KYC & Risk Controls Documentation

1. Introduction

This document describes the Know Your Customer (KYC) and risk control framework implemented by OnPoint Administration, LLC for the sweepstakes platform at onpointcasino.com and opcasino.com. These controls verify customer identities at payout, prevent underage access, detect fraud and financial crimes, and describe how location eligibility actually works.

The Company uses IP geolocation for location eligibility, including at redemption, Breeze for identity verification at redemption or withdrawal, and manual review where a risk control calls for it.

2. Location Eligibility

2.1 Overview

Eligibility is determined by the visitor's IP geolocation: the place they are accessing the Platform from, not their home state.

2.2 When it is checked

The IP geolocation check runs at registration, sign-in, game launch, purchase, redemption, contests, and free Sweeps Coins claims.

2.3 Restricted jurisdictions

The Platform is unavailable in these 21 states: Arizona, California, Connecticut, Delaware, Idaho, Illinois, Indiana, Louisiana, Maine, Maryland, Michigan, Minnesota, Mississippi, Montana, Nevada, New Jersey, New York, Oklahoma, Tennessee, Washington, or West Virginia. It is also unavailable outside the United States. A visitor whose IP address cannot be placed in a U.S. state is refused.

2.4 What this check is not

The Platform does not check device location. Identity verification does not check residency. Location eligibility is the IP geolocation result alone.

Location at redemption is the IP geolocation of the connection. The player must be physically located in a permitted U.S. state. A connection in a Restricted Jurisdiction, outside the United States, or that cannot be placed in a U.S. state is refused. Using a VPN, proxy, Tor exit, or hosting network does not, by itself, refuse a redemption or hold it for review. The same place check applies at registration, sign-in, play, and purchase. It does not suspend the account.

3. IP Records

3.1 Overview

Customer sessions are logged with the originating IP address. That address is what the location check in Section 2 uses. It also supports fraud review, where two accounts share an address, and the ordinary account record.

3.2 Data collected

• IP address at registration and each login
• IP geolocation (country and U.S. state, when the address can be placed)
• Associated device fingerprint, stored hashed

3.3 Use

• Refusing access when the IP is outside the United States, in a state listed in Section 2, or cannot be placed in a U.S. state
• Detecting multiple accounts linked to the same IP address
• Supporting a fraud review of a specific session

The Platform does not decide eligibility from a device GPS reading. Using a VPN, proxy, Tor exit, or hosting network does not, by itself, refuse a redemption.

4. Age

4.1 Policy

The Company does not allow access by anyone under 18.

4.2 Registration

1. The visitor provides a date of birth during account registration.
2. Registration is refused when that date of birth is under 18.

4.3 Identity verification is not the age gate

Breeze identity verification runs at redemption or withdrawal, not at registration and not before a purchase. It is not an age check for play, and it is not a residency check. A date of birth under 18 is refused at registration, before any of those steps.

5. KYC Verification

5.1 Provider

Identity verification (KYC) is completed through Breeze, our payout provider, on Breeze's hosted pages. It is required at redemption or withdrawal only.

5.2 Registration

Registration collects the account email, the date of birth used for the age rule, and acceptance of the Terms and Sweepstakes Rules. It does not ask the visitor to certify a state of residence, and it does not start a Breeze identity check.

5.3 Redemption and withdrawal

• Breeze identity verification is required before the first redemption or withdrawal
• The check confirms identity for the payout. It does not decide the visitor's state and it does not replace the IP geolocation check
• The payout method must be in the account holder's name
• The Platform does not collect raw card numbers on its own pages

5.4 If verification does not succeed

• Redemption and withdrawal stay unavailable until Breeze verification succeeds
• The customer is told and can try again
• After repeated failure, the request is reviewed manually
• An unsuccessful identity check does not, by itself, disable Gold Coin purchases. Purchases remain subject to the IP geolocation check in Section 2

6. Risk checks

The Platform runs risk checks at registration and at redemption. Those checks are:

• A shared device, when more than one account uses the same device
• A link to a suspended or self-excluded account
• A redemption that is large compared with lifetime spend, including a redemption from an account that has never purchased
• A young account requesting a redemption
• An email pattern the rule flags, including a plus-address or a blocked disposable domain

A matching rule can flag the account, send the redemption to review, or block it. The Platform does not run a separate real-time AML alert workflow, and it does not rescreen accounts against OFAC, UN, EU, PEP, or adverse-media lists.

7. What this page does not claim

Identity verification at redemption or withdrawal is done by Breeze on Breeze's pages. That step is not an OFAC, UN, EU, PEP, or adverse-media rescreen, and this page does not describe one.

Document Approval

This document has been reviewed and approved by authorized representatives of OnPoint Administration LLC.

AML Compliance Officer. OnPoint Administration LLC | OnPointCasino.com. Date: April 12, 2026.