Anti-Money Laundering and Counter-Terrorist Financing Policy

Pokewin Entertainment Ltd

1. Purpose, Status and Regulatory Context

This Anti-Money Laundering and Counter-Terrorist Financing Policy (the "Policy") sets out the internal governance framework, risk controls, and compliance procedures adopted by Pokewin Entertainment Ltd (the "Company") in connection with the operation of the Packy.gg platform (the "Platform").

This Policy is intended to:

mitigate the risk of money laundering, terrorist financing, fraud, and other financial crime;
support compliance with applicable European Union anti-money laundering legislation, Cyprus law, international standards, and payment service provider requirements; and
align the Company's internal controls with the Platform's social gaming and promotional sweepstakes structure.

This Policy is an internal compliance document. It does not constitute a representation to users and does not create rights in favour of any third party.

2. Applicable Legal and Regulatory Framework

The Company adopts this Policy with reference to, inter alia:

Directive (EU) 2015/849 and Directive (EU) 2018/843 (as amended);
The Prevention and Suppression of Money Laundering and Terrorist Financing Law of Cyprus;
Financial Action Task Force (FATF) Recommendations;
International sanctions regimes administered by the European Union, United Nations, OFAC, and HM Treasury;
Payment services compliance standards and industry best practices.

3. Risk-Based Approach

The Company applies a documented, risk-based approach to AML/CTF. Risk assessments are conducted having regard to factors including, without limitation:

user jurisdiction and geolocation;
transactional and redemption behaviour;
frequency and aggregate value of redemptions;
use of promotional entry mechanisms, including alternative methods of entry (AMOE);
payment and funding methods used, including fiat and cryptocurrency funding channels;
technical indicators of automation, collusion, or abuse; and
historical compliance or enforcement considerations.

Where elevated risk is identified, enhanced controls and review procedures are applied.

4. Customer Due Diligence (CDD)

4.1 Standard Due Diligence

The Company may require users to complete identity verification prior to permitting:

any redemption activity;
cumulative redemptions exceeding internal thresholds;
access to certain promotional or prize-bearing features; or
continued account access where risk indicators arise.

In particular, and without limiting the generality of the foregoing, identity verification will normally be required where:

aggregate fiat deposits exceed a cumulative total of USD 100 (or its equivalent in any other currency); or
a withdrawal or redemption exceeding USD 100 (or its equivalent in any other currency) is requested from an account that has previously been funded by way of fiat deposit.

For the purposes of this Policy, "fiat deposits" include all non-cryptocurrency payment methods accepted by the Platform, including credit cards, debit cards, Apple Pay, Google Pay, and Cash App Pay, in each case processed through one or more third-party payment processors. The thresholds above apply on an aggregated basis across all fiat payment methods used on an account.

The thresholds set out above are indicative operational triggers only. They do not confer any right on any user to transact below such thresholds without verification, and the Company expressly reserves the right, at its sole discretion and at any time, to require identity verification at lower thresholds, prior to any transaction, or in the absence of any transaction, including where required by applicable law, regulation, a payment service provider, or the Company's risk-based assessment. The Company may amend these thresholds at any time without notice.

Standard CDD may include collection and verification of:

full legal name;
date of birth;
residential address;
government-issued photo identification;
proof of address;
proof of ownership of the payment method used;
IP address, device identifiers, and geolocation data.

In addition, the Company may, at its sole discretion, require identity verification in connection with any fiat (including credit or debit card) deposit, whether before or after the transaction is processed. Where verification is not completed to the Company's satisfaction, or where the Company otherwise determines not to accept a fiat transaction, the Company may decline or reverse the transaction and refund the corresponding amount to the original payment method (refund to source), and may void any virtual units or promotional benefits credited in connection with that transaction.

Identity verification is performed through one or more independent third-party identity verification providers appointed by the Company from time to time (currently including Sumsub). Verification includes automated sanctions screening, politically exposed person (PEP) screening, and related compliance checks. The Company may change, add, or replace verification providers at any time without amendment to this Policy. Personal data processed in connection with identity verification is handled in accordance with the Company's Privacy Policy.

Once verification has been requested, relevant payment or redemption features may be restricted until verification is successfully completed. Deposits must originate from payment methods owned by the account holder; the use of third-party payment methods is prohibited unless expressly authorised, and evidence of payment method ownership may be required at any time.

4.2 Enhanced Due Diligence (EDD)

Enhanced due diligence may be applied where higher risk is identified, including but not limited to:

high-frequency or high-value redemptions;
inconsistent or anomalous activity patterns;
users located in higher-risk jurisdictions;
repeated or structured AMOE submissions;
indicators of multi-accounting, collusion, or automation; or
potential sanctions or politically exposed person (PEP) exposure.

EDD measures may include, without limitation:

additional documentation requests, including Source of Funds and/or Source of Wealth documentation;
proof of ownership of the payment method used;
bank statements or equivalent financial records;
manual compliance review; and
senior management approval prior to the continuation of the business relationship or the processing of any redemption.

The Company shall determine, at its sole discretion and on a risk-based basis, which EDD measures are appropriate in any given case.

4.3 Cryptocurrency-Funded Accounts

The Company applies its risk-based approach to accounts funded with cryptocurrency in the same manner as to all other accounts.

Accounts funded exclusively with cryptocurrency are not, as a matter of routine, subject to standard identity verification triggers of the kind described in Section 4.1. Verification will ordinarily be requested on cryptocurrency-only accounts where suspicious activity, elevated risk indicators, or other grounds for review are identified, including without limitation:

transaction patterns consistent with money laundering, structuring, or layering;
funds originating from or destined for wallets, mixers, tumblers, privacy-enhancing services, darknet marketplaces, sanctioned addresses, or other high-risk sources identified through blockchain analytics or otherwise;
indicators of multi-accounting, collusion, automation, or abuse;
volumes, velocities, or behaviours inconsistent with ordinary entertainment use of the Platform;
sanctions, PEP, or adverse media exposure; or
any request, requirement, or recommendation of a regulator, law enforcement authority, payment or custody provider, or other competent body.

Subject to the foregoing, routine cryptocurrency deposits, pack openings, and withdrawals are otherwise unaffected.

For the avoidance of doubt, nothing in this Section 4.3 limits, waives, or derogates from the Company's right or obligation to require identity verification, enhanced due diligence, or any other compliance measure in respect of any account (including a cryptocurrency-only account) at any time, whether before, during, or after any transaction, where the Company considers it appropriate or where required by applicable law or regulation. All accounts, regardless of funding method, remain subject at all times to transaction monitoring, sanctions screening, geolocation controls, and all other provisions of this Policy. The Company may amend or withdraw the treatment described in this Section 4.3 at any time without notice.

5. Virtual Currency and Wallet Controls

The Platform operates segregated, platform-specific virtual currencies. Controls include:

prohibition of peer-to-peer transfers;
prohibition of off-platform trading or monetisation;
segregation of wallets by gameplay environment;
automated and manual monitoring of balance movements; and
audit logging of all wallet activity.

Virtual currencies may not be sold, gifted, transferred, or exchanged except as expressly permitted within the Platform's rules.

The Company does not accept deposits for speculative or investment purposes. Any value introduced into the Platform is strictly for entertainment and promotional participation and does not constitute stored monetary value.

6. Digital Items and Pack Mechanics

The Platform may offer digital "packs", "cases", or similar mechanisms (collectively, "Packs"), which provide users with randomized digital items for entertainment purposes. Such Packs:

do not constitute gambling products;
do not represent financial instruments or assets;
do not provide a guaranteed outcome or value;
are part of a promotional entertainment framework.

The Company monitors Pack interactions as part of its transaction monitoring framework, including:

abnormal pack opening frequency;
structured behaviour aimed at extracting value;
coordinated or automated pack usage patterns.

7. Transaction Monitoring and Analytics

The Company maintains transaction monitoring mechanisms designed to identify activity that may warrant further review, including:

rapid accumulation and redemption patterns;
deposit and withdrawal velocity, including rapid deposit followed by immediate withdrawal;
structuring of deposits to avoid verification thresholds;
multiple accounts linked through devices, payment methods, or behavioural indicators, including multiple payment cards used across linked accounts;
stolen card, payment fraud, and chargeback or payment abuse indicators;
behaviour inconsistent with stated usage patterns;
repeated low-effort AMOE submissions followed by immediate redemption;
patterns indicative of automated or coordinated activity; and
circumvention of geolocation or technical safeguards.

Monitoring combines screening performed by the Company's verification providers with the Company's internal fraud detection systems. Automated monitoring is supplemented by manual review where appropriate, and high-risk cases are escalated to the Anti-Money Laundering Officer for manual review.

8. Anti-Abuse and Fair Use Controls

The Company implements anti-abuse measures to prevent exploitation of promotional mechanisms, including:

limits on redemption frequency and velocity;
monitoring of device, IP, and behavioural fingerprints;
controls against multi-accounting and collusion;
review of XP, progression, and promotional participation patterns.

Where abuse is identified or suspected, the Company may restrict accounts, void balances, or terminate access.

9. Suspicious Activity Escalation and Reporting

Where activity raises suspicion of money laundering, fraud, or other financial crime, the Company may:

conduct internal investigation;
restrict or suspend account activity;
delay or refuse redemptions; and
report activity to competent authorities where legally required.

The Company is not obligated to inform users of any such review or report.

10. Sanctions, PEPs and Restricted Jurisdictions

The Platform is not available to persons:

located in sanctioned or embargoed jurisdictions;
listed on applicable sanctions or watchlists; or
located in jurisdictions where Platform operation is restricted.

The jurisdictions in which the Platform is not offered are set out in Schedule A (Restricted Jurisdictions) to the Platform's Terms of Service, as amended from time to time. These include, without limitation, certain restricted United States states; jurisdictions subject to comprehensive or significant sanctions (including Afghanistan, Belarus, Cuba, Iran, North Korea, Russia, Syria, Venezuela (sanctioned regions and persons), and the Crimea, Donetsk, Luhansk, and Sevastopol regions); and high-risk jurisdictions (including Myanmar, Yemen, Sudan, South Sudan, the Democratic Republic of the Congo, Haiti, Somalia, and Lebanon).

Where an account is identified as connected to a restricted or sanctioned jurisdiction or a sanctioned person, the Company may freeze, suspend, or terminate the account, void balances and rewards, and withhold refunds to the extent permitted by applicable law, in accordance with the Terms of Service.

Sanctions screening and geolocation controls are applied on a risk-based basis.

11. Record Keeping and Audit Trail

The Company maintains records relating to:

identity verification;
transactional activity;
compliance reviews;
AML/CTF decisions and escalations.

Records are retained for a minimum of five (5) years or such longer period as required by law or contractual obligations.

12. Governance, Oversight and Training

Responsibility for AML/CTF oversight is assigned to senior management. Management appoints an Anti-Money Laundering Officer (AMLO), who is responsible for oversight of AML policies and procedures, review and approval of escalated cases, staff training and competency records, ongoing effectiveness reviews, and liaison with payment providers, legal advisers, and regulators where necessary.

Personnel involved in compliance functions receive training appropriate to their role and responsibilities. Staff must escalate unusual behaviour to the AMLO, must not inform customers that they are under investigation or subject to internal AML review, must document decisions accurately and consistently, and must treat all AML investigations as confidential.

12A. Payment Processor Compliance

The Company complies with all applicable requirements imposed by its payment processors, their acquiring banks, and associated payment networks (including card scheme rules). Where a payment processor's requirements exceed the minimum standards set out in this Policy, the stricter requirement applies. The Company may share relevant account, transaction, and device information with payment processors, card issuers, financial institutions, and fraud prevention services where reasonably necessary for fraud prevention, dispute handling, investigation, or compliance.

13. Review, Amendment and Discretion

This Policy is reviewed periodically and may be amended to reflect changes in law, regulation, risk profile, or business operations. The Company reserves discretion in the application of this Policy.

14. Third-Party IP Disclaimer

The Company does not claim ownership over any third-party intellectual property that may be displayed for illustrative purposes. The AML framework is independent of any intellectual property considerations.

Effective Date: 10 May 2026

Last Amended: 22 July 2026

Approved by: Board of Directors, Pokewin Entertainment Ltd