1. DOCUMENT CONTROL

1.1. REVISION HISTORY

2. FOREWORD

Each Remote Gaming Licensee is defined in the Proceeds of Crime and Anti-Money Laundering Act of 2006 (POCAMLA), as a person who carries on the business of making available a gambling activity as contemplated in Betting, Lotteries and Gaming Act (Cap 131) of 1966 (“BGA”) as amended as a Remote Gaming Licensee, in respect of which a license is required to be issued by the applicable licensing authority.

The Remote Gaming Licensees as holders of a Remote Gaming license and is thus subject to POCAMLA. The platforms are web based and therefore no cash is accepted or paid out by way of the platforms. Payments are received only from Resellers or licensees against valid invoices and in accordance with signed agreements in respect of which KYC processes are undertaken.

Remote Gaming Licensee shall comply with the relevant provisions of the POCAMLA, the Money Laundering and Terrorist Financing Control Regulations (“the Regulations”) to the POCAMLA. The money laundering control measures prescribed by the POCAMLA impose certain obligations on Accountable Institutions, of the POCAMLA and are inter alia:

• The duty to identify clients (Part 1);
• The duty to keep record (Part 2);
• Sanction screening (Part 2A);
• Reporting duties and access to information (Part 3);
• Measures to promote compliance by Accountable Institutions (Part 4).

3. DEFINITIONS

In this Code of Conduct, the following words and expressions bear the meanings ascribed to them:

4. PURPOSE OF POCAMLA

The purpose of POCAMLA includes the following objectives:

• To establish a Centre in order to combat money laundering activities and the financing of terrorist and related activities.
• To impose certain duties on institutions and other persons who might be used for money laundering purposes and the financing of terrorist and related activities.
• To provide for customer due diligence measures including with respect to beneficial ownership and persons in prominent positions.
• To provide for a risk-based approach to client identification and verification.
• To provide for the implementation of financial sanctions and to administer measures pursuant to resolutions adopted by the Security Council of the United Nations.
• To clarify the application of the Act in relation to other laws.
• To facilitate information-sharing by the Centre and supervisory bodies.
• To provide for risk management and compliance programs, governance, and training related to combating money laundering and the financing of terrorism.
• To provide for the issuance of guidelines by the Centre and supervisory bodies.
• To provide for the registration of accountable institutions and reporting institutions.
• To establish the roles and responsibilities of supervisory bodies.
• To establish written arrangements regarding the respective roles and responsibilities of the Centre and supervisory bodies.
• To empower the Centre and supervisory bodies to conduct inspections.
• To regulate certain applications to the courts.
• To provide for administrative sanctions that may be imposed by the Centre and supervisory bodies.
• To establish an appeal tribunal to hear appeals against decisions of the Centre or supervisory bodies.
• To provide for stakeholder consultation arrangements.

5. PURPOSE OF THE CODE OF CONDUCT

It can be argued that the primary obligation of the Remote Gaming Licensee under the Act is to design and implement this Code of Conduct, which is a document that sets out how the Remote Gaming Licensee will (a) collect information about customers, (b) maintain records of its customers’ transactions, and (c) report information to the relevant authorities under certain circumstances, with (a) to (c) being crucial to the effectiveness of the Act.

The Code of Conduct is based on the "risk-based approach," under which an Accountable Institution has the discretion to assess whether each of its customers presents an AML, CFT, and Sanctions risk to the Remote Gaming Licensee and to what extent. The Customer Due Diligence (“CDD”) procedures followed concerning a particular customer must be tailored and proportionate to that customer's assessed ML/TF and Sanctions risk, as determined by the Accountable Institution in terms of its own Code of Conduct.

The Code of Conduct and, indeed, POCAMLA itself exist within the broader context of:

• Equatorial Guinea’s status as a member of the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG) and a United Nations member state.
• The Remote Gaming Licensee’s commitment to playing its role in protecting Equatorial Guinea’s financial system and constitutional democracy by effectively identifying and managing ML/TF and Sanctions risks to which the Remote Gaming Licensee is exposed and cooperating with relevant authorities as required.

The Remote Gaming Licensee recognizes the regulatory importance of adhering to the Act and thus acknowledges and commits to:

• Being a registered Accountable Institution.
• Applying a risk-based approach to ensure that measures to prevent or mitigate money laundering and terrorist financing are proportionate to the identified risks.
• Developing, documenting, maintaining, and implementing a Code of Conduct.
• Implementing robust and effective risk management systems and controls to comply with the Act’s requirements.
• Applying a risk-based approach when conducting measures to establish and verify the identity of specific customers with whom the Remote Gaming Licensee typically transacts or enters into a business relationship/single transaction.
• Taking measures to determine when a transaction is reportable to ensure compliance with the Act.
• Striving to identify, assess, and monitor ML/TF risks to prevent the exploitation of the Remote Gaming Licensee and to assist in combating AML/CFT and Sanctions.
• Training all its employees to effectively implement AML/CFT and Sanctions risk management and compliance.
• Training key persons, representatives, and supporting staff on the Act’s legal provisions.
• Continuously improving POCAMLA’s risk and compliance policies and processes to limit and control money laundering.
• Fostering a compliance culture within the Remote Gaming Licensee to adhere to legislation and enforce penalties for non-compliance.
• Safeguarding POCAMLA-related information and record-keeping.
• Protecting and safeguarding customer information.
• Reporting suspicious and unusual transactions.
• Customer risk rating and source of funds verification.
• Cash Threshold Reports: As previously mentioned, the Remote Gaming Licensee does not deal with cash as defined in POCAMLA as banknotes and coins.
• Ensuring that all prospective customers are screened against sanctions lists as required by the Act.
• Screening all prospective customers for adverse media as required by regulators.

This document will focus on the duties outlined above, as well as the measures the Remote Gaming Licensee must take to comply with POCAMLA and Anti-Money Laundering legislation more comprehensively. All employees must read and understand the duties expected of them, as well as the potential disciplinary measures the Remote Gaming Licensee may take in the event of non-compliance.

The Risk Management and Compliance Program (hereinafter "the Code of Conduct") has been developed as required under the terms of "POCAMLA." The Code of Conduct outlines the policies and procedures that all employees of the Remote Gaming Licensee must adhere to in order to comply with the following legislative framework:

• POCAMLA;
• Anti-Money Laundering and Counter-Terrorist Financing Control Regulations and its amendments;
• Guidance Notes;
• Prevention of Organized Crime Regulations;
• ESAAMLG;
• Prevention of Terrorism Act;
• Data Protection Act of 2019 (“DPA”).

The Code of Conduct is designed to meet all regulatory and statutory obligations, covering various related business activities, including customer identification, record-keeping requirements, internal controls, internal training, and internal communication and reporting procedures.

6. SCOPE OF APPLICATION AND PURPOSE

The Remote Gambling Licensee must ensure that there is appropriate responsibility, authority, and competence to manage POCAMLA/AML risks and sanctions, including the implementation and maintenance of the Risk Management and Compliance Program, and to ensure the suitability, effectiveness, and efficiency of key controls established to achieve these objectives.

6.1. ROLES AND RESPONSIBILITIES

6.1.1. Board of Directors

The Board of Directors of the Remote Gambling Licensee is responsible for appointing a person in charge of legal compliance. The Board of Directors, or the person with a high level of authority, bears the ultimate responsibility for ensuring that the institution maintains an effective internal structure for AML/CFT and Sanctions control through a Code of Conduct.

It is the responsibility of the Board and its delegated officers to approve any new product that the Remote Gambling Licensee wishes to create. Approval must be obtained along with the approval of the relevant Gaming Boards before launching a new product.

6.1.2. Executive Management

As the custodian of the Anti-Money Laundering control function, executive management is required to:

• Maintain a broad understanding of these Rules;
• Consider and decide on waiver requests to deviate from these Rules;
• Ensure compliance with these Rules;
• Monitor compliance with these Rules;
• Obtain and communicate management information when appropriate;
• Approve the business risk-based approach;
• Plan for succession;
• Ensure awareness and compliance with the requirements of these Rules and supporting policies;
• Ensure adequate staff training to comply with these Rules; and
• Oversee compliance with the requirements of these Rules.

6.1.3. Compliance Officer

The designated Compliance Officer or any person appointed as such by an Executive is responsible for compliance. The Remote Gambling Licensee and the AML Compliance Committee shall be responsible for enforcing and overseeing compliance with the provisions of the Law. The role of the Compliance Officer is to assist the Board of Directors or senior management of the institution in meeting their obligations. The candidate must be sufficiently competent and hold a senior level position to ensure the effectiveness of the compliance function. The Compliance Officer is responsible for ensuring that the Code of Conduct is updated and reviewed annually and/or upon any legislative changes.

6.1.4. POCAMLA Compliance Officer

The POCAMLA Compliance Officer is responsible for ensuring compliance with the provisions of this Law by the Remote Gambling Licensee as well as its employees.

6.1.5. AML Compliance Committee ("the AML Committee")

The AML Committee is responsible for reviewing compliance with the Code of Conduct and any other relevant matters. The AML Committee will oversee the development of the Code of Conduct.

The AML Committee will monitor compliance with the POCAMLA Code of Conduct. The Anti-Money Laundering Committee shall establish and approve AML structures and systems that subsidiaries, divisions, and business units within the Group will use to prudently manage risks.

The Anti-Money Laundering Committee shall ensure that risks and contributing factors, along with risk policies, are formally reviewed at least once a year or when circumstances change.

The AML Committee shall determine delegations of responsibility and authority regarding risk and compliance.

The AML Committee shall ensure that the adequacy and effectiveness of risk management and compliance within the Group’s divisions, business units, and processes are reviewed and approved by the relevant parties. The AML Committee shall ensure that risks and key decisions of the Group’s subsidiaries, divisions, and business units are considered.

6.1.6. Money Laundering Reporting Officer ("MLRO")

The MLRO shall be responsible for managing the Remote Gambling Licensee’s registration and administration process with POCAMLA. Whenever the MLRO knows or suspects that a person, transaction, or attempted transaction reported to them falls into any of the following categories, they must report the person, transaction, or attempted transaction to POCAMLA:

• The Company has received or is about to receive the proceeds of illegal activities or assets related to a crime related to terrorist financing and related activities;
• Any transaction or possible transaction about which a person is making inquiries;
• Facilitates or will facilitate the proceeds of illegal activities for the Remote Gambling Licensee;
• Facilitates or may facilitate the transfer of proceeds from illicit activities;
• Has no apparent commercial or legal purpose;
• Is conducted or will be conducted to prevent a reporting obligation under the Law;
• Appears to be an attempt to evade tax obligations;
• May cause the Company to be used in any way for money laundering purposes;
• Relates to a terrorist financing offense and related activities.

The MLRO must report to POCAMLA as soon as possible, but no later than 5 days (excluding Saturdays, Sundays, and public holidays) from the date the MLRO became aware or suspected the occurrence of a reportable transaction. Any submission made to the MLRO must be recorded by the MLRO and not in the general database of the Remote Gambling Licensee. The MLRO must have access to this database.

• Whenever a duly authorized POCAMLA representative requests additional information on a reported case, the POCAMLA Compliance Officer must provide the required information;
• Whenever the POCAMLA Compliance Officer deems it necessary to obtain additional information about a client who has established or is about to establish a business relationship that presents a high risk of facilitating money laundering activities, or if the POCAMLA Compliance Officer believes additional measures should be taken to help the Company identify the proceeds of potential illegal activities or money laundering activities, they must obtain sufficient appropriate information to determine whether transactions involving the client align with the Company’s knowledge of that client. This must include:
  • The source of the client’s income; and
  • The origin of the funds the person expects to use for the transaction or contract.

6.1.7. Operational Staff

All employees or designated persons shall be responsible for enforcing and/or monitoring compliance with the provisions of the Law, to the extent that they affect operations within their respective portfolios, and for reporting any reportable transactions, including suspicious or unusual transactions, in the prescribed format, as well as reporting assets associated with terrorism and related activities, violations, or non-compliance to the Compliance Officer.

All staff must familiarize themselves with POCAMLA requirements and these Rules to the extent that they impact client relationships and apply them when necessary. They must also recognize their duty to identify clients, maintain records, and report specified, unusual, or suspicious transactions.

If any Company employee fails to comply with POCAMLA and these Rules, they may face disciplinary action.

7. DUTY TO VERIFY CLIENT IDENTITY

7.1. CUSTOMER BASE

As a manufacturer, the company interacts with a limited customer base comprising both legal entities and individuals within the Republic of Equatorial Guinea, including foreign nationals. Broadly speaking, the customer base can be classified into the following groups:

• Gambling operators who pay license fees.
• Resellers of our products who earn a commission for reselling the products. They, in turn, will have the following customers:
  • Registered non-playing customers: Customers who register on our website out of curiosity or to use any registration bonus they may receive, without depositing or withdrawing any money.
  • Registered playing customers: Customers who register on our website and actively deposit and/or withdraw funds from their account. The Company considers that a relationship has been established on this basis.

7.2. SCOPE AND PURPOSE

The Law prohibits responsible institutions from establishing business relationships or carrying out even a single transaction with their customers unless they have established and verified the identity of the customers involved.

The Remote Gaming Licensee is required to establish and verify a customer’s identity each time a business relationship is established or a transaction is concluded with the customer.

8. PROCESS TO IDENTIFY CLIENTS

The prospective licensee the customer will be required to conduct a full POCAMLA and KYC as well as produce a copy of their license. A call is made to FraudCheck (“FraudCheck”) to verify the validity of the Identity Number as provided by the prospective client. These checks take place prior to the punter being able to register. These include sanctions and adverse media checks/screening. Please see lists below as provided by FraudCheck for screening purposes. If the prospective client fails the screening undertaken by FraudCheck, we will not proceed with the contract. The customer will be required to upload a copy of his/her ID and various documents as the need arises for the Business to conduct a manual verification check.

Please refer to the table below which details information as set out in the risk scoring section. All clients are identified and verified irrespective of amounts involved. This relates to a single transaction and aggregates of amounts as well.

8.1. FRAUDCHECK LISTS SCREENED AGAINST

All clients are screened via FraudCheck prior to registration. The lists below are as supplied and screened against using FraudCheck for sanctions and adverse media.

9. CUSTOMER VERIFICATION AND DUE DILIGENCE

Due to the broad scope of the customer base, it is not practical to determine whether prospective customers intend to establish long-term business relationships or conclude single transactions with the business. Given these factors, the Business has decided to focus CDD on the Risk Matrix and the rules stipulated further within this section of the Code of Conduct.

All customer verification and CDD functions are embedded within the Business' existing standard operating procedures (“SOPs”).

As part of good governance practice, all customer records are kept electronically. FraudCheck verifies the clients’ names, identity number and, the source of funds is requested at the registration process. Clients are requested to provide legible documents to Remote Gaming Licensee on registration on the on-line portal. Should the client fail to supply such documentation, they will be unable to withdraw any funds from the account and it is locked until they supply documents.

Further checks such as threshold recognition checks are performed by the organisation as this functionality is not offered by FraudCheck on account balances. FraudCheck cannot perform this function as they are not privy to the client’s deposit or withdrawal information. It is noted that all clients are checked against FraudCheck as part of the registration process. The Call Centre staff do perform additional due diligence when they perform investigations to ensure that PEPS and DPIPs etc., do not form part of the client base at any one time. All verification and identification of clients takes place in house and are not outsourced to any third parties. Ongoing due diligence is undertaken for all who have made a deposit into their account during any quarter of the review period.

In those instances where a manual verification takes place, which is triggered by a report as received from FraudCheck, the Compliance Officer will pull both transactions and documents for the respective client and investigate the client. If it is found that the report does not warrant further investigation, the Compliance Officer will note this and close the investigation. Should the FraudCheck report indicate that there is a match to an individual as listed on the various lists provided by FraudCheck, again the Compliance Officer will investigate same. If the outcome is that the alert received, is not in line with the risk appetite of Remote Gaming Licensee, the Compliance Officer will obtain signoff from senior management to terminate the client relationship. Record is kept of all investigations and monitoring undertaken for the business to refer to in need. To avoid any clients going undetected or where their personal status may have changed to a PEP as an example, the entire client database is screened against FraudCheck lists to detect anything untoward. As mentioned above, if client behaviour triggers a concern or suspicion, the client is flagged on the system for further investigation.

9.1. ANONYMOUS CUSTOMERS

The Business is strictly prohibited from dealing with anonymous persons, or persons who have fictitious names in accordance with. The Business must, by adhering to the provisions of this Code of Conduct, ward against the risk of:

• Dealing with an anonymous person by refusing to on-board anybody who appears to desire or expresses a desire to transact with the business anonymously;
• Dealing with a fictitiously named person by subjecting all Prospective Customers to the CDD procedures described in the Code of Conduct, which procedures are aimed at ensuring, amongst other things, that the Business only deals with persons who exist.

9.2. VERIFICATION AND IDENTIFICATION OF CUSTOMER (KYC)

The Business’ system will automatically keep the following information on record for each registered customer:

• Name and surname;
• ID Number or Passport Number;
• Contact Number;
• Bank account Number;
• Address details;
• Driver’s License details.

Before concluding a single payment transaction with a customer irrespective of the amount of the transaction, the following details of a customer must be requested:

For foreign nationals, the process is the same as for Equatorial Guinean citizens except for checks being performed by FraudCheck on their passport numbers to ensure validity as opposed to an identity number. They also must confirm on the system whether they are not an Equatorial Guinean and must tick a block reflecting this. For these clients they are required to provide all POCAMLA documents (as per table above) prior to registration. If they fail to provide these documents, they cannot register and the system will block any attempt to do so.

9.3. DOUBTS ABOUT THE ACCURACY OF EXISTING INFORMATION

Where an employee has doubts about information that it previously obtained from an existing client, it must take reasonable steps to satisfy itself as to that information’s accuracy or otherwise, and such reasonable steps may include (without limitation):

• Requesting from the client an original document, if a certified copy thereof was originally accepted;
• Requesting from the client a copy that is certified more recently than the copy that was originally accepted;
• Requesting from the client a document generated by a Governmental Authority or other independent person, where a document generated by the client was originally accepted;
• Employing any other reasonable measure to satisfy itself as to the accuracy or otherwise of the information.

Should the measures as listed above:

• Reveal the accuracy of any previously obtained information, then the affected information must be updated accordingly;
• Reveal the inaccuracy of any previously obtained information, then the affected information must be updated accordingly;
• Provide no clarity regarding whether the information is accurate or not, then the Risk Officer of Remote Gaming Licensee must consider the importance of that information’s correctness in light of Remote Gaming Licensee’s ML/FT risk, if, in the discretion of the Risk Officer, the correctness or incorrectness of the information sought has a material bearing on the ML/FT risk to which Remote Gaming Licensee is potentially exposed.

Betting accounts may not accept funds if the client identification and verification process has not been completed. A list of prescribed documents is contained in the table below regarding POCAMLA verification documentation.

10. ONGOING CUSTOMER DUE DILIGENCE OF BUSINESS RELATIONSHIPS (ODD)

The Remote Gaming Licensee must closely monitor and compare each transaction concluded with a client with whom a business relationship has been established. In this way, a pattern will be established of the nature and average monetary value of the client’s transaction(s).

When it becomes clear that a client is transacting/behaving out of this established norm/pattern, the person who becomes aware of this must immediately inform the POCAMLA Compliance Officer. The Remote Gaming Licensee must identify this transacting behaviour and establish:

• The reason(s) for this transacting behaviour;
• The source of the funds that financed the transaction, which is out of the client’s norm.

A client who has transacted/behaved out of his/her established norm/pattern must provide the Remote Gaming Licensee with additional documents as contemplated by the Compliance Officer, before the client will be permitted to transact again.

The Compliance Officer will then decide whether any additional documents must be provided by the client as mentioned above. The Compliance Officer will also have to decide whether the client must fall into a higher risk category.

The Business' automated system is configured to periodically (every month) scan the details of the existing playing customers (long-term customers) against the watch lists. The Business’ Compliance Officer/s will be notified when positive matches are identified or a high-risk is determined. These identified customers will be placed on the Business' Blacklist for flagging and prevention of high-risk future transactions.

11. ENHANCED CUSTOM DUE DILIGENCE (EDD)

The Business' automated systems apply the following enhanced CDD procedures, pertaining to all customers, and will notify the Business' Compliance Officer/s of the necessary risk actions to be taken:

• A customer will be screened against several watch lists, as detailed in POCAMLA, on an ongoing basis to identify:
  • Sanctioned individuals;
  • Organised crime and threat finance;
  • Politically Influential Person relationships, both domestic and foreign.
• The following review and approval procedures will be adopted and administered by the Compliance Officer/s:
  • As indicated, PEPs, etc., do not form part of the client database;
  • Continue screening identified PEPs against the sanction watch lists.

All details of risk monitoring activities performed are recorded on the Business' automated system (As per SOP in Appendix C). The automated system will automatically create Suspicious and Terrorist reports in the event of customers being positively matched against entities/persons contained in the Sanctions or Terrorist lists. The Business' Compliance Officer/s will automatically be alerted when suspicious or terrorist reports are created. The Compliance Officer/s will thereafter notify Management who will conduct the Review and Approval process.

The Manager will access the Business' automated System and review the positive matches found as per the watch-list detailed below. The respective Manager will thereafter disable the accounts of the confirmed high-risk individuals who pose a threat to the business. The Compliance Officer will simultaneously ensure that the necessary reports are lodged with the POCAMLA where applicable.

Taking the above into consideration, EDD can only be performed on the betting behaviour of the said client. This is a general practice in gambling organisations to closely monitor the deposits, withdrawals, and betting patterns of a client. If the need does arise for EDD to be performed, the Compliance Officer will retrieve all information related to the client, this includes KYC documents as well as the record of all transactions. This is investigated on the back-end of the system as the Compliance Officer can retrieve the necessary information to perform EDD if required. Triggers that may result in EDD being performed out of cycle will be betting behaviour and possibly when a suspicion is formed and further investigation is required to ensure that the client is compliant. It is noted that under no circumstances may a client withdraw any funds until such time as they have provided a complete set of KYC documents.

When compliance monitoring is undertaken, those clients who made a deposit in the quarter under review are checked during this process as part of the monitoring sample. As mentioned, those clients who appear to be suspicious are flagged, investigated and reported where applicable.

12. INTERNAL CONTROLS – PROCESSES AND PROCEDURES

12.1. REPORTING

12.1.1. CASH THRESHOLD REPORTING (“CTR”)

The transactions are online and therefore no cash is accepted or paid, hence Remote Gaming Licensee does not perform any cash threshold reporting to the POCAMLA.

12.1.2. SUSPICIOUS AND UNUSUAL TRANSACTIONS

Any transaction that is unusual or suspicious for purposes of the Act, as being out of the ordinary having regard to the nature of the transaction or knowledge of the client’s betting trends/behaviour whether the transaction involves a substantial amount of money, such be reported in the prescribed manner. Use of a fraudulent document or other documents required for purposes of the Act may also indicate a suspicious transaction. Section 29 of the Act places the following duty on all persons employed by Remote Gaming Licensee:

• A person who carries on a business or oversees or manages a business or who is employed by a business and who knows or suspects that:
• Remote Gaming Licensee has received or is about to receive the proceeds of unlawful activities;
• A transaction or series of transactions to which Remote Gaming Licensee is a party:
• Facilitated or is likely to facilitate the transfer of the proceeds of unlawful activities;
• Has no apparent business or lawful purposes;
• Is conducted for the purpose of avoiding giving rise to a reporting duty under this Act;
• May be relevant to the investigation of an evasion or attempted evasion of a duty to pay any tax, duty or levy imposed by legislation administered by the Commissioner for the Equatorial Guinean Revenue Services;
• Remote Gaming Licensee has been or is about to be used in any way for money laundering purposes.

Must, immediately after the knowledge was acquired or the suspicion arose, report to the POCAMLA the grounds for the knowledge or suspicion and the prescribed particulars concerning the transaction or series of transactions.

Staff/Business can file the report with the appointed Compliance Officer or reporting Officer who can then electronically forward the report to the POCAMLA. The Act has guaranteed that such reports will remain confidential.

The person reporting such a transaction must submit all the details as required by Suspicious or Unusual Transaction Report as described above as provided in Remote Gaming Licensee POCAMLA file and obtain all relevant information from the client concerned as far as possible. The Manager or Supervisor in charge can be called to assist the person to obtain this information.

The completed report must be forwarded to the MLRO as soon as possible and be treated as a confidential report by all people involved. If in doubt, the Manager or Supervisor must consult the operations Manager or a person with similar responsibility of the POCAMLA Compliance Officer, for further assistance.

The POCAMLA Compliance Officer or MLRO will electronically forward a report under this section to the POCAMLA within fifteen (15) working days and in the manner prescribed by the Act.

All reports to the POCAMLA must always remain confidential. The person making the report may not disclose to any other person that he or she has made the report or any information regarding the contents of any such report, including the person in respect of whom the report is or must be made, otherwise than:

• Within the scope of the powers and duties of that person in terms of any legislation;
• For carrying out the provision of the Act;
• For legal proceedings, including any proceedings before a judge in chambers;
• In terms of an order of court.

No person who knows or suspects that a report is or will be made may disclose this fact to any other person. Suspicious transaction reporting is completed on any transaction irrespective of the amount.

12.1.3. SANCTIONS AND ADVERSE MEDIA SCREENING

Sanctions and adverse media screening is performed on all potential clients, especially those from known sensitive countries via FraudCheck. Screening is performed on an ongoing basis to ensure that clients are identified who may pose a risk to the company, be this PEP, DPIP, FPIP terrorist and/or sanctions. The screening takes place prior to establishing a business relationship or on a single transaction.

12.1.4. PROPERTY ASSOCIATED WITH TERRORIST AND RELATED ACTIVITIES

Should Remote Gaming Licensee have in its possession or under its control property owned or controlled by or on behalf of, or at the direction of the following entities, Remote Gaming Licensee must within five (5) days report that fact and the prescribed particulars to the POCAMLA. Should Remote Gaming Licensee become aware of customers in sanctioned countries, they will terminate the relationship if the customers are from these countries.

Such clients are:

• Any individual which has committed or attempted to commit, or facilitated the commission of a specified offence as defined in POTA;
• A specific individual identified in a notice issued by the President under POTA.

The Customer Service Department of Remote Gaming Licensee and the MLRO will reasonably verify the customer database against the United Nations list of terrorists and terrorist organisations, which is subject to a notice issued by the President under Section 25 of POTA.

For the purposes of POTA, the verification of all POCAMLA clients against the United Nations list of terrorists and terrorist organisations will be done at inception of an account. The MLRO must then file a report with the POCAMLA of any clients found on the United Nations list within five (5) working days after the fact. Remote Gaming Licensee is required to screen all prospective customers and any related party, to ensure compliance with sanctions and anti-terrorism regulations and that the relationship will not create undue reputational risk. Prospective customers must be screened against checklists containing details of known terrorists, money laundering, sanctioned entities, PEPs, and similar high-risk individuals, with specific reference to identifying the following:

• Prohibited customers, such as screening against a list of countries subject to sanctions;
• Politically Exposed Person (PEPs);
• Foreign Prominent Public Officials (FPPOs);
• Domestic Prominent Persons (DPIPs);
• Undesirable individuals, groups, or companies (reputational risk screening).

Certain types of customers may carry reputational implications that required further assessment prior to acceptance. If any PEP, FPPO or DPIPs are detected, the relationship is terminated. The account is locked and an investigation is undertaken. On completion of the investigation, if applicable funds may be refunded after POCAMLA verification has taken place. Any cause for concern should be referred to senior management for guidance.

13. RECORD KEEPING

To establish a business relationship or conclude a single transaction with a customer, the Business must obtain information from the prospective customer as stipulated in section 21 of the POCAMLA and keep a record of the acquired information. Without limiting section 22 of the POCAMLA, which details the information required to be kept on record, the records must:

• Include copies of, or references to, the information provided to or obtained by the AI to verify a person's identity;
• In the case of a business relationship, reflect the information obtained by the AI concerning:
  • The nature of the business relationship;
  • The amounts involved;
  • All accounts that are involved in transactions concluded by that AI during that business relationship;
  • Any document or copy of a document obtained by the AI to verify a person’s identity;
  • If the transaction is related to E-Wallet, the Business can trace/track the transaction and where it was paid, which includes amount and account level. The mobile phone number is recorded as provided by the punter at registration.

The Business will keep a record of every business relationship and transaction that takes place in the ordinary course of business which can be readily available upon request. The records must reflect, but not be limited to, the following information:

• The amount involved;
• The date on which the transaction was concluded;
• Parties to the transaction;
• The nature of the transaction and correspondence related to the transaction.

The Business must keep all records for at least 5 (five) years from the date on which the business relationship is terminated and from the date on which a transaction is concluded. The information will be recorded at source, as indicated within the Business' SOPs in Appendices B, C and D, and will be stored in electronic form by the Business' automated system providers.

The records will be backed-up frequently. Should POCAMLA request any information from the Business, such request shall be directed to and overseen by the Compliance Officer/s, who will respond accordingly with the required information.

No Manager or employee is permitted to destroy or amend any records; any gross negligence or wilful non-compliance in this regard will result in Disciplinary Action. Remote Gaming Licensee and all employees are expected to be responsible about collecting, processing, storing, and sharing another person’s information in line with the Protection of Personal Information Act (DPA Act).

14. TRAINING

The POCAMLA Compliance Officer must ensure that all staff that interact and transact with clients on behalf of the Company, as well as staff responsible for implementation of these rules are trained to understand and implement the provisions of POCAMLA and these Rules. This includes that all new staff in this category receive this training as part of their induction or as soon as possible after employment, within a maximum period of 30 (thirty) days.

The Compliance Officer will ensure ongoing training for employees; as well as promoting compliance and being up to date with the latest regulatory changes. Refresher training will be provided to employees annually and when new amendments to legislation are implemented and in consultation with management when it is deemed necessary by the Compliance Officer. A register of all POCAMLA training sessions must be kept by the POCAMLA Compliance Officer. An appropriate training manual must be provided and updated whenever required.

Each employee is obliged to read through the POCAMLA training material and receive POCAMLA training. An employee must ensure that he/she fully understands the contents, duties, and obligations in terms of POCAMLA and know how to identify and report a suspicious transaction. After reading the POCAMLA training manual and receiving POCAMLA training, each employee must sign and date a training register, which is to be kept on file and updated after training has taken place. All staff will be subjected to undertake an assessment, which will have a pass mark of 80 (eighty) percent. Should a staff member fail to achieve this pass mark, he/she will be subjected to training and assessment again.

15. TERMINATING A BUSINESS RELATIONSHIP

The Company may wish to exit existing business relationships due to Money Laundering and/or Terrorist Financing risk involved. The Business should initiate steps to exit customer relationships in the following circumstances where:

• The Company considers the customer to be involved in criminal activity;
• The Company is made aware that the customer is now:
  • Listed on a relevant sanctions list;
  • Listed on an internal caution list;
• The customer refuses without explanation to provide additional KYC information as required (applicable where a customer changes business entity and/or risk category for example, from a betting account holder to a walk-in punter);
• The operation of policy is commercially judged unacceptable considering Money Laundering and Terror Financing risk posed; and
• The customer poses an unacceptable reputation risk.

The Risk Officer must terminate a business relationship with a client in respect of whom CDD or ODD cannot be conducted. An employee who is unable to conduct CDD or ODD must immediately upon realizing his/her inability inform the Risk Officer in writing of:

• The client involved; and
• The reason(s) for which CDD or ODD cannot be conducted.

If the Risk Officer agrees with this assessment, then they must advise the client involved that:

• Remote Gaming Licensee is terminating their relationship; and
• The reason for termination is Remote Gaming Licensee’s inability to conduct CDD per POCAMLA and Code of Conduct (providing underlying reason(s) for inability).

Not terminating Remote Gaming Licensee’s relationship in these circumstances would constitute a serious breach of its legal duties. Where practically possible, this shall be communicated in writing to clients.

16. TIPPING OFF

When confronted with the facts that the client may be involved with criminal activity, an Accountable Institution is under an obligation to report it. If this is not done, the person involved will be guilty of an offence;

A person cannot afford to turn a blind eye to keep a profitable client or close a deal – it is an offence to not report suspicious and unlawful transactions and failure to do so will result in a heavy fine or prison sentence as well as a criminal record;

A whistle blower according to the dictionary is an informer who exposes a wrongdoing in the hope of stopping it. In the past they were regarded as troublemakers and disloyal employees, but in the new arena we find ourselves in a situation where corporate governance and transparency has come to the protection of those who speak out about wrongdoing;

Protection of whistle blowers can be found in the POCAMLA legislation as follows:

• The whistle blower is not compelled to appear in court;
• The whistle blower’s details will be protected.

Note: a person reporting a suspicious transaction to the POCAMLA is not allowed to remain anonymous. Their details are, however, protected during the prosecution process.

The “Whistle-blowing Act”, aims to protect a person who reports a criminal act or intended criminal act by stating that employers are not allowed to:

• Dismiss, suspend, demote, harass, or intimidate the employee;
• Take disciplinary action;
• Transfer the employee against their will;
• Refuse due transfer or promotion;
• Alter employment conditions unilaterally;
• Refuse an employee a reference or give them an adverse reference;

17. RISK SCORING AND ASSESSMENT

Remote Gaming Licensee must, when identifying a client, categorise the client as being high, medium, or low risk. Risk ratings are generally determined by client betting behaviour. When a client has been categorised as being low risk, Remote Gaming Licensee must obtain an official identification document.

18. ASSESSMENT AND RISK

The Business conducts a risk assessment, taking into consideration the required RBA, to decide on the appropriate level and type of CDD to apply to a customer, business relationship and single transaction. The Business also takes recommendations and guidance from external authorities into consideration, such as ESAAMLG.

The assessment focuses on the types of risks that exist within the gambling sector as indicated by the ESAAMLG including but not limited to the potential customers of the business, geographic risks, and the average spend of customers.

The business chose to focus primarily on CDD and the associated reporting obligations. Upon registration all new customers undergo an identity verification check which is conducted by FraudCheck (“FraudCheck”). Further details in respect of customer verification are detailed in Section 8 of the Code of Conduct.

The factors which will escalate a customer's risk rating include, but are not limited to, the following:

• A customer's unreasonable resistance or unwillingness to provide requested CDD documentation;
• Inconsistencies between the provided CDD documentation and the existing customer information on record;
• Suspicious account activity and/or transactions;
• Being flagged against sanction watch lists;
• Being identified as a PEP or as a family member or associate of a PEP.

Customers who deposit or request for funds to be withdrawn from his/her betting account, for the first time will be requested to provide his/her ID/Passport and proof of residence, customers will also be requested to state his/her source of wealth/funds on-line by using the drop-down facility provided. All escalations are sent to the Compliance/Money Laundering team for consideration.

19. TRANSACTIONS

All transactions between the Business and the customer take place in terms of reseller or license agreements.

20. REGISTRATION WITH POCAMLA

The Business is required to register with the Financial Intelligence Center (POCAMLA) within 90 (ninety) days from the date the business commences. The Business will ensure that the registration is completed and submitted to the POCAMLA within the stipulated period using the goAML registration system.

The Compliance Officer or nominated representative will update the registration information of the Business on the goAML platform should there be any material changes, subject to Management approval.

21. REPORTING PROCEDURES

The Business has implemented a strict reporting process to report any POCAMLA-related reports that may be identified during the ordinary course of business. These processes have been clearly documented and illustrated in Appendices B, C, and D. Details of the SOPs can be requested directly from the Compliance Officer/s or the Operational Managers. The process has been set out in the stages detailed below for ease of reference. Any deviation from this process will require the approval of the Board of Directors.

STAGE 1:

Stage one of the process requires a customer to register on the Business’ website by providing all the relevant information required in accordance with section 8 of this Code of Conduct. This is done prior to the commencement of the business relationship (i.e., the depositing or withdrawing of funds by a customer). Once the information has been completed and submitted for processing, the automated systems will automatically conduct the respective due diligence and reporting.

STAGE 2:

Stage two requires the staff member to verify the transactional information before the conclusion of the business transaction. The staff member is required to review the FraudCheck report with their respective Supervisor. Once completed, the report must be submitted to the Compliance Officer.

Suspicions must not be discussed with anyone other than the Fraud and Risk Team, Management, and the Compliance Manager/Officers. Once the reporting process has commenced, it must be followed through to completion. All reports will be kept electronically by the Compliance Officer/s for record-keeping and referral purposes.

It is of vital importance, regardless of whether the suspicions are proven to be true or not, that no mention of these suspicions is made to the customer. Any discussion of this nature risks constituting a tipping-off offense. Staff members must neither confirm nor deny the existence of a report to the customer or any third party. Any correspondence that may indicate the existence of a report must not be placed in the customer’s file for record-keeping purposes.

STAGE 3:

Stage three of the process involves submitting the information in the prescribed format to POCAMLA. The process is exclusively overseen by the Compliance Officer/s. The Compliance Officer/s must prepare the report for approval by Management. Thereafter, the approved report must be submitted to POCAMLA electronically via POCAMLA’s online reporting portal.

In accordance with Stage 3 of the reporting procedures, the automated systems will compare customer information against existing sanctions lists and will automatically generate a Terrorist Property Report (TPR) or a Terrorism Financing Transaction Report (TFTR) if a sanctioned person is identified, immediately alerting the Business’ Compliance Officers. Subsequently, the Compliance Officer/s will notify Senior Management, who will conduct the review and approval process.

Once Management has given the go-ahead after completing the review process, the Business will immediately freeze the property/transaction as per POCAMLA’s instructions and cease doing business with the individual in question. The Compliance Officer will complete a TPR or TFTR and submit it to POCAMLA.

It is important to note that under no circumstances should the suspected individual be alerted to the report being made under section 28A of POCAMLA, nor should the matter be discussed with anyone other than the Compliance Officer. Tipping-off is an offense under POCAMLA.

22. REPORTING OF SUSPICIOUS AND UNUSUAL TRANSACTIONS (MONEY LAUNDERING) AND/OR TERRORISM FINANCING

If the Business or any of its employees knows or ought to have known or reasonably suspected that:

• The Business has received or is about to receive the proceeds of illicit activities or property related to an offense related to terrorism financing and associated activities;
• A transaction, or a series of transactions in which the Business is a party:
• Has facilitated, or may facilitate, the transfer of the proceeds of illicit activities or property related to an offense related to terrorism financing and associated activities;
• Has no apparent business or lawful purpose;
• Is carried out to avoid triggering a reporting obligation under POCAMLA;
• May be relevant to an investigation into tax evasion or attempts to evade any tax, duty, or levy imposed by law;
• Involves transactions with individuals whose names appear on the TFS list;
• The Business has been used or is about to be used in any way for money laundering purposes or to facilitate the commission of an offense related to terrorism financing and associated activities.

A Suspicious and/or Unusual Transaction Report must then be completed and submitted to POCAMLA.

Multiple payments received over 24 hours (one business day) that are suspected of being structured to evade a reporting requirement must be reported as a suspicious or unusual transaction. Additional guidance on identifying suspicious transactions/activities is provided during our internal training sessions. This also includes transactions that may appear suspicious regardless of their amount. As a Reporting Institution, the Remote Gaming Licensee has a duty to report whenever a suspicion is formed. This also includes transactions that may appear unusual and outside the norm for a particular customer.

In accordance with Stage 3 of the reporting procedures, the automated systems will compare customer information against existing sanctions lists and will automatically generate an STR or SAR if a sanctioned person is identified, immediately alerting the Business’ Compliance Officers.

Subsequently, the Compliance Officer/s will notify Senior Management, who will conduct the review and approval process. Once Management is satisfied that a transaction is suspicious and/or unusual, the Compliance Officer will submit the report to POCAMLA within 15 (fifteen) days of becoming aware of the situation.

The Compliance Officer will monitor daily and respond to requests for additional information in a timely manner in accordance with sections 27 and 32 of POCAMLA. If a written directive is received under section 34 of POCAMLA, the Compliance Officer must ensure that all affected transactions are identified and frozen.

It is important to note that under no circumstances should the suspected individual be alerted to the report being made under section 29 of POCAMLA, nor should the matter be discussed with anyone other than the Compliance Officer. Tipping-off is an offense under POCAMLA.

25. LEGAL STATUS AND REVIEW OF CODE OF CONDUCT

This Code of Conduct is legally binding on the Business and all employees; any non-compliance herewith is to be regarded by the Business as gross misconduct.

The Business is required to review and update this Code of Conduct annually from the effective date. Notwithstanding the annual interval, if, in the Compliance Officer's discretion, there is a change in the circumstances of the Business or where there is a legislative change to the relevant legislation that warrants a review of the Code of Conduct in-between the annual interval then:

• The Compliance Officer may affect such amendments to the Code of Conduct as are appropriate, considering such changes, which will be subject to Board approval;
• The annual review period shall begin to run anew from the date on which the amendments are affected by the Board.