Anti-Money Laundering and Terrorism Financing Prevention Policy

Introduction

Tobix Limited (“the Company”) is a Company, with its HQ in Malta Isle of Man, established with the purpose of offering gambling services.

The provision of gambling services is regulated and subject to the requirement of obtaining and holding a licence to carry out gambling activities.

The core services provided by the Company are remote gambling:

• casino games (including live casino);
• fixed odds betting including live bets.

The Company establishes business relations with its Customers and provides services only in the context of the established business relations.

Objective

The Company considers the risk of becoming unwillingly involved in ML/FT activity as related to the type of services it offers. Such risk can be effectively and efficiently mitigated and managed if the potential risk linked to the different services is known in advance.

It is the responsibility and obligation of the Company and all its employees and officers to protect it against misuse of its business and its services for the conduct of criminal activity, money laundering purposes, terrorist financing purposes and from attempts at contraventions of sanctions.

For the Company and its employees to safeguard the integrity of the Company and its activities at all times, the Anti-Money Laundering and Terrorism Financing Prevention Policy is established.

The objectives of this Policy are:

• To ensure compliance with the national and international regulatory framework towards AML/CTF and for this purpose;
• To lay down the principles applicable to the Company’s framework of internal regulation that governs the Company's operations designed in accordance with legal and regulatory requirements.

The Policy is primarily based on the Regulations Concerning Anti-Money Laundering And Counter Terrorism Financing (the “Regulations”) enacted by the Tobique Gaming Commission (the “Commission”) pursuant to Section 22 of the Tobique Gaming Act 2023 (the “Gaming Act”).

Scope and Applicability

This Policy is an internal document and the principles laid down herein provide ground for elaboration of effective internal regulations to prevent, mitigate and manage risks of abuse of the Company’s products and services for money laundering and terrorist and proliferation financing purposes, as well as guarantee compliance with the regime on sanctions enforcement.

This Policy also applies to third parties (suppliers, partners, clients) who have agreed to be bound by this Policy through the appropriate applicability statement.

This Policy and the Company's internal guidelines stemming from it, which are developed in accordance with the regulatory AML/CTF framework, apply to all Company’s employees and officers wherever they may be located for the performance of their duties.

Definitions

For the purposes of this Policy, the following terms, definitions and abbreviations shall be adopted:

Policy statement

The Company recognises that financial crime is a threat to the integrity of the services and products it offers which can be abused to launder money or finance terrorist activities.

The Company is committed to ensuring that the highest standards and regulations in regards to Anti-Money Laundering and Countering the Financing of Terrorism and Proliferation are adhered to.

Management further commits itself to ensuring a positive cultural attitude toward AML/CTF prevails. The Company operates in accordance with high ethical standards, integrity, and compliance with relevant AML/CTF laws and regulations.

The Company is aware of its responsibility and liability in respect of money laundering offences initiated in other jurisdictions by its Customers engaged in deposit, gambling, withdrawal or money transfer activities.

To ensure compliance and prevent abuse of its services, the Company conducts its business in compliance with the following general principles:

• To take reasonable steps to determine the identity of all customers and ensure that none of its customers are subject to sanctions under the regime of EU, UN, OFAC, or any other applicable body.
• Do not knowingly accept funds from or engage in any business relations with customers whose money the Company reasonably believes is derived from criminal activity.
• Do not open anonymous accounts or accounts using fictitious names.
• To monitor the transactional activity of its customers to prevent the abuse of products and services for illicit purposes.
• To take seriously any indications that a customer's money might potentially originate from criminal or other money laundering activities. If the Company becomes aware of facts which lead to a reasonable presumption that funds held by it are from criminal or other money laundering or terrorist financing activity appropriate measures, consistent with the law, will be taken, including denial of provision of services to the Customer, severing relations with the Customer, closing or freezing transactions and filing of a suspicious matter report wherever required and appropriate.
• To cooperate fully with law enforcement and regulatory agencies to the extent that it can under all applicable foreign and domestic laws.
• To report all identified instances of suspicious activity to the extent that it can do so under all applicable foreign and domestic laws.

To ensure compliance with the above principles, the Company:

• Shall appoint designated personnel responsible for compliance with anti-money laundering and terrorism financing provisions.
• Shall appoint a senior officer of the Company (MLRO), responsible for compliance with anti-money laundering and terrorism financing provisions, independent in the performance of his or her duties.
• Shall establish due diligence and customer identification procedures to be able to take reasonable steps in order to determine and verify the true identity of its customers and sources of fund.
• Shall establish procedures for ongoing monitoring of activities of its customers in order to prevent the abuse of products and services for illicit purposes.
• Shall establish risk assessment procedures for identification of cases (customers, activity) posing high risk of money laundering where application of enhanced measures in required.
• Shall inform and train responsible employees, including management, on the matters covered in this Policy.
• Shall comply with applicable requirements established by law for the obtaining of documents and record-keeping.
• Shall cooperate fully with the government authorities to the extent that it can do so under all applicable foreign and domestic legislation.
• Shall perform periodic audits, evaluation and risk assessment of all internal ML and TF systems and controls.

The Company’s officers and employees adhere to its ethical and integrity standards as a condition of their employment with the Company and bear the responsibility of following the principles and provisions laid down in this Policy.

Subsidiaries and Groups

When the Company relies on a third party that is a related company or a part of the same group of companies, and that company or group implements a program to combat the risks of money laundering and financing of terrorism, and is supervised by the competent authority of another jurisdiction to a standard equivalent to these AML Regulations, it is deemed as adequately controlled by the current AML/CFT program.

Where the law of a third country does not permit the application of such equivalent measures by the subsidiary undertaking or branch established in that country, the relevant parent undertaking shall:

• Inform the Commission; and,
• Take additional measures to effectively mitigate risks of money laundering or financing of terrorism.

Compliance Governance

The implementation of the Policy requires a top-down approach, with the senior management taking an active role in the oversight and implementation of this Policy.

The board of the Company shall approve any amendments made to the Policy and to any of the substantial policies and procedures.

Revision and updates of the Policy shall take place regularly or be reviewed on an ad-hoc basis following updates in relevant requirements, regulations and best practices.

The Executive board; Senior management and company directors

The board, Senior management and the director(s) of the Company together form the Executive Committee in charge of decision making.

The purpose of the Executive Committee is to ensure proper management and decision making within the Company.

The Executive committee will evaluate suggestions for risk mitigations from the AML/ CTF functions detailed below, and the Internal Audit Function in order to ensure that senior management and board is well aware of the current controls in place to reduce risks of non compliance and gaps in such controls which require remediation.

Nominated Senior Manager

The Company shall appoint a member of senior management to take the responsibility for implementing, managing and overseeing all requisite AML/CFT measures and thereby ensure compliance with the principles laid down within the Commission’s AML Code.

The Nominated Senior Manager will ensure that the Executive committee is kept updated on any material ML/TF risks, sign off on/approve higher risk scenarios where appropriate, as well as own board level accountability.

In carrying out this function, the Nominated Senior Manager may appoint a Senior Compliance Officer or Money Laundering Reporting Officer (“MLRO”) to take ownership of the day-to-day management of the Company’s ML/TF risks.

With considerations given to the overall size of the Company and the number of employees, the senior manager may fulfill the function of MLRO. The manager may have other duties.

The Company shall ensure that the appointed senior manager/MLRO possesses:

• Sufficient AML/CFT knowledge of the international regulations/guidance and other applicable AML/CFT legal and regulatory frameworks, and experience in the implementation of AML/CFT controls within similar firms and the gambling industry in particular.
• Autonomy in their role to be able to exercise independent influence and provide effective challenge as appropriate.
• Sufficient knowledge and understanding of the specific ML/TF risks associated with the gaming/gambling sector in general and with the remote gaming world in particular.

The appointed suitably senior and qualified manager shall monitor and manage compliance with, and the internal communication of, the policies, controls and procedures adopted by the Company, and in particular:

• Identify any situations at higher risk of money laundering or financing of terrorism;
• Maintain a record of its risk assessment, changes to any assessment and its risk management policies, controls and procedures, and relevant changes;
• Maintain a record of its compliance with its policies, controls, and procedures, including its compliance with reporting obligations to the Commission; and,
• Provide information to senior management about the operation and effectiveness of its policies, controls, and procedures whenever appropriate.

The Board should receive at least an annual report on AML/CFT activities and issues affecting the company from the MLRO, including an annual update of the corporate Risk Assessment and a report on the work of the Executive Committee. More regular reports to the Board should be made as events dictate.

Risk assessments and annual Board reports shall be provided to the Commission for review on request.

Management of ML/TF Risks

The implementation of a risk-based approach enables the Company to properly identify and measure the risks for potential money laundering arising from the Company’s activities, prioritise risks and allow for the appropriate actions to be taken in order to mitigate and control such risks.

The purpose of the AML risk assessment is the identification, assessment and appropriate management of potential risks of money laundering and terrorism financing and all associated risks that the Company may be exposed to in relation to the laundering of proceeds of crime and financing of terrorism.

In carrying out the risk assessment, the Company shall take into account all relevant money laundering and financing of terrorism risk factors including factors relating to:

• Customers - the general characteristics of the Customer;
• Countries and Geographic areas - the characteristics of the country of residence and other geographical risks;
• Product and services - the characteristics of the products and services provided by the Company;
• Payment Methods - risks connected to specific payment methods used by the Customers;
• Delivery channels - the characteristics of intermediaries and interface risks;
• Any third parties that provide services to the business.

The steps of the risk assessment methodology are as follows:

• Identification;
• Assessment;
• Risk Management practices;
• Internal controls;
• Customer Due Diligence measures;
• Record keeping; and,
• The monitoring and management of compliance with such policies, controls and procedures.

This methodology also allows the Company to prioritize its actions and focus on risks presenting greater severity and likelihood of materialization.

Business risk evaluation and management

The Company considers that the risk of becoming unwillingly involved in ML/TF activity is related to the type of services it offers and that such risk can be effectively and efficiently mitigated and managed if the potential risk linked to the services offered is known in advance.

Therefore, it is the Company’s policy to determine the risk of the services it offers with respect to ML/TF in accordance with regulatory requirements, by applying pertinent risk factors. The criteria and factors to be used for such categorisation shall be identified in line with regulatory requirements. Accordingly, the Company designs and implements measures and controls to mitigate such risks in relation to its services.

This also enables the Company to focus on areas that present greater risks.

Reliance on Third Parties

Should the Company rely on third parties by outsourcing elements or functions of its processes, it commits to bearing the ultimate responsibility for their fulfilment and will therefore ensure that it has adequate visibility of processes carried out on its behalf and has satisfied itself that the controls implemented by the third party are fit for the intended purpose.

In cases where the Company relies on third parties, it shall:

• Ensure that appropriate measures are taken to assess whether a third party is suitable to undertake the task and has in place adequate controls to ensure compliance with the relevant ML/FT legislation;
• Take adequate steps to satisfy itself that copies or records of identification data and other relevant documentation will be made available upon request without delay; and
• The obligations and responsibilities of the Company and the third party are clearly defined.

Key Concepts

In order to effectively comply with the regulatory framework, all employees are required to have a clear understanding of the process of Money Laundering and Terrorism Financing.

For the purposes of the current policy and its operations, the Company adopts the following definitions:

Money Laundering

Money Laundering is the activity whereby:

• A person uses, transfers the possession of, sends or delivers to any person or place, or otherwise deals with, in any manner and by any means, any property or any proceeds of any property with intent to conceal or convert that property or those proceeds, knowing or believing that, or being reckless as to whether all or a part of that property or those proceeds was obtained or derived directly or indirectly as a result of criminal activity; or,
• A person enters into, or becomes concerned in, an arrangement which he or she knows, or has reasonable cause to suspect, facilitates the acquisition, retention, use or control of criminal property by or on behalf of another person.

“Money laundering offence” is an offence whether committed in the Territory of Tobique or under the laws of another jurisdiction, which criminalises money laundering or the disposal of the proceeds of crime.

Money laundering involves the introduction or movement of funds from illicit or criminal origins within legitimate financial services or businesses in an attempt to clean or legitimise those funds. Where the Customer knowingly attempts to ‘clean’ or legitimise funds from illegitimate origins (‘dirty money’) by either depositing illicit funds into the game and recording a loss or thereafter cashing out legitimate funds in the form of ‘winnings’, such Customer commits the crime of money laundering.

Generally speaking, the money laundering process, consists of three stages:

• Placement - funds generated from illegal activities are placed into the financial system or retail economy or are smuggled out of the country. The launderer aims to move the funds from its source so as to avoid detection from the authorities and to then transform it into other asset forms.
• Layering - funds are transferred or moved into other accounts or other financial institutions to further separate money from its illegal origin, to concealment or disguise of the source of the ownership of funds by creating complex layers of financial transactions designed to disguise the audit trail and provide anonymity.
• Integration - the final stage in the process, at which the money is integrated into the legitimate economic and financial system and is assimilated with all other assets in the system. Integration of the "cleaned" money into the economy is accomplished by the launderer making it appear to have been legally earned.

In the context of the remote gaming sector, money laundering being committed knowingly by the Customer is likely to occur most commonly in the below scenarios:

• Disguise - The misrepresentation of illicit funds to the operator as arising from a legitimate source (whether the funds are held on account, played or withdrawn).
• Conversion – the conversion of ‘dirty money’ from illicit sources into ‘clean money’ the source of which appears legitimate (winnings paid out or balances either held on account or withdrawn)
• Disposal – the disposal of illicit funds by way of spending or receiving these illicit funds (e.g. the loss of a deposit or the settlement of debts, known as ‘credit betting’).

Red Flags

The Company and its employees shall monitor for warning signs of money laundering such as those indicated below:

A transaction is:

• Complex;
• Unusual including unusually large or there is an unusual pattern of transactions;
• With no apparent economic or legal purpose;

High losses which are not consistent with the normal activity of the Customer nor in line with such a Customer’s player profile or documented financial means;

Spikes in player activity: significant increase in the Customer’s play or betting activity which appears to be inconsistent with the known or profiled activity for that Customer;

Avoidance or delay by the Customer to connect personally with the Company;

Provision of false or implausible information or documentation by the Customer in a seeming attempt to conceal or withhold information or documentary evidence required for AML/CFT purposes;

Identification of inconsistent personal information or adverse media related to that Customer’s reputation, financial standing or previous convictions;

The Customer’s withdrawals are not consistent with usual player activity such as minimal play or spending;

Deposits made from corporate cards or accounts and/or by players with access to corporate funds such as senior financial officers;

Problem gambling behaviour resulting in increased wagering levels and frequencies, where the Customer may be financing addiction from stolen funds.

A Customer misleads the Company as to the source of their deposits, where the source of funds is linked to criminal activity.

A Customer transfers criminal funds to another player whether by play or by other means. The Customer will still be deemed guilty of money laundering whether or not that player is colluding with that customer.

A Customer engages in very low risk gambling activity or in minimal play in an attempt to recycle illicit funds, or a proportion thereof, through gambling facilities.

Financing of terrorism

“Financing of terrorism” refers to activity where:

• A person provides or collects funds, and intends or is negligent or reckless as to whether the funds will be used to facilitate or engage in a terrorist act; or
• A person to become involved in an arrangement which makes money or other property available to another if he or she knows, or has reasonable cause to suspect, it may be used for terrorist purposes.

“Financing of terrorism activity” is an offence whether committed in the Territory of Tobique or under the laws of another jurisdiction, which criminalizes the financing of terrorism, and includes circumstances where financing was provided, even if a terrorist act does not occur.

Source of funds for terrorism financing can be illegal or relatively legal, such as for example collection of membership dues and/or subscriptions; sale of publications; donations of a portion of their personal earning and etc. Often only small amounts are needed to commit acts of terrorism, increasing the difficulty of tracking the funds.

Risks related to the financing of terrorism or proliferation financing facilitated through the remote gambling industry manifest themselves in various methods of peer-to-peer fund transfers, including the purposeful transferring of player funds or chips from one player to another within the same country or cross-border.

‘Chip-dumping’ in poker is an example of such a transfer.

Gaming operations can be used at any point in the money laundering or terrorism or proliferation financing process and the Company is aware of this risk.

All money laundering and terrorism and proliferation financing are considered criminal offences, and merely facilitating such activities exposes the Company, its employees and its officers to liability.

To prevent the risk of money laundering and terrorism and proliferation financing from materialising via the Company, a comprehensive set of risk management measures are implemented.

Customer Acceptance Policy

Risks inherent in ML/TF can be managed effectively and efficiently if the potential risk is understood in advance.

Having Customers identified by risk level enables the Company to design and implement measures and establish controls to mitigate such risk.

For this purpose, the Company has designed and implemented procedures which provide for a risk categorization of ML/TF risk by considering relevant factors. The criteria and factors to be used for such categorisation shall be identified in line with the Commission’s requirements.

Risk assessment methodology for ML/TF risks

In conducting risk assessments, the Company shall apply a holistic risk-based approach in order to identify and assess the risks of money laundering and terrorist financing while taking into account risk factors emanating from at least the following categories:

• Countries or geographic areas in which customers reside or operate;
• The geographical location of the customer domicile,
• locations where the customer register/logins from;
• Customers (players) - the type of Customer that the Company is dealing with, whether they:
  • Fall under PEPs category, High Net Worth Individual, public figure,
  • Are subject to adverse media findings,
• Products provided to the customer.
• Its payment and transactions;
  • Payment methods being used,
  • number and frequency of payment methods used/changed,
  • whether the same payment method used for deposits and withdrawal (and the reason for usage of different payment methods),
  • deposit amount per transaction/ total deposits within specific period of time,
  • deposits/withdrawal ratio;
• Its operational set-up and delivery channels - whether the method/channel used for interacting with customers is:
  • face-to-face, or
  • non face-to-face;

The different risk variables within each of the risk categories and their subcategories are each awarded a score which determines the final risk score of the customer and decides the next course of action.

Once the scoring for each key risk category is calculated (i.e. by summing up scoring of each sub-category), the Customer is then assigned with the overall Risk Score. Upon calculation every customer is assigned an internal risk level (Low, Medium, and High and Extra High Risk) depending on the Customer’s profile.

As part of its mitigation and minimisation strategies, the Company has developed and implemented enhanced due diligence measures for customers who meet the criteria for being categorised as high-risk.

These criteria were established in accordance with applicable directives and legal requirements and the following EDD measures adopted shall depend on the high-risk scenarios portrayed by that particular Customer and may be different on a case by case basis.

Prohibited Customers

For effective ML/TF risk control implementation, the Company does not establish or terminates business relationships with the following categories of Customers:

• Anonymous accounts;
• Underaged individuals;
• Sanctioned individuals;
• A specified person of a class of persons for whom the Commission has directed (i) to not enter into a business relationship, (ii) to not undertake transactions of a specified description or (iii) to terminate an existing business relationship;
• Self-excluded customers, excluded from the Company’s site or any self-exclusion register available within the licence conditions;
• Customers previously terminated by the Company;
• Customer is not cooperative, refuses to submit or does not submit required information and documents, including for identification and due diligence purposes, monitoring and justification of its transactions, etc.
• Individuals who are subject to restrictive measures issued by the Office of Foreign Assets Control (US-OFAC).

In the above circumstances, EDD may be carried out if applicable, the case may further be reviewed by the MLRO and potentially result in a suspicious matter report.

Politically exposed person (“PEP”)

In the normal course of CDD, the Company shall have risk-management systems to determine whether a Customer or the beneficial owner is a politically exposed person, or an immediate family member or close associate of the politically exposed person.

Individuals who meet the definition of a PEP are considered to pose a higher money laundering risk as their prominent political position makes them vulnerable to corruption.

For the purpose of the Company’s AML/CFT Policy and operations, the following definitions are adopted:

1. A “Politically Exposed Person” means an individual who holds a prominent public position or function in a government body or an international organisation, including:
   • Head of State or head of a country or government;
   • Government minister or equivalent senior politician;
   • Senior government official;
   • Senior judge in a foreign country or international organisation;
   • Governor of a central bank;
   • Senior foreign representative, ambassador, or high commissioner;
   • High-ranking member of the armed forces; or,
   • Board chair, chief executive, or chief financial officer of, or any other position that has comparable influence in any State enterprise or international organisation.
2. An “immediate family member” includes a:
   • Spouse;
   • De facto partner;
   • Child and a child's spouse or de facto partner; or,
   • Parent.
3. A “close associate” is any individual known (based on public or readily available information) to have:
   • Joint beneficial ownership of a legal entity or legal arrangement with a politically exposed person referred to in paragraph (1); or,
   • Sole beneficial ownership of a legal entity or arrangement, known to exist for the benefit of a politically exposed person described in paragraph (1).

Due to the influence held by individuals holding prominent political positions, ‘Politically Exposed Persons’ (PEPs) are deemed to represent an extremely high risk from a money laundering perspective. This risk will be further exacerbated when the individual is a direct PEP and linked to either a higher risk jurisdiction or countries with known higher levels of corruption and political/ financial instability.

If the Company determines a Customer falls under the category of a PEP or his/her family members or close business associate, the Company shall obtain senior management approval for establishing a business relationship or continuing an existing business relationship with an existing Customer. Furthermore, the Company shall take reasonable measures to establish the source of funds and conduct Enhanced Due Diligence checks and ongoing monitoring of the business relationship with the Customer.

The Company acknowledges that PEP status itself is intended to apply EDD measures to certain individuals and put those individuals who are customers or beneficial owners into a higher risk category. A PEP status itself is not intended to suggest that such individuals are involved in suspicious activity. Depending on the type of PEP client, the measures to be carried out may be lighter.

For at least 12 months after a PEP is no longer entrusted with a prominent public function, the Company shall consider the continuing risk posed by that person and apply appropriate measures until such time as that person is deemed to no longer pose a further risk specific to PEPs.

The Company shall consider and determine whether to terminate a business relationship with Customer that falls under the category of a PEP or his/her family members or close business associate:

• If it receives any adverse information about the PEP or his/her family or close business associate that may affect the integrity of the business relationship; or
• If it is unable to determine the source of any funds.

The Company shall document the reasons for any decision to continue the business relationship.

Person Connected to Sporting Events

Within its operations, the Company shall also employ risk-management systems to determine whether a Customer is a person, or a family member or close associate of such person, who has a close connection to:

• A sporting event, team, sporting association or organisation; and
• The Company accepts bets on that team, sport or sporting event.

For the purposes of the current Policy, the following definitions are adopted:

1. A “person connected to sporting events” includes an individual who (having regard to information that is public or readily available) owns, plays with, coaches, trains or manages a sporting team, or who has a senior role with the governing body of a sport;
2. An “immediate family member” includes a:
   • Spouse;
   • De facto partner;
   • Child and a child's spouse or de facto partner; or,
   • Parent.
3. A “close associate” is any individual known (based on public or readily available information) to have:
   • Joint beneficial ownership of a legal entity or legal arrangement with a politically exposed person referred to in paragraph (1); or,
   • Sole beneficial ownership of a legal entity or arrangement, known to exist for the benefit of a politically exposed person described in paragraph (1).

Additional high-risk measures shall be taken by the Company, should it determine that a Customer falls under the category of a Person Connected to Sporting Events or his/her family members or close business associate.

In that case, the Company shall obtain senior management approval for establishing a business relationship or continuing an existing business relationship with an existing Customer. Furthermore, the Company shall take reasonable measures to establish the source of funds and conduct enhanced ongoing monitoring of the business relationship with the Customer.

The Company shall consider and determine whether to terminate a business relationship with Customer that falls under the category of a Person Connected to Sporting Events or his/her family members or close business associate:

• If it receives any adverse information about the Person Connected to Sporting Events or his/her family or close business associate that may affect the integrity of the business relationship; or
• If it is unable to determine the source of any funds.

The Company shall document the reasons for any decision to continue the business relationship.

Sanctions Screening

All potential and existing customers (where required) should be screened against Sanctions and Blacklists.

To avoid the risks of being used as a vehicle for sanctions contraventions or financing of terrorism, the Company maintains a zero-tolerance approach to any sanctions matches it identifies. The Company also refuses to conduct business in any comprehensively sanctioned country, or with any sanctioned individual, where it can be reasonably established that the match is genuine.

The Company shall strictly adhere to the UN Security Council resolutions relating to the prevention and suppression of terrorism and terrorist financing and in particular shall freeze without delay the funds or other assets of, and ensure that no funds or other assets are made available, directly or indirectly, to or for the benefit of, any person or entity either (i) designated by, or under the authority of, the UN Security Council under Chapter VII of the Charter of the UN, including in accordance with resolution 1267 (1999) and its successor resolutions; or (ii) designated by that country pursuant to resolution 1373 (2001).

The Company shall also adhere to the UN Security Council resolutions relating to the prevention, suppression and disruption of the proliferation of weapons of mass destruction and its financing and, in particular, shall freeze without delay the funds or other assets of, and to ensure that no funds and other assets are made available, directly or indirectly, to or for the benefit of, any person or entity designated by, or under the authority of, the UN Security Council under Chapter VII of the Charter of the UN.

Wherever a match with a sanctioned individual is determined to be a true match, the following risk mitigation measurements will take place:

• Relationship with the Customer are terminated or not established;
• MLRO informs Management;
• MLRO shall file a suspicious matter report, if apart from the Customer being sanctioned, there is also knowledge or suspicion on AML/CFT; and,
• MLRO shall report to the respective authorities for further guidance in relation to the blocking of the account and freezing of funds.

Know your Customer and Customer Due Diligence Measures

The Company shall conduct customer identification and due diligence procedures in order to obtain adequate information regarding the Customer.

Customer Due Diligence measures should be employed at the following times:

• When establishing business relations.
• When carrying out occasional transactions.
• Where there is a suspicion of money laundering or terrorist financing.
• Where there is doubt about the veracity or adequacy of previously obtained customer identification data.

The verification of the Customer, is required in order for the Company to:

• Understand the potential ML/TF risks associated with the Customer in the context of the business relationship; and
• Take appropriate steps to mitigate the risks.

Initial Customer Due Diligence

The Company shall initiate Customer Due Diligence (“CDD”) identification measures when a Customer opens an account, which is considered to be the moment when the Client accepts the Terms and Conditions of the Company’s site.

The Company shall undertake the verification of identity and such other CDD measures as are appropriate, as soon as reasonably practicable following the deposit of funds into the account.

In any case, this verification process should be completed within 30 days or as soon as reasonably and operationally possible from registration OR before the Customer wagers more than an equivalent of EUR 2,000 of their own funds (as opposed to recycled winnings) and before any money is paid out.

The Company shall utilise electronic verification services, where these are available and add value, in order to verify registration details and identify both errors in data entries and deliberate misleading attempts.

Where invalid data, missing information, and/or inconsistencies are identified in a registered account, then these should be reviewed on a risk-based approach, but especially when other alerts present themselves.

Pending any necessary clarification and verification, if significant inconsistencies are identified and are considered “higher-risk” in terms of the veracity of the Customer, peer to peer gambling should not be allowed. All other forms of gambling should be subject to additional supervision/monitoring until identification is verified.

The CDD measures to be applied by the Company are as follows:

• Identification via the registration process and further verification of the Customer’s identity using reliable independent or primary source documents (such as government-issued photo ID documents) or other appropriate electronic ID&V software;
• Gathering of supporting information and accompanying proofs (such as date of birth and residential address);
• Standard screening checks.

PEP and sanctions screening is an integral part of the Initial CDD process and it shall be commenced and concluded immediately or as soon as reasonably and operationally possible at account opening and concluded prior to wagering.

Sanctioned Customers shall not be allowed to deposit and play. Any players infringing international sanctions legislation shall be immediately barred from further play.

Accounts with PEP hits are to be frozen pending EDD checks and PEP risk assessment.

Adverse media identified in relation to the Customer may be put through a risk assessment and mitigation process and should be concluded within 30 days of account opening or first deposit, and before any money is paid out.

In the event that the Company is unable to satisfy itself that the identity of the Customer has been verified:

• The business relationship shall be terminated; and,
• A suspicious matter report shall be made in regard to the Customer.

Enhanced Due Diligence

Customer Due Diligence measures of increased scrutiny shall be employed where a Customer is deemed to carry a higher money laundering and terrorist financing risk. A holistic approach to risk assessment is to be employed, the risks considered together and mitigated where appropriate.

Enhanced Due Diligence measures shall go beyond the measures applied under Initial or Standard Customer Due Diligence and may include the following:

• Obtaining additional information to verify the customer’s identity;
• Obtaining additional information as to the Customer’s source of funds and source of wealth;
• Enhanced screening – for example using a second search engine in addition to a third-party data provider (e.g. Google screening).
• Senior management and MLRO approval may be required for the establishment or continuation of the business relationship;
• Conducting enhanced monitoring of the business relationship.

The Company shall apply enhanced customer due diligence when presented with the following circumstances:

• Change in the risk assessment for a Customer occurs;
• Where there is any indication that the identity of the Customer is not correct or has changed;
• Where there are any transactions which are not reasonably consistent with the Company’s knowledge of the Customer;
• There is a suspicion of money laundering or terrorist financing; or
• The Company has doubts about the veracity or adequacy of previously obtained Customer identification data.

The presence of high-risk factors or red flags may necessitate the implementation of enhanced due diligence measures. These factors may include:

• High-Risk Countries or Jurisdictions;
• A Customer using faked or stolen identification documents;
• A Customer excluded for problem gambling reasons who has bypassed blocking measures to start playing again;
• Use of high-risk payment methods such as prepaid cards or cryptocurrency;
• Significant/Material adverse media related to financial crime/ serious or criminal offences/ reputationally damaging news events;
• Identification of a Politically Exposed Person (PEP);
• Indirect link to a sanctioned individual, entity or country; and,
• Customer transactional activity of either high value or high volume may also be deemed to be a high-risk factor especially where it exceeds the customer’s estimated affordability levels.

Enhanced due diligence measures shall include:

• Obtaining additional information as to the Customer's identity;
• Obtaining additional information as to the Customer's source of funds;
• Obtaining an approval of senior management for establishing or continuing the Business Relationship;
• Conducting enhanced monitoring of the Business Relationship.

Commercial or Business-to-Business (B2B) Relationships

Commercial or Business-to-Business Customer Due Diligence

The Company shall employ Initial Customer Due Diligence measures on their B2C Operator Customers as part of their onboarding procedures.

Customer Due Diligence in this context of onboarding of B2C Operator Customers refers to the process of information gathering to identify and verify the Licensee entity, its owners, controllers and other related parties to better identify, assess and manage relevant associated risk factors. This process entails the following:

• Identifying the customer and verifying that customer’s identity using reliable, independent source documents, data or information to understand the ultimate beneficial ownership and control of their B2B customers.
• Where the customer is a corporation or other business entity, the License Holder must take reasonable measures to verify the identity of the individual or individuals who are the ultimate beneficial owners of the customer, such that the License Holder is satisfied that it knows who the ultimate beneficial owner is. This may require License Holders to understand the ownership and control structure of the customer.
• Understanding and, as appropriate, obtaining information on the purpose and intended nature of the business relationship; and
• Understanding the predicted transactional profile of the B2C Operator Customer and where appropriate, the source of funds.

B2B License Holders who provide customer-facing type services to and on behalf of their B2C Operator Customers, including but not limited to customer services, VIP account management, fraud and risk services, must obtain the approval of the Commission or the Direct Licensee on behalf of the Commission and undergo ongoing monitoring by the B2C Licensee to ensure that the services they provide on their behalf meet the requirements and standards necessary to mitigate money laundering and terrorism financing as contemplated in the Codes.

Other relevant B2B Suppliers:

• B2B Aggregator License Holders who distribute third party gambling software to B2C Operator Customers must employ Initial Customer Due Diligence measures on their gambling software providers as part of their onboarding procedures.
• B2B License Holders who are suppliers of casino table games, or providers of peer-to-peer poker networks or betting exchange platforms have access to real time game play or game performance statistics, betting patterns, wagering levels and collusion activity and therefore will need to ensure that gameplay and betting transactions are monitored in real time for recognised money laundering or terrorist financing ‘gameplay’ methodologies and reported to their B2C Operator Customer in a timely and proportionate way should they occur, allowing for possible interventions in funds transfers or withdrawals.
• Given the evolving nature of ML/TF methodologies, it is expected that the details of the monitoring which will be carried out will be agreed between the parties from time to time and need not be set out in precise detail at the outset. While some methodologies are transparent and easy to identify (e.g. repeated low risk bets in roulette), P2P transfers and chip dumping can be highly sophisticated, shielded and complex.

Commercial or Business-to-Business Enhanced Customer Due Diligence (EDD)

The Company shall employ Enhanced Customer Due Diligence measures on their B2C Operator Customers as part of their onboarding procedures when they are deemed to carry a greater risk of money laundering and terrorist financing risk.

Enhanced Due Diligence measures are employed in these higher risk circumstances to allow for a better understanding of the customer ownership and control structure, as well as the risks specific to the size and nature of the business and customer base.

Enhanced Due Diligence measures for corporate entities include, but are not limited to, the following:

• Increased scrutiny checks to establish the Ultimate Beneficial Owners of the corporate entity (down to 10% ownership in the Customer entity).
• Additional Verification of Identity checks – government-issued and valid photo-ID documents are required to verify the identity for more Directors under EDD measures. Certification of these identity documents may also be required.
• Evidence of the Sources of Wealth and the Source of Funds for UBOs.
• Enhanced screening – for example using a second search engine in addition to a third-party data provider (e.g. Google screening)
• Senior management and MLRO approval may be required for the continuation of the business relationship.

Country risk

The Company will apply a risk-based approach to ensure that measures to prevent or mitigate money laundering and terrorist financing are commensurate with the risks identified within its area of control.

The Company shall monitor against and block access to persons from such locations or apply EDD measures against them, based on the holistic risk assigned for each country in the following lists:

1. FATF High-Risk Jurisdictions (aka the “Black List”)
2. FATF Jurisdictions Under Increased Monitoring ( aka “Grey List”)
3. High Corruption Scoring Jurisdictions
4. International Sanctions
5. Countries Considered to be Funding Terrorism
6. Conflict Zones

Sanctioned Jurisdictions

The Company will not enter into business relationships with any entity or individual who is subject to EU, UN, UK, US or other international sanctions legislation or ones related to parties on the FATF blacklist.

Restricted Jurisdictions

In accordance with the holistic risk applied for the evaluation of each jurisdiction, the following have been determined as Restricted Jurisdictions and the Company shall refrain from conducting business with Clients having those as their origin or location as they fall outside of the Company’s risk appetite:

• Afghanistan, Canadian Provinces of New Brunswick and Ontario, China, Cuba, Central African Republic, Democratic Republic of Congo, Haiti, Iran, Iraq, Israel, Libya, Myanmar, North Korea, Russia, Somalia, South Sudan, Syria, UK, USA, Yemen, Venezuela

The Company shall integrate technological solutions to geo-block consumers residing in the USA, the UK, New Brunswick, Ontario and FATF sanctioned countries. Further measures shall be taken to block player registration from restricted territories.

High-risk countries

When a Client is found as associated with a High-Risk third country or any other high-risk jurisdiction on the FATF ‘grey’ list, Enhanced Due Diligence measures shall be employed, and the risks considered holistically so as to try to mitigate this red flag.

Thus, countries subject to Enhanced Due Diligence are:

• Albania, Barbados, Bulgaria, Burkina Faso, Burundi, Chad, Comoros, Cameroon, Cayman Islands, Croatia, Equatorial Guinea, Gibraltar, Jamaica, Jordan, Lebanon, Mali, Mozambique, Nicaragua, Nigeria, Pakistan, Palestinian Territory, Panama, Philippines, Senegal, South Africa, Tanzania, Tajikistan, Turkey, Turkmenistan, Uganda, United Arab Emirates, Ukraine, Vietnam, Zimbabwe

The complete methodology of the assessment as well as the scoring matrix are further described in the Company’s separate Country Risk Assessment.

Monitoring and Control Activities

Ongoing monitoring

Ongoing monitoring of customers' activities and transactions is a critical tool that the Company has adopted within its ML/TF framework of internal regulations. Robust, efficient and pertinent monitoring ensures that the Company identifies and manages ML and TF risks efficiently and that any potential new risks are identified in a timely manner.

Ongoing monitoring includes but is not limited to the following activities:

• Regular screening against PEP, sanctions, and adverse media databases.
• Transaction Monitoring activities in terms of which the frequency, volume and value of bets placed by an individual Customer shall be monitored and compared and, in the case of potentially suspicious activity, will be escalated to the MLRO in the form of a Suspicious Matter Report.

The Company carries out monitoring and control process, at a minimum, in relation to:

• High-risk customers.
• Complex and unusual transactions.
• Large transactions above pre-set limits.
• Any other transactions which are particularly likely, by their nature, to be related to money laundering or the funding of terrorism.

The Company does not accept cash deposits and does not provide cash transactions. The Company works only with online payment methods, i.e. credit cards, debit cards, electronic transfers, wire transfers and equivalents.

The Company shall only transfer payments of winnings or refunds back to the same route from where the funds originated, where possible.

Transfers of funds between Clients’ accounts shall be prohibited.

Periodic review

The Company is to perform periodic reviews of the CDD of its Customers, with the period between reviews and their scrutiny to be based on the risk profile of each Customer.

Periodic reviews will consist of a full review of all Customer risk assessments, Know Your Customer information and documentation collected in support of the CDD requirements, records of screenings against PEP, sanctions and adverse media databases and transaction monitoring reviews.

Event-driven reviews

An event-driven review (“EDR”) consists of a full refresh of Customer KYC and CDD information and documentation together with a re-assessment of any risk associated.

The identification of a high-risk factor or red flag during the screening or transaction monitoring processes will trigger an EDR and may include the identification of the placement of unusually large or frequent bets or bets placed during particular times or events.

A material change to the ownership or control of the Company’s corporate customer will trigger an EDR.

Records and reports

The Company shall comply with its obligation to report to the Commission, or Direct Licensee on behalf of the Commission, any identified instances of suspicious activity where the Company knows of or reasonably suspects that certain behaviour of the Customer may be related to money laundering activity or where such activity appears to be unusual or at variance with the usual behaviour or transactional activity of the Customer. The Company shall share all Suspicious Matter Reports with the Commission.

The Company shall further report on request to the Commission, or Direct Licensee on behalf of the Commission, on additional AML/CFT requirements as deemed appropriate.

Reports of Suspicious Matters

A suspicious matter report shall be lodged when:

• The Company reasonably suspects that a Customer is not the person they claim to be; or
• The Company reasonably suspects that the provision or prospective provision of its services are related to money laundering, financing of terrorism or proliferation or other criminal offences; or
• A transaction does not appear to have a lawful economic purpose.

A suspicious matter report concerning a possible money laundering offence or other criminal offence shall be lodged with the Commission within 5 business days after the day on which the Company formed the relevant suspicion.

A suspicious matter report related to possible financing of terrorism or proliferation shall be lodged with the Commission within 24 hours after the time when the Company formed the relevant suspicion.

A suspicious matter report shall contain a statement of the grounds on which the Company holds the relevant suspicion. The Company shall fully document the reasons for any decision regarding the submission or non-submission of a suspicious matter report.

Record-keeping and provision of audited accounts

The Company commits to maintaining all records obtained through customer due diligence including copies or records of official identification documents, account files and business correspondence, for at least five years after the business relationship is ended, or after the date of the occasional transaction. It shall further nominate a place for the safekeeping of its transaction records by notice in writing to the Commission or applicable Direct Licensee.

The records shall include the originator/payer information and required beneficiary/payee information on wire transfers, electronic fund transfers and other electronic payments.

The Company shall keep said records in a manner that allows:

• true and fair financial statements and accounts to be prepared annually; and
• those financial statements and accounts to be audited.

The Company shall comply with the provision of a copy to the Commission, or Direct Licensee on behalf of the Commission, of all records as specified whenever the Company relocates the business or ceases business.

Training and Vetting of Employees

The Company shall take appropriate measures to ensure that its employees are:

• made aware of the law relating to money laundering and financing of terrorism, and to the requirements of the AML Regulations; and,
• regularly given training in how to recognise and deal with transactions and other activities or situations which may be related to money laundering or financing of terrorism or proliferation, as appropriate to their roles.

All new joiners receive training as part of the introduction process.

The Company’s MLRO shall maintain a record in writing of the training given to its employees.

After training, each attendee shall undergo an assessment to test their recently acquired AML/CFT knowledge. If a score of at least 75% is not achieved, attendees will be required to re-sit the test and/or repeat the training.

Every year on the anniversary of their initial training and assessment all staff shall attend refresher training.

Any changes to relevant regulations, policies or procedures shall be covered within the scope of this annual training. This is done so as to ensure all personnel can meet the Company’s requirements and are aware of their responsibilities with regards to AML at all times.

Training shall cover at least the following areas:

• Risks of money laundering and terrorist financing relevant to the business, the applicable legislation and staff obligations and responsibilities under the legislation.
• The Company’s Risk Assessment methodology and mitigating policies, controls and procedures.
• The identification of potentially suspicious transactions or activity.
• Red flags or indicators of money laundering or suspicious activity appropriate to the remote gaming/gambling sector.

The Company shall further have in place adequate and appropriate checks and controls to determine whether to or in what manner, to screen any prospective employee who, if employed, could be in a position to conduct or facilitate an offence of money laundering or financing of terrorism.

Furthermore, the Company shall have in place adequate and appropriate checks and controls pertaining to the re-screening of an employee where the employee is transferred or promoted to a position wherein conduct or facilitation of an offence of money laundering or financing of terrorism is possible.

The Company shall have in place and maintain a system whereby it has the ability to manage any employee who fails, without reasonable excuse, to comply with the above-mentioned procedures.

Tipping off

Tipping off is a criminal offence. Tipping off can be defined as any person or employee who discloses to any other person, information or any other matter, which have led to the Company:

1. forming a reasonable suspicion of financial crime activities;
2. filing a suspicious matter report with the Commission, or,
3. providing documents or other information to the Commission,

In the aforementioned cases, neither the Company nor any person employed or associated with the Company may disclose to someone other than the Commission that the suspicion has been formed, report lodged, or information has been communicated to the Commission, as applicable.

Review and Audit

The Company is committed to taking necessary measures for the implementation and maintenance of policies, controls, and procedures as part of its obligation to mitigate and effectively manage the risks of money laundering and financing of terrorism identified during the risk assessment process. These measures encompass:

• Risk management practices;
• Internal controls;
• Customer Due Diligence measures;
• Record keeping; and,
• The monitoring and management of compliance with, and the internal communication of, such policies, controls and procedures.

Application of and recording of the results under this risk assessment methodology allows for a solid understanding of inherent risks, as well as the subsequent evaluation of the effectiveness of the internal control measures implemented to mitigate and manage them.

Accordingly, the Company is to regularly assess ML/TF risk and the entire set of measures of the internal control for prevention and suppression of money laundering and terrorist financing in order to determine the existing and residual level of the risk and take appropriate corrective measures. Such overall assessments involve the determination of both compliance of internal regulations with regulatory framework and best standards and their effectiveness.

In addition to any audit that may be required by the Commission, the Company’s AML/CTF Policy shall be subject to regular, independent and, where appropriate, external review.

Furthermore, the AML/CFT Policy of the Company is to be subject to regular, independent and, where appropriate, external review. The frequency of the review should take into account the nature, size and complexity of the Company’s business, and the type and level of money laundering or financing of terrorism risk it might face but must be undertaken at least once per year every two years as a minimum.

The purpose of such review is to assess:

• the effectiveness of the Policy with regard to the money laundering or financing of terrorism risk of the Company;
• whether the Policy has been effectively implemented; and,
• whether the Company has complied with its Policy.

The results of such a review, including any reports prepared, shall be provided to senior management and the Commission.