This Anti-Money Laundering and Know Your Customer Policy ("Policy") sets out the obligations of luckyzap ("we", "us", "our"), operated at luckyzaps.org, in relation to the prevention of money laundering, terrorist financing, and related financial crime. luckyzap is licensed by the Curaçao Gaming Control Board ("GCB") and is committed to full compliance with all applicable anti-money laundering regulations, licensing conditions, and international standards. All players, staff, and third-party partners interacting with luckyzaps.org are bound by the principles contained in this Policy.

1. Introduction and Purpose

Money laundering is the process by which the proceeds of criminal activity are introduced into, moved through, or extracted from the legitimate financial system so as to conceal their true origin. Terrorist financing involves the provision or collection of funds intended for use in acts of terrorism, regardless of whether those funds are themselves derived from criminal activity. Both represent serious threats to the integrity of the financial system and to society at large.

luckyzap operates under a Curaçao GCB licence and takes its obligations to prevent financial crime seriously. The purpose of this Policy is to:

• Define the procedures by which luckyzap identifies and verifies the identity of its customers;
• Set out the monitoring and reporting obligations that apply across all payment channels, including Visa, Mastercard, PayID, Apple Pay, Google Pay, Revolut, and cryptocurrency (Bitcoin and USDT);
• Describe the risk-based approach luckyzap applies to customer due diligence;
• Explain the rights and obligations of customers during the verification process;
• Establish internal controls, record-keeping requirements, and escalation procedures.

This Policy applies to every registered account on luckyzaps.org, every deposit, withdrawal, and bonus redemption made on the platform, and every member of luckyzap's operations and compliance teams.

2. Legal and Regulatory Framework

luckyzap holds a gaming licence issued by the Curaçao Gaming Control Board. All operations conducted at luckyzaps.org must comply with the conditions of that licence, which include obligations relating to player identification, transaction monitoring, suspicious activity reporting, and record retention. In addition to its licence conditions, luckyzap applies the standards articulated in the Financial Action Task Force (FATF) Recommendations as a baseline for its AML/CFT programme.

Where a customer's country of residence imposes additional AML or data-protection obligations, luckyzap will take reasonable steps to apply those obligations to the relevant account. Players bear responsibility for ensuring that their use of luckyzaps.org complies with the laws applicable in their own jurisdiction.

3. Scope

This Policy applies to:

• All natural persons who register, or attempt to register, an account at luckyzaps.org;
• All financial transactions processed through the platform, including casino deposits and withdrawals, sportsbook stakes and payouts, bonus credits, cashback payments, rakeback distributions, and tournament prize settlements;
• All payment methods supported by luckyzaps.org, namely Visa, Mastercard, PayID, Apple Pay, Google Pay, Revolut, Bitcoin (BTC), and Tether (USDT);
• All currencies accepted on the platform, including euro (EUR) and Swedish krona (SEK), as well as cryptocurrency equivalents;
• All members of luckyzap's staff who handle customer accounts, process transactions, or make compliance decisions.

4. Know Your Customer (KYC) Programme

4.1 KYC Philosophy

luckyzap uses Sum and Substance ("Sumsub") as its automated identity-verification provider. Sumsub is an established, AI-assisted KYC platform that processes document checks, liveness tests, and database screenings in real time, without requiring manual document submission by email or lengthy back-and-forth with a compliance agent. The goal is to complete standard verification quickly and accurately, so that legitimate players can deposit, withdraw, and claim bonuses without unnecessary delay.

4.2 Customer Identification and Verification

Before a customer may withdraw funds from luckyzaps.org, and at any earlier point that our compliance team considers appropriate, luckyzap will require the customer to complete identity verification. The standard documents and information required are:

• Proof of Identity: A valid, government-issued photo identity document — typically a national identity card, passport, or driving licence. The document must be current (not expired), clearly legible, and must show the customer's full legal name, date of birth, and photograph.
• Proof of Address: A document confirming the customer's residential address, such as a utility bill, bank statement, or official government correspondence, dated within the last three months.
• Proof of Payment Option: Where required by our risk assessment, confirmation that the payment method belongs to the customer — for example, a screenshot or statement showing the last four digits of a card, or the wallet address used for a cryptocurrency deposit.
• Selfie / Liveness Check: A real-time liveness check conducted through the Sumsub interface, confirming that the person submitting documents is the same individual pictured on the identity document.

All verification is handled within the Sumsub automated flow. Customers will be guided through each step directly on luckyzaps.org or via a secure Sumsub link. luckyzap does not accept documents sent to [email protected] as a substitute for completing the Sumsub verification flow, though our support team is available 24/7 via live chat and at [email protected] to assist with any technical difficulties encountered during the process.

4.3 Timing of Verification

luckyzap applies a risk-based approach to the timing of KYC checks:

• At registration: Basic account information is collected, including full name, date of birth, residential address, email address, and preferred currency. This information is subject to internal screening at sign-up.
• Before first withdrawal: Full KYC verification through Sumsub must be completed before any withdrawal is processed. The minimum withdrawal threshold at luckyzaps.org is €40 / 400 SEK. No withdrawal will be released until identity verification is confirmed.
• At cumulative deposit thresholds: luckyzap may trigger enhanced due diligence checks when a customer's cumulative deposits or account activity reach internal risk thresholds, even where a withdrawal has not yet been requested.
• At any time: luckyzap reserves the right to request KYC documentation at any point during the customer relationship, including where a change in account behaviour, a high-value transaction, or a compliance flag warrants further scrutiny.

4.4 Age Verification

luckyzap does not permit persons under the age of 18 to register or use luckyzaps.org under any circumstances. Age verification forms an integral part of the Sumsub identity check. Where there is any doubt about a customer's age, the account will be restricted pending satisfactory verification. If verification reveals that a customer was under 18 at the time of registration, the account will be closed immediately, all deposits will be returned (less any withdrawals already made), and any winnings will be forfeited.

4.5 Source of Funds and Source of Wealth

Where a customer's transaction patterns, account balance, or depositing behaviour indicates that additional scrutiny is warranted, luckyzap will request evidence of the customer's source of funds and, where appropriate, source of wealth. This may include, but is not limited to:

• Recent payslips or employment contracts;
• Bank statements covering an appropriate period of account activity;
• Evidence of investment returns, pension income, or business ownership;
• Any other documentation that reasonably demonstrates the legitimate origin of funds being deposited at luckyzaps.org.

Customers are required to respond to source-of-funds requests promptly. Failure to provide satisfactory evidence within a reasonable timeframe may result in account restriction, suspension of withdrawal processing, or account closure.

4.6 Politically Exposed Persons (PEPs)

A Politically Exposed Person is an individual who holds, or has held, a prominent public position — such as a head of state, senior politician, senior judicial or military official, senior executive of a state-owned enterprise, or an important political party official — together with their immediate family members and known close associates.

luckyzap screens all customers against PEP databases as part of the Sumsub verification flow. Where a customer is identified as a PEP, or as a close associate or family member of a PEP, enhanced due diligence ("EDD") will automatically be applied. This includes senior management approval before account activation, ongoing monitoring of transactions, and periodic refresh of source-of-funds documentation.

4.7 Sanctions Screening

luckyzap screens all customers, at registration and on an ongoing basis, against international sanctions lists, including those maintained by the United Nations, the European Union, the Office of Foreign Assets Control (OFAC), and other relevant authorities. Any match against a sanctions list will result in the immediate suspension of the account and escalation to the compliance team. Accounts confirmed as belonging to sanctioned individuals or entities will be closed and relevant authorities notified in accordance with applicable law.

5. Risk-Based Approach

5.1 Customer Risk Classification

luckyzap assigns every customer a risk rating — low, medium, or high — based on a combination of factors assessed at registration and updated continuously throughout the customer relationship. Factors considered include, but are not limited to:

• Country of residence and nationality (including FATF grey- or blacklisted jurisdictions);
• Source of funds and employment status;
• Transaction volume, frequency, and pattern relative to stated income;
• Payment methods used (including use of cryptocurrency);
• PEP or sanctions status;
• History of chargebacks, fraud flags, or account disputes;
• Behavioural anomalies identified by the transaction-monitoring system.

5.2 Standard Due Diligence

Standard due diligence ("SDD") applies to the majority of luckyzap customers assessed as low or medium risk. SDD consists of the identity and address verification steps described in section 4.2, PEP and sanctions screening, and ongoing transaction monitoring at automated risk-threshold levels.

5.3 Enhanced Due Diligence

Enhanced due diligence ("EDD") applies to customers classified as high risk, including confirmed PEPs, customers from higher-risk jurisdictions, customers whose transaction volumes are disproportionate to their stated income, and any customer where our compliance team exercises its judgement that a deeper review is warranted. EDD measures may include:

• Mandatory source-of-funds documentation before further deposits or withdrawals are processed;
• Senior management review and sign-off on account activity;
• More frequent periodic reviews of account standing;
• Enhanced scrutiny of every withdrawal request;
• Restrictions on maximum deposit or withdrawal amounts.

5.4 Simplified Due Diligence

luckyzap does not currently operate a simplified due diligence track. All customers are subject to at minimum the standard due diligence procedures described in section 5.2.

6. Transaction Monitoring

All financial activity on luckyzaps.org is subject to automated transaction monitoring. The monitoring system evaluates deposits, withdrawals, bonus claims, cashback credits, rakeback payments, and tournament prize settlements against a set of risk rules and behavioural baselines. Alerts are generated where activity deviates from expected patterns or crosses defined thresholds.

Patterns that may trigger a compliance review include, but are not limited to:

• Rapid cycling of funds — depositing and withdrawing with minimal or no gameplay;
• Depositing the card transaction cap of €500 / 5,000 SEK and immediately requesting withdrawal without meaningful play;
• Multiple deposits at or near the daily transaction limit (up to 10 card transactions per day) without corresponding gameplay;
• Unusual cryptocurrency activity, including deposits from wallets associated with mixing services or high-risk exchanges;
• Attempting to circumvent the same-method withdrawal rule (crypto deposits must be withdrawn in crypto; fiat deposits must be withdrawn in fiat);
• Structuring of deposits into multiple smaller amounts to avoid threshold-based controls;
• Claiming bonus offers — including the Welcome Package, Monday Reload, Tuesday Reload, High Roller Bonus, or Live Casino Welcome Bonus — in patterns inconsistent with genuine recreational play;
• Repeated chargebacks or payment reversals;
• Account sharing or evidence that multiple accounts are controlled by the same individual.

Where the monitoring system or a member of staff identifies potentially suspicious activity, the matter is escalated to the designated compliance officer for review. The compliance officer determines whether a Suspicious Activity Report ("SAR") or equivalent filing is required under applicable law and takes any appropriate account action.

7. Payment Options and AML Controls

luckyzap accepts deposits and processes withdrawals only via the methods listed below. The same-method principle applies: funds deposited via a given method must, where technically possible, be returned via the same method. Cryptocurrency deposits in Bitcoin (BTC) or Tether (USDT) must be withdrawn in cryptocurrency; fiat deposits via Visa, Mastercard, PayID, Apple Pay, Google Pay, or Revolut must be withdrawn to a fiat-compatible method.

luckyzap does not accept cash payments, bank drafts, money orders, or anonymous payment methods under any circumstances. All payment accounts and wallets used on luckyzaps.org must belong to the registered account holder. Payments from, or to, third parties are strictly prohibited and will be returned where technically possible, with the account flagged for review.

7.1 Cryptocurrency-Specific Controls

Cryptocurrency transactions present a distinct set of AML considerations. luckyzap applies the following controls specifically to Bitcoin and USDT activity:

• All cryptocurrency wallet addresses used for deposits are screened against blockchain analytics databases before funds are credited to the player's account;
• Wallets associated with dark-net markets, mixing or tumbling services, ransomware, or other high-risk categories will result in the deposit being held pending compliance review;
• Customers are required to confirm ownership of the depositing wallet address where requested;
• Withdrawals in cryptocurrency are processed only to a wallet address that has been verified as belonging to the account holder;
• The same-method rule is strictly enforced: no conversion of cryptocurrency deposits into fiat withdrawals is permitted.

8. Bonus Integrity and AML

luckyzap's promotional programme — which includes the four-part Welcome Package (up to €4,000 + 400 Free Spins), the High Roller Bonus (150% up to €3,000 + 150 Free Spins on a minimum €500 deposit), the Live Casino Welcome Bonus (100% up to €1,000), the Monday Reload (60% up to €500 + 60 Free Spins), the Tuesday Reload (50% up to €200), daily cashback of up to 15%, rakeback from Stampede tier onwards, and tournament prize pools including the €2,000,000 Lucky ZAP Battle — forms part of the overall transaction picture reviewed by our compliance monitoring systems.

Bonus abuse and bonus laundering are forms of financial misconduct that luckyzap takes seriously. Behaviour that may indicate bonus abuse includes:

• Claiming multiple welcome bonuses through separately registered accounts;
• Depositing the minimum qualifying amount, completing wagering at minimum bet stakes permitted under bonus terms (maximum bet while a bonus is active: €5 / 50 SEK), and immediately withdrawing;
• Coordinated play between multiple accounts to exploit cashback, rakeback, or reload promotions;
• Wagering on excluded game types — for example, placing live casino bets at 10% wagering contribution or table game bets at 0% contribution solely to satisfy administrative requirements without genuine risk;
• Any pattern of promotional exploitation that is inconsistent with genuine recreational gambling.

Where bonus abuse is detected, luckyzap reserves the right to void bonus funds, forfeit associated winnings, restrict or close the account, and, where the conduct discloses indicators of money laundering or fraud, to file a report with the appropriate authority.

9. Record Keeping

luckyzap retains the following records for a minimum period of five (5) years from the date of the relevant transaction, the end of the customer relationship, or such longer period as may be required by applicable law:

• All customer identification and verification documents obtained through Sumsub or otherwise;
• Account registration data, including name, date of birth, address, contact details, and currency preference;
• Records of every deposit, withdrawal, bonus credit, cashback payment, rakeback distribution, and tournament prize settlement processed through luckyzaps.org;
• Internal risk assessments and customer due diligence files;
• Records of any suspicious activity investigation, whether or not a SAR was filed;
• Communications between luckyzap and the customer relevant to KYC or compliance matters.

Records are stored securely and are accessible only to authorised compliance and management personnel. They may be disclosed to competent regulatory or law-enforcement authorities in accordance with applicable legal requirements.

10. Suspicious Activity Reporting

Any member of luckyzap's staff who identifies, or reasonably suspects, that a customer is engaged in money laundering, terrorist financing, or any other financial crime must report their concerns to the designated compliance officer without delay. Staff must not "tip off" the customer — that is, disclose to the customer or any third party that a report has been made or is being considered.

The compliance officer will review the report, gather any additional information needed, and determine whether to file a Suspicious Activity Report with the relevant financial intelligence unit or regulatory body. Where a SAR is filed, luckyzap will co-operate fully with any resulting investigation and will comply with any directions — including account freezing orders — issued by competent authorities.

11. Staff Training and Internal Controls

luckyzap maintains an internal AML/KYC training programme covering:

• Recognition of money laundering typologies relevant to online gaming, including deposit cycling, bonus laundering, and cryptocurrency obfuscation;
• Customer due diligence and enhanced due diligence procedures, including use of the Sumsub platform;
• Internal reporting obligations and the tipping-off prohibition;
• Record-keeping requirements;
• Sanctions screening obligations.

All relevant staff complete training upon joining luckyzap and at periodic intervals thereafter. Training records are maintained by the compliance function. The compliance officer is responsible for keeping the AML/KYC programme current in light of regulatory developments and emerging financial crime typologies.

12. Responsible Gambling and AML — the Connection

luckyzap recognises that problem gambling and financial crime are sometimes related — for example, where a customer deposits funds from unlawful sources to fund compulsive gambling activity, or where a customer places large wagers to disguise the origin of proceeds. Our AML monitoring systems and our responsible gambling controls therefore operate in a complementary manner.

Customers who wish to impose limits on their own activity — including deposit limits, session limits, loss limits, or self-exclusion — may do so by contacting luckyzap's 24/7 support team via live chat on luckyzaps.org or by emailing [email protected]. These responsible gambling tools are available in both English and Spanish, reflecting the platform's supported languages.

Where our compliance or customer-experience teams identify indicators of problem gambling that may also have AML implications — such as erratic, high-volume depositing inconsistent with a customer's profile — both sets of procedures will be applied concurrently.

13. Account Restrictions, Suspension, and Closure

luckyzap reserves the right, at any time and without prior notice where circumstances require, to:

• Restrict a customer's account — including suspending deposit, withdrawal, or bonus functionality — pending completion of KYC verification or a compliance review;
• Delay the processing of any withdrawal request where additional due diligence is required; the standard target payout speed at luckyzaps.org is within two banking days, but this target is contingent on all applicable KYC and AML checks being satisfactorily completed;
• Freeze account funds in accordance with a direction from a competent authority or where our compliance team has reasonable grounds to suspect financial crime;
• Permanently close an account where KYC verification cannot be completed, where a customer provides false documentation, where sanctions screening returns a confirmed match, or where the account is associated with confirmed financial crime.

Where an account is closed for AML-related reasons, luckyzap will determine the appropriate treatment of any remaining funds in accordance with the instructions of competent authorities and its own legal obligations. In some circumstances, return of funds may not be possible.

14. Customer Obligations

By registering at luckyzaps.org, customers agree to:

• Provide accurate, complete, and up-to-date personal information at registration and throughout the customer relationship;
• Complete identity verification through the Sumsub platform promptly when requested;
• Use only payment methods registered in their own name;
• Not deposit, wager, or withdraw funds derived from criminal activity;
• Notify luckyzap promptly of any material change to their personal circumstances — including changes of address, employment status, or country of residence — that may affect their risk profile;
• Comply with any reasonable request for additional documentation or information made by luckyzap's compliance team.

Providing false, misleading, or fraudulent documentation to luckyzap constitutes a serious breach of these obligations and may result in immediate account closure, forfeiture of funds, and reporting to law-enforcement authorities.

15. Data Protection

All personal data collected by luckyzap for AML and KYC purposes — including identity documents, address verification, source-of-funds information, and Sumsub liveness check data — is processed in accordance with applicable data-protection legislation and luckyzap's Privacy Policy, which is available at luckyzaps.org. Data is used solely for the purposes of regulatory compliance, fraud prevention, and account security, and is not sold or disclosed to third parties except where required by law or regulation, or where necessary to operate the Sumsub verification service.

16. Policy Review

This Policy will be reviewed at least annually, or more frequently where material changes to luckyzap's operations, its licensing conditions, or applicable AML legislation make an earlier review necessary. The current version of this Policy is published at luckyzaps.org and supersedes all previous versions. Customers are encouraged to review this page periodically to remain informed of any updates.

17. Contact

If you have questions about this Policy, wish to submit KYC documentation, or need assistance with the verification process, please contact luckyzap's compliance and support team:

• Live Chat: Available 24/7 directly on luckyzaps.org
• Email: [email protected]

luckyzap is committed to providing a fair, transparent, and secure gaming environment. Compliance with this AML / KYC Policy is fundamental to that commitment.