AML/CFT Policy

1. Company Overview

gayporno (operating under the "test cas" brand and hereinafter referred to as the "Company") is a company duly incorporated and registered under the laws of Curaçao, bearing Company Registration Number 1234, with its registered office at Abraham Mendez Chumaceiro Boulevard 50, Willemstad, Curaçao, and is licensed by the Curaçao Gaming Authority to conduct its gaming activities.

test cas holds a gaming licence (1234) issued by the Curaçao Gaming Authority. The Company conducts its operations pursuant to that licence and in accordance with the National Ordinance on Games of Chance (Landsverordening op de Kansspelen, P.B. 2024, no. 157).

As part of its international operations, test cas has established a comprehensive compliance framework proportionate to its services and product offering. This framework is designed to identify, deter, and prevent illicit activity on the platform and encompasses customer screening procedures, onboarding controls, and ongoing transaction-based monitoring.

2. Policy Statement

test cas does not constitute a financial institution within the meaning of applicable Curaçao legislation and is therefore not directly subject to the statutory and regulatory frameworks governing financial institutions, money transmission services, or virtual asset service providers. Notwithstanding the foregoing, and in full accordance with the 2016 Regulations for Anti-Money Laundering and Combating the Financing of Terrorism ("AML/CFT Regulations") applicable within the Curaçao jurisdiction, as issued by the Curaçao Gaming Control Board, test cas unconditionally prohibits and rejects any use of its platform or products for illicit purposes, including but not limited to money laundering, terrorist financing, and violations of applicable trade sanctions regimes.

test cas actively monitors the regulatory guidance and recommendations issued by the Financial Action Task Force ("FATF"), relevant gaming industry bodies, and the Curaçao Gaming Control Board, and undertakes to implement any measures it deems necessary in response to legislative or regulatory developments.

test cas's AML/CFT compliance framework is built upon the following core principles:

• Formulation and maintenance of a written compliance policy, alongside documented procedures and internal controls, reasonably designed to prevent and detect money laundering, terrorist financing, and trade sanctions violations;
• Appointment, where appropriate, of a designated Compliance Officer responsible for overseeing the implementation and ongoing effectiveness of the compliance framework;
• Delivery of periodic AML/CFT education and training to all relevant personnel; and
• Conduct of independent audits and ongoing reviews to evaluate the effectiveness, adequacy, and continued relevance of the policy, procedures, and controls in place.

3. Key Definitions

The following definitions apply throughout this Policy:

Money Laundering

The process by which criminally derived proceeds are concealed and made to appear as legitimate funds. This process is typically divided into three distinct phases: Placement (the introduction of illicit proceeds into the financial system, for example through cash deposits or other financial instruments); Layering (the concealment of the criminal origin of funds through a series of complex transactions, such as conversions into monetary instruments, wire transfers, or asset acquisitions); and Integration (the re-introduction of laundered funds into the legitimate economy through apparently lawful commercial or financial activities).

Suspicious Activity

Any conduct, transaction, or behaviour by a user or third party that gives rise to a reasonable suspicion that the individual may be engaged in, or facilitating, fraudulent, unlawful, or otherwise prohibited activities.

Sanctions

Restrictive measures imposed by the international community to constrain or prohibit specific activities in relation to targeted individuals, entities, or jurisdictions. Sanctions may be applied for the following purposes:

• To induce a change in the conduct of a targeted state, government, or regime;
• To exert economic or political pressure on a target in furtherance of defined policy objectives;
• As a coercive mechanism where international peace and security has been threatened and diplomatic efforts have proven insufficient; or
• To prevent and suppress the financing of terrorism and terrorist organisations.

4. Governance and Oversight

test cas operates a decentralised, automated licensing solution that coordinates the implementation of this AML/CFT Policy across its platform. In collaboration with relevant government regulators, test cas actively participates in the development of AML initiatives, contributes to the review and revision of compliance policy, evaluates emerging regulatory obligations, and oversees the investigation of potentially suspicious or unusual activity.

test cas provides structured AML/CFT training to all employees on a regular basis to ensure that personnel remain informed of their obligations and are equipped to identify and escalate potential compliance concerns.

5. Know Your Customer (KYC) and Transaction Monitoring

test cas applies appropriate user due diligence and ongoing monitoring measures as required by applicable law, utilising automated systems to operationalise these requirements. test cas is committed to preventing users from engaging in illicit or otherwise unauthorised activity on its platform. Compliance is ensured through a combination of its proprietary software, contractual arrangements, and internal operational controls.

A. Customer Due Diligence (CDD)

test cas has adopted a risk-based CDD framework designed to enable a thorough understanding of the nature and purpose of each user relationship, thereby facilitating the development of an individual customer risk profile. To this end, test cas collects documentary and non-documentary information at the point of account creation, calibrated to the nature of the account type and the services being provided. Distinct CDD requirements apply to different account types and service categories.

In particular, the CDD framework requires all users to undergo test cas's Customer Identification Programme ("CIP"), which consists of the following procedures:

• Collection of baseline information (including wallet address and email address) at the time of account creation, through test cas's user onboarding portal;
• Assessment of the risk profile associated with the cryptocurrency wallet used to fund the user's account;
• Retention of records of all identification information collected in relation to each user; and
• Screening to determine whether any user appears on applicable lists of known or suspected terrorists or terrorist organisations.

These procedures are operationalised through the following measures:

Identity and Age Verification.

test cas engages a third-party identity verification service provider to assess the strength and validity of identification materials and other KYC information provided by users, and to confirm that each user is eligible to access the platform. The service provider also verifies that the user does not appear to be located in a comprehensively sanctioned or otherwise prohibited jurisdiction, and conducts searches against global sanctions databases based on onboarding data, including wallet addresses.

(i) Customer Information.

test cas collects personal information from each user sufficient to form a reasonable belief as to their identity, commensurate with the user's assessed risk profile. Such information may include wallet address, full legal name, residential address, country of residence, date of birth, and postal code (collectively, "KYC Information"). All required KYC Information is collected prior to the issuance of a test cas funding address (e.g., QR code). test cas currently restricts platform access to natural persons only. test cas may, at its discretion, rely upon the performance by a third-party institution of some or all elements of the CIP process.

(ii) Geo-blocking for Prohibited Jurisdictions.

test cas requires contractual certifications from users confirming that, through IP address-based geo-blocking, gaming services will not be accessed from countries in which such activity is not lawfully permitted.

(iii) Geo-blocking for Sanctioned Jurisdictions.

test cas further requires users to certify that they are not subject to United States, European Union, or other applicable international sanctions regimes or watch lists, including those relating to comprehensively sanctioned jurisdictions such as Iran, Cuba, North Korea, Syria, and the Crimean region of Ukraine. Verification of such representations is conducted through risk-based measures including KYC procedures and IP address-based geo-blocking.

(iv) Contractual Prohibitions on Users from Restricted Jurisdictions.

Users are notified at the point of onboarding that test cas does not offer services to individuals located in restricted jurisdictions. The Company's approach to restricting user access reflects its risk management standards, fraud prevention obligations, and AML/CFT requirements, as well as assessments of the permissibility of its services in various jurisdictions.

B. Enhanced Due Diligence and Ongoing Monitoring

test cas conducts ongoing monitoring of its user base to detect behaviours or indicators potentially indicative of money laundering or terrorist financing. For this purpose, test cas has established a set of internal red flag indicators that assist in the identification of such conduct and may require the Company to take further action in relation to specific users.

Where one or more red flags are triggered, test cas may suspend the relevant user account or restrict withdrawals, and will communicate to the user the steps required to restore normal account access. Such steps may include verification of the cryptocurrency wallet through a deposit of an exact prescribed amount (as further detailed in the Company's Terms and Conditions or as communicated by a Support Agent via Live Chat), or completion of Enhanced KYC due diligence.

Enhanced KYC due diligence under this Policy includes, without limitation, the provision of the following:

• Full legal name;
• Country of citizenship;
• Permanent residential or business address (for individuals, a street address; for entities, a principal place of business or other physical location);
• Identification number, comprising either a tax identification number or, where unavailable, a passport number and country of issue, alien identification card number, or the number and country of issue of another government-issued document evidencing nationality or residence and bearing a photograph or equivalent safeguard;
• Government-issued Identification Document; and
• Evidence of Source of Funds and Source of Wealth.

test cas may engage a third-party service provider to verify any of the above information as necessary to establish a reasonable basis for confirming the identity of the user, where the user's activity warrants such action.

C. User Acceptance Policy

test cas will decline to onboard, and will block access for, users who:

• Fail to provide identification information as requested by test cas;
• Submit fraudulent, falsified, or otherwise inauthentic identification documents;
• Attempt to circumvent jurisdictional restrictions through the use of VPNs, proxies, or other geo-spoofing techniques;
• Are resident in, or accessing the platform from, a restricted or prohibited jurisdiction;
• Are subject to United States, European Union, or other applicable global sanctions or are listed on any applicable sanctions watch list;
• Are identified as problem gamblers or as individuals with relevant mental health concerns;
• Have funds originating from, or processed through, exchanges or platforms operating in restricted jurisdictions.

test cas reserves the right to suspend or block any user account at its sole discretion for any other reason it deems appropriate.

D. Transaction Monitoring

test cas is firmly committed to compliance with economic and trade sanctions programmes applicable in the jurisdictions in which it operates. To this end, test cas has established a robust transaction monitoring programme incorporating controls and processes designed to identify and flag unusual activity in real time and through ongoing periodic review.

test cas conducts regular monitoring using a combination of internally developed rule-based systems and solutions provided by third-party vendors, enabling the review of user activity histories and behavioural patterns to detect and report unusual conduct and to implement any additional platform controls or restrictions as appropriate. test cas's transaction monitoring procedures address the following key components:

(i) Monitoring for Sanctioned or Prohibited Jurisdictions.

test cas may impose targeted due diligence requirements at the point of account withdrawal at its reasonable discretion. The Company conducts a combination of manual and automated transaction monitoring to identify red flag behaviour, and may refuse to process withdrawal requests or may seek additional information from the relevant user where such behaviour is identified. test cas further seeks to prevent account funding from prohibited jurisdictions where the associated wallet address indicates a connection to such a jurisdiction. Users may provide supplementary information to challenge any account suspension as part of the ongoing monitoring process.

(ii) Sanctions Screening.

Prior to issuing a test cas funding address to any user, test cas screens the user's wallet address against applicable sanctions databases using third-party blockchain forensics tools, including Chainalysis. Wallet address screening is conducted periodically on a re-screening basis to account for changes in sanctions listings.

(iii) Unusual Activity Identification.

test cas monitors account activity for any transactions that are unusual in terms of size, volume, frequency, pattern, or type, having regard to the relevant risk factors and applicable red flag indicators. Monitoring is conducted through the generation of regular reports on high-risk or otherwise anomalous user behaviour.

(iv) Anti-Mixing Controls.

test cas deploys software specifically designed to detect suspicious deposit or withdrawal patterns associated with cryptocurrency mixing or tumbling activity. Identified instances are assessed on a case-by-case basis commensurate with the perceived level of risk. In such circumstances, the user may be required to provide a satisfactory explanation of their methodology and the purpose for which the platform is being used.

(v) Chainalysis Blockchain Review.

All cryptocurrency deposits and withdrawals, both direct and indirect, are subject to review through Chainalysis for indicators of fraud or suspicious behaviour. User accounts are suspended and subjected to review upon receipt of any alert of potentially illicit activity. test cas may request evidence of source of wealth from users identified as high risk, and reserves the right to decline withdrawal requests to addresses classified as high risk pursuant to Chainalysis risk scoring.

(vi) Withdrawal Threshold KYC.

Independently of other monitoring controls, all user accounts will be placed on hold pending completion of satisfactory KYC verification once cumulative withdrawals reach a threshold determined by reference to the account's risk classification over its lifetime.

E. Additional Ongoing Monitoring Controls

In addition to the measures described above, test cas has implemented the following supplementary controls:

(i) Multiple Account Detection.

test cas utilises third-party software to detect the use of multiple accounts by a single user, operating through the identification of device-level linkages across accounts. Such instances are addressed on a case-by-case basis based on the perceived level of risk, and users may be required to explain their conduct. test cas expressly prohibits peer-to-peer account transfers within its platform infrastructure. Any attempt to circumvent this restriction will be treated as a red flag indicator.

(ii) Time Zone and Location Controls.

test cas has implemented controls that detect user device location information and cross-reference it against restricted jurisdictions to identify any attempts to use geo-location manipulation software to conceal the user's true jurisdiction of access.

(iii) Platform Integrity and Product Safeguards.

test cas maintains a comprehensive suite of user-facing terms and conditions to which all users must agree as a condition of platform access. The Company may establish additional safeguards from time to time to mitigate the risk of platform misuse. test cas operates a defined list of permitted digital assets on its platform and does not permit the use of anonymity-enhancing technologies, including cryptocurrency mixers, tumblers, or privacy-focused coins or tokens. Where test cas identifies the use of any such technology, access will be immediately restricted.

(iv) Third-Party Vendor Management.

test cas engages reputable third-party service providers as integral components of its compliance infrastructure. The Company periodically reviews the performance of its key vendors to assess whether additional services are required, whether contractual obligations are being fulfilled, or whether any remedial action is necessary. test cas may request relevant information from any third-party service provider as part of its vendor review process. In addition, test cas continuously evaluates emerging non-documentary compliance mechanisms and may conduct limited pilot programmes with new compliance vendors to assess their effectiveness and suitability for the test cas compliance programme.

6. Education and Training

test cas, with the support of its legal advisers and under the supervision of its Chief Compliance Officer ("CCO"), provides periodic AML/CFT and trade sanctions compliance training to all relevant employees. The frequency and content of such training are determined by reference to regulatory developments, changes in the risk environment, and the Company's ongoing assessment of employee training needs.

7. Suspicious Activity Reporting

test cas is obligated to report all unusual and suspicious transactions to the relevant regulatory authority in accordance with the provisions of the National Ordinance on Games of Chance and applicable AML/CFT regulations. Any user identified as appearing on a sanctions list, or as being connected to money laundering, terrorist financing, or other criminal activity, will be reported to the regulator as a suspicious activity matter and their account will be suspended pending further review.

test cas — AML/CFT Policy — Confidential