Money Laundering and Terrorism Financing Prevention Policy

1. General Provisions

Spinlab Management LLC, company number: 4411 LLC 2026, registered at Euro House, Richmond Hill Road, Kingstown, St. Vincent and the Grenadines (the "Company") confirms the Money Laundering and Terrorist Financing Prevention Policy (the "Policy").

The Company's main business is to provide online gaming (gambling) services.

This Policy applies to the Company in cases when the Company's customers seek to establish a business relationship with the Company, as well as to implement ongoing monitoring of Company's customers' business behavior and is applied to ensure safety and transparency of both customers and Company's funds. Employees of the Company whose responsibilities are related to prevention of money laundering and terrorist financing or outsourced service providers are responsible for the implementation of this Policy.

Company's customers - natural persons who in order to become a customer of the Company apply for the creation of an account on the Company's website or app (the "Customer").

The Company provides services that support both fiat and virtual currency deposits and withdrawals, all processed under strict KYC and AML standards.

The Company's Policy is designed to be compliant with applicable legislation, regulations and directives which include but not limited to, among others, and with the following:

Directive 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering.
EU Regulation 2015/847 on information accompanying the transfer of funds.
Various EU Regulations imposing sanctions or restrictive measures against persons and embargo on certain goods and technology, including all dual-use goods.
European Business Law of 18 September 2017 on the prevention of money laundering limitation of the use of cash.
FATF Recommendations for International Standards on combating Money Laundering and the financing of terrorism and proliferation (AML/CFT).

2. Risk-Based Approach

The nature of the services provided by the Company poses a significant risk of money laundering and/or terrorist financing, therefore the Company's Customers also pose a risk to be involved in money laundering and/or terrorist financing activities or may use the Company as tool for money laundering and/or terrorist financing.

Due to the risks indicated above, the Company based on the identity of the Customer and Customer's risk characteristics specified in this Policy, classifies Customer to one of the following risk categories:

Low Risk Customer
Medium Risk Customer
High Risk Customer

During the process of onboarding the Customer, the Company has to perform identification of the Customer and implement specific measures (checks) based on which the Customer is classified to one of the risk categories. The risk factors due to which specific measures are implemented are as follows:

The Customer is involved in adverse media, i.e., negative news in the media is linked to the Customer (related with terrorism, financial crimes, violence, narcotics, cybercrime, fraud, etc.);
The Customer is considered as politically exposed person (PEP);
The Customer is listed on a sanctions list (restrictions imposed on individual);
Geographical Customer's location is considered as a high-risk country and jurisdictions under Increased Monitoring as indicated by FATF, Countries subject to EU or Anjouan licensing restrictions or FATF blacklists.

The Customers are classified by default as Low Risk Customer until the moment when the Company implements specific measures (performs checks) and classifies the Customer to each risk category. The Customers shall be classified as follows:

Low Risk Customer - none of the risk factors are applicable to the client;
Medium Risk Customer - the Customer matches no more than one of the risk factors;
High-Risk Customer - the Customer matches at least two of the risk factors.

The Company shall apply respective Enhanced Due Diligence (EDD) measures to Medium Risk Customers. In case the Company decides to not apply Enhanced Due Diligence (EDD) measures to Medium Risk Customers, the Company will notify the Customer regarding the decision not to establish a business relationship.

The Company does not establish a business relationship with the Customer if the Customer is classified as a High-Risk Customer.

3. Identification of the Customer - Establishment of Business Relationship

The identity of the Customer (beneficial owner) in the Company is established only remotely. Once the Customer has been identified, the identity of the beneficial owner shall be deemed to be identified as well.

By signing up and applying for the account opening in the Company, the Customer fills-in an online application by indicating his/her personal data as follows:

Full name;
Date of birth;
Full address;
Gender;
Contact details (phone number and email address).

For Customer identification purposes, the Company requests from Customers to upload and provide proof of identity documents together with address proof documentation to verify their account when the following conditions are met:

When Customer deposits any amount of funds in his/her account;
When Customer proposes to withdraw funds from the account.

Additionally, the Customer needs to provide a selfie holding a passport or ID.

The Company only considers provided documentation from the Customer suitable if scanned copies and/or good quality photos are provided to the Company.

Uploaded and provided proof of identity and address proof documents are verified and full name is compared. If the full name provided during sign-up matches the name of the provided proof of identity document, the identity of the Customer is verified.

The following identity proof documents are acceptable for verifying identity and address of the Customer:

Copy of national ID card, passport or driving license;
Copy of utility bill (not older than 3 months);
Copy of bank statement (not older than 3 months);
Any other proof document which is requested by the Company on an individual case.

In cases when the Company receives proof of identity and address proof documents from Customers and information/details in the provided identity and address proof documents are different than details in the filled online application form in the sign-up process, the Customer account will be closed and the business relationship terminated. Also, in cases when the Customer is determined to be underaged or is prohibited from participation in gambling, the Company immediately notifies the Customer regarding the decision not to establish a business relationship.

Verification/re-verification is required in the following situations:

When Customer deposits or requests to withdraw above a nominated threshold of EUR 5,000 (equivalent in virtual currency) and more. This can be in one withdrawal, or cumulatively from the time of the first withdrawal. Until the verification is complete, the withdrawal or deposit request will be on hold.
If the address of Customer's first deposit method does not match the address used to register the account.
If there is a change in the pattern of Customer's deposits or withdrawals.
When a name matches, or is similar to that of someone with a history of criminal activity.

Further, when Customer deposits or requests to withdraw EUR 5,000 or more, the Customer needs to declare and submit evidence of their source of wealth (SOW). Until the verification is complete, the withdrawal or deposit request will be on hold.

Examples of SOW include the following:

Ownership of business;
Employment;
Inheritance;
Investment;
Family.

It is critical that the origin and legitimacy of that wealth is clearly understood. If this is not possible, an employee may ask for additional evidence and/or information.

The account will be frozen if the same Customer deposits either this amount at once or by multiple transactions. An automatic email will be sent to the particular customer guiding them through the procedure.

In order to fast track the process, the Customer can upload or email the required documents to the payment team in advance of any request. Account verification will vary according to every individual circumstance. It can take as long as a few days or as little as a few minutes.

4. Risk-Based Evaluation of the Customer

Once the Customer has been identified, the Company shall apply a risk-based approach.

The Company performs the Customer's risk-based evaluation in accordance with the personal data of the Customer indicated in the filled online application and provided documents and implements specific measures (performs checks) in order to find out if the Customer meets the risk factors.

Risk-based evaluation of the Customer is performed by using publicly available information/tools and other reliable and independent sources or service providers.

All data of the Customer collected during the stage of risk-based evaluation shall be recorded and stored.

In case none of the risk factors apply to the Customer (meaning the Customer is classified as Low-Risk Customer), the Company decides to establish a business relationship with the Customer. Following the decision, the Company continues to perform ongoing due diligence of the Customer, periodic reviews of the relevance of the data, and notifies the Supervisory authority about unusual/suspicious activity.

5. Enhanced Due Diligence of the Customer

In cases when results of risk-based evaluation indicate that no more than one risk factor applies to the Customer (meaning the Customer was classified as Medium Risk Customer), the Company shall perform Enhanced Due Diligence (EDD) of the Customer.

In cases when at least two of the risk factors apply to the Customer (meaning the Customer was classified as High-Risk Customer), the Company notifies the Customer regarding the decision not to establish a business relationship.

By performing Enhanced Due Diligence (EDD) of the Customer, the Company implements measures to eliminate risk of money laundering and/or terrorist financing as follows:

Obtaining additional information/explanation and/or documents from the Customer;
Obtaining the approval of senior manager of the Company for establishing the business relationship;
Obtaining information and/or documents on the source of funds and source of wealth of the customer;
Any other data/information that employees of the Company consider relevant to eliminate or mitigate the risk.

If the Customer avoids providing the above mentioned explanations/information and/or documents, or if the provided information does not allow to mitigate the risk, the Company notifies the Customer regarding the decision not to establish a business relationship.

In cases when Customer provides requested information and provided information allows to eliminate or mitigate the risk, the Company decides whether to establish or not establish a business relationship with the Customer.

6. Ongoing Due Diligence

While providing services, the Company shall continue to perform ongoing monitoring of the Customer, periodic reviews of the relevance of the data, and inform the supervisory authority about possible suspicious activity if needed.

The Company must ensure continuous monitoring of Customers' transactions and behavior to identify unusual operations or activities. Unusual indications may be related to the deposits made into Customer's account, abuse of bonuses or other promotions, using unfair external factors or influences, taking unfair advantage, opening any duplicate accounts, undertaking fraudulent practice or criminal activity, etc.

Designated person from the Company or MLRO or third-party service provider shall monitor Customers' transactions and apply measures, including but not limited to the following:

Screening of wallet addresses as they might be linked to criminal activities or owned by people engaged in criminal activities;
Screening and detection of unusual operations on the wallet addresses (extremely low amount transactions with extremely great volume of transactions);
Screening of different assets on blockchain and their interaction with specific wallet addresses;
Tracing funds as they have been transferred across multiple tokens or chains, etc.

The Company shall ensure that the data, documents and information about the Customer are constantly updated (at least once every 24 months). In cases Enhanced Due Diligence (EDD) was applied to the Customer during onboarding stage, data, documents and information shall be updated at least once every 12 months.

If the Customer avoids submitting updated documents, information and other data required by the Company within the reasonable time, the Company might terminate the business relationship with the Customer. Even if the Customer provides requested information, the decision to terminate or continue business relationships with the Customer is at the discretion of the Company.

7. Recognition, Documentation and Reporting of Unusual/Suspicious Transactions

An unusual transaction shall be considered a transaction which is inconsistent with the Customer's business behavior or personal activities.

The Company shall pay special attention to all complex, unusually large transactions and all unusual patterns of transactions, which have no apparent economic or visible lawful purposes.

To guard against money laundering and/or terrorist financing, the Company shall record any suspicious/unusual transaction in writing by making a record in the Company's register of unusual/suspicious transactions of the Customer. Such findings shall be kept for at least five years and shall be available for respective supervisory authorities.

In case an unusual/suspicious transaction is detected and recorded, the senior manager shall be internally reported regarding this matter within undue delay, in the manner approved by the Company. Together with the internal unusual/suspicious report, senior manager shall be provided with all collected data related to the Customer being reported.

In cases when senior manager has evaluated the nature, risks and other relevant circumstances of the transaction and authorized the received report, an external report shall be prepared and submitted to the Supervisory authority without undue delay.

The Company shall appoint a Money Laundering Reporting Officer (the "MLRO") who shall be responsible for the filing of needed reports, pertaining a risk analysis on Money Laundering with the designated authorities.

Additionally, MLRO duties include the following:

Ensure that procedures are in place to ensure compliance with all applicable legislation, regulations and all associated guidelines, codes of practice and Company policies and procedures;
Report to the Managers and inform senior management the results of any remedial action taken;
Attend regular compliance meetings with selected senior management, prepare an agenda, and maintain the minutes thereof;
Update and maintain any compliance-related policies, including this Policy;
Plan and coordinate training activity for all departments to include key regulatory areas including the significance of regulatory compliance as a whole, ID and age verification, fraud, anti-money laundering, and problem gambling;
Be the point of contact with the involved regulators;
Investigate and report any breaches of the applicable laws, regulations, guidelines, codes of practice and company policies and procedures to senior management and, as appropriate, to the regulator;
Consult with staff representatives and attend staff meetings on compliance topics;
Manage regular reviews of Company's internal control system to ensure that it accurately reflects the current operation of the business and report any discrepancies to relevant senior management;
Look after records of high-risk clients and report suspicious activities, if any;
Assist the implementation of an AML program;
Arrange inspections from third-party organizations and eliminate mistakes in the program, if any.

8. Employees Training

The Company provides anti-money laundering/terrorism financing risk awareness training for employees. The Company intends to conduct trainings so frequently so Company's employees would be well familiarized with latest AML/KYC practices.

Regardless of who conducts the employees training (senior manager or external providers), employees shall be instructed about the following matters:

Obligations under anti-money laundering/terrorism financing laws and FATF, CFATF recommendations;
The consequences of not complying with anti-money laundering/terrorism financing requirements;
The types and patterns of money laundering and/or terrorism financing that the Company's business might face and the consequences of these risks;
The Company's compliance to anti money-laundering/terrorism financing laws, including the Company's processes and procedures to identify, manage and mitigate risks related to money laundering/terrorism financing.

Anti-money laundering/terrorism financing risk awareness training programs to all employees and directors of the Company shall be conducted by senior manager. Programs for senior manager shall be conducted by external providers.

The Company ensures that Customer identifications and monitoring of their operations will be conducted by professional, well trained Company's employees.

9. Storage of Registers and Customer's Data

The Company shall maintain and store registers as follows:

The registers shall be stored in electronic format for 5 years from the date of termination of business relations with the Customer.

All information/explanation, data and documents related with the Customer shall be stored in electronic format for 5 years from the date of termination of business relations with the Customer.

The Company shall keep secure all data given by the Customer and shall not sell or give it to anyone else. The data may only be shared with the AML authority of the affected state if forced by law, or to prevent money laundering.

10. Final Provisions

This Policy is approved by the Company's Managers. The Policy shall enter into force on the date of its approval, unless otherwise specified. The Company's Policy is reviewed regularly, but at least once a year and in case any adjustments are required, the new version of the Company's Policy takes effect from the date of its approval.