KYC & ANTI-MONEY LAUNDERING

POLICY

1. PURPOSE
This policy establishes BetNlaff’s mandatory framework for:
• Preventing money laundering and terrorist financing
• Detecting suspicious betting and payment behaviour
• Verifying customer identity (KYC)
• Complying with Nigerian regulatory and financial crime laws
• Protecting BetNlaff from financial crime, fraud, and reputational damage
This policy ensures compliance with:
• FCT Lottery Regulatory Office requirements
• Nigeria Lottery Regulatory Commission (NLRC) requirements
• Central Bank of Nigeria (CBN) AML/CFT Regulations
• Nigerian Financial Intelligence Unit (NFIU) reporting standards
• Money Laundering (Prevention and Prohibition) Act 2022
• Terrorism (Prevention and Prohibition) Act 2022
• Nigeria Data Protection Regulation (NDPR)
• FATF Recommendations
• ISO 37301 (Compliance Management Systems)

2. SCOPE
This policy applies to:
• All sportsbook customers (punters)
• All employees, contractors, and agents
• All payment transactions and withdrawals
• All betting activity and account behaviour
• All customer onboarding and KYC processes
• All third-party service providers
• All suspicious activity investigations

3. DEFINITIONS
Term Definition
AML Anti-Money Laundering
CFT Counter-Terrorist Financing
KYC Know Your Customer
PEP Politically Exposed Person
SAR Suspicious Activity Report
STR Suspicious Transaction Report
CDD Customer Due Diligence
EDD Enhanced Due Diligence
NFIU Nigerian Financial Intelligence Unit
UBO Ultimate Beneficial Owner

4. REGULATORY & STANDARDS REFERENCES
This policy is aligned with:
• NLRC and FCT Gaming & Compliance Guidelines
• Money Laundering (Prevention and Prohibition) Act 2022
• Terrorism (Prevention and Prohibition) Act 2022
• CBN AML/CFT Regulations
• NFIU Reporting Framework
• Nigeria Data Protection Regulation (NDPR)
• FATF Recommendations
• Basel AML Principles
• ISO 37301 (Compliance Management Systems)

5. AML GOVERNANCE STRUCTURE
Role Responsibility
CEO / Managing Director Ultimate accountability
AML Compliance Officer (MLRO) AML programme governance
Compliance Manager Regulatory reporting
Risk Manager AML risk assessments
IT Manager Transaction monitoring systems
Customer Support Lead KYC execution
Finance Manager Transaction monitoring
Vendor Manager Third-party AML governance
All Staff AML policy compliance

6. AML RISK ASSESSMENT
BetNlaff performs annual AML risk assessments covering:
• Customer risk
• Product risk
• Transaction risk
• Geographic risk
• Delivery channel risk
• Third-party risk
Risk ratings:
Risk Level Description
Low Minimal AML exposure
Medium Moderate exposure
High Elevated exposure
Critical Severe exposure
Mitigation actions documented in the AML Risk Register.

7. CUSTOMER DUE DILIGENCE (KYC)

7.1 KYC Triggers
KYC verification is mandatory:
• At account registration
• Before first withdrawal
• Upon reaching cumulative ₦100,000 deposits
• When suspicious activity is detected
• For all high-risk customers

7.2 Standard KYC Requirements
Customers must provide:
• Full legal name
• Date of birth
• Residential address
• Valid phone number
• Email address
• Government-issued ID
• Live selfie / liveness check
• Bank account details
Accepted ID Types:
• National Identity Number (NIN)
• International Passport
• Driver’s Licence
• Voter’s Card

7.3 Verification Methods
• Biometric face match
• ID document authentication
• Address verification
• Phone number OTP validation
• Database cross-checks
• Fraud database screening

8. ENHANCED DUE DILIGENCE (EDD)
EDD is mandatory for:
• Politically Exposed Persons (PEPs)
• High-value customers
• High-risk geographies
• Unusual betting behaviour
• Structuring or layering behaviour
EDD Measures Include:
• Additional ID documents
• Source of funds verification
• Manual compliance review
• Management approval
• Ongoing monitoring

9. POLITICALLY EXPOSED PERSONS (PEP)
SCREENING
• Automated PEP screening at onboarding
• Continuous PEP database monitoring
• Mandatory EDD for all PEPs
• Senior management approval required
• Annual PEP re-screening

10. TRANSACTION MONITORING
Automated transaction monitoring detects:
• Unusual deposit patterns
• Rapid bet-withdraw cycles
• Structuring below reporting thresholds
• Multiple accounts using same device
• Dormant account reactivation
• Velocity betting anomalies
• Bonus abuse

Monitoring rules reviewed quarterly.

11. SUSPICIOUS ACTIVITY DETECTION
Red flags include:
• Frequent small deposits to avoid KYC
• Betting without normal risk behaviour
• Large withdrawals without betting
• Multiple linked accounts
• Use of VPNs or proxy servers
• Unusual geographic access
• Third-party payment usage

12. SUSPICIOUS TRANSACTION REPORTING (STR)
• All suspicious activity logged
• STRs filed to NFIU within 24 hours
• NLRC notified where required
• Internal SAR register maintained
• Confidentiality maintained
• Tipping-off prohibited

13. ACCOUNT RESTRICTIONS & SUSPENSION
Accounts may be:
• Temporarily frozen
• Placed under review
• Permanently closed
Triggers include:
• Failed KYC verification
• Suspicious activity
• Fraud detection
• Regulatory instruction

14. RECORD KEEPING & RETENTION
Record Type Retention Period
KYC Records 5 years
Transaction Logs 5 years
STR Reports 5 years
Risk Assessments 5 years
Audit Reports 5 years
Records stored securely and encrypted.

15. DATA PROTECTION & CONFIDENTIALITY
• NDPR compliance enforced
• KYC data encrypted
• Access restricted
• RBAC enforced
• MFA mandatory
• Data minimisation applied
• Secure data destruction enforced

16. THIRD-PARTY AML SERVICE PROVIDERS
• Vendor due diligence mandatory
• Data Processing Agreements required
• Annual vendor AML audits
• Right-to-audit clauses enforced
• Vendor breach reporting required

17. STAFF TRAINING & AWARENESS
• Mandatory AML training at onboarding
• Annual AML refresher training
• Role-specific training for high-risk teams
• Training attendance tracked
• AML testing conducted

18. COMPLIANCE MONITORING & REPORTING
• Monthly AML compliance reports
• Quarterly AML risk reviews
• Annual independent AML audit
• Findings reported to senior management
• Regulatory correspondence tracked

19. INTERNAL AUDIT & QUALITY ASSURANCE
• Independent AML audits annually
• Random KYC file reviews
• Transaction sampling
• Control effectiveness testing
• Audit remediation tracking

20. BREACH HANDLING & DISCIPLINARY ACTION
• Failure to comply with AML obligations may result in:
– Disciplinary action
– Access suspension
– Termination
• Wilful breaches reported to regulators
• Legal action pursued where applicable

21. AUDIT EVIDENCE REQUIREMENTS
The following must be available during audits:
• AML Risk Register
• KYC verification logs