Purpose and Scope
This AML Policy governs anti-money laundering (AML) and countering the financing of terrorism (CFT) controls for Xhjili. It applies to all players, transactions, and activities conducted on or through the Xhjili platform, including subsidiaries and services under the Xhjili brand where applicable.
Governance and Responsibilities
The organization designates a Money Laundering Reporting Officer (MLRO) responsible for implementing and maintaining this policy, supervising reporting of suspicious activities, and ensuring interaction with regulatory authorities. The MLRO serves as the primary point of contact for AML/CTF matters and maintains auditable records of suspicious activity reports (SARs) and internal investigations.
- Compliance and escalation: Staff must report suspicious activity to the MLRO immediately; the MLRO assesses reports and determines whether a SAR or equivalent submission is required.
- Training: The compliance function provides AML/CTF training to staff, updated at least annually or as regulatory guidance requires.
- Recordkeeping: All KYC, due diligence, monitoring, and SAR records are retained in accordance with applicable laws for no less than five years after account termination or the completion of the business relationship.
Risk-Based Approach and Classification
Xhjili employs a risk-based framework to identify, assess, and mitigate AML/CTF risks associated with customers and transactions. Client risk is categorized into Low, Standard, and Enhanced levels based on factors such as geography, type of activity, transaction patterns, and source of funds. The monitoring program generates automated alerts; high-risk cases trigger enhanced due diligence and ongoing scrutiny.
- Low risk: Standard KYC, ongoing monitoring, and routine screening.
- Standard risk: Regular due diligence with ongoing monitoring and periodic review.
- Enhanced risk: Immediate escalation to enhanced due diligence, additional documentation, and intensified monitoring.
Know Your Customer (KYC) and Onboarding (CDD)
Onboarding and ongoing service are contingent on verified identity and eligibility. Xhjili collects and verifies information to comply with applicable laws and to safeguard the integrity of the platform. The following information must be obtained and verified during onboarding: date of birth, government-issued photo ID, full legal name, residential address, valid email address, and payment method details. A geolocation check of the applicant’s IP is conducted to ensure the individual is located in a permitted jurisdiction. The platform may request additional documentation to verify identity or address and may suspend or terminate a Player Account if information is false or misleading.
- A single Player Account is required per person, household, and shared environment. Sharing login details with third parties is strictly prohibited.
- The MLRO may request further documentation for verification at any time, including during onboarding, at withdrawal, or at the company’s discretion.
- Account activity and KYC information are reviewed periodically to confirm continued compliance and to detect changes in risk profile.
Enhanced Due Diligence (EDD)
Enhanced due diligence is applied when risk indicators are elevated. Triggers include presence in a high-risk or non-reputable jurisdiction, politically exposed persons (PEP) status, suspected multiple accounts, suspected collusion among players, irregular or unusual activity, or regulatory requirements. Additional verification may include: government-issued identification, selfie with the ID, recent proof of address, source of funds and wealth, and a bank statement showing initial deposits. The MLRO approves escalation to EDD; if identity cannot be verified, the account may be closed and winnings may be forfeited in accordance with applicable laws.
Ongoing Monitoring and Account Activity
Ongoing monitoring of Player Accounts is conducted to identify irregular, suspicious, or fraudulent activity. Designated personnel review flagged activity, and automated technologies generate alerts for investigation. If irregular or suspicious activity is detected, the account may be reclassified to High Risk and subjected to Enhanced Due Diligence. Regular reviews consider factors such as false or unverifiable KYC data, use of fictitious identifiers, unusual transaction patterns, and attempts to circumvent security measures. Access to services may be restricted during investigations.
Multiple Accounts and Customer Integrity
Xhjili enforces a single-account policy per person, family, and shared environment, including address, phone number, IP address, and device. If multiple accounts or syndicate activity is suspected, related accounts will be temporarily suspended and reviewed. If it is determined that multiple accounts exist or that players are colluding, Xhjili may withhold cash or winnings and suspend or terminate related accounts, including deposits and withdrawals, pending resolution.
Unusual Activities and Reporting
Instances such as unusual deposits, rapid transfers, or atypical betting patterns trigger investigations. If warranted, the MLRO will report to the relevant regulatory or supervisory authority in accordance with applicable law. All decisions to report or not to report will be documented with justification and maintained for audit purposes.
Withdrawals and Payouts
Withdrawal requests must be submitted via the Player Account and are subject to verification of identity and compliance checks. Funds must be paid to the registered player and, where applicable, to an account or wallet in the name of the player. Third-party payouts require explicit authorization under regulatory and internal controls. The platform may pause withdrawals or suspend the account and request additional documentation if suspicious activity is identified or verification fails. The MLRO may direct withholding of funds pending investigation or resolution.
Cryptocurrency and Digital Assets
In platforms that support digital assets, Xhjili may permit cryptocurrency transactions subject to the following: the initial deposit method, if cryptocurrency-based, governs subsequent activity; the platform does not engage in fiat-crypto exchange services for customers; assets are held segregated from other funds and are not interest-bearing. The platform will display current exchange rates for any permitted conversions where applicable and will inform users that cryptocurrency values fluctuate with market conditions. Identity, age, and address verification are required for all crypto-related transactions, and solvency and balance verifications may be requested to satisfy regulatory requirements. Non-compliant activity may result in account termination.
Data Retention, Privacy, and Recordkeeping
All AML-related records, including KYC documentation, due diligence results, and SARs, are retained for a minimum of five (5) years after the end of the business relationship, or longer if mandated by law. Records are stored securely, with access limited to authorized personnel. Data processing complies with applicable data protection laws, and personal data is handled consistently with the purposes of AML/CTF obligations and regulatory reporting requirements.
Training and Awareness
All staff receive AML/CTF training at onboarding and at least annually thereafter. Training covers detection of suspicious activity, escalation procedures, recordkeeping requirements, KYC documentation standards, and regulatory obligations. Evidence of completion is maintained for audit purposes and regulatory reviews.
Policy Review and Updates
The AML Policy is reviewed at least annually and whenever regulatory guidance necessitates changes. Material amendments require communications to staff and players, with the revised policy becoming effective on the stated date.
Definitions
- AML: Anti-money laundering.
- CTF: Countering the financing of terrorism.
- KYC: Know Your Customer.
- CDD: Customer Due Diligence.
- EDD: Enhanced Due Diligence.
- MLRO: Money Laundering Reporting Officer.
- SAR: Suspicious Activity Report.
- PEP: Politically Exposed Person.
Contact and Escalation
Questions about this policy should be directed to the compliance function at Xhjili. For inquiries, please contact the MLRO or the designated Compliance Officer through approved channels maintained by Xhjili. All inquiries will be handled in accordance with applicable data protection and regulatory requirements.