AML Policy

1. Introduction and Purpose

This document establishes the Anti-Money Laundering (AML), Counter-Terrorist Financing (CTF), and Sanctions Compliance policies and procedures for Mysti Games Ltd. (the "Organisation"). Its purpose is to set out the Organisation's commitments, responsibilities, and procedures to detect, prevent, and deter the use of its services for financial crime.

This Policy applies to all employees of the Organisation, its Board of Directors, and any third parties acting on its behalf.

2. Definitions

Money Laundering (ML): The process of concealing the origin of illegally obtained proceeds through stages of Placement (introducing illicit funds into the financial system), Layering (separating funds from their source), and Integration (making funds appear legitimate).

Terrorist Financing (TF): The provision or collection of funds, from legitimate or illicit sources, with the intention that they should be used to carry out any act of terrorism.

Customer Due Diligence (CDD): The process of identifying our customers and verifying their identity, understanding the nature of the business relationship, and assessing the ML/TF risks associated with them.

Politically Exposed Person (PEP): An individual who is or has been entrusted with a prominent public function, their immediate family members, and known close associates.

Risk-Based Approach (RBA): The principle of applying financial crime prevention measures that are proportionate to the risks identified.

Source of Funds (SoF): The origin of the particular funds or assets used for a specific transaction.

Source of Wealth (SoW): The origin of a customer's overall wealth, describing the activity that generated their net worth.

Sanctions: Restrictive measures imposed by competent authorities, including the United Nations, European Union, United Kingdom, United States, and other applicable authorities, prohibiting or limiting dealings with certain persons, entities, jurisdictions, or activities.

3. Policy Statement and Objectives

Mysti Games Ltd. has a zero-tolerance appetite for financial crime. We are committed to conducting our business with the highest standards of integrity and in compliance with all applicable laws, regulations, licensing conditions, and sanctions obligations.

The primary objectives of this Policy are:

To prevent the Organisation's services from being used to facilitate ML, TF, sanctions violations, fraud, or any other financial crime.

To identify, assess, and mitigate financial crime risks through a comprehensive and dynamic Risk-Based Approach.

To ensure all staff are aware of their legal and regulatory obligations and are trained to identify and report suspicious activity.

To meet all applicable obligations for customer due diligence, reporting, monitoring, and record-keeping.

To protect the reputation of the Organisation and the integrity of its licensing position.

4. Governance and Responsibilities

4.1. The Board of Directors

The Board of Directors holds ultimate responsibility for the Organisation's AML/CFT framework. Their duties include:

Approving the Organisation's policies and procedures for the prevention of ML/TF and sanctions violations.

Appointing a qualified Money Laundering Reporting Officer (MLRO).

Ensuring the MLRO has sufficient resources, authority, and independence to perform their duties effectively and has full access to all necessary information.

Reviewing the effectiveness of the AML/CFT framework and any regular AML reports from the MLRO, taking appropriate measures to address any deficiencies.

Ensuring the Organisation's AML/CFT framework is subject to periodic independent review to assess its effectiveness and implementation, with findings reported to the Board for action.

4.2. The Money Laundering Reporting Officer (MLRO)

The Organisation has appointed an MLRO with the authority and expertise to carry out the role. The MLRO's duties include:

Drafting, maintaining, and overseeing the implementation of this Policy and associated controls.

Monitoring the effectiveness and implementation of the Organisation's AML/CFT framework.

Advising the Board and employees on all matters relating to financial crime prevention.

Providing and overseeing necessary training to all staff on AML/CFT and sanctions compliance.

Maintaining a Business-Wide Risk Assessment, reviewed periodically, which evaluates the inherent risks to the Organisation.

Receiving, evaluating, and investigating all internal reports of suspicious activity.

Making external suspicious activity reports to the relevant authority where required.

Preparing regular AML reports for the Board of Directors.

4.3. All Employees

All employees have a personal responsibility to be vigilant against financial crime. They must:

Read, understand, and adhere to this Policy.

Promptly report any knowledge or suspicion of financial crime to the MLRO.

Refrain from "tipping off" any customer that they are the subject of a suspicion or report.

Complete all mandatory compliance training.

Failure to comply with these obligations may result in disciplinary action.

5. The Risk-Based Approach (RBA)

The Organisation's AML/CFT framework is built upon a formal, documented, and dynamic Risk-Based Approach.

5.1. Business-Wide Risk Assessment

The Organisation considers, among other things:

Customer risk;

Jurisdictional risk;

Product risk;

Payment, wallet, and delivery channel risk;

Transactional and behavioural risk.

5.2. Customer Risk Categorisation

The Organisation applies a dynamic Customer Risk Assessment to every customer. Based on this assessment, each customer is categorised according to their risk profile. This risk rating determines the level of due diligence and ongoing monitoring applied.

High ML/TF Risk

A customer may be classified as High Risk if one or more of the following indicators are present:

The customer is identified as a Politically Exposed Person, or is a known family member or close associate of a PEP.

The customer is a resident of, located in, or transacting from a jurisdiction subject to sanctions, restrictions, prohibitions, or enhanced due diligence requirements under applicable law, regulation, licensing requirements, or the Organisation's internal compliance framework.

The customer's activity involves high-value transactions, unusual transactional behaviour, or patterns indicative of higher risk.

The customer uses payment methods, crypto-wallets, or transaction patterns that raise heightened AML/CFT concerns.

The customer is otherwise determined by the AML/Compliance Department to present elevated risk due to other identified factors.

Medium ML/TF Risk

A customer may be classified as Medium Risk where:

The customer has completed the required CDD process;

The customer does not fall into the High Risk category; and

The customer requires a standard level of ongoing monitoring based on the Organisation's risk assessment.

Low ML/TF Risk

A customer may be classified as Low Risk where:

The customer is not associated with high-risk or prohibited jurisdictions;

The customer's activity is consistent with a low-risk profile;

The origin and destination of the customer's funds or crypto-assets do not indicate elevated risk; and

The customer uses standard and reasonably traceable payment methods or wallet activity acceptable to the Organisation.

The risk categorisation is recorded in the customer's profile and is subject to periodic and event-driven review as part of the Organisation's ongoing monitoring process.

6. Customer Due Diligence (CDD) / Know Your Customer (KYC)

6.1. When to Apply CDD

CDD measures are applied at the following times:

When establishing a business relationship;

When a suspicion of ML/TF, sanctions exposure, fraud, or other financial crime arises;

When there are doubts about the veracity or adequacy of previously obtained identification data;

When otherwise required by applicable law, regulation, licensing requirements, or the Organisation's internal risk procedures.

The Organisation will establish or continue a business relationship only after taking appropriate steps to:

Identify the customer and verify their identity using information or documentation considered reliable and appropriate in the circumstances;

Determine the purpose and intended nature of the business relationship;

Assess the ML/TF risk of the customer and allocate the customer to an appropriate risk category;

Apply appropriate CDD or EDD measures; and

Screen relevant persons, payment details, and wallet information against applicable sanctions and risk controls.

6.2. Standard KYC Procedures

At registration or during the onboarding and verification process, we may collect the following information from the customer, as applicable:

Full name;

Date of birth / age;

Full residential address;

Email address;

Technical and electronic footprint data, including IP address, device identifiers, internet cookies, and related usage data;

Information on the purpose and intended nature of the business relationship;

Payment method information and, where relevant, crypto-wallet information, including wallet addresses used to deposit or withdraw.

Following the collection of information, the Organisation may verify the identity and address of its customers using reliable, independent documents and/or electronic verification sources provided by internal systems or third-party service providers. Standard verification may require:

Proof of identity, such as a valid government-issued photo ID;

Proof of address, such as a recent utility bill, bank statement, or other reliable evidence of address;

PEP screening;

Sanctions screening;

Verification of ownership or control of the relevant payment method or crypto-wallet, where applicable.

Verification must be completed within the timeframe required by applicable law, regulatory requirements, and the Organisation's internal risk procedures. No withdrawal will be permitted until CDD has been successfully completed to the Organisation's satisfaction.

The Organisation reserves the right to request additional information or documentation at any stage of the customer relationship.

7. Enhanced Due Diligence (EDD)

Enhanced Due Diligence (EDD) is a more intensive level of customer scrutiny applied when a customer is assessed as presenting a higher risk of money laundering, terrorist financing, sanctions exposure, fraud, or other financial crime. The application of EDD is a mandatory component of the Organisation's risk-based approach.

EDD may be applied in any of the following situations:

A business relationship with a Politically Exposed Person, their immediate family members, or known close associates.

Transactions involving a customer from, or linked to, a jurisdiction designated as high-risk, restricted, or sanctioned under the Organisation's jurisdictional risk framework.

Any transaction or pattern of transactions that is complex, unusually large, or otherwise unusual and appears to have no apparent economic or lawful purpose.

Any instance where a suspicion of ML/TF, sanctions evasion, or other financial crime arises.

Significant doubts emerge regarding the validity, authenticity, or adequacy of identity documents previously supplied by the customer.

Discovery of significant adverse media related to financial crime, fraud, corruption, or sanctions.

The customer attempts to use fake, stolen, altered, or fraudulent identity documents.

The customer's activity involves elevated crypto-asset risk indicators, including suspicious wallet exposure, use of anonymity-enhancing services, or unusual blockchain patterns.

When EDD is triggered, the Organisation may take further steps to manage and mitigate the identified risks. These measures may include, but are not limited to, the following:

Establishing Source of Wealth and Source of Funds by obtaining a credible explanation and supporting documentation regarding the customer's overall wealth and the specific funds or crypto-assets being used.

Verifying ownership or control of payment methods, bank accounts, and wallet addresses used by the customer.

Conducting enhanced scrutiny and monitoring of the customer's account and transactional activity.

Requiring further documentation or explanations concerning the customer's employment, occupation, business activities, or expected use of the account.

Obtaining senior management approval for the establishment or continuation of a high-risk business relationship.

Applying additional restrictions, suspending account activity, delaying or refusing withdrawals, or terminating the relationship where appropriate.

8. Sanctions Compliance

The Organisation maintains a zero-tolerance policy towards sanctions violations and is prohibited from conducting business with any individual, entity, wallet, or jurisdiction subject to applicable sanctions regimes, including but not limited to those issued by the United Nations, European Union, United Kingdom, and the United States, as well as any other sanctions regimes applicable to the Organisation.

To support compliance, the Organisation has implemented screening and control measures, including the following:

New customers may be screened against applicable sanctions lists and other relevant databases during onboarding and before being permitted to access certain services.

The customer base may be re-screened periodically and on an event-driven basis to identify any changes in sanctions status or risk exposure.

Payment methods, wallet addresses, and associated blockchain activity may be screened where relevant and available.

Customers from restricted, prohibited, or otherwise unacceptable jurisdictions may be blocked, rejected, or subject to additional due diligence.

The Organisation follows a documented procedure upon the detection of a potential sanctions match.

Upon detection of a potential match, an alert is generated and escalated to the AML Department for investigation.

The MLRO or designated compliance personnel will promptly investigate to determine whether the potential match is a true match or a false positive.

If a match is confirmed, the Organisation may immediately freeze or restrict the customer's account and any funds or crypto-assets held within it, block the customer from conducting further transactions or gameplay, and report the matter to the relevant authority where required.

Under no circumstances will any employee "tip off" a customer by informing them that they are the subject of a sanctions report or ongoing investigation.

A restricted or frozen account will only be released or otherwise dealt with in accordance with applicable law, regulatory requirements, and any relevant authority instructions.

9. Ongoing Monitoring

The Organisation's duty to manage and mitigate financial crime risk does not end upon the completion of initial customer due diligence. We have implemented a system of ongoing monitoring for customers to detect and prevent financial crime throughout the business relationship. This monitoring is conducted on a risk-sensitive basis.

9.1. Transaction Monitoring

The AML Department monitors customer accounts and transactions to identify activity that is unusual, inconsistent with the customer's known profile, or otherwise indicative of potential money laundering, terrorist financing, sanctions evasion, fraud, or other criminal conduct.

Monitoring may include automated and manual reviews based on pre-defined rules, scenarios, alerts, and risk indicators. These may include, but are not limited to:

Significant or rapid changes in the level, value, or nature of transaction activity;

Transactions that exceed internal velocity, value, or risk thresholds;

Use of multiple payment methods, accounts, or wallets in a suspicious manner;

Deposits followed by withdrawal requests with minimal or no meaningful gameplay;

Patterns of activity associated with known laundering methodologies or fraud typologies;

Activity inconsistent with the customer's stated purpose, profile, or affordability indicators;

Wallet exposure to high-risk services, illicit activity indicators, or sanctioned entities;

Attempts to use mixers, tumblers, chain-hopping, anonymising services, or other techniques designed to obscure the source or destination of crypto-assets;

Attempts to circumvent jurisdictional restrictions, device controls, or account limitations.

The Organisation also monitors for linked accounts or related activity that may indicate multi-accounting, account misuse, or attempts to circumvent controls. Where such links are identified, the Organisation may review customer activity on a consolidated basis.

9.2. Periodic Review of Customer Due Diligence

Customer information and risk assessments are reviewed and refreshed on a periodic basis to ensure they remain accurate and up to date. The frequency and depth of these reviews are determined by the customer's risk rating, applicable legal and regulatory requirements, and the Organisation's internal procedures.

A review may include refreshing CDD information, re-screening against relevant databases, reassessing the customer's risk profile, and reviewing recent transactional and behavioural activity.

9.3. Event-Driven Reviews

In addition to periodic reviews, a full or partial refresh of customer due diligence may be triggered by certain events, including but not limited to:

The identification of a high-risk factor or red flag during ongoing monitoring;

A material change to the customer's account profile, activity, or circumstances;

A significant change in transactional behaviour;

A new wallet address, payment method, or destination being used;

The receipt of information from external sources, service providers, regulators, or law enforcement that affects the customer's risk profile.

10. Reporting Suspicious Activity

The Organisation is committed to fulfilling its legal obligation to report any knowledge or suspicion of money laundering, terrorist financing, sanctions breaches, or other suspicious activity to the relevant authorities where required. We maintain a clear process for internal escalation and external reporting.

10.1. Internal Reporting

All employees have a personal and legal responsibility to report any activity they suspect may be related to financial crime.

Any employee who becomes suspicious of a customer's activity must immediately report their concerns to the MLRO.

Reports should be made using the Organisation's internal reporting procedures and should include the customer information, nature of the activity, and reasons for the suspicion.

At no point should the employee alert or "tip off" the customer or any other person that a suspicion has been raised or that a report is being made.

10.2. MLRO Investigation and External Reporting

The MLRO is responsible for receiving and evaluating all internal suspicious activity reports.

The MLRO will investigate the matter using available information to determine whether the suspicion is substantiated.

The MLRO will document the outcome of every investigation, including the reasons for dismissing or escalating the matter.

If the MLRO concludes that there are reasonable grounds to know or suspect that a customer is engaged in money laundering, terrorist financing, sanctions evasion, or other relevant criminal conduct, the Organisation will file an external report with the relevant authority in accordance with applicable law and regulatory requirements.

After filing such a report, the Organisation will cooperate fully with any subsequent investigation and will adhere to any lawful instructions received, including instructions relating to monitoring, restriction, retention, or freezing of funds or crypto-assets.

11. Anti-Bribery and Corruption (ABC) Policy

The Organisation has a zero-tolerance approach to bribery and corruption and is committed to conducting its business professionally, ethically, and with integrity. This policy applies to all employees, directors, agents, consultants, and other third parties acting on behalf of the Organisation.

11.1. Prohibited Activities

Bribery is the act of offering, promising, giving, accepting, or soliciting an advantage as an inducement for an action that is illegal, unethical, or a breach of trust. It is strictly prohibited for any person associated with the Organisation to engage in such activities.

This prohibition includes, but is not limited to:

Bribes: Offering or accepting money, gifts, or other inducements to or from any person, including public officials, to gain a commercial, contractual, or regulatory advantage.

Facilitation Payments: Making unofficial payments to secure or expedite a routine government action. Such payments are considered bribes and are strictly prohibited.

Kickbacks: The return of a sum of money or other benefit as a reward or incentive for making a particular business arrangement.

11.2. Gifts and Hospitality

The Organisation understands that the normal and appropriate exchange of business gifts and hospitality may occur in the ordinary course of business. However, such exchanges must be transparent, proportionate, lawful, and not intended to influence a business decision or create a sense of obligation.

Employees must not accept or offer gifts or hospitality of any kind if they could reasonably be perceived as influencing a business outcome.

Offers or receipts of gifts or hospitality above internally permitted levels must be declared and recorded in accordance with internal procedures.

Any offer that seems unusual, excessive, or suspicious must be refused and reported immediately.

11.3. Reporting Concerns

Any employee who is concerned about a potential breach of this policy, or who has been offered a bribe or witnessed suspicious activity, has a duty to report it immediately. Concerns may be reported directly to the MLRO or through the Organisation's confidential reporting channels. The Organisation will not tolerate retaliation against any employee who raises a concern in good faith.

12. Anti-Fraud Policy

The Organisation is committed to protecting its customers and its operations from fraudulent activity. We employ a multi-layered, technology-driven strategy to detect and prevent various forms of fraud common to the remote gaming industry.

12.1. Key Fraud Risks

Our anti-fraud systems and procedures are designed to mitigate risks including, but not limited to:

Payment fraud;

Identity fraud;

Account takeover;

Bonus abuse;

Collusion and chip dumping;

Multi-accounting and ban evasion;

Use of stolen, compromised, or unauthorised payment methods or wallet credentials.

12.2. Fraud Prevention Systems and Controls

The Organisation utilises a combination of internal controls and third-party systems to create a robust fraud prevention environment.

Payment system controls: We work with payment and service providers to implement transaction security and fraud detection features.

Jurisdictional and IP controls: We use technical and operational measures to enforce jurisdictional restrictions and detect the use of VPNs, proxies, and other anonymising technologies where prohibited.

Behavioural and device monitoring: Our systems analyse device information and behavioural patterns to detect anomalies that may signal account takeover, account sharing, or the use of multiple accounts by a single individual.

Game integrity monitoring: We monitor for patterns of play indicative of collusion, abuse, unfair advantage, or illicit fund transfers.

Wallet and blockchain monitoring: Where crypto-assets are used, we may monitor wallet activity, ownership indicators, and blockchain risk signals to detect suspicious conduct.

12.3. Procedure for Handling Suspected Fraud

When fraudulent activity is suspected, the Organisation may take immediate action, including:

Suspending the relevant customer account pending investigation;

Cancelling pending withdrawals;

Voiding winnings, bonuses, or transactions in accordance with the Terms and Conditions;

Permanently closing the account and blocking future access if fraud is confirmed;

Escalating the matter to the MLRO where the conduct may also give rise to suspicion of money laundering, terrorist financing, or other criminal activity.

13. Record Keeping

The Organisation is committed to maintaining complete and accurate records of activities related to this Policy. Record keeping is essential for demonstrating compliance with legal and regulatory obligations, assisting with investigations, and ensuring a clear audit trail.

13.1. Records to Be Retained

We retain records necessary to provide a complete picture of each customer relationship and our compliance activities. These records may include, but are not limited to:

CDD and EDD records:

Copies of identification and verification documents obtained;

Information gathered at registration or during onboarding;

Records of risk assessments conducted on the customer;

SoF and SoW documentation obtained;

Correspondence with the customer related to due diligence.

Transactional records: A history of deposits, withdrawals, gameplay activity, and other relevant account activity.

Financial crime and compliance records:

Internal suspicious activity reports and investigation outcomes;

External reports filed with competent authorities where required;

Sanctions screening results;

Employee AML/CFT training records.

All records related to this Policy will be retained for the period required by applicable law, regulation, and licensing requirements. Records will be maintained securely in a format that allows timely retrieval and production to competent authorities where required.

14. Staff Training and Vetting

All employees of the Organisation are required to complete mandatory training on their financial crime prevention obligations. The MLRO is responsible for overseeing the training programme.

The programme includes:

Induction training: New employees must complete AML/CFT training as part of their onboarding process before being given access to relevant systems or responsibilities.

Refresher training: Employees must complete periodic refresher training to reinforce key concepts and address regulatory updates, emerging risks, and internal policy changes.

Role-specific training: Employees in higher-risk or specialist roles may receive additional training tailored to their responsibilities.

Assessments and records: Training completion and, where applicable, assessments are recorded and maintained by the Organisation.

14.2. Employee Vetting

The Organisation conducts pre-employment screening on prospective hires to ensure they are fit and proper for their role and to mitigate the risk of internal fraud or collusion. Screening is proportionate to the risk of the role and may include:

Identity verification;

Verification of references;

Criminal record checks, where legally permissible and appropriate for the role.

Ongoing screening may be conducted for employees in particularly sensitive positions. Any employee who fails to comply with the Organisation's financial crime policies and procedures may be subject to disciplinary action, up to and including dismissal.

Appendix A: Key Financial Crime Red Flags

This is a non-exhaustive list of potential warning signs that must be escalated internally:

A customer is reluctant to provide CDD information or provides unusual, altered, or suspicious identification documents.

Large volumes of transactions or transactions inconsistent with the customer's usual activity or profile.

The business relationship appears unusually short, artificial, or limited to isolated funding and withdrawal behaviour.

Instructions for payment or withdrawal to an unrelated third party or unexplained destination.

Use of multiple accounts, multiple wallets, or attempts to register multiple accounts.

Unexplained inconsistencies arising during customer identification and verification.

Attempts to deposit through one payment method or wallet and withdraw through another without a credible explanation.

Use of mixers, tumblers, anonymity-enhancing tools, or wallet behaviour suggesting an effort to obscure origin or destination of funds.

Evidence of attempts to circumvent sanctions, geolocation controls, or jurisdictional restrictions.

Activity suggesting fraud, account takeover, collusion, or other abuse of the platform.

Appendix B: Jurisdictional Risk Framework

The Organisation maintains a jurisdictional risk framework based on applicable law, sanctions obligations, licensing requirements, regulatory guidance, and internal risk assessments.

1. Restricted or Prohibited Jurisdictions

The Organisation may prohibit or refuse services to persons located in, resident in, or otherwise connected to jurisdictions that are restricted or prohibited under applicable law, sanctions regimes, licensing conditions, or the Organisation's internal compliance standards. The applicable restrictions may be set out in the Organisation's Terms and Conditions and may be updated from time to time.

2. Jurisdictions Subject to Enhanced Due Diligence

Customers connected to jurisdictions that present elevated AML/CFT, sanctions, fraud, or regulatory risk may be automatically classified as higher risk and made subject to Enhanced Due Diligence and increased monitoring. The scope of such jurisdictions is determined by the Organisation's internal compliance framework and may be updated from time to time.