AML/CFT Policy

AML/CFT Policy

Lottorbit · Version 1.0

1. Introduction and Purpose

1.1. This Anti-Money Laundering and Counter Terrorist Financing Policy ("Policy") sets out how Lottorbit ("we", "us", "the Company") identifies, assesses, and mitigates the risks of money laundering, terrorist financing, and proliferation financing ("ML/TF/PF") arising from our remote gaming operations.

1.2. This Policy is prepared in accordance with the Regulations Concerning Anti-Money Laundering and Counter Terrorism Financing ("the Regulations") and the AML Code of Practice for Remote Gaming License Holders, Version 3.0 ("the AML Code"), both issued by the Tobique Gaming Commission ("Commission") pursuant to Section 22 of the Tobique Gaming Act 2023 ("Gaming Act"), and reflects the international standards of the Financial Action Task Force ("FATF").

1.3. Lottorbit is currently in the process to be licensed and regulated by the Tobique Gaming Commission. Compliance with the Regulations and the AML Code is a condition of our licence requirements.

1.4. This Policy, together with our risk assessment, forms our AML/CFT Program. It is reviewed at least annually, and following any material change to our business, products, customer base, or the applicable regulatory framework.

2. Risk-Based Approach

2.1. We apply a risk-based approach to the identification, assessment, and management of ML/TF/PF risk, applying resources and control measures proportionate to the risks we identify, and to the size and nature of our business.

2.2. We understand that money laundering in the remote gaming sector typically occurs through disguise (misrepresenting the source of illicit funds), conversion (turning 'dirty' money into apparently legitimate winnings), or disposal (spending or receiving illicit funds through play, including the deliberate loss of a deposit). We design our controls with these three risk patterns in mind.

3. Risk Assessment

3.1. We maintain a written risk assessment identifying and assessing the ML/TF/PF risks to which our business may be subject, taking into account:

• our customers;
• the countries or geographic areas in which our customers reside or operate;
• our products and services;
• our payments and transactions;
• our operational set-up and delivery channels; and
• any third parties that provide services to our business.

3.2. Our risk assessment is kept under regular review, and a written record of all steps taken in preparing and reviewing it is maintained and made available to the Commission on request.

4. Policies, Controls, and Procedures

4.1. We maintain policies, controls, and procedures to manage and mitigate the risks identified in our risk assessment, covering risk management practices, internal controls, customer due diligence, record-keeping, and the monitoring and internal communication of compliance with these measures. These are approved by our board or governing body and subject to their ongoing oversight.

4.2. Our policies, controls, and procedures provide for the identification and scrutiny of any transaction that is complex, unusually large, follows an unusual pattern, or has no apparent economic or legal purpose, and of any new product, business practice, delivery mechanism, or technology we adopt, so that ML/TF/PF risks are assessed and mitigated before and during adoption.

4.3. Any employee who knows or suspects that a person is engaged in money laundering or terrorist financing is required to report this internally without delay, in accordance with Clause 12 below.

5. Compliance Governance

5.1. We have appointed a member of senior management to take ownership of implementing, managing, and overseeing our AML/CFT measures, with Board-level accountability. This Nominated Senior Manager has appointed a Money Laundering Reporting Officer ("MLRO") to take ownership of the day-to-day management of our ML/TF risk.

Appointed MLRO - Thomas Annand

Contact - thomasannand90@gmail.com

5.2. Our MLRO has sufficient AML/CFT knowledge, experience, and autonomy to discharge these responsibilities effectively, including specific knowledge of ML/TF risks in the remote gaming sector. The existence of the MLRO does not exonerate other senior executives from liability for allowing money laundering to occur.

5.3. We maintain clear governance processes for escalating accounts that raise AML concerns, including a properly constituted forum (which may be combined with our responsible gaming review process) comprising senior managers and the MLRO, with minutes and formal assessment records kept for each case.

5.4. Our Board receives at least an annual report on AML/CFT activities, including an updated risk assessment and a report on escalated cases, with more frequent reporting where events require it.

6. Reliance on Agents or Third Parties

6.1. Where we use agents or third parties to perform elements of customer due diligence, or rely on third-party databases or information services, we remain fully responsible for the outcome of that process. We assess whether each third party is suitable and has adequate controls in place, ensure that identification records will be made available to us without delay on request, and clearly define our respective obligations and responsibilities.

7. Training

7.1. All staff receive AML/CFT training appropriate to their role, covering: the risks of money laundering and terrorist financing relevant to our business and applicable legislation; our risk assessment methodology and mitigating controls; the identification of potentially suspicious transactions; and red flags and indicators specific to the remote gaming sector.

7.2. Each attendee must pass an assessment following training, with a minimum score of 75%. Attendees who do not achieve this score must re-sit the assessment and/or repeat the training.

7.3. All staff attend refresher training annually, on the anniversary of their initial training, covering any changes to relevant regulations, policies, or procedures. Training records are maintained for all staff.

8. Employee Due Diligence

8.1. We apply risk-based screening to prospective employees who may be in a position to facilitate money laundering or terrorist financing if employed, with re-screening where an employee is transferred or promoted into such a position. We maintain a system to manage any employee who fails, without reasonable excuse, to comply with our AML/CFT systems, controls, or procedures.

9. Independent Review

9.1. Our AML/CFT Program is subject to regular, independent, and, where appropriate, external review, at least once every two years, to assess its effectiveness, whether it has been properly implemented, and whether we have complied with it. Results are reported to senior management, our governing body, and the Commission.

10. Customer Due Diligence

10.1 When CDD Is Applied

10.1.1. Customer due diligence ("CDD") begins at account opening, when a Customer registers and accepts our Terms and Conditions. Verification of identity and other appropriate CDD measures must be completed within 30 days of the Customer's first deposit, or before the Customer wagers more than the equivalent of EUR 2,000 of their own funds (as opposed to recycled winnings), and in any event before any money is paid out.

10.1.2. CDD is also applied when carrying out an occasional transaction, where there is a suspicion of money laundering or terrorist financing, and where there is doubt about the veracity or adequacy of previously obtained customer identification data.

10.2 Initial Customer Due Diligence

10.2.1. Initial CDD comprises: identification via the registration process and verification of the Customer's identity using reliable independent or primary source documents, such as government-issued photo identification, or appropriate electronic ID&V software; gathering of supporting information, including date of birth and residential address; and standard screening checks.

10.2.2. Every Customer is screened against industry-standard databases to identify Politically Exposed Persons, sanctions matches, and adverse media. This screening begins at registration and concludes no later than the point of verification.

10.2.3. A Customer who is a sanctions match must not be permitted to deposit or play, and any Customer found to infringe international sanctions legislation must be immediately barred from further play. An Account with a PEP hit is frozen pending Enhanced Due Diligence and a PEP risk assessment. Adverse media identified in relation to a Customer is put through a risk assessment and, where applicable, a mitigation process.

10.2.4. Where a screening result is deemed relevant and material, it is run through our risk mitigation process, and may require Enhanced Due Diligence measures.

10.2.5. The company currently uses Sumsub as a means to assist with electronic ID & Verification and PEP, Sanctions and adverse media screening.

11. Enhanced Due Diligence

11.1. We perform Enhanced Due Diligence ("EDD") on Customers risk-rated as High or otherwise associated with red flags or high-risk factors. EDD measures may include: obtaining additional identity verification, including certified identity documents; obtaining information on the Customer's source of funds and/or source of wealth; enhanced screening using a second search engine or data provider; senior management and MLRO approval for establishing or continuing the relationship; and enhanced ongoing monitoring.

11.2. EDD is applied where: there is a change in the Customer's risk assessment; there is suspicion regarding the Customer's true identity; transactions are inconsistent with the Customer's usual activity; there is suspicion of money laundering or terrorist financing; or there are doubts about the veracity or adequacy of previously obtained identification data.

11.3. The following are treated as red flags or high-risk factors that may necessitate EDD:

• association with a High Risk Country or Jurisdiction, or a jurisdiction on the FATF grey list;
• use of faked or stolen identification documents;
• a Customer previously excluded for problem gambling who has bypassed blocking measures to resume play;
• use of high-risk payment methods, such as prepaid cards or cryptocurrency;
• significant or material adverse media relating to financial crime or other serious or reputationally damaging conduct;
• identification of the Customer as a Politically Exposed Person;
• an indirect link to a sanctioned individual, entity, or country; and
• transactional activity of high value or high volume, particularly where it exceeds the Customer's estimated affordability.

11.4. We are alert to the wider red flags of money laundering identified in the AML Code, including: losses inconsistent with a Customer's known profile or financial means; unexplained spikes in play; a Customer's avoidance of personal contact; provision of false or implausible information; inconsistent personal information; withdrawal patterns inconsistent with actual play; deposits from corporate cards or accounts; problem gambling behaviour suggestive of financing an addiction from stolen funds; and low-risk or minimal play consistent with attempted fund recycling.

11.5. Cryptocurrency deposits and withdrawals are treated as a high-risk payment method for the purposes of this Clause and are subject to the additional safeguards set out in our Cryptocurrency Policy, in addition to the EDD measures in this Clause.

12. Politically Exposed Persons

12.1. A Politically Exposed Person ("PEP") is a natural person who is or has been entrusted with a prominent public function, together with their immediate family members and close associates, as further defined in the Regulations. PEP status is not itself a suggestion of wrongdoing; it requires heightened vigilance given the elevated corruption risk associated with prominent public positions.

12.2. PEPs are subject to Enhanced Due Diligence and ongoing monitoring. Our Board must sign off on any PEP relationship before play is permitted, and this approval is documented together with a risk mitigation statement.

12.3. Following a PEP's departure from their public function, we continue to consider and apply appropriate measures to the residual risk they present for at least 12 months, until we are satisfied they no longer pose an elevated risk.

13. Country Risk

13.1. We do not do business with any entity or individual subject to EU, UN, UK, US, or other applicable international sanctions, or with related parties appearing on the FATF blacklist; this is outside our risk appetite.

13.2. We do not permit Customers to access our Services from any jurisdiction on our banned country list, and we apply Enhanced Due Diligence to any Customer or related party associated with a jurisdiction on the FATF grey list or otherwise designated as high-risk. Our current country risk classifications are maintained as a schedule to this Policy.

13.3. Our current list of banned countries includes but is not limited to Afghanistan, Canadian Province of New Brunswick, China, Cuba, Central African Republic, Democratic Republic of Congo, Haiti, Iran, Iraq, Israel, Libya, Myanmar, N. Korea, Russia, Somalia, South Sudan, Syria, UK, USA, Yemen and Venezuela.

14. Ongoing Monitoring

14.1. Customers are subject to ongoing monitoring for the duration of the relationship, not only at onboarding. This includes regular re-screening against PEP, sanctions, and adverse media databases, and transaction monitoring comparing the frequency, volume, and value of a Customer's activity against their expected profile. Unusual activity is investigated and, where potentially suspicious, escalated to the MLRO as a Suspicious Activity Report.

14.2. We identify and monitor linked accounts belonging to the same Customer, so that activity across all such accounts is assessed together rather than in isolation.

15. Periodic and Event-Driven Reviews

15.1. We conduct periodic reviews of Customer due diligence and risk assessments, at a frequency commensurate with the ML/TF risk each Customer presents, refreshing KYC information, screening results, and transactional profiles.

15.2. An Event-Driven Review — a full refresh of KYC, CDD, and risk assessment — is triggered by the identification of a high-risk factor or red flag during screening or monitoring, including unusually large or frequent bets, or bets placed at unusual times or around particular events.

16. Record-Keeping

16.1. We keep all records obtained through customer due diligence, including copies of official identification documents, account files, and business correspondence, for at least five years after the business relationship ends or after the date of an occasional transaction.

16.2. We maintain records of originator/payer and beneficiary/payee information for wire transfers, electronic fund transfers, and other electronic payments, and will provide a copy of all such records to the Commission on request, including if we relocate or cease business.

17. Reporting of Suspicious Matters

17.1. We lodge a Suspicious Activity Report ("SAR") with the Commission where we suspect on reasonable grounds that: a Customer is not who they claim to be; the provision of our Services is related to money laundering, terrorist financing, or another criminal offence; or a transaction does not appear to have a lawful economic purpose.

17.2. A SAR concerning suspected money laundering or another criminal offence is lodged within 5 business days of the suspicion being formed. A SAR concerning suspected terrorist financing is lodged within 24 hours. Every SAR states the grounds for the suspicion, and we document our reasoning for any decision to submit, or not submit, a SAR.

17.3. Where we have formed a reasonable suspicion, lodged a SAR, or provided information to the Commission under this Clause, neither we nor any employee or associated person may disclose to anyone other than the Commission that the suspicion was formed, the report was lodged, or the information was provided.

18. Financial Sanctions

18.1. We comply with United Nations Security Council resolutions relating to the prevention and suppression of terrorism, terrorist financing, and the proliferation of weapons of mass destruction. We freeze without delay the funds or assets of, and ensure no funds or assets are made available to or for the benefit of, any person or entity designated under the relevant UN Security Council resolutions.

19. Confidentiality

19.1. All information received from or about us by the Commission under the Regulations is treated as confidential, and may only be disclosed as permitted under the Regulations. This does not prevent the exchange of information between us, the Commission, and law enforcement or regulatory agencies as contemplated by the Regulations.

20. Directions and Amendment

20.1. The Commission, or a Direct Licensee acting with the Commission's approval, may direct us to adopt additional measures, including not entering into or terminating a business relationship with a specified person or class of persons, not undertaking specified transactions, or ceasing operations in a particular jurisdiction. We will comply with any such direction.

20.2. This Policy may be amended at any time, including by resolution of the Commission. We will implement any resulting changes to our AML/CFT Program within the timeframe required by the Commission.