This Anti-Money Laundering and Know Your Customer Policy ("Policy") sets out the obligations of luckyzap, operated at lucky-zap.org, and the responsibilities of our customers in preventing financial crime, money laundering, terrorist financing, and related illegal activity on our platform. luckyzap holds a licence issued by the Curaçao Gaming Control Board ("GCB") and is committed to full compliance with all applicable AML/CFT regulatory requirements as a condition of that licence.

1. Introduction and Purpose

Money laundering is the process by which criminally obtained funds are made to appear legitimate. Terrorist financing involves the channelling of funds — whether of legitimate or illegitimate origin — towards terrorist activity. Both represent serious threats to the integrity of the financial system and to the safety of society.

luckyzap operates lucky-zap.org as a fully licensed online gaming platform under the authority of the Curaçao GCB. As a condition of that licence and as a matter of corporate principle, we maintain robust systems and controls to detect, prevent, and report suspicious activity. This Policy applies to every customer, every transaction, and every product offered on lucky-zap.org — including casino games, live casino tables, and the Betby-powered sportsbook.

The objectives of this Policy are to:

• Establish clear customer due diligence ("CDD") and enhanced due diligence ("EDD") procedures;
• Define the circumstances under which the platform will request identity verification and supporting documentation;
• Describe how luckyzap monitors transactions and player behaviour for suspicious indicators;
• Explain the process for reporting suspicions to the relevant authorities;
• Set out customer rights and obligations in relation to KYC compliance;
• Ensure that luckyzap cannot knowingly or unknowingly be used as a vehicle for financial crime.

2. Scope and Application

This Policy applies to:

• All registered customers of lucky-zap.org, regardless of nationality, jurisdiction, or payment method used;
• All deposits, withdrawals, bonus claims, and wagers placed on the platform;
• All payment methods accepted on the platform, including Visa, Mastercard, Apple Pay, Google Pay, Revolut, PayID, and cryptocurrency (including Bitcoin and USDT);
• All currencies and account denominations supported by luckyzap, including EUR and SEK;
• All third parties and service providers engaged by luckyzap who handle customer data or funds.

Customers who are unable or unwilling to satisfy our KYC requirements will be unable to deposit, withdraw, or access the full functionality of lucky-zap.org. luckyzap reserves the right to suspend or close any account that fails to meet the standards set out in this Policy.

3. Regulatory Framework

luckyzap operates under a gaming licence granted by the Curaçao Gaming Control Board. Our AML/CFT framework is designed to meet the standards set by:

• The Curaçao GCB licensing conditions and associated AML/CFT requirements;
• The Financial Action Task Force ("FATF") Forty Recommendations and associated guidance for the gambling sector;
• Applicable international sanctions frameworks, including lists published by the United Nations, the European Union, the Office of Foreign Assets Control ("OFAC"), and His Majesty's Treasury;
• General best practice standards for online gaming operators in relation to financial crime prevention.

4. Know Your Customer (KYC) Policy

4.1 Identity Verification Partner

luckyzap uses Sum and Substance (Sumsub) as its third-party identity verification provider. Sumsub is a recognised KYC technology platform that conducts automated and manual document checks, liveness detection, and database screening. The use of Sumsub allows us to conduct KYC quickly and efficiently — in most cases, verification wraps up within a short timeframe after documents are submitted. Once a customer is verified, the process is designed to stay out of their way during normal account use.

4.2 When KYC Is Required

KYC verification may be initiated at the following stages:

• At registration — luckyzap may request basic identity information during account creation;
• Before processing a withdrawal — no withdrawal will be released to an unverified account. Our standard withdrawal window is within two banking days, subject to successful KYC completion;
• Upon reaching cumulative deposit or activity thresholds — as determined by our internal risk-based approach;
• When a transaction or pattern of play triggers a risk alert;
• At any time we consider it necessary to satisfy our regulatory obligations or to protect the integrity of the platform.

4.3 Standard Customer Due Diligence (CDD)

All customers are required to complete standard CDD before withdrawals can be processed. The standard CDD process requires customers to provide:

• Proof of Identity (POI) — a valid, government-issued photo identity document. Acceptable documents include a passport, national identity card, or driving licence. The document must be current and clearly display the customer's full name, date of birth, photograph, and document number;
• Proof of Address (POA) — a document confirming the customer's residential address, such as a utility bill, bank statement, or official government correspondence, issued within the previous three months and displaying the customer's full name and address;
• Selfie or liveness check — a real-time selfie or short video recorded through the Sumsub verification flow, used to confirm that the person submitting documents matches the identity document provided.

4.4 Enhanced Due Diligence (EDD)

Enhanced due diligence is applied where a higher level of risk is identified. EDD may be triggered by, among other factors:

• High-value deposits or withdrawals, including use of the High Roller route (minimum deposit of €500, with bonuses up to €3,000);
• Unusually rapid cycling of funds through deposits and withdrawals;
• Activity inconsistent with the customer's stated profile, occupation, or source of funds;
• Customers identified as Politically Exposed Persons ("PEPs") or their close associates;
• Customers from higher-risk jurisdictions as identified by FATF or our internal risk assessment;
• Any account flagged by our transaction monitoring systems.

EDD may require the customer to provide one or more of the following:

• Source of Funds (SOF) — documentation evidencing the origin of the funds deposited, such as recent payslips, bank statements, a letter from an employer, or evidence of a business transaction;
• Source of Wealth (SOW) — broader documentation demonstrating how the customer accumulated their overall wealth, which may include tax returns, investment statements, or evidence of asset sales;
• Proof of payment method ownership — confirmation that the payment method used belongs to the registered account holder, such as a bank statement, screenshot of a cryptocurrency wallet, or card statement;
• Any other documentation reasonably requested by luckyzap's compliance team.

4.5 Cryptocurrency Transactions

luckyzap accepts cryptocurrency deposits and withdrawals, including Bitcoin (BTC) and USDT. Crypto transactions carry specific AML risk considerations and are subject to the following controls:

• Customers using cryptocurrency must verify the wallet used belongs to them and is in their sole control. Third-party wallet transactions are not permitted;
• luckyzap reserves the right to use blockchain analytics tools to assess the risk profile of cryptocurrency transactions, including screening for known illicit addresses or mixing services;
• Funds originating from high-risk sources — including darknet markets, sanctioned entities, or flagged wallets — will be rejected, and the relevant account will be subject to immediate review;
• Cryptocurrency withdrawals, like all withdrawals, are subject to full KYC verification before processing, within the standard two banking day window post-verification.

4.6 Payment Method Ownership

luckyzap operates a strict policy that all payment methods used on the platform must be registered in the name of the account holder. Customers may not use payment methods belonging to third parties under any circumstances. Where there is any doubt about payment method ownership, luckyzap will request documentary evidence before processing any transaction. The use of anonymous or prepaid instruments may attract additional scrutiny.

4.7 Age Verification

luckyzap does not permit any person under the age of 18 to register, deposit, or participate in any game or bet on lucky-zap.org. Age verification is a mandatory component of the KYC process. Where there is any doubt about a customer's age, access to the account will be suspended until satisfactory proof of age has been provided. Any funds deposited by a customer who is subsequently found to be under 18 will be returned and the account permanently closed.

4.8 Duplicate and Fraudulent Accounts

Each customer is permitted to hold one account on lucky-zap.org. luckyzap uses identity verification technology, including Sumsub's deduplication tools, to identify customers who attempt to open multiple accounts. Duplicate accounts may be closed without notice, and any funds held across such accounts may be forfeited pending investigation. The use of false identity documents or deliberately misleading information during KYC is a serious matter and may be reported to the relevant authorities.

5. Risk-Based Approach

luckyzap applies a risk-based approach ("RBA") to AML/CFT compliance. This means that the level of scrutiny applied to any given customer or transaction is proportionate to the risk that customer or transaction presents. Customers who deposit small amounts using established payment methods and whose activity is consistent with their stated profile attract a lower level of scrutiny than those who engage in high-value, unusual, or complex transactions.

Risk factors that may elevate a customer's risk rating include, but are not limited to:

• Jurisdiction of residence — customers from jurisdictions identified by FATF as high-risk or subject to increased monitoring;
• PEP status — customers who hold or have held prominent public functions, or who are close family members or known associates of such persons;
• Adverse media — negative news coverage linking a customer to financial crime, fraud, or corruption;
• Sanctions list matches — any name match against published sanctions lists;
• Transaction behaviour — structuring of deposits or withdrawals in a manner that appears designed to avoid reporting thresholds, rapid fund turnaround without significant play, or repeated deposits and immediate withdrawals;
• Payment method risk — use of higher-risk payment channels, particularly certain cryptocurrency arrangements.

Risk ratings are not static. luckyzap reviews customer risk profiles on an ongoing basis, and a customer whose risk profile changes may be subject to additional verification requirements at any point during their relationship with the platform.

6. Transaction Monitoring

luckyzap maintains an ongoing transaction monitoring programme designed to detect activity that may indicate money laundering, terrorist financing, or other financial crime. Our monitoring systems assess:

• Deposit and withdrawal frequency, volume, and patterns;
• The ratio of deposits to actual gambling activity — customers who deposit and withdraw without meaningful play attract specific attention;
• Sudden changes in wagering behaviour, particularly sharp increases in bet size;
• Use of multiple payment methods or frequent changes of payment method;
• Requests to withdraw to a different method or account from that used to deposit;
• Deposits and withdrawals that cluster around round numbers or specific thresholds;
• Any activity that appears structured to avoid triggering internal controls.

Where a transaction or pattern of behaviour triggers an alert, it is reviewed by our compliance team. This may result in a request for additional information from the customer, a temporary hold on transactions, or — where appropriate — the filing of a suspicious activity report with the relevant authority.

7. Suspicious Activity Reporting

Where luckyzap identifies activity that gives rise to knowledge, suspicion, or reasonable grounds for suspicion that a customer is engaged in money laundering or terrorist financing, we are obliged to report that activity to the relevant competent authority. Such reports are made in strict confidence. luckyzap, its employees, and its service providers are prohibited from disclosing to the customer or any third party that a report has been made ("tipping off"). Customers should be aware that placing luckyzap under a legal obligation to report does not trigger any right to information about the report, nor does it automatically result in account closure, though operational holds on transactions may apply during an investigation.

8. Sanctions Screening

luckyzap screens all customers and transactions against applicable international sanctions lists, including but not limited to those maintained by the United Nations Security Council, the European Union, OFAC, and His Majesty's Treasury. Customers who appear on, or are closely associated with individuals or entities appearing on, sanctions lists will have their accounts blocked immediately and any relevant reports made to the appropriate authority. luckyzap does not accept customers from jurisdictions that are subject to comprehensive sanctions or that are identified by FATF as non-cooperative jurisdictions.

9. Politically Exposed Persons (PEPs)

A Politically Exposed Person is an individual who holds, or has held within the previous 12 months, a prominent public function, including heads of state or government, senior politicians, senior government or judicial officials, senior executives of state-owned enterprises, and senior officials of international organisations. Immediate family members and known close associates of PEPs are treated as PEPs for the purpose of this Policy.

luckyzap screens all customers against PEP databases as part of the KYC process. Where a customer is identified as a PEP, EDD is applied as a matter of course, and the customer relationship is subject to senior management approval and enhanced ongoing monitoring. The existence of PEP status does not automatically prevent a person from registering with luckyzap, but it does trigger a higher level of scrutiny throughout the customer relationship.

10. Record Keeping

luckyzap maintains records of all customer identification documents, transaction data, and AML-related assessments in accordance with our regulatory obligations. Records are retained for a minimum period as required by applicable law and regulation from the date of the last transaction or the date of account closure, whichever is later. All data is held securely in accordance with our Privacy Policy and in compliance with applicable data protection legislation. The platform is SSL encrypted to protect customer data in transit.

11. Staff Training and Internal Controls

All relevant luckyzap personnel with responsibilities related to customer onboarding, payments processing, customer support, or compliance are required to receive training in AML/CFT awareness, the requirements of this Policy, and the procedures for escalating concerns. Training is conducted at induction and refreshed on a regular basis. luckyzap maintains a designated compliance function responsible for overseeing the implementation of this Policy, reviewing alerts, and liaising with the relevant competent authorities as required.

12. Customer Obligations

By registering an account at lucky-zap.org, customers agree to:

• Provide accurate, truthful, and complete information during registration and at any subsequent point when requested to do so;
• Promptly submit all documentation requested by luckyzap's compliance team as part of the KYC or EDD process;
• Notify luckyzap without undue delay of any material change to their personal circumstances, including change of name, address, or occupation;
• Use only payment methods registered in their own name;
• Not attempt to deposit, wager, or withdraw funds that are derived from illegal activity;
• Not attempt to use lucky-zap.org to launder money, finance terrorism, or circumvent applicable laws and regulations;
• Not open more than one account on the platform;
• Cooperate fully with any investigation conducted by luckyzap's compliance team.

Failure to comply with any of the above obligations may result in the suspension or permanent closure of the customer's account, the withholding of funds pending investigation, and/or referral of the matter to the relevant authorities.

13. Deposit and Withdrawal Limits in the AML Context

luckyzap's published transaction limits form part of our broader AML framework. For reference:

These limits may be adjusted downward or upward at luckyzap's discretion on the basis of a customer's risk profile, verification status, or account history. Customers seeking to deposit or withdraw amounts above standard transaction limits may be required to undergo additional verification. Attempts to structure transactions to remain within published limits as a means of avoiding scrutiny are themselves considered a suspicious activity indicator.

14. Bonus Activity and AML

luckyzap offers a range of bonuses and promotional offers, including a welcome pack of up to €4,000 + 400 Free Spins across four deposits, a High Roller Bonus of 150% up to €3,000 + 150 Free Spins for deposits of €500 or more, and ongoing reload and cashback promotions. The bonus wagering requirement is 40× and the maximum bet while a bonus is active is €5 / 50 SEK per spin. The maximum cashout from bonus funds is 10× the bonus amount.

luckyzap monitors bonus activity specifically for patterns consistent with bonus abuse and money laundering. Patterns of concern include depositing to claim a bonus and withdrawing with minimal genuine play, systematic exploitation of low-risk games to clear wagering requirements with the intent of extracting funds rather than for genuine entertainment purposes, and the use of multiple accounts to claim the same bonus. Where such patterns are identified, luckyzap reserves the right to void bonus funds, decline withdrawal requests pending investigation, and close the relevant account.

15. Responsible Gaming and AML Intersection

luckyzap recognises that there is a meaningful intersection between responsible gaming obligations and AML compliance. Customers exhibiting signs of problem gambling — including depositing funds in excess of their apparent means, rapidly increasing wager sizes, or showing signs of financial distress — may also present elevated AML risk indicators. Our responsible gaming tools, including deposit limits, session limits, self-exclusion, and cooling-off periods, are available to all customers and can be activated through the account settings or by contacting our support team at [email protected] or via 24/7 live chat. The existence of AML monitoring does not diminish our responsible gaming obligations; both programmes operate in parallel.

16. Updates to This Policy

luckyzap reviews and updates this Policy periodically to reflect changes in regulatory requirements, industry best practice, and the risk environment. Material changes will be communicated to customers via the website at lucky-zap.org. Continued use of the platform following the publication of an updated Policy constitutes acceptance of the revised terms. Customers with questions about this Policy or about any AML or KYC matter are encouraged to contact us at [email protected] or via the 24/7 live chat facility available on lucky-zap.org.