AML policy

This AML policy describes how Winnow Lotto helps prevent money laundering, terrorism financing, fraud, and other financial crime in connection with our services. We are committed to complying with applicable anti-money laundering laws and regulations, including but not limited to the UK Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (as amended), EU Anti-Money Laundering Directives (AMLD5/AMLD6), and FATF Recommendations where applicable to our business model and jurisdiction of operation.

We may request identity and address verification before allowing purchases, wallet activity, or payouts. Failure to complete verification may result in restrictions on your account or service.

We apply a risk-based approach to AML compliance. This means that the level of due diligence we apply is proportionate to the risk associated with a customer, transaction, or business relationship.

• Lower-risk interactions may be subject to standard Customer Due Diligence (CDD) only.
• Higher-risk factors — including high transaction values, unusual activity patterns, high-risk jurisdictions, or politically exposed person (PEP) status — trigger Enhanced Due Diligence (EDD).
• Our risk assessment is reviewed periodically and updated to reflect changes in applicable law, regulatory guidance, and our operational environment.

We apply Customer Due Diligence measures when establishing a business relationship, when carrying out occasional transactions above applicable thresholds, or when we suspect money laundering or terrorism financing regardless of transaction value.

• We may request your full legal name, date of birth, residential address, and proof documents (e.g., government-issued photo ID and proof of address).
• We may use third-party verification providers to validate identity, age, and address, and to screen against relevant databases.
• CDD may be triggered at account opening, at transaction thresholds we determine appropriate, or at any point we consider the risk warrants it.
• If CDD cannot be completed or verification fails, we may restrict, suspend, or terminate service and refund where required by applicable law.

Enhanced Due Diligence applies to customers or transactions assessed as higher risk. EDD measures may include, but are not limited to:

• Obtaining additional identity documents or certified copies.
• Requesting evidence of the source of funds or source of wealth.
• Applying increased transaction monitoring and frequency of reviews.
• Obtaining senior management approval before proceeding with the business relationship.
• Conducting more detailed scrutiny of transactions and activity over time.

EDD is applied as a minimum for Politically Exposed Persons (PEPs), customers from high-risk jurisdictions identified by the FATF, EU, or UK government, and transactions that appear inconsistent with the customer's known profile or stated purpose.

A Politically Exposed Person is an individual who holds or has held a prominent public position, or who is a close family member or known associate of such a person. PEPs present a higher risk of involvement in bribery and corruption.

• We screen customers against PEP databases as part of our verification process.
• Where a customer is identified as a PEP or close associate of a PEP, Enhanced Due Diligence applies automatically, including obtaining information on the source of wealth and source of funds.
• Senior management approval is required before accepting or continuing a business relationship with a PEP.
• PEP status is subject to ongoing monitoring for the duration of the business relationship.

We screen customers, transactions, and associated parties against applicable sanctions lists, which may include:

• The UK Consolidated List of Financial Sanctions Targets (maintained by OFSI / HM Treasury)
• EU Consolidated Sanctions List
• UN Security Council Consolidated List
• OFAC Specially Designated Nationals (SDN) list and other US sanctions programmes

Any match against a sanctions list will result in an immediate block on service and, where legally required, a report to the relevant authorities. We do not provide services to individuals or entities subject to applicable financial sanctions or located in sanctioned territories.

• We monitor transactions and account activity on an ongoing basis for suspicious patterns, including but not limited to: unusual payment activity, repeated reversals, inconsistent identity details, structuring, or transactions that appear to have no clear economic purpose.
• We may delay, block, restrict, or reverse transactions and payouts where required to investigate suspicious activity.
• We reserve the right to request additional information or documentation at any time where our monitoring identifies a concern.
• Accounts may be suspended or terminated where suspicious activity is identified or where verification requirements cannot be met.

Where we identify activity that we know, suspect, or have reasonable grounds to suspect is connected to money laundering or terrorism financing, we are required by law to make a Suspicious Activity Report (SAR) to the relevant Financial Intelligence Unit (FIU).

• In the UK, SARs are submitted to the National Crime Agency (NCA) via the UKFIU.
• We are subject to "tipping-off" restrictions under applicable law: once a SAR has been filed or a suspicion has been formed, we may not inform the subject of the investigation or the report.
• Our obligation to file a SAR takes precedence over any contractual obligation to you.

We retain records of customer due diligence, identity documents, transaction records, and any supporting evidence for a minimum of five years from the end of the business relationship or from the date of the transaction, in accordance with applicable AML regulations (including Regulation 40 of the UK Money Laundering Regulations 2017). In some circumstances, we may be required to retain records for longer. See our Privacy Policy for further information on how we store and protect personal data.

We maintain a compliance function responsible for overseeing our AML programme. Relevant staff receive AML training appropriate to their role and responsibilities. Training covers:

• How to recognise transactions or behaviour that may indicate money laundering or terrorism financing.
• The legal obligations that apply to the business and to individual employees or contractors.
• Internal reporting procedures, including how to escalate concerns to the compliance function.

This policy is reviewed at least annually and updated to reflect changes in applicable law, regulatory guidance, and the risk environment.

If you have questions about this policy or our verification process, contact us at support@winnowlotto.com. For privacy-related requests, see our Privacy Policy.