KYC & AML Policy

Effective date: 1 July 2026. This Know-Your-Customer and Anti-Money-Laundering Policy (the "Policy") records the identity-verification, transaction-monitoring and compliance obligations observed by WolfWinner N.V., a company incorporated in Curaçao under registration number 157447, with its registered office at Heelsumstraat 51, E-Commerce Park, Curaçao (the "Operator"). WolfWinner N.V. operates the online casino brand Wolf Winner Casino under Curaçao eGaming licence 8048/JAZ (full form 8048/JAZ2020-013). The Policy governs every natural person who opens an account on the Wolf Winner platform, and it is to be read together with the Terms & Conditions, the Privacy Policy and the Responsible Gambling framework. Continued use of the Site constitutes acknowledgement of the procedures set out below.

1. Regulatory Framework

The Operator is supervised by the Curaçao Gaming Control Board ("CGCB"), the national authority responsible for licensing and ongoing oversight of gaming operators established in Curaçao. Compliance obligations are drawn from the Curaçao gaming framework and from the applicable directives on the prevention of money laundering and the reporting of unusual transactions, in particular the National Ordinance on Reporting of Unusual Transactions and the National Ordinance on the Identification of Clients when Rendering Services, together with associated guidance issued to licensees.

The Policy is aligned with the international standards of the Financial Action Task Force ("FATF") on customer due diligence, ongoing monitoring, source-of-funds enquiry and record retention. WolfWinner N.V. does not hold, and does not represent that it holds, any Australian gambling licence; Australian users are welcomed on the basis that each Player accepts personal responsibility for compliance with the laws of the Player’s own place of residence.

The Wolf Winner review page summarises the licence particulars and the operator profile for readers who require the general commercial background before consulting this Policy.

2. Purpose of KYC

Customer due diligence is applied by the Operator in order to (i) confirm the identity of each User, (ii) confirm that the User has reached the minimum age of eighteen (18) years, (iii) confirm the User’s country of residence and (iv) confirm the User’s ownership of the payment methods used to fund the account. These enquiries are conducted to prevent identity theft, underage gambling, jurisdictional breach, bonus abuse, money laundering and terrorist financing. Verification also protects the Account Holder against unauthorised access to funds, since withdrawal proceeds are released only to the verified Account Holder using a payment method registered in the same person’s name.

3. When KYC is Triggered

Customer due diligence is applied on a risk-sensitive basis. Beyond the events listed below, verification may be requested by the Operator at any time during the account lifecycle where the applicable risk assessment so requires.

3.1 First Withdrawal

Full identity verification is mandatory at the point of the first withdrawal from an account, irrespective of the amount requested. No withdrawal is released until the verification file has been completed and reviewed. First-withdrawal review typically falls within the standard timing described in Section 6 below.

3.2 Cumulative Deposit Threshold

Verification is triggered once the aggregate value of deposits credited to the account exceeds AU$3,000. Aggregation is performed across all deposit methods and across the lifetime of the account. Once the threshold is reached, further transactions may be deferred until verification is complete.

3.3 Suspicious Activity

Irregular deposit or wagering patterns, chargebacks, refund requests, use of anonymising services such as virtual private networks or proxies, mismatches between the registered country of residence and the detected connection location, or any circumstance that gives the compliance team reasonable grounds for further enquiry may trigger verification outside the ordinary threshold events.

3.4 Jurisdictional Risk

Where the User is identified as connecting from, or as a resident of, a jurisdiction listed among higher-risk countries by international bodies, verification is applied at an enhanced level as described in Section 5.

3.5 Politically Exposed Person Match

Where screening indicates that the User, an immediate family member or a close associate is a Politically Exposed Person ("PEP") within the meaning of applicable AML guidance, verification is applied at an enhanced level and the account may be referred for senior-management sign-off before any transaction is released.

4. Required Documents

The documents set out in this Section are requested through the in-account verification portal. An equivalent alternative may be accepted at the discretion of the compliance team where the primary document is unavailable.

4.1 Photo Identification

A clear, unobstructed colour image of a valid government-issued photo identification document is required. Acceptable documents include a national passport, an Australian driver licence (front and back) and a national identity card issued by a recognised authority. All four corners must be visible, the machine-readable zone (where present) must be legible, and the document must fall within its validity period.

4.2 Proof of Address

A recent document evidencing the User’s residential address is required. Acceptable documents include a utility bill (electricity, gas, water, internet or landline), a bank or credit-card statement, a council rates notice or an equivalent official correspondence. The document must be dated within the preceding three (3) months and must show the User’s full name and residential address as registered on the account.

4.3 Payment-Method Proof

Ownership of each payment method used on the account is verified. For card payments, an image of the front and back of the card is required, with all digits masked except the first six and the last four, and with the CVV code obscured. For electronic wallets, a screenshot of the account overview showing the User’s name and the wallet identifier is required. For cryptocurrency deposits, a screenshot of the wallet interface identifying the sending address is required. For bank transfers, the front page of a recent bank statement is required.

4.4 Source of Funds

For deposits, or aggregate lifetime deposits, exceeding AU$10,000, or in any other circumstance where the Operator’s risk assessment so requires, documentation supporting the source of the funds deposited is required. Acceptable evidence is described in Section 5 below.

5. Enhanced Due Diligence

Enhanced Due Diligence ("EDD") is applied where a Player is identified as a PEP or a close associate of a PEP, where the Player is connected with a jurisdiction subject to enhanced monitoring under FATF or equivalent guidance, where the deposit profile of the account reaches the source-of-funds threshold described above, or where the account is otherwise assessed by the compliance team as presenting an elevated risk profile.

Additional documentation requested under EDD may include payslips or employment contracts, most recent tax returns or notices of assessment, sale-of-asset contracts (for example, evidence of the sale of real property, a vehicle or investment holdings), inheritance or gift documentation, business ownership records, dividend statements or, in the case of cryptocurrency deposits, a full transaction history from a regulated exchange showing acquisition of the funds. A written statement summarising the origin of the funds may be requested by the compliance team, and follow-up questions may be put in writing.

EDD review is generally completed within five (5) to fifteen (15) business days from receipt of the complete file. Where documentation is incomplete or where clarifications remain outstanding, the timeline restarts from the date on which the file is completed.

6. KYC Timing

6.1 Standard Review

Standard verification files are reviewed within twenty-four (24) to seventy-two (72) hours of receipt of a complete documentation set. Files received outside Curaçao business hours are timed from the next business day.

6.2 Enhanced Review

EDD files follow the extended timeline described in Section 5.

6.3 Periodic Re-verification

Periodic re-verification is applied by the Operator on active accounts on a twelve-to-twenty-four-month cycle. Re-verification is also triggered when a document previously accepted for the file expires (for example, on expiry of the passport or driver licence), when the account’s risk profile changes materially, or when the Player updates key registration details such as name, address or date of birth.

7. AML Compliance Measures

Transaction-monitoring, screening and reporting measures are applied by the Company on a systematic basis. General descriptions of these measures are set out below; operational thresholds, detection algorithms and vendor identities are treated as confidential and are not disclosed here.

7.1 Transaction Monitoring

Deposits, withdrawals, transfers between wallets and internal balance movements are monitored on a rules-based and pattern-based basis. Alerts generated by the system are referred to the compliance team for further review.

7.2 Sanctions Screening

Users are screened against consolidated sanctions lists maintained by the United Nations Security Council, the European Union and the Office of Foreign Assets Control of the United States Department of the Treasury, together with any additional lists which the Operator is required or elects to apply. A confirmed match results in the immediate suspension of the account and, where required, in a report to the competent authority.

7.3 PEP Screening

Users are screened against commercially available PEP databases, for example services of the SumSub or equivalent standard, and any match is escalated to senior management for review before further transactions are permitted.

7.4 Suspicious Activity Reporting

Where the compliance team forms a reasonable suspicion that a transaction, an attempted transaction or a series of transactions is connected with money laundering, terrorist financing or another predicate offence, an unusual-transaction report is filed with the Financial Intelligence Unit of Curaçao in accordance with the applicable National Ordinance. The User is not notified of the filing, and the Operator does not disclose whether a filing has been made.

7.5 Adverse Media

Adverse-media checks are applied where the risk assessment so requires. A confirmed material adverse finding may lead to the imposition of additional verification requirements or, where appropriate, to closure of the account.

8. Restricted Countries

Services are not provided by the Operator to Users resident in jurisdictions where the offering would be unlawful or where WolfWinner N.V. has elected not to accept business. Non-served jurisdictions include the United States, France, the Netherlands, Curaçao itself, Israel, Spain, the United Kingdom and further countries listed in the Terms & Conditions. Attempts to circumvent geographic restrictions by means of a virtual private network, a proxy, a smart-DNS service or otherwise constitute a material breach of the Terms and may result in the immediate closure of the account and the forfeiture of any bonus or associated winnings. Detected mismatches between the registered residence and the connection location are referred for compliance review.

9. Data Protection During KYC

Documents supplied for KYC and AML purposes are handled in accordance with the Privacy Policy and, to the extent applicable to Australian users, the Privacy Act 1988 (Cth). Uploads to the in-account portal are transported over Transport Layer Security ("TLS") 1.3. Stored files are encrypted at rest under the Advanced Encryption Standard ("AES") with a 256-bit key.

Access to the verification file is limited to authorised members of the compliance and payments teams on a need-to-know basis, and access is logged. Records are retained for a period of seven (7) years from the closure of the account, in accordance with the statutory retention requirement imposed on licensees under the applicable AML framework. Once the retention period has expired, records are deleted or irreversibly anonymised, subject to any legal hold in force at the time.

10. Account Actions During KYC Review

10.1 Deposits

Deposits may continue to be accepted during a standard verification review, subject to any account-level limit imposed by the compliance team. Where an account has been referred to EDD, further deposits may be paused.

10.2 Withdrawals

Withdrawal requests are held in a pending state until the applicable verification review has been completed. The weekly withdrawal cap of AU$10,000 continues to apply once verification is cleared. Further information on payout mechanics is set out on the withdrawal timing page.

10.3 Bonuses

Where suspected bonus abuse is identified by the compliance team, the associated bonus may be paused pending review, and, where abuse is confirmed, the bonus balance and any winnings derived from it may be voided in accordance with the Terms.

10.4 Account Freeze

Where a Player fails to complete the requested documentation within the timelines communicated by the compliance team, the account may be placed in a frozen state. A frozen account cannot deposit, withdraw or wager pending resolution.

11. Player Rights During KYC

The User has the right to receive a written explanation of the general reason for which verification has been requested. The User has the right to a review within the standard timing set out in Section 6 once a complete file has been submitted. The User has the right to appeal a denial through the internal complaints process described in Section 13, and the User has the right of access to personal data held by the Operator in accordance with the Privacy Policy.

12. Chargeback Protection

A card chargeback initiated in respect of a deposit that has been credited to the account and used for wagering is treated by the Operator as an attempted fraud. Users who have a dispute in respect of a transaction are asked to contact support through the twenty-four-hour chat channel before contacting the card issuer, so that the dispute can be resolved directly. Repeated or unresolved chargebacks may result in the permanent closure of the account, the forfeiture of any remaining balance and, where appropriate, the referral of the matter to fraud-prevention networks.

13. Complaints and Escalation

Complaints are handled internally in the first instance. The User should raise the complaint with Wolf Winner support through the twenty-four-hour live-chat channel, describing the relevant facts, the account identifier and the outcome sought. Where the internal review does not resolve the matter, the User may escalate to the Curaçao Gaming Control Board at the contact details published on the CGCB website. Where an alternative-dispute-resolution provider is designated by the Operator from time to time, contact details for that provider will be published on the Site.

14. Policy Changes

This Policy may be amended by the Operator from time to time in order to reflect changes in the applicable regulatory framework, changes in operational procedure or changes in the risk assessment applied to particular categories of activity. Material amendments are notified by e-mail to registered users at least fourteen (14) days before they take effect and are announced by a banner on the Site. Continued use of the services after the effective date of an amendment constitutes acceptance of the amended Policy. A prior version is available on request through support. For general commercial background please refer to the Wolf Winner Casino homepage, and for the payment framework please refer to the payment methods page.