Anti-Money Laundering and Counter-Terrorism Financing (AML) and Know your Customer (KYC) Policy

(last updated 03.07.2026)

1. INTRODUCTION

1.1 https://fs-casino.io/ (the "Website") is owned and operated by Kryztral Ltd, registration number 2026-00016, a company registered at Unit 1, La Place Creole Building, Rodney Village, Rodney Bay, Gros-Islet, Saint Lucia.

1.2 The Website operates under a remote gambling license issued by the Tobique Gaming Commission in compliance with the Gaming Act.

1.3 Unless stated otherwise, all references to "we," "us," and "our" in these Terms refer to the Company, while "user", "you," and "your" refer to the individual using our Website and agreeing to this Policy.

1.4 This Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) Policy, along with the Know Your Customer (KYC) procedures ("Policy"), outlines The Company’s commitment to preventing money laundering (ML) and terrorist financing (TF). This Policy has been developed in accordance with the Gaming Act, Tobique Gaming Commission Regulations on AML and CTF, and the Tobique Gaming Commission Remote Gambling Code of Practice, incorporating industry best practices.

1.5 The Company acknowledges that its services may be vulnerable to misuse for money laundering or terrorist financing activities. As a result, The Company is committed to fostering a culture of compliance by identifying, assessing, and mitigating the risks associated with ML and TF.

2. DEFINITIONS OF MONEY LAUNDERING (ML) AND TERRORIST FINANCING (TF)

2.1 Terrorist Financing (TF)

Terrorist financing refers to any action involving:

• The provision or accumulation of financial resources by an individual who either intends or negligently disregards the possibility that such funds will be utilized to support or carry out terrorist activities.
• Participation in any financial arrangement that grants access to money or assets for another party while being aware of or having reasonable grounds to suspect that these resources might contribute to terrorism.

2.2 Money Laundering (ML)

Money laundering encompasses:

• The handling, transfer, possession, or distribution of funds or assets—through any method or channel—with the purpose of disguising their origins, despite knowing, believing, or recklessly ignoring that they were acquired directly or indirectly through illicit means.
• Engaging in or facilitating financial transactions that enable another individual to obtain, hold, use, or manage illicitly sourced property while being aware or suspecting its criminal origin.

2.3 Stages of Money Laundering

The money laundering process typically unfolds in three phases:

• Placement: Illegally acquired funds enter the financial system, often through deposits or conversion into monetary instruments.
• Layering: The origins of the funds are deliberately concealed by conducting multiple transactions, such as transfers or conversions.
• Integration: The "cleaned" money is reinvested or withdrawn in a way that gives it the appearance of legitimacy, such as through legal investments or structured withdrawals.

3. POLICY STATEMENT AND OBJECTIVES

3.1 The Company strictly prohibits the use of its Services for any illegal purposes, including money laundering (ML), terrorist financing (TF), or violations of sanctions. To prevent such activities, The Company is committed to:

• Conducting and regularly updating a Enterprise-Wide Risk Assessment (EWRA) related to ML and TF, which serves as the foundation of the AML Program. The Company conducts an Enterprise-Wide Risk Assessment (EWRA) on a periodic basis and when material changes occur in its business or operations. The EWRA assesses key money laundering and terrorist financing risk factors, including customer typologies, geographic exposure, products and services offered, payment methods and transaction patterns, operational delivery channels, and the use of third-party suppliers. The results of the EWRA are used to inform the Company’s risk-based AML/CFT controls and procedures.
• Implementing a comprehensive AML Program, including written policies, procedures, and controls designed to identify, assess, and mitigate ML and TF risks in compliance with regulatory requirements.
• Appointing a senior manager responsible for overseeing the implementation of the AML Program and related policies, procedures, and controls.
• Providing employees with continuous training and education on AML and compliance matters.
• Engaging in independent reviews, conducting ongoing monitoring, and performing internal audits to assess the effectiveness of the AML Program, policies, procedures, and controls.
• Cooperating fully with AML regulatory authorities and other relevant institutions.
• Continuously improving this Policy and the AML Program through regular reviews, ensuring compliance with legal updates, best practices, regulatory guidance, and audit findings.

3.2 The primary aim of this AML and KYC Policy is to define the key procedures, systems, and controls that The Company has implemented to detect and reduce the risks of ML and TF within its operations.

4. SECURITY AND MONITORING

4.1 Robust monitoring practices are crucial for any gaming business to maintain security across all operational aspects, including physical locations, equipment, personnel, communications, and financial transactions. To uphold these security standards, the Company will implement a comprehensive set of protective measures and procedures.

4.2 The Company employs call recording technology to enhance operational efficiency and security. This system provides several key benefits, such as:

• Improving staff training and professional development;
• Ensuring precise documentation of bets, transaction times, and financial records;
• Safeguarding user interests while preserving the Company’s reputation;
• Strengthening monitoring protocols to detect and prevent potential collusion between employees and users.

4.3 Given the importance of data protection and the security of software and hardware—especially in a Non-Face-to-Face transaction environment—The Company will follow a strict policy of "Encrypt whatever can be encrypted." Access to shared drives will be strictly controlled, monitored, and, where necessary, password-protected. Secure data storage and backup procedures are in place to ensure that user data remains protected from unauthorized access and to prevent data loss.

5. EMPLOYEE ROLES AND COMPLIANCE OBLIGATIONS

5.1 The Company has designated a senior manager as the Compliance Officer, tasked with overseeing the development, implementation, and enforcement of anti-money laundering (AML) measures. This role ensures adherence to relevant regulations and the Company’s AML framework, including this Policy. The Compliance Officer's primary duties include:

• Designing, implementing, and assessing AML strategies;
• Engaging with key stakeholders to stay informed on emerging AML trends and industry best practices;
• Managing and regularly updating AML policies and procedures;
• Evaluating regulatory changes and business developments to ensure compliance;
• Identifying high-risk scenarios and recommending appropriate safeguards;
• Conducting investigations and reporting suspicious activities;
• Preparing and delivering compliance reports to senior management and Director.

5.2 All employees, directors, and officers, regardless of their position within the Company, must adhere to this Policy and actively contribute to identifying and preventing money laundering (ML) and terrorist financing (TF). If an employee suspects or has reason to believe that a transaction, potential transaction, or any other activity may be linked to criminal activity, they are required to report it immediately to the relevant manager. Failure to do so may result in disciplinary measures.

5.3 The Company is dedicated to equipping all employees with the necessary knowledge and training to identify and report suspicious activities effectively. To ensure continued compliance, staff will receive ongoing training on ML and TF risks and regulatory obligations, with refresher courses conducted at least once per year.

The AML training program covers the following core topics:

• Overview of applicable AML/CTF laws and regulatory obligations (including Tobique jurisdiction-specific requirements)
• Key money laundering (ML) and terrorist financing (TF) typologies and red flags
• Customer due diligence (CDD), enhanced due diligence (EDD), and ongoing monitoring procedures
• Procedures for identifying and reporting suspicious transactions (STRs)
• Recordkeeping and data protection requirements
• Sanctions compliance and PEP identification
• Use of AML-related tools and systems, including screening software
• Internal escalation processes and the role of the Compliance Officer

Covered Roles and Departments

The training program is tailored to the responsibilities of different employee groups. The following roles are covered:

• Front-line staff and customer-facing teams: Trained to recognize red flags and apply CDD/EDD procedures.
• Operations and payments personnel: Instructed on transaction monitoring, sanctions screening, and handling suspicious activities.
• Compliance and risk management staff: Receive in-depth training on regulatory developments, internal controls, reporting obligations, and case analysis.
• Senior management and director: Provided with strategic AML/CTF training to support a top-down culture of compliance and meet governance responsibilities.

Documentation and Monitoring

The Company maintains detailed records of all training sessions, including:

• Date of training
• List of attendees and their roles
• Content and materials used
• Assessment results, where applicable

5.4 As part of its commitment to mitigating ML and TF risks, The Company upholds high recruitment standards, including conducting background checks on new employees.

6. KYC POLICY AND DUE DILIGENCE

6.1 The Company adheres strictly to "Know Your Customer" (KYC) protocols to combat financial crimes, including money laundering, by implementing rigorous client identification and due diligence measures.

6.2 All customers/players must undergo identity verification at whichever of the verification thresholds is reached first, whether individually or in aggregate:

• within 30 days of the first deposit;
• upon reaching cumulative deposits of EUR 2,000; and/or
• prior to the first withdrawal.

6.3 Verification includes, at a minimum:

• identification and identity verification;
• screening against sanctions lists, politically exposed persons (PEPs), and adverse media; and
• confirmation of the customer’s country of residence.

6.4 Until the verification process is satisfactorily completed, the Company reserves the right to restrict or suspend access to services, transactions, and withdrawals, in accordance with applicable legal and regulatory requirements.

6.5 Verification includes a risk-based process to establish and verify the customer’s identity using reliable and independent sources. The verification process covers screening against applicable sanctions lists, politically exposed persons (PEPs) and adverse media sources, confirmation of the customer’s country of residence, and assessment of the consistency of the information provided.

6.6 A risk-based approach is applied to all users, incorporating stringent due diligence procedures and continuous transaction monitoring. In compliance with anti-money laundering regulations, the Company implements a two-tiered due diligence framework, adjusted according to transaction type, risk level, and user profile:

• Customer Due Diligence (CDD): The standard verification process required in most cases, as described in this Policy.
• Enhanced Due Diligence (EDD): Used for high-risk users, large transactions, or unusual circumstances requiring additional scrutiny.

6.7 By applying a risk-based approach, the level of due diligence is adjusted accordingly—the higher the risk of money laundering or terrorist financing, the more extensive the verification process.

6.8 The following categories of individuals and entities are prohibited from using the Company's services:

• Minors (under the age of 18 or higher is required by domestic legislation);
• Beneficial owners (whether disclosed or undisclosed) or agents acting on behalf of users;
• Non-individual entities, such as companies or trusts;
• Persons subject to sanctions;
• Individuals residing in Restricted Jurisdictions.

6.9 Restricted jurisdictions and geo-blocking

When a User registers an account on the Website, his or her place of residence/domicile (hereinafter the "Jurisdiction") must be considered as a matter of priority. At first, the Company checks whether the jurisdiction is on the European Commission's list of "high-risk third countries with strategic deficiencies" (see "sources"). Then, the Company checks whether or not the jurisdiction is presented in the list of "high-risk and other monitored jurisdictions", presented by FATF. Furthermore, the Company conducts its own monitoring of the jurisdictions based on the following parameters:

• Legal environment.
• Political environment.
• A country's economic structure.
• Cultural factors and the nature of civil society.
• Sources, location and concentration of criminal activity (if any).

6.10 Restricted jurisdictions are included:

• Afghanistan
• Canadian Province of New Brunswick
• China
• Cuba
• Central African Republic
• Democratic Republic of Congo
• Haiti
• Iran
• Iraq
• Israel
• Libya
• Myanmar
• North Korea
• Russia
• Somalia
• South Sudan
• Syria
• UK
• USA
• Yemen
• Venezuela

• FATF black listed countries
  https://www.fatf-gafi.org/en/countries.html#high-risk

6.11 Required Documentation and Information

Depending on the type of verification process, The Company may request the following types of documents and details from users:

6.11.1 Basic Identification Information:

• Full legal name
• Date of birth
• Permanent residential address

6.12 User Identity Verification at the earliest occurrence of any of the following thresholds:

• Within 30 days of the player’s first deposit; or
• When a user has cumulative deposit's of EUR 2,000 or more; and/or
• Prior processing first withdrawal.

The Company will verify the user's identity using third-party verification services, internal data, or a combination of both.

• This verification process may involve cross-checking the user's KYC information with a valid passport, driver's license, or national government-issued ID.
• Pending withdrawals may be placed on hold until the requested KYC information is successfully verified or updated.

6.12.1 Depending on the verification process, The Company may request the following documents:

• A copy or a photo of the user's identification document;
• A photo of the payment card used or intended to be used in making deposits on the Website. It is important that the name of the cardholder must match the name of the user who passes the verification. CVV code and payment card number (except first six and last four digits) may be hidden or covered. The cardholder's name must not be hidden or covered in any way;
• A photo of the user holding the documents required for the verification process (may be with the requested information, written by hand (the e-mail of the user, used when registering an account; the date of the photo request and the confirmation code);
• If applicable, include a bank statement, a letter from User’s duty station or place of employment, and a tax bill;
• If applicable, User’s address confirmation. It may be a utility bill, a phone bill, or other documents that, in accordance with the jurisdiction's legal and regulatory requirements, are sufficient to confirm the User's address;
• Any other documents or information that the situation may require.

6.12.2 Once the required documents are uploaded, the user will receive a "Temporarily Approved" status. At this stage, the documents are under review by The Company's KYC Team, which will assess them within 24 hours and notify the user of the outcome via email. The possible outcomes are:

• Approved – Verification is successfully completed.
• Rejected – The documents do not meet the verification requirements.
• More Information Needed – Additional details or documents are required (status remains unchanged).

6.12.3 Users with a "Temporarily Approved" status can access the platform’s services but are restricted from making withdrawals.

6.12.4 After reviewing the documents, The Company will make a final decision regarding verification. If the KYC process is unsuccessful, the reason will be documented, and a support ticket will be created. The user will receive a ticket number along with an explanation of the decision.

6.12.5 Users who fail the KYC verification process will be restricted from making further deposits or withdrawals.

6.12.6 If a user successfully passes the KYC process, any withdrawal request will undergo both automated and manual verification to ensure the funds were legitimately obtained through platform activity.

6.13 Additional verification

6.13.1 The Company may implement additional verification processes in the following circumstances:

a) The user meets the definition of a Politically Exposed Person (PEP).

A politically exposed person is defined as a natural person who is or has been entrusted with prominent public functions, which include the following: (a) heads of government, heads of state, ministers, and deputy or assistant ministers; (b) members of parliament or similar legislative bodies; (c) members of political party governing bodies; (d) members of supreme courts, constitutional courts, or other high-level judicial bodies, the decisions of which are not subject to further appeal, except in exceptional circumstances; (e) members of courts of auditors or central bank boards; (f) ambassadors, chargés d'affaires, and high-ranking officers in the armed forces; (g) members of State-owned enterprise administrative, management, or supervisory bodies; and (h) directors, deputy directors, and members of an international organization's board or equivalent function.

b) If the User's country of residence is defined by the European Commission as a "third country with strategic deficiencies" or is on the FATF's list of "high-risk and other monitored jurisdictions";

c) In other cases, when additional verification is required by law or at the request of authorities, financial institutions, etc.

6.13.2 In addition to the standard verification, when applying additional verification, the Company requires to submit the document(s) or data on the source of the user's income in accordance with the jurisdiction's legal and regulatory requirements when using additional verification. In the event of additional verification, the final approval on the verification will be done by Senior management of the Company.

6.13.3 For the purposes of this Policy, the Company reserves the right to collect additional user identification data. Furthermore, if a) a user refuses to pass verification; and/or b) the Company has reasonable grounds to suspect that a user is using the Company for illegal purposes and the user does not provide evidence to the contrary, the Company may inform appropriate government authorities on such case. Additionally, the Company may suspend the User's account until the user passes a verification process or provides the document(s) or information requested by the Company.

6.14 Where technically possible, The Company will prevent onboarding, block, or suspend users who meet any of the following criteria:

• Failure to Provide Identification – Users who do not submit the required identification documents or fail identity verification.
• Submission of Fraudulent Documents – Users who provide fake, altered, or otherwise fraudulent identification materials.
• Concealment of Identity or Location – Users who attempt to mask their real identity or geographical location.
• Restricted Jurisdiction Users – Individuals who are from or currently located in a jurisdiction where The Company does not offer services.
• Sanctioned Individuals – Users appearing on U.S., EU, or other international sanctions and watch lists.
• Multiple Accounts – Users attempting to operate or create duplicate accounts on the platform.

7. ENHANCED DUE DILIGENCE

7.1 The Customer Due Diligence (CDD) process outlines the steps taken to verify user identities, specifying the circumstances and timeframes in which verification is required. It also defines scenarios where Enhanced Due Diligence (EDD) must be conducted for higher-risk users.

7.2 The Company applies Enhanced Due Diligence (EDD) measures for users engaging in transactions that exceed EUR 10,000 within a 30-day period, or in cases where transactions exhibit unusual patterns, involve high-risk jurisdictions, or relate to politically exposed persons (PEPs).

7.3 As part of the EDD process, users may be asked to provide additional documentation to confirm their identity, source of funds, and overall financial background. Required documents may include:

• Unique Identification Number (e.g., passport number, taxpayer ID, alien registration number, or any government-issued ID with a photo).
• Government-Issued Identification (such as a passport or national ID).
• Recent Proof of Address (utility bill or official correspondence dated within the last three months).
• Proof of Source of Funds & Wealth (such as tax returns, salary slips, bank statements, or other financial records).

7.4 While low and medium-risk users are primarily monitored through internal compliance measures, The Company reserves the right to request EDD-level documentation if their activity exhibits ML/TF risk indicators or if further verification is deemed necessary.

8. ONGOING MONITORING

8.1 The Company conducts sanctions and watchlist screening of all players at the point of registration and on an ongoing basis thereafter. Ongoing screening is performed at regular intervals, including daily and/or weekly reviews, and on an ad-hoc basis where triggered by risk indicators, updates to sanctions lists, or changes in customer information.

8.2 The Company actively monitors user activities to detect any potential money laundering (ML), terrorist financing (TF), sanctions violations, or other illicit activities.

This includes:

I. Transaction Screening for Restricted Jurisdictions

The Company employs a combination of automated and manual monitoring tools to detect potential money laundering and terrorist financing activities. Automated systems utilize AI-driven risk assessment models to flag unusual transactions based on pre-defined thresholds and behavioral anomalies. Manual reviews are conducted by the Compliance Team for flagged transactions and high-risk users.

The effectiveness of monitoring systems is evaluated through regular internal audits and independent third-party reviews, conducted at least annually.

II. Sanctions & Politically Exposed Persons (PEP) Monitoring

When a user is identified as a Politically Exposed Person (PEP), the Director is notified and determines whether to proceed with the business relationship. If approved, the user is classified as high risk, and enhanced due diligence (EDD) measures are implemented to ensure strict compliance with anti-money laundering (AML) and counter-terrorist financing (CTF) regulations.

III. Detection of Unusual Transactions

The Company actively monitors transaction patterns, volumes, and frequencies to identify irregular or high-risk activity. Complex or suspicious transactions are documented, reviewed, and escalated to senior management for further assessment and appropriate action.

The Company applies the following triggers for enhanced review:

• Transactions exceeding EUR 2,000 that deviate from a user’s typical transaction behavior;
• Rapid movement of funds between multiple accounts without clear justification;
• Deposits or withdrawals involving high-risk jurisdictions or third-party payments;
• Large cash deposits followed by immediate withdrawals or transfers.

Upon detection of a suspicious transaction, the Compliance Team conducts a detailed review, and if necessary, reports the activity to the Tobique Gaming Commission and relevant Financial Intelligence Units (FIUs).

IV. Prohibition of Anonymity Tools

The use of tumblers, and other anonymity-enhancing technologies is strictly forbidden. If such tools are detected, the Company will block them, and any related transactions will undergo a case-by-case review to determine potential risks.

V. Withdrawal-Based KYC Verification

Withdrawals may be temporarily suspended until additional customer due diligence (CDD) is performed. This precaution is triggered when withdrawal amounts exceed designated risk thresholds, requiring further review.

VI. Prevention of Ban Evasion

To maintain security and compliance, each user is permitted to have only one account, as outlined in the Terms of Service. Automated detection systems are in place to identify and prevent users from creating multiple accounts under different identities.

VII. Location & Time Zone Monitoring

The Company examines device location data to detect attempts to disguise geographic locations. Accounts suspected of using VPNs, proxy services, or other methods to bypass jurisdictional restrictions may be temporarily suspended for further investigation.

VIII. Oversight of Third-Party Service Providers

The Company routinely assesses third-party vendors to ensure their compliance with ML/TF risk management protocols. Periodic evaluations are conducted to determine whether additional safeguards are needed or if corrective measures should be implemented.

IX. Advancements in Compliance Technologies

The Company continuously explores innovative compliance solutions, including blockchain-based fraud detection and on-chain KYC technologies, to enhance security measures and meet evolving regulatory requirements.

8.2 Users are encouraged to submit additional documentation or information to challenge any suspensions, restrictions, or flagged transactions as part of The Company’s ongoing monitoring and due diligence process.

8.3 The company implements a robust and risk-based approach to the periodic review of client dossiers. These reviews are an integral component of our ongoing monitoring process and are designed to ensure that customer information remains accurate, up-to-date, and relevant to the assessed level of risk.

8.3.1 Frequency of Reviews

The frequency of periodic client dossier reviews is determined based on the customer’s risk classification:

• High-Risk Clients: reviewed annually (every 12 months)
• Medium-Risk Clients: reviewed biennially (every 24 months)
• Low-Risk Clients: reviewed every 36 months or upon trigger events

Trigger events that may prompt an earlier review include, but are not limited to:

• Changes in the customer’s identification information
• Unusual or suspicious transaction patterns
• Regulatory updates requiring enhanced scrutiny
• Changes in the customer’s risk profile or business activity

8.3.2. Scope of Review

Each periodic review includes the following steps:

• Verification of identity documents to ensure validity and authenticity
• Assessment of the client’s source of funds and source of wealth, particularly for high-risk clients
• Review of transaction history to identify patterns or activities inconsistent with the customer’s known profile
• Re-evaluation of the client’s risk rating, adjusting it as necessary based on new information or behavioral patterns
• Confirmation of PEP or sanctions status through updated screening tools

9. ADVERSE MEDIA AND NEGATIVE NEWS SCREENING

9.1 In line with our risk-based approach and ongoing monitoring obligations under the Tobique Gaming Authority regulations, the Company performs continuous screening for adverse media and negative news related to its customers and their beneficial owners.

9.2 Ongoing Monitoring Process

We conduct adverse media screening as part of both the onboarding process and ongoing customer due diligence. This includes the identification of:

• Negative or adverse media coverage
• Reputational risks
• Public allegations of financial crimes (e.g., fraud, corruption, money laundering)
• Involvement in criminal investigations or legal proceedings

9.3 Screening Tools Used

To ensure comprehensive and up-to-date monitoring, we utilize third-party compliance tools that include:

• AI-powered media monitoring platforms
• Global sanctions and watchlist databases
• Politically Exposed Persons (PEP) screening tools
• Structured and unstructured data sources, including international news, regulatory publications, and open-source intelligence

9.4 Escalation and Review

When adverse media or negative news is detected, the Compliance Officer is notified immediately. A formal review is conducted to assess the credibility and relevance of the information.

10. SAR REPORTING

10.1 If there is suspicion that a user is involved in money laundering or terrorist financing (ML/FT), staff must submit an internal report to the Compliance Officer. When unusual activity is detected, an unusual activity report will be prepared and reviewed by the Compliance Officer (or their delegate) to assess whether a suspicious transaction report needs to be filed.

10.2 If a user is suspected of engaging in money laundering or terrorist financing activities, the Company follows a structured escalation process:

• Transaction Review & Temporary Account Suspension – The suspicious transaction is flagged, and the user’s account may be temporarily restricted pending further investigation.
• Enhanced Due Diligence (EDD) Measures – The user is required to submit additional documents, such as proof of source of funds and wealth verification.
• Filing a Suspicious Transaction Report (STR) – If the suspicion is substantiated, a report is filed with the Tobique Gaming Commission and relevant FIUs.
• Account Closure & Funds Freezing – If the user fails to provide satisfactory explanations or if criminal activity is confirmed, the account may be permanently closed, and funds may be frozen in accordance with regulatory requirements.
• Right to Appeal – Users whose accounts are restricted may request a review, providing additional documentation to contest the decision. The final determination is made by the Compliance Officer.

10.3 The Company will file a Suspicious Matter Report (SMR) with the Tobique Gaming Commission as required by applicable law in cases where:

• there are reasonable grounds to suspect that a User is misrepresenting their identity;
• there are reasonable grounds to believe that our Services are being used in connection with money laundering (ML), terrorist financing (TF), or other criminal activities; and/or
• a transaction appears to lack a legitimate economic purpose.

10.4 A suspicious matter report concerning a possible money laundering offence or other criminal offence must be lodged with the Commission within 5 business days after the day on which the reporting entity forms the relevant suspicion. A suspicious matter report concerning or in relation to possible financing of terrorism must be lodged with the Commission within 24 hours after the time when the reporting entity forms the relevant suspicion.

10.5 The Company promptly reports to the Commission, or to the Direct Licensee acting on behalf of the Commission, any identified instances of suspicious activity where the Company knows or has reasonable grounds to suspect that a Customer’s behaviour may be related to money laundering, or where such behaviour is unusual or inconsistent with the Customer’s normal transactional activity. The Company ensures that all Suspicious Activity Reports are duly prepared and shared with the Commission without delay.

10.6 Additionally, if a User is identified on a sanctions list or linked to ML, TF, or other illicit activities, we will submit a report to the relevant Financial Intelligence Unit (FIU).

10.7 The Company will also maintain comprehensive records to ensure compliance with all applicable ML/TF regulatory requirements.

11. Business Wide Risk Assessment (“BWRA”)

The Company will undertake a risk assessment to identify and assess the risks of financial crime to which it may be subject.

In conducting the risk assessment, the Company will take into account all relevant financial crime factors, including (but not limited to):

• It’s Customers;
• The countries or geographic areas in which it operates;
• Its products or services;
• Its payments and transactions;
• Its operational set up and delivery channels; and,
• Any Third Parties (“TPs”) that provide services to the Company.

In deciding how to conduct the BWRA, the Company will take into account its size and nature of business. The BWRA must be reviewed regularly (e.g., annually), with a clear methodology documented.

12. Record Keeping period

12.1 For a period of 5 (five) years, the Company may keep a record of the verification data of the Website's Users, as well as the transaction data (the history of the transactions and their supporting evidence) in easily accessible form. Please refer to the Privacy Policy for more information on the storage of personal data of Website users.

13. References

Here you can find the source list (but not limited to) for this Policy. Additional legislation or documents may be applied.

1. The Forty Recommendations and Special Recommendations on Terrorism Financing ("FATF Recommendations");
2. Risk-based approach guidance for the casinos (RBA for Casinos), issued by FATF;
3. Directive 2015/849 of the European Union and Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing;
4. Commission Delegated Regulation (EU) 2016/1675 of 14 July 2016 supplementing Directive (EU) 2015/849 of the European Parliament and of the Council by identifying high-risk third countries with strategic deficiencies;
5. REGULATIONS CONCERNING ANTI-MONEY LAUNDERING AND COUNTER TERRORISM FINANCING enacted by the Tobique Gaming Commission on April 5, 2024 pursuant to Section 22 of the TOBIQUE GAMING ACT 2023.
6. AML CODE OF PRACTICE FOR REMOTE GAMING LICENSE HOLDERS enacted by the Tobique Gaming Commission on April 5, 2024 pursuant to Section 22 of the TOBIQUE GAMING ACT 2023.
7. FATF list of High-risk and other monitored jurisdictions:
   http://www.fatf-gafi.org/countries/#high-risk