KYC & Risk Controls Documentation

1. Introduction

This document describes the Know Your Customer (KYC) and risk control framework implemented by OnPoint Administration, LLC for the sweepstakes platform at onpointcasino.com and opcasino.com. These controls verify customer identities at payout, prevent underage access, detect fraud and financial crimes, and describe how location eligibility actually works.

The Company uses IP geolocation for location eligibility, the redemption network check in Section 2, Breeze for identity verification at redemption or withdrawal, and manual review where a risk control calls for it.

2. Location Eligibility

2.1 Overview

Eligibility is determined by the visitor's IP geolocation: the place they are accessing the Platform from, not their home state.

2.2 When it is checked

The IP geolocation check runs at registration, sign-in, game launch, purchase, redemption, contests, and free Sweeps Coins claims.

2.3 Restricted jurisdictions

The Platform is unavailable in these 21 states: Arizona, California, Connecticut, Delaware, Idaho, Illinois, Indiana, Louisiana, Maine, Maryland, Michigan, Minnesota, Mississippi, Montana, Nevada, New Jersey, New York, Oklahoma, Tennessee, Washington, or West Virginia. It is also unavailable outside the United States. A visitor whose IP address cannot be placed in a U.S. state is refused.

2.4 What this check is not

The Platform does not check device location. Identity verification does not check residency. Location eligibility is the IP geolocation result alone.

At redemption, we also check whether the connection comes from a VPN, proxy, Tor, or hosting network. Redemptions made through one are refused. A connection using iCloud Private Relay is allowed, including when that relay is also on a hosting network, unless it is also a VPN, proxy, or Tor exit. If the check cannot be completed, the redemption is held for staff review. The check runs only when a redemption is requested. It does not run at sign-up, sign-in, play, or purchase, and it does not suspend the account.

3. IP Records

3.1 Overview

Customer sessions are logged with the originating IP address. That address is what the location check in Section 2 uses. It also supports fraud review, where two accounts share an address, and the ordinary account record.

3.2 Data collected

• IP address at registration and each login
• IP geolocation (country and U.S. state, when the address can be placed)
• Associated device fingerprint, stored hashed

3.3 Use

• Refusing access when the IP is outside the United States, in a state listed in Section 2, or cannot be placed in a U.S. state
• Detecting multiple accounts linked to the same IP address
• Supporting a fraud or sanctions review of a specific session

The Platform does not decide eligibility from a device GPS reading. The redemption network check in Section 2 applies only to a redemption request.

4. Age

4.1 Policy

The Company does not allow access by anyone under 18.

4.2 Registration

1. The visitor provides a date of birth during account registration.
2. Registration is refused when that date of birth is under 18.

4.3 Identity verification is not the age gate

Breeze identity verification runs at redemption or withdrawal, not at registration and not before a purchase. It is not an age check for play, and it is not a residency check. A date of birth under 18 is refused at registration, before any of those steps.

5. KYC Verification

5.1 Provider

Identity verification (KYC) is completed through Breeze, our payout provider, on Breeze's hosted pages. It is required at redemption or withdrawal only.

5.2 Registration

Registration collects the account email, the date of birth used for the age rule, and acceptance of the Terms and Sweepstakes Rules. It does not ask the visitor to certify a state of residence, and it does not start a Breeze identity check.

5.3 Redemption and withdrawal

• Breeze identity verification is required before the first redemption or withdrawal
• The check confirms identity for the payout. It does not decide the visitor's state and it does not replace the IP geolocation check
• The payout method must be in the account holder's name
• The Platform does not collect raw card numbers on its own pages

5.4 If verification does not succeed

• Redemption and withdrawal stay unavailable until Breeze verification succeeds
• The customer is told and can try again
• After repeated failure, the request is reviewed manually
• An unsuccessful identity check does not, by itself, disable Gold Coin purchases. Purchases remain subject to the IP geolocation check in Section 2

6. Transaction Monitoring

6.1 Overview

The Company operates an automated transaction monitoring system analyzing customer transaction patterns in real time to detect potential money laundering, fraud, and other suspicious activity.

6.2 Monitoring Rules and Triggers

• Rapid deposit/withdrawal cycles with minimal or no gaming activity
• Multiple transactions just below reporting thresholds (structuring indicators)
• Large single transactions inconsistent with customer's historical pattern
• Multiple accounts transacting from the same device, IP, or payment method
• Unusual geographic patterns or sudden changes in access location
• Chargebacks or payment disputes exceeding platform thresholds
• Dormant account reactivation with immediate high-value transactions

6.3 Alert Workflow

1. Automated alert generated by monitoring system
2. Alert reviewed by compliance analyst within 24–48 hours
3. If benign, alert closed with documentation
4. If suspicious, escalated to AML Compliance Officer
5. AML Compliance Officer determines whether SAR filing is required
6. Account action taken as appropriate (restriction, suspension, or termination)

6.4 Reporting

SARs are filed with FinCEN as required. All SAR decisions (filed or not filed) are documented and retained. SARs are never disclosed to the subject of the report.

7. OFAC / Sanctions Screening

7.1 Overview

The Company screens all customers against the OFAC Specially Designated Nationals (SDN) list and all applicable U.S. and international sanctions programs.

7.2 Screening Process

1. OFAC screening is performed as part of identity verification.
2. Ongoing rescreening occurs automatically when the OFAC SDN list is updated.
3. All potential matches reviewed manually by the compliance team.
4. True matches result in immediate account freeze and escalation to AML Compliance Officer.
5. OFAC notified and required reporting or blocking completed.

7.3 Screening Lists

• OFAC SDN (Specially Designated Nationals) List
• OFAC Non-SDN Consolidated Sanctions List
• UN Security Council Sanctions List
• EU Consolidated Sanctions List
• Politically Exposed Persons (PEP) databases
• Adverse media databases

7.4 False Positive Management

Documented procedures exist for resolving false-positive matches. All false-positive determinations are documented with supporting rationale and retained for a minimum of five years.

Document Approval

This document has been reviewed and approved by authorized representatives of OnPoint Administration LLC.

AML Compliance Officer. OnPoint Administration LLC | OnPointCasino.com. Date: April 12, 2026.