Anti-money Laundering

Purpose and scope

Riobet maintains an anti-money laundering and countering the financing of terrorism policy (AML/CFT) to satisfy applicable laws, regulations, and international standards. The policy governs all customer onboarding, identity verification, ongoing monitoring, and transactional activity conducted on the Riobet platform and by Riobet personnel, agents, and any third parties acting on Riobet's behalf.

Definitions

• KYC, Know Your Customer: the process of obtaining, verifying, and maintaining accurate information about a customer to establish identity and risk profile.
• CDD, Customer Due Diligence: the initial verification and assessment of a customer’s identity, risk, and expected activity.
• EDD, Enhanced Due Diligence: heightened verification and monitoring applied to high‑risk customers or transactions.
• MLRO, Money Laundering Reporting Officer: the designated official responsible for AML/CFT compliance, escalation, and reporting to authorities as required.
• PEP, Politically Exposed Person: an individual who is or has been entrusted with prominent public functions and may present elevated AML/CFT risk.
• FIU, Financial Intelligence Unit: a competent authority responsible for receiving, analyzing, and disseminating information related to suspicious financial activity.
• Sanctions: legal prohibitions or restrictions imposed by competent authorities that affect customer or transaction viability.

Governance and responsibilities

Riobet assigns clear accountability for AML/CFT compliance. The MLRO oversees all KYC/CDD programs, transaction monitoring, suspicious activity reporting, and cooperation with authorities. The Compliance team maintains records, conducts training, performs internal audit support, and directs escalation of suspicious or unusual activity to the appropriate authorities. Senior management reviews risk reports and approves changes to the risk‑based framework.

Know Your Customer and onboarding (KYC/CDD)

Riobet applies a risk‑based approach to verify customer identity and assess AML/CFT risk at onboarding and on an ongoing basis. On registration, the following information must be collected and verified before enabling real‑money play:

• Full legal name and date of birth to confirm legal eligibility to contract.
• Residential address and contact details for identity verification and geolocation checks.
• Government‑issued photo ID (eg, passport or national identity card) and a recent proof of address (eg, utility bill or bank statement).
• Username, password, and device information for account integrity and risk assessment.
• Geolocation verification to ensure the user is accessing from an allowed jurisdiction.

Single‑account integrity is maintained by Riobet. A customer may not operate more than one active account within a household, family unit, or shared device environment. Riobet may require additional information or documentation and may suspend or terminate an account if falsified or misleading data is detected.

Enhanced due diligence (EDD)

High‑risk scenarios trigger Enhanced Due Diligence, including but not limited to:

• Residence in or connection to high‑risk or non‑reputable jurisdictions.
• Suspicion of multiple accounts under different names or collusion among multiple customers.
• Politically exposed person (PEP) status or link to sanctioned individuals/entities.
• Unusual, complex, or large transactions inconsistent with the customer’s profile or declared activity.

EDD requires supplementary documentation such as an additional source of wealth evidence, recent bank statements, and verification of the initial deposit source. Riobet may perform enhanced identity verification, request a live verification step, or implement transaction thresholds to restrict activity until verification is complete.

Ongoing monitoring and risk classification

Riobet classifies customers based on a risk assessment framework into Low/Standard and High risk. Ongoing monitoring includes automated and manual reviews of:

• Account activity patterns, bet types, amounts, and frequency.
• Geolocation consistency, IP address history, and device fingerprints.
• Cross‑checking against sanctions lists, politically exposed status, and adverse media where applicable.

High‑risk indicators trigger escalations to the MLRO and may result in enhanced monitoring, temporary restrictions, or account limitations until satisfactory information is obtained.

Transaction monitoring and suspicious activity handling

Riobet employs ongoing monitoring to identify unusual or potentially illicit activity. Examples of such activity include, but are not limited to:

• Deposits followed by no wagering or minimal activity inconsistent with normal play patterns.
• Structuring deposits or rapid, repetitive funding from multiple sources.
• Frequent transfers to unfamiliar third parties or multiple withdrawals without corresponding play.

When suspicious activity is detected, Riobet will investigate, request additional information, and may:

• Place the account on restricted access or temporarily suspend activity.
• Withhold funds pending verification or escalation to the MLRO.
• Report the activity to the relevant financial intelligence authority in accordance with legal obligations.

Suspicious activity reporting and cooperation with authorities

The MLRO coordinates reporting obligations. Riobet will file a Suspicious Activity Report (SAR) where required and maintain a record of all disclosures or refusals to report, including the rationale. Riobet cooperates with law enforcement, regulatory bodies, and the FIU as appropriate, providing access to records and information within the bounds of applicable data protection laws.

Record keeping and data retention

Riobet retains KYC documents, transaction data, risk assessments, monitoring results, and SARs for a minimum period required by applicable law, but not less than five years from the end of the customer relationship or the last relevant transaction. Records are stored securely, access is restricted to authorized personnel, and data is safeguarded in accordance with data protection requirements.

Account integrity and access controls

Riobet prohibits login data sharing and enforces controls to detect and prevent multiple accounts from being opened under different identities or shared environments. In the event of suspected sharing of access or account takeovers, Riobet may suspend affected accounts and conduct a formal review, including device, IP, and session history assessments.

Withdrawal controls and funds traceability

Withdrawal requests are evaluated for AML/CFT risk prior to processing. Riobet may require additional identity verification or documentation before approving a withdrawal. Funds are disbursed only to the verified account holder and via the original payment method used for funding, except where a lawful alternative method is approved. Riobet may suspend, delay, or deny withdrawals if suspicious activity is suspected or if documentation is incomplete.

Crypto and digital assets policy

Riobet supports cryptocurrency deposits and withdrawals in accordance with applicable AML/CFT requirements. Key controls include:

• Initial deposit must be conducted in a supported cryptocurrency; all subsequent deposits, wagers, and withdrawals must be conducted in the same cryptocurrency unless otherwise authorized.
• Riobet does not engage in converting crypto to fiat within the platform, nor does it provide crypto exchange services to third parties.
• Customer identity, age, and address are verified at onboarding and retained for verification at all steps of the transaction flow.
• Solvency documentation and wallet balance evidence may be requested and stored to demonstrate adequate funds for wagering and potential jackpots.
• Cryptocurrency balances are held in segregated wallets, with the exchange rate displayed on Riobet’s platform for transparency. Crypto values are subject to market risk and may fluctuate.

Record retention, data security and privacy

Riobet implements information security controls and privacy protections over all AML/CFT data. Data is retained and processed in adherence to applicable privacy laws, with access restricted to authorized personnel conducting AML/CFT duties. Data is encrypted at rest and in transit, and security incidents are managed pursuant to the incident response plan.

Training, independent review and testing

Riobet provides AML/CFT training to relevant staff on an annual basis and whenever significant policy updates occur. An independent party may audit compliance with this policy and perform testing of the controls, reporting findings to the MLRO and senior management for remediation.

Policy updates and communication

Riobet reviews this policy at least annually or in response to material regulatory change. Material updates become effective on the stated date and are communicated to customers through the platform in a timely manner, with historical versions retained for reference.

Contact and escalation

Riobet’s compliance channel for AML/CFT matters is via the designated MLRO. Inquiries, requests for documentation, or reporting of suspicious activity should be directed to the MLRO through the official reporting process maintained by Riobet. The MLRO coordinates with relevant internal teams and regulatory authorities as required.