KYC & Risk Controls Documentation

1. Introduction

This document describes the Know Your Customer (KYC) and risk control framework implemented by OnPoint Administration LLC for the OnPointCasino.com sweepstakes gaming platform. These controls verify customer identities, prevent underage access, detect fraud and financial crimes, and ensure compliance with applicable laws and regulations.

The Company employs a layered, risk-based approach combining automated technology, third-party verification providers, and manual review processes.

2. Geolocation Tracking

2.1 Overview

The Company employs real-time geolocation tracking to ensure customers are located in jurisdictions where sweepstakes gaming services are legally permitted.

2.2 Technical Implementation

Browser-based geolocation API detects customer location at account registration and each session login. IP geolocation is cross-referenced with browser geolocation for consistency. GPS-level accuracy is requested where supported by the customer's device. Geolocation data is logged and retained for each session.

2.3 Restricted Jurisdictions

Access is blocked for customers in prohibited jurisdictions, including Washington State, Michigan (certain formats), any additional states per legal counsel, and any country subject to OFAC comprehensive sanctions.

2.4 VPN and Proxy Detection

The Company employs VPN/proxy detection technology. Customers using a VPN or proxy are required to disable it to continue, and are flagged for enhanced review if the usage appears related to jurisdiction evasion.

2.5 Controls and Alerts

Automated alerts are generated when geolocation and IP data are inconsistent, when access from a restricted jurisdiction is detected, or when VPN/proxy use is identified.

3. IP Tracking

3.1 Overview

All customer sessions are logged with the originating IP address. IP tracking supports identity verification, fraud detection, geolocation confirmation, and device fingerprinting.

3.2 Data Collected

• IP address at registration and each login
• IP geolocation (country, state/region, city)
• ISP/carrier identification
• Proxy/VPN/Tor detection flag
• Associated device fingerprint

3.3 Use Cases

• Confirming customer location in a permitted jurisdiction
• Detecting multiple accounts linked to the same IP address
• Identifying IP addresses associated with fraud or abuse
• Cross-referencing with transaction activity for AML purposes
• Supporting SAR investigations

3.4 Blocklist Management

The Company maintains and regularly updates blocklists of IP addresses associated with known fraud, abuse, restricted jurisdictions, and sanctioned entities.

4. Age Verification

4.1 Policy

The Company strictly prohibits access by individuals under the age of 18. Age verification is performed at customer onboarding and is required prior to any financial transaction.

4.2 Verification Process

1. Customer provides date of birth during account registration.
2. Platform blocks registration if customer is under 18.
3. Full KYC identity verification (via Sumsub) confirms date of birth against government-issued ID.
4. Any discrepancy between self-reported DOB and ID document triggers manual review and account suspension.

4.3 Third-Party Verification

Age verification is conducted through Sumsub's platform, which cross-references the customer's government-issued ID (driver's license, passport, or state ID) against the date of birth provided during registration. Sumsub's AI-powered document verification confirms authenticity and performs biometric facial comparison.

4.4 Ongoing Controls

The Company reserves the right to request additional verification at any time. Accounts where age verification cannot be conclusively completed are suspended until verification is resolved.

5. KYC Verification

5.1 KYC Provider

The Company uses Sumsub (sumsub.com) as its primary KYC and identity verification platform, providing automated identity verification, AML screening, and ongoing monitoring services.

5.2 KYC Tiers

Tier 1 — Account Registration (All Customers)

• Email address verification
• Date of birth confirmation
• Self-certification of residency in a permitted jurisdiction
• Acceptance of Terms of Service and Sweepstakes Rules

Tier 2 — Transaction Verification (Prior to First Purchase)

• Government-issued ID document scan (Sumsub AI document verification)
• Biometric liveness check (selfie comparison to ID photo)
• OFAC/PEP/sanctions screening
• Address verification

Tier 3 — Redemption Verification (Prior to First Cash Prize Redemption)

• Full Tier 2 completion required
• Bank account ownership verification
• Source of funds review for high-value redemptions
• Enhanced due diligence as required by risk score

5.3 Sumsub Integration Details

• Real-time API integration between platform and Sumsub
• Sumsub applicant ID linked to customer account in platform database
• Verification results and risk scores stored in customer record
• Webhook notifications for verification status changes
• Audit trail maintained for all verification actions

5.4 KYC Failure Handling

• Account placed in restricted status — purchases and redemptions disabled
• Customer notified and given opportunity to resubmit documentation
• After two failed attempts, manual review is initiated
• Unverified accounts after reasonable notice may be permanently restricted
• Any credits placed on hold pending resolution

6. Transaction Monitoring

6.1 Overview

The Company operates an automated transaction monitoring system analyzing customer transaction patterns in real time to detect potential money laundering, fraud, and other suspicious activity.

6.2 Monitoring Rules and Triggers

• Rapid deposit/withdrawal cycles with minimal or no gaming activity
• Multiple transactions just below reporting thresholds (structuring indicators)
• Large single transactions inconsistent with customer's historical pattern
• Multiple accounts transacting from the same device, IP, or payment method
• Unusual geographic patterns or sudden changes in access location
• Chargebacks or payment disputes exceeding platform thresholds
• Dormant account reactivation with immediate high-value transactions

6.3 Alert Workflow

1. Automated alert generated by monitoring system
2. Alert reviewed by compliance analyst within 24–48 hours
3. If benign, alert closed with documentation
4. If suspicious, escalated to AML Compliance Officer
5. AML Compliance Officer determines whether SAR filing is required
6. Account action taken as appropriate (restriction, suspension, or termination)

6.4 Reporting

SARs are filed with FinCEN as required. All SAR decisions (filed or not filed) are documented and retained. SARs are never disclosed to the subject of the report.

7. OFAC / Sanctions Screening

7.1 Overview

The Company screens all customers against the OFAC Specially Designated Nationals (SDN) list and all applicable U.S. and international sanctions programs.

7.2 Screening Process

1. OFAC screening performed at account registration via Sumsub's AML screening service.
2. Ongoing rescreening occurs automatically when the OFAC SDN list is updated.
3. All potential matches reviewed manually by the compliance team.
4. True matches result in immediate account freeze and escalation to AML Compliance Officer.
5. OFAC notified and required reporting or blocking completed.

7.3 Screening Lists

• OFAC SDN (Specially Designated Nationals) List
• OFAC Non-SDN Consolidated Sanctions List
• UN Security Council Sanctions List
• EU Consolidated Sanctions List
• Politically Exposed Persons (PEP) databases
• Adverse media databases

7.4 False Positive Management

Documented procedures exist for resolving false-positive matches. All false-positive determinations are documented with supporting rationale and retained for a minimum of five years.

Document Approval

This document has been reviewed and approved by authorized representatives of OnPoint Administration LLC.

AML Compliance Officer. OnPoint Administration LLC | OnPointCasino.com. Date: April 12, 2026.