# Winna.com AML/CTF Policy ### **1\. Introduction** 1.1 This AML/CTF Policy applies to Winna, its staff, and services, in full compliance with the licensing conditions outlined by the Tobique Gaming Commission. 1.2 The objective of this policy is to prevent the use of Winna's platform and services for money laundering or the financing of terrorism by implementing strong internal procedures, employee awareness, and proactive system controls. 1.3 Winna maintains a comprehensive risk-based AML framework that includes: - Regulatory-compliant policies and procedures - Customer Due Diligence (CDD) at registration and in full within 30 days of the first deposit, before the Customer wagers an equivalent of EUR 2,000, or upon first withdrawal - Systems for reporting suspicious transactions internally and externally - Secure and compliant document retention - Annual AML training for all relevant employees 1.4 A robust, market-wide ML/TF risk management framework ensures we actively detect, prevent, and report suspicious activity. ### **2\. Regulatory Framework** 2.1 This policy is aligned with: - Tobique Gaming Commission regulations - FATF and Asia/Pacific Group (APG) international standards ### **3\. Definitions** 3.1 **Money Laundering**: - _Placement_: Introducing illegal funds into the financial system - _Layering_: Concealing the source through transactions - _Integration_: Reintegrating funds into the economy as legitimate 3.2 Winna does not accept cash payments. Our AML efforts target the layering and integration stages. ### **4\. Purpose and Scope** 4.1 This policy applies to all clients and business activities licensed under the Tobique jurisdiction. 4.2 Winna identifies, assesses, and mitigates risks associated with ML/TF in compliance with AML directives and local regulations. ### **5\. Business Risk Assessment** 5.1 A comprehensive Enterprise-Wide Risk Assessment (EWRA) is conducted regularly and considers: - Customer typologies - Transaction patterns - Product and service risks - Payment and delivery methods - Geographic exposure - Third-party relationships 5.2 The policy is reviewed annually or when triggered by: - Regulation changes - Updated best practices - Regulatory or audit findings ### **6\. Compliance Officer (MLRO)** 6.1 Winna has appointed a qualified MLRO responsible for: - Identifying high-risk activities - Maintaining risk assessments - Managing STRs - Reporting to senior management ### **7\. Required Customer Information (KYC)** 7.1 At the point of registration, the following information is collected: - Full legal name - Residential address - Country of residence - Date of birth - Email address 7.2 Player names are screened at registration and continuously against sanctions, PEP, and adverse media lists using automated tooling. ### **8\. Customer Due Diligence (CDD)** 8.1 CDD measures are initiated under the following circumstances, in line with Tobique regulations and FATF guidance: - When establishing a business relationship (e.g., at point of registration) - When carrying out occasional transactions - When there is a suspicion of money laundering or terrorist financing - When there is doubt about the veracity or adequacy of previously obtained customer identification data 8.2 CDD must be completed: - Within 30 days of first deposit - Before first withdrawal - Before wagering an equivalent of EUR 2,000 - When there is a suspicion of ML/TF or doubt about prior data 8.3 Acceptable documentation: - Personal ID: Passport, Driving Licence, Government-issued ID - Address Verification (dated within 3 months): Utility Bill, Tax Bill, Bank Statement - Source of Payment: Card (front only), linked Bank Statement 8.4 CDD verification is conducted by trained staff using both manual reviews and external KYC tooling. ### **9\. Customer Risk Assessment** 9.1 Risk is assessed based on: - Transaction behavior - Payment type - Geography - Product usage 9.2 High-risk customers are escalated for Enhanced Due Diligence (EDD). ### **10\. Enhanced Due Diligence (EDD)** 10.1 Triggered when: - Suspicious activity is detected - Profile inconsistencies arise - The customer is a PEP or connected to sports events 10.2 Additional documentation: - Payslips, Tax returns - Business financials - Bank statements showing income or savings 10.3 EDD includes ongoing monitoring and source of wealth checks. ### **11\. Internal Controls** 11.1 Transaction Monitoring Enhancements: - Continuous monitoring of all customer transactions (deposits and withdrawals) - Automated threshold setting (e.g., EUR 2,000 within 24 hours) - Alerts reviewed by Compliance Team and escalated if needed - Red flag indicators include abnormal transaction patterns, velocity, and high-risk country exposure - Case management system logs investigations and outcomes 11.2 Tooling provided by Cryptochill and custom-built systems support detection and alerting. ### **12\. Ongoing Monitoring and Screening** 12.1 Continuous monitoring is applied across all accounts. 12.2 Adverse media, sanctions, and PEP screening is automated using third-party tooling, such as ION, Worldcheck, or Lexis Nexis. 12.3 Screening occurs: - At registration - On a daily and weekly basis - Prior to major transactions or withdrawals 12.4 **Screening Policy and Procedure:** - All alerts generated by screening tools (e.g. name matches, sanctions flags, or adverse media hits) are reviewed by the Compliance Team. - The Compliance Team evaluates each alert for accuracy and relevance using a risk-based approach, including manual verification when necessary. - Alerts are categorised into: false positives (no action required), low-risk (document and monitor), or high-risk (escalate to MLRO). - High-risk alerts are escalated to the MLRO within 24 hours. The MLRO will determine whether Enhanced Due Diligence (EDD) or a Suspicious Transaction Report (STR) is necessary. - All screening decisions are logged and auditable. - Screening effectiveness is periodically tested and calibrated to maintain accuracy and regulatory alignment. ### **13\. Third-Party Clients** 13.1 Winna requires before engagement: - Company incorporation documents - UBO disclosure - Licensing or registration certificates (where applicable) - Sanctions, PEP, and adverse media screening ### **14\. Counter-Terrorist Financing (CTF)** 14.1 All customers are screened against global sanctions databases. Matches result in immediate account suspension and STR filing. ### **15\. Politically Exposed Persons (PEPs)** 15.1 **Definition (Per Tobique Regulation Article 22):** A PEP is any individual who is or has been entrusted with prominent public functions, including: - Heads of state or government, ministers, members of parliament - Senior judicial, military, or law enforcement officials - Senior executives of state-owned corporations - Political party leaders - Immediate family and known close associates 15.2 If a PEP is identified: - Senior management approval is required - Source of wealth verification is mandatory - EDD and enhanced ongoing monitoring are applied ### **16\. Persons Connected to Sporting Events** 16.1 These individuals are treated similarly to PEPs under Tobique Regulation Article 22\. This includes: - Enhanced monitoring - MLRO approval - Source of wealth verification ### **17\. Adverse Media Screening** 17.1 Conducted at onboarding and ongoing via tooling 17.2 Flags result in review, customer escalation, and account restrictions ### **18\. Threshold Transaction Reporting** 18.1 Transactions over 10,000 CAD must be reported within 10 business days ### **19\. High-Risk Jurisdictions** 19.1 Risk assessed using: - FATF/APG watchlists - US Department of State INCSR - Basel AML Index 19.2 High-risk customers face immediate CDD or EDD. ### **20\. Record Keeping** 20.1 All relevant records (KYC, STRs, customer profiles) are stored securely for 5 years post-account closure. ### **21\. Suspicious Transaction Reporting (STR)** 21.1 STRs are filed when: - The customer is not who they claim to be - Transactions may relate to ML/TF or other offences - Transactions lack lawful purpose 21.2 Reporting Requirements: - ML/Other crimes: Report to Tobique Gaming Commission within 5 business days - Terrorist financing: Report to Tobique Gaming Commission within 24 hours - Simultaneous report to local Financial Intelligence Unit (FIU) 21.3 STRs are handled by the MLRO. Internal staff must report suspicions via internal templates and reporting channels. Tipping-off is strictly prohibited. ### **22\. Employee Training** 22.1 Mandatory annual AML/CTF training 22.2 Completion is tracked and recorded ### **23\. Employee Due Diligence** 23.1 New employees undergo: - Background screening - Reference checks - Police conduct certificate verification ### **24\. Restricted Countries** 24.1 Winna does not accept players from the following jurisdictions: - Afghanistan - Canadian Province of New Brunswick - China - Cuba - Central African Republic - Democratic Republic of Congo - Haiti - Iran - Iraq - Israel - Libya - Myanmar - North Korea - Russia - Somalia - South Sudan - Syria - United Kingdom - United States of America - Yemen - Venezuela 24.2 This list is reviewed quarterly and updated based on Tobique and global sanctions data. ### **25\. Changes to This Policy** 25.1 Winna reserves the right to modify this policy. Updates will be published with an updated version date. 25.2 Users are encouraged to review this document periodically. ### **26\. Acceptance of Terms** By using the Winna platform, users agree to this AML/CTF Policy. Continued use following any changes constitutes acceptance of those changes. ### **27\. Policy Review & Version Control** This policy is reviewed annually or upon regulatory updates. **Last reviewed:** May 7, 2025 **Updated:** May 7, 2025 **Next scheduled review:** May 5, 2026 **Version 1.1 – Updated by Max Noha, Responsible Gambling Officer**