1. Introduction and Purpose

3-102-950476 LIMITADA ("the Company") is committed to preventing money laundering, terrorist financing, fraud, and other financial crimes in accordance with international standards and the regulatory requirements applicable to internet gaming operations licensed in Anjouan.

This Anti-Money Laundering and Know Your Customer (AML/KYC) Policy establishes the framework for:

• Verifying the identity of all customers;
• Assessing and mitigating financial crime risks;
• Monitoring transactions for suspicious activity;
• Ensuring compliance with applicable laws and licensing conditions;
• Protecting the integrity of the Company's gaming platform and its customers.

All employees, contractors, and third-party service providers acting on behalf of 3-102-950476 LIMITADA are required to adhere to this Policy.

2. Regulatory Framework

This Policy is developed in alignment with:

• Applicable laws and regulatory requirements of the Autonomous Island of Anjouan, Union of the Comoros, for internet gaming operations;
• FATF Recommendations on AML/CFT for the Gaming Sector;
• EU AML Directives, where applicable to cross-border operations;
• Licensing conditions and compliance requirements applicable to licences issued under the Anjouan internet gaming licensing framework.

The Company applies a risk-based approach (RBA) to all AML/CFT measures, ensuring resources are focused on higher-risk customers, products, and geographies.

3. Definitions

AML: Anti-Money Laundering — measures to prevent the concealment of illicit funds.

KYC: Know Your Customer — procedures to verify customer identity and assess risk.

CDD: Customer Due Diligence — baseline verification and risk assessment of customers.

EDD: Enhanced Due Diligence — additional measures applied to high-risk customers.

PEP: Politically Exposed Person — individual holding prominent public function, presenting higher corruption risk.

SoF/SoW: Source of Funds / Source of Wealth — documentation explaining origin of gambling funds and overall wealth.

UTR: Unusual Transaction Report — internal report filed when activity raises suspicion.

4. Risk Assessment Framework

3-102-950476 LIMITADA conducts periodic Enterprise-Wide Risk Assessments (EWRA) covering:

• Customer Risk: nationality, residency, occupation, PEP status, adverse media;
• Product/Service Risk: deposit/withdrawal methods, bonus structures, high-limit games;
• Geographic Risk: jurisdictions with weak AML regimes, sanctions exposure;
• Channel Risk: online vs. mobile, third-party payment processors.

Risk ratings (Low / Medium / High) determine the level of due diligence applied.

5. Customer Due Diligence (CDD) — Three Step Verification

All customers must complete the Three Step Verification process. Verification is mandatory regardless of payment method, transaction amount, or customer nationality. No deposits, withdrawals, or gameplay with real funds are permitted until the applicable verification step is successfully completed.

Step One Verification: Mandatory Onboarding

Applicability: All users during registration/onboarding on www.tycoonwin.com.

Requirement: Completion is mandatory before any deposit or withdrawal is permitted.

Process: Customer completes a self-declaration form with the following mandatory fields:

• First Name
• Last Name
• Date of Birth (to confirm minimum legal age of 18+)
• Nationality
• Country of Usual Residence
• Full Residential Address
• Contact Information (Email and Phone Number)
• Payment Information (e.g., bank account or e-wallet details)

Validation: Automated checks verify format, consistency, and basic plausibility. Data is screened against internal blacklists and sanctions/PEP databases.

Step Two Verification: Threshold & Risk-Based

Applicability: Any user depositing or withdrawing ≥ $2,000 USD (or equivalent); any user classified as High-Risk based on risk assessment, including geographic location in high-risk jurisdictions, unusual user activity patterns, PEP status, or adverse media mentions.

Hold Policy: Until Step Two is completed, all withdrawals, tips, and deposits above the threshold are placed on hold.

Process:

• Customer is directed to a secure subpage to submit a valid government-issued ID. Accepted documents include International Passport, National ID Card, and Driver's License, subject to country-specific variations.
• Customer must upload a clear photo of the ID alongside a paperclip displaying a six-digit randomly generated number, to confirm liveness and prevent document reuse.
• Electronic verification performs a dual-database cross-check to confirm that data from Step One matches the ID document and that name and date of birth are consistent across sources.
• If electronic verification fails or is unavailable, the customer must submit government-issued proof of residence, such as certificate of registration, utility bill ≤ 6 months old, or bank statement.

Approval: Manual review by Compliance Team for document authenticity, image quality, and data consistency.

Step Three Verification: High-Value & Enhanced Risk

Applicability: Any user depositing or withdrawing ≥ $10,000 USD (or equivalent); any user classified as High-Risk per risk assessment, including geography, activity, PEP status, or adverse media.

Hold Policy: All transactions remain on hold until Step Three is successfully completed.

Process:

• Customer is requested to provide documentation evidencing Source of Funds (SoF), including explanation and proof of origin of funds used for gambling, such as salary slips, business income statements, sale of assets, or inheritance documentation.
• Customer is requested to provide Source of Wealth (SoW), including broader explanation of how the customer accumulated overall net worth, such as career history, business ownership, or investments.
• Documentation must be recent, typically ≤ 12 months, issued by a verifiable third party such as a bank, employer, or government, and translated into English if not originally in English.
• Compliance Team conducts a proportionality assessment. Requests are tailored to the customer's profile and risk level to avoid over-collection.

Approval: Senior Compliance Officer sign-off required. Case file must include rationale for approval/rejection.

6. Enhanced Due Diligence (EDD)

EDD measures apply automatically when Step Two or Step Three is triggered, or when risk assessment identifies elevated risk. EDD includes:

• Additional identity/address documentation;
• Biometric verification or liveness checks;
• Independent verification of SoF/SoW documents;
• Senior management approval for account activation or high-value transactions;
• Increased transaction monitoring frequency;
• Documentation of ongoing relationship rationale.

For PEPs, EDD is mandatory regardless of transaction value. The Company obtains senior management approval before establishing or continuing a business relationship with a PEP.

7. Ongoing Monitoring

Customer accounts are subject to continuous monitoring based on:

• Transaction velocity, volume, and pattern analysis;
• Deviations from established behavioral profiles;
• Changes in customer risk indicators, such as new adverse media or change of residence;
• Geolocation/IP address anomalies.

Trigger-Based Reviews: Automated alerts prompt manual review when thresholds are breached, such as rapid deposit-withdrawal cycles, use of multiple payment methods, or access from high-risk jurisdictions.

Periodic KYC Refresh: High-risk customers undergo re-verification at least annually; medium-risk every 24 months; low-risk upon material change or every 36 months.

8. Record Keeping

3-102-950476 LIMITADA maintains comprehensive, audit-ready records for a minimum of 5 years after termination of the customer relationship, including:

• Customer identification data and verification documents;
• Transaction history and supporting evidence;
• Risk assessments and due diligence decisions;
• Internal reports (UTRs) and external filings;
• Training logs and policy acknowledgments.

Records are stored securely with access controls, encryption, and backup procedures in compliance with data protection standards.

9. Reporting Obligations

Suspicious Activity: Any employee who suspects money laundering, terrorist financing, or fraud must immediately file an internal Unusual Transaction Report (UTR) with the Compliance Officer.

External Reporting: Where required by applicable Anjouan licensing conditions, applicable law, or competent authority requirements, the Compliance Officer files reports with the relevant authority.

The Company prohibits "tipping off" — customers must not be informed of investigations.

Sanctions Compliance: All customers are screened against UN, EU, and OFAC sanctions lists at onboarding and periodically thereafter. True matches result in immediate account freeze and regulatory reporting.

10. Staff Training and Awareness

• All relevant staff receive AML/KYC training upon hire and annually thereafter;
• Training covers: Policy procedures, red flags, reporting obligations, data protection;
• Compliance Team receives specialized training on emerging typologies and regulatory updates;
• Training attendance and assessment results are documented and retained.

11. Data Protection and Privacy

Customer data collected for AML/KYC purposes is processed in accordance with:

• Applicable data protection laws;
• The Company's Privacy Policy;
• Principles of data minimization, purpose limitation, and secure storage.

Customers are informed of data usage via Privacy Notice at registration. Data is not shared with third parties except as required by law or for essential service provision, such as payment processors under strict contractual safeguards.

12. Policy Governance and Review

• Policy Owner: Chief Compliance Officer (CCO)
• Approval Authority: Board of Directors / Designated Compliance Committee
• Review Frequency: Annual, or immediately upon regulatory changes in Anjouan or key markets, material incidents or audit findings, or introduction of new products or payment methods.

Updates require formal approval and communication to all relevant staff.

13. Contact

Tycoon Casino is owned and operated by 3-102-950476 LIMITADA, registration number: 3-102-950476, registered address: Provincia de Puntarenas 06, Canton 11, Garabito, Jaco, 61101, Costado Este De La Municipalidad Garabito, Bufete Sanchez Chavarria, Costa Rica. Contact us [email protected].