto purchases are supplied by Coinbase, Transak or MoonPay through their applicable legal entities. Enabled crypto-to-fiat off-ramps are supplied by Owl/Harbor and its applicable counterparties. A user enters the relevant provider’s service on its terms, and the provider applies its own eligibility and verification requirements. The provider’s permission must cover the actual product, customer type and territory; a global brand does not establish universal coverage.

LFG performs its own account eligibility process using Didit. Owl independently performs its own off-ramp checks, including business verification through Sumsub. These are different processing relationships. LFG remains responsible for the duties applying to its own onboarding, data use, interface, marketing and commercial conduct.

Owl currently excludes EU-citizen individual senders and EU-incorporated business senders from Harbor onboarding. Payouts to EU destinations can still be supported for an otherwise eligible sender. LFG does not represent payout destination coverage as permission to onboard a sender.

Owl’s current customer off-ramp fee is 0.50% of the off-ramped amount. LFG receives a referral commission from Owl out of that fee. The commission does not increase the 0.50% customer fee.

6. Regulatory basis and limits

LFG’s operating position for the described product is that it supplies non-custodial software rather than customer custody, discretionary execution or an exchange service undertaken by LFG. This describes the actual functions on which that position depends. It is not a declaration that every non-custodial product is exempt everywhere or that an integrated provider’s licence transfers to LFG.

Regulatory duties depend on the activities actually performed, the relevant country’s rules and their territorial reach. The Global Availability Statement classifies LFG software markets as eligible or excluded and currently lists 92 eligible countries and territories, including all 50 United States and Washington, DC. Provider-specific feature availability is stated separately and does not make the underlying LFG software account unavailable.

Cryptoassets are not local legal tender. LFG does not represent USDC, USDT or any other supported cryptoasset as government-issued currency or legal tender in any market.

In the EU/EEA, this statement does not claim that LFG holds a MiCA authorisation or that software access has been approved by a regulator. A change that brings an LFG activity within a regulated service category requires a new assessment and any applicable permission before that activity is offered. A GDPR representative is a privacy requirement, not a MiCA licence.

The United Kingdom is an eligible LFG software market, while UK-facing communications and onboarding remain subject to applicable financial-promotion requirements. LFG does not rely on an “API wrapper passport” or a provider’s registration as automatic permission for its own communications. All 50 United States and Washington, DC are eligible for the described non-custodial software model; Delaware incorporation does not replace any separate tax, privacy, corporate-registration or other obligation arising from LFG’s activities in a state. There is no blanket UAE permission simply because a customer is incorporated in a free zone.

7. Risk controls and information

LFG uses account verification, risk information and geographic controls to protect its software service. It may restrict software access and respond to lawful demands within applicable requirements. It cannot itself reverse a customer’s confirmed blockchain transfer or freeze the customer’s independently controlled assets through account suspension.

Risk signals are indicative and can be inaccurate. They are not legal, tax or investment advice and do not establish that a transaction is safe or compliant. LFG does not promise a universally licensed or insured service, deposit protection, a token’s value, or an independent provider’s future availability. These explanations do not exclude responsibilities imposed on LFG by law.

---