This Know Your Customer ("KYC") Policy sets out the identity verification and due diligence procedures applied by HeavenOnline ("we", "us", "our", or the "Website") to all players accessing the website located at heavenonline.io and its related services (collectively, the "Services").

HeavenOnline is owned and operated by Lucifer Ltd., registration number: 000054043, registered address: San Victor Street, Orange Walk Town, Belize, licensed by Anjouan Licensing Services Inc. ("Anjouan Gaming") under License No. ALSI-202605018-FI1.

This Policy is issued in accordance with the AML & CTF Code of Conduct issued by Anjouan Licensing Services Inc., the recommendations of the Financial Action Task Force (FATF), and applicable international standards.

Compliance with this Policy is mandatory. All players are required to cooperate with our identity verification procedures as a condition of accessing the Services.

The purposes of this Policy are to:

• Verify the true identity of every player
• Prevent underage gaming
• Prevent and detect money laundering, terrorist financing, fraud, and other financial crime
• Comply with Anjouan Gaming licensing conditions
• Protect the integrity of the Services and the safety of legitimate players

This Policy applies to:

• All players registering or maintaining an account on the Website
• All transactions conducted through the Services, including deposits, wagers, and withdrawals
• All employees, contractors, and third-party service providers involved in player onboarding, payments, or compliance functions

At the point of account registration, every player is required to provide the following information as part of our Customer Due Diligence ("CDD") process:

• Full legal name
• Valid email address
• Date of birth
• Residential address

No account will be activated unless the above information has been provided in full. Players warrant that all information provided is true, accurate, complete, and current.

We reserve the right, at any time, to:

• Request additional information to verify the data provided
• Conduct screening against sanctions, politically exposed persons (PEP), and adverse media databases
• Suspend or restrict an account pending verification

Enhanced Due Diligence ("EDD") is a deeper level of verification required where elevated risk is identified. EDD will be triggered, and additional documentation will be required, in any of the following circumstances:

5.1 First Withdrawal Request

EDD is automatically triggered upon the player's first withdrawal request, regardless of amount.

5.2 Cumulative Deposit Threshold

EDD is automatically triggered when the player's aggregate lifetime deposits reach USD 10,000 (or equivalent in any other currency).

5.3 Risk-Based Triggers

EDD may also be triggered where any of the following risk indicators are identified:

• Suspicious transaction patterns (including structuring, rapid movement of funds, or unusual betting behavior)
• Use of high-risk payment methods or jurisdictions identified by FATF
• Inconsistencies between declared information and observed behavior
• Match against sanctions, PEP, or adverse media databases
• Any other circumstance that, in our reasonable judgment, warrants enhanced verification

Where EDD is triggered, the player will be required to provide, at minimum, the following:

6.1 Identity Verification

Government-issued photo identification, such as:

• Valid passport
• National identity card
• Driver's license

The document must be valid, unexpired, and clearly legible.

6.2 Address Verification

Proof of residential address, such as:

• Utility bill (electricity, water, gas, internet, or landline phone)
• Bank or credit card statement
• Official government correspondence

The document must be issued within the last 3 months and display the player's name and address matching the registration details.

6.3 Source of Funds

Where required based on risk assessment, the player will additionally be required to provide proof of source of funds, such as:

• Recent salary slips or employment contract
• Bank statements showing income
• Tax returns or business income records
• Documentation evidencing inheritance, investment proceeds, or other lawful source

6.4 Source of Wealth

For higher-risk profiles or larger transactions, we may additionally request proof of source of wealth, evidencing the overall economic basis of the player's funds.

6.5 Additional Verification

We may require additional steps, including but not limited to:

• Live video verification or selfie with ID ("liveness check")
• Video call with a compliance officer
• Notarized or apostilled copies of documents
• Direct confirmation from issuing authorities

Where EDD has been triggered but has not been completed to our satisfaction:

• Withdrawals will not be processed. All withdrawal requests will be held pending verification.
• Financial activity may be restricted. Deposits, wagering, and other transactional activity may be limited or suspended where necessary to mitigate risk.
• Account access may be restricted. Where required, the account may be placed in a restricted state until verification is complete.

These restrictions are a regulatory requirement and are not subject to waiver.

8.1 All documents submitted must be:

• Valid and unexpired (where applicable)
• Clear, legible, and in full color
• Submitted in their entirety (no cropped corners or redacted fields, except for non-essential data fields where permitted)
• In English, or accompanied by a certified translation

8.2 We aim to review submitted documents within 3 business days of receipt. Complex cases or requests for additional documentation may take longer.

8.3 We reserve the right to reject documents that do not meet our verification standards and to request resubmission or alternative documentation.

9.1 The Services are strictly limited to individuals aged 18 or older, or the legal age of majority in the player's jurisdiction, whichever is higher.

9.2 Age verification is conducted during registration based on the date of birth provided and, where EDD is triggered, confirmed through government-issued identification.

9.3 If we determine that a player is below the minimum legal age:

• The account will be closed immediately
• All deposits will be returned (subject to AML checks)
• Any winnings will be forfeited
• The incident will be reported to relevant authorities where required

10.1 All players are screened against:

• International sanctions lists (including UN, OFAC, EU, UK, and other applicable lists)
• Politically Exposed Persons (PEP) databases
• Adverse media sources

10.2 Where a player is identified as subject to sanctions, the account will be frozen, no transactions will be processed, and the matter will be reported to relevant authorities in accordance with applicable law.

10.3 Where a player is identified as a PEP or a close associate of a PEP, EDD will be applied, including additional source of funds and source of wealth checks, and senior management approval will be required to onboard or maintain the account.

11.1 KYC is not a one-time exercise. We conduct ongoing monitoring throughout the lifecycle of every account, including:

• Transaction monitoring for suspicious activity
• Periodic review of player profiles
• Re-verification where documents have expired or circumstances have changed
• Behavioral monitoring for responsible gaming and fraud indicators

11.2 We may, at any time and at our sole discretion, request updated KYC documentation or additional verification.

We reserve the absolute right to:

• Refuse registration where verification cannot be completed
• Suspend or restrict an account pending verification or investigation
• Terminate an account where the player provides false, misleading, or fraudulent information; verification cannot be satisfactorily completed; the player is found to be underage or otherwise ineligible; the player is subject to sanctions or other legal prohibitions; or the player engages in suspected money laundering, terrorist financing, or fraud

In cases of fraud, misrepresentation, or suspected criminal activity, balances may be forfeited and reported to relevant authorities.

13.1 All KYC documentation and information is collected, stored, and processed in accordance with our Privacy Policy.

13.2 Sensitive data is stored in encrypted form, with access limited to authorized compliance and operations personnel on a strict need-to-know basis.

13.3 KYC records are retained for a minimum of 5 years after account closure or the date of the last transaction, in line with AML regulatory requirements.

14.1 Where suspicious activity is detected during the KYC process or through ongoing monitoring, an internal Suspicious Activity Report ("SAR") will be filed with our Compliance Officer.

14.2 Where required, SARs will be reported to Anjouan Licensing Services Inc. within 24 hours of detection, with full supporting documentation.

14.3 Players are not entitled to be informed of internal or external suspicious activity reporting, and "tipping off" is strictly prohibited under applicable law.

15.1 We have appointed a qualified Compliance Officer responsible for:

• Oversight of KYC and AML/CTF compliance
• Regulatory liaison with Anjouan Licensing Services Inc.
• Escalation and timely reporting of suspicious activity
• Maintenance and review of this Policy

15.2 All relevant staff receive KYC and AML/CTF training:

• Upon onboarding
• At minimum annually
• Following any regulatory or policy change

15.3 This Policy is subject to independent AML audit annually and to inspection by Anjouan Licensing Services Inc. at any time.

By accessing the Services, players agree to:

• Provide truthful, accurate, and complete information
• Cooperate fully with all KYC and EDD requests
• Submit required documentation within reasonable timeframes
• Notify us promptly of any changes to their personal information

Failure to cooperate with KYC procedures may result in restriction or termination of the account in accordance with Section 12.

We reserve the right to amend this Policy at any time in response to regulatory changes, risk developments, or operational requirements. Material changes will be notified through the Website. Continued use of the Services constitutes acceptance of the revised Policy.

For any questions regarding this KYC Policy or to submit verification documentation, please contact:

HeavenOnline — KYC & Compliance
Operated by Lucifer Ltd.
KYC submissions/General support: [email protected]
Licensed by: Anjouan Licensing Services Inc.
License No.: ALSI-202605018-FI1