KYC POLICY

Lucky Days

Last updated: 08/13/2026

3-102-961212 Sociedad de Responsabilidad Limitada, operating https://luckydays.co (the "Company"), adheres to and complies with Know Your Customer ("KYC") principles, which aim to prevent financial crime and money laundering through client identification and due diligence. This Policy applies to all users of https://luckydays.co.

The Company reserves the right, at any time, to request any KYC documentation it deems necessary to determine the identity and location of a user of https://luckydays.co. We reserve the right to restrict the Service, payment, or withdrawal until identity is sufficiently established, or for any other reason at our sole discretion based on the applicable legal framework.

1. Risk-Based Approach

We take a risk-based approach and perform strict due diligence checks and ongoing monitoring of all clients, customers and transactions. In accordance with the Anjouan Gaming AML & CTF Code of Conduct and applicable anti-money laundering regulations, we apply three tiers of due diligence depending on the assessed risk, transaction type and customer profile:

SDD — Simplified Due Diligence: applied in instances of extremely low-risk transactions that do not meet the required thresholds for standard verification.

CDD — Customer Due Diligence: the standard level of due diligence applied in most cases for verification and identification of customers.

EDD — Enhanced Due Diligence: applied to high-risk customers, large transactions, or special cases where additional scrutiny is required. EDD includes verification of source of funds and, where applicable, source of wealth.

The Company maintains a documented AML/CTF risk assessment covering player risk profiles (geography, behaviour and funding sources), the products and services offered, payment methods and delivery channels and the jurisdictions involved, including FATF-identified high-risk countries. Proportionate controls are implemented based on the identified risks. The risk assessment is reviewed and updated at least annually, or upon any material change to the business or its risk environment.

2. Customer Due Diligence at Registration

At registration, every user must provide, as a minimum:

• Full legal name;

• A valid email address;

• Date of birth (confirming the user is at least 18 years of age); and

• Residential address.

No account will be activated until all of the above information has been provided. The Company shall not establish or maintain accounts for anonymous users or users acting on behalf of undisclosed third parties.

3. Enhanced Due Diligence — Verification Triggers

A user will be required to complete the full KYC / Enhanced Due Diligence process when any of the following conditions is met:

• The user requests their first withdrawal, regardless of the amount;

• The user's aggregate lifetime deposits reach USD 10,000 (or equivalent in any other currency) on https://luckydays.co;

• The user attempts to complete or completes a transaction that is deemed suspicious, or elevated risk indicators are identified; or

• The Company otherwise deems it necessary based on the user's activity or risk profile.

While Enhanced Due Diligence is pending, no withdrawals will be processed and the financial activity of the account will be restricted until verification is completed to the Company's satisfaction.

During the KYC process, the user will be required to provide personal information and upload supporting documentation as described below.

4. Required Documentation

4.1 Proof of Identity

Users must provide a copy of a valid Government-Issued Photo ID. Accepted documents include:

• Passport (biometric page, front and back if applicable)

• National Identity Card (front and back)

• Driver's Licence (front and back)

The document must satisfy all of the following criteria:

• A valid signature is present on the document (where applicable)

• The country of issue is not one of the Restricted Countries listed in Section 6

• The full name on the document matches the name on the user's account

• The document does not expire within the next 3 months from the date of submission

• The document confirms the holder is at least 18 years of age

4.2 Proof of Residence

Users must provide a recent proof of residential address. Accepted documents include:

• Bank statement (not older than 3 months)

• Utility bill (gas, electricity, water, or internet — not older than 3 months)

• Official government correspondence dated within the last 3 months

The document must satisfy all of the following criteria:

• The country of issue is not one of the Restricted Countries listed in Section 6

• The full name on the document matches the name on the user's account and the Proof of Identity submitted

• The date of issue is within the last 3 months from the date of submission

4.3 Selfie with Identity Document

Users must provide a clear selfie photograph of themselves holding their Government-Issued Photo ID. The following must be verified:

• The person in the selfie is identifiably the same individual as in the Photo ID

• The Photo ID in the selfie is the same document as submitted in Section 4.1 (photo and/or document number must be visible)

5. KYC Process — Operational Guidelines

The following guidelines govern the KYC review process:

• All submitted documentation is reviewed by designated compliance personnel under the oversight of the Company's appointed Compliance Officer.

• If the KYC review is unsuccessful, the reason is documented and a support ticket is created. The ticket reference number and an explanation are communicated to the user.

• If additional documentation is required, the user is notified and given a reasonable opportunity to provide it.

• Once all required and valid documents are received and verified, the user's account is approved and restrictions are lifted.

• The Company may conduct re-verification of a user's identity at any time during the account lifecycle where the risk profile of the user changes or where required by applicable law.

• All AML-related records are retained for a minimum of five (5) years from the end of the business relationship, in accordance with the Anjouan Gaming AML & CTF Code of Conduct and applicable AML legislation. This includes CDD and EDD documentation, transaction records (deposits, wagers and withdrawals), suspicious activity reports and internal reports and audit and compliance records. Records are stored securely and are readily available to Anjouan Gaming upon request.

6. Restricted Countries

The Service is not available to users who are residents of, or are accessing https://luckydays.co from, any of the following jurisdictions (the "Restricted Countries"). Users from these jurisdictions are not permitted to register, deposit, or play on https://luckydays.co:

• France and its territories

• Germany

• Netherlands and its territories

• Spain

• Union of Comoros

• United Kingdom

• USA and its territories

• All countries on the FATF Blacklist

• Any other jurisdiction deemed prohibited by the Anjouan Offshore Financial Authority

This list may be updated from time to time to reflect changes in the regulatory environment or the Company's licensing obligations. It is the user's responsibility to ensure they are not accessing the Service from a Restricted Country.

7. Source of Funds

Where required by the risk-based assessment, where Enhanced Due Diligence has been triggered, or where a user's deposits or gambling activity exceed defined internal thresholds, the Company may request documentary evidence of the user's source of funds and/or source of wealth. This may include, but is not limited to:

• Recent payslips or employment contracts

• Bank statements demonstrating income or asset accumulation

• Tax returns or financial statements (for self-employed individuals)

• Documentation of inheritance, sale of assets, or other one-time receipts

Failure to provide satisfactory source of funds documentation within a reasonable timeframe may result in restrictions on the account, suspension of withdrawals, or account closure.

8. Reporting, Compliance and Regulatory Basis

This KYC Policy is maintained in compliance with the obligations imposed on the Company as a licensed gaming operator under the Computer Gaming Licensing Act 007 of 2005 administered by the Anjouan Offshore Financial Authority, the Anjouan Gaming AML & CTF Code of Conduct and applicable international AML/CFT standards including the recommendations of the Financial Action Task Force (FATF).

In accordance with those obligations:

• Suspicious activity is reported to Anjouan Gaming within twenty-four (24) hours of detection, with full supporting documentation;

• All transactions or linked transactions exceeding USD 10,000 (or equivalent) are reported, whether or not they are suspicious;

• The Company has appointed a Compliance Officer responsible for AML oversight, regulatory liaison and reporting; and

• The Company operates transaction monitoring systems designed to detect structuring or threshold avoidance, rapid movement of funds, unusual betting patterns and activity involving high-risk jurisdictions;

• All staff receive AML training upon onboarding, annually thereafter and following any material regulatory or policy change; and

• The Company undergoes an independent AML audit annually, assessing policy effectiveness, regulatory compliance and internal controls and training. Anjouan Gaming may additionally conduct inspections and audits at any time.

The Company shall not establish or maintain accounts for anonymous users and shall not knowingly facilitate transactions for users who have failed to complete or pass the KYC process.