Know Your Customer (KYC) Policy

Know Your Customer (“KYC”) verification protects players, the operator, and the financial system from identity theft, underage gambling, fraud, and money laundering. It is a precondition for licensed real-money gaming.

We process your identification data on three legal bases:

• Legal obligation — Anjouan License Conditions §4 (mandatory enhanced verification at USD 10,000 cumulative deposits) and applicable anti-money-laundering law.
• Contractual necessity — we cannot lawfully process your withdrawals or settle wagers without verified identity.
• Legitimate interest — fraud prevention and protection of players.

See our Privacy Policy for full data-handling disclosures, and the AML Policy for the anti-money- laundering controls KYC supports.

Verification happens at four trigger points:

• Registration (basic identity). Your name, date of birth, country of residence, and contact details are validated immediately when you create an account. This establishes you are over 18 and not on a sanctions list.
• First withdrawal (full KYC). Before any funds leave the platform, we require government-issued photo ID and proof of address. Withdrawals are held in pending status until verification completes.
• Enhanced Due Diligence (EDD). Once your cumulative deposits reach USD 10,000, License Conditions §4 requires enhanced verification — typically Source of Funds documentation and a fresh proof of address. Additional deposits are paused until EDD completes.
• Periodic refresh. Documents on file are refreshed at least every 24 months, or sooner where risk indicators (unusual activity, jurisdiction change, sanctions-list updates) trigger an earlier review.

Government-issued photo identification — exactly one of:

• Passport (preferred — most reliable)
• National identity card (front and back, both sides)
• Driver’s licence (front and back, both sides)
• Government-issued residence permit with photo and date of birth

The document must be currently valid (not expired), clearly legible, and unedited. The photo, full name, date of birth, document number, issuing authority, and expiry date must all be visible.

Proof of address — exactly one of, dated within the last 90 days:

• Utility bill (electricity, water, gas, fixed-line internet, landline phone)
• Bank or credit-card statement (mobile-banking screenshots are not accepted)
• Government correspondence (tax notice, voter registration, council letter, licence renewal)
• Mortgage or rental-agreement statement issued by a regulated entity

The proof of address must show your full name and full residential address as it was registered on the account, and it must be issued by an independent third party (mobile-phone bills are accepted only when issued by a regulated telecoms operator showing the postal address, not just an email statement).

Liveness check — for higher-risk accounts and at our discretion, we may also request a brief selfie video or a real-time photograph holding the identity document. This protects against identity theft.

For your protection and ours, the following are automatically rejected:

• Expired documents, even if expired by a single day.
• Photocopies of photocopies, scans of screen photographs, or any document where the original surface cannot be confirmed.
• Edited or retouched images. Any sign of digital manipulation (clone-stamping, inconsistent compression artefacts, font mismatches) results in rejection and may trigger a fraud review.
• Cropped images that hide part of the document edge, the photograph, the machine-readable zone, or any required field.
• Documents in non-Latin scripts without a certified translation, except for Arabic and Cyrillic which we read directly with internal translators.
• Mobile-banking app screenshots used as proof of address. We require a formal statement document.

If we reject a document we tell you exactly why, and you may resubmit. Repeated submission of obviously fraudulent documents is treated as attempted fraud under our Terms of Service.

Targets, measured from the moment all required documents are uploaded:

• Automatic verification — five minutes or less for the typical case (passport + utility bill, no risk flags). The upload, OCR, document-validity check, and sanctions screen all complete in under five minutes.
• Manual review — within one working day. Triggered when automatic checks need a second pair of eyes (e.g. document quality borderline, name mismatch, address ambiguity).
• Complex cases — up to five working days. Triggered for source-of- funds reviews, sanctions hits requiring escalation, or jurisdictions where additional documentation is mandated.

You can check verification status in your account settings at any time. We do not tell you which checks specifically have or have not run — that information is confidential and could compromise the controls.

For Enhanced Due Diligence we may request evidence that the funds you deposit and wager originate from legitimate sources. This is a regulatory obligation, not a judgement of your character.

Documents that satisfy a Source of Funds request:

• Recent payslips (3 to 6 months) or an employment contract with stated salary
• Bank statement showing the salary or other regular income credit
• Tax return or assessment from a national tax authority
• For self-employed players: invoices, a business bank statement, or accountant’s letter
• Sale receipts (property, securities, business equity) where the funds came from a one-off transaction

Source of Wealth is broader and may apply for very high-value play; we may ask about your overall financial position, asset base, or inheritance history. We treat all such information with the same confidentiality protections as your identity documents.

If verification fails, the platform will:

• Pause withdrawals until the failure is resolved.
• Restrict deposits where the failure indicates a sanctions risk.
• Notify you in writing with the reason and the remediation steps available.

You have two routes to challenge a failed verification:

• Resubmission — you may upload corrected documents. The clock resets to the timeline in §5 above.
• Appeal — you may write to kyc@huli.bet requesting a senior review. We respond within five working days. If you disagree with the appeal outcome you may raise a complaint under our Complaints & Disputes procedure.

During the appeal your account remains restricted but funds are preserved; we never confiscate funds during a verification dispute.

Identity documents on file are re-verified on a rolling basis. Expect a refresh request when:

• An identity document on file is approaching its expiry date.
• Your jurisdiction of residence changes — a new address triggers fresh address verification and possibly a fresh sanctions screen against the new jurisdiction.
• Risk indicators on your account (unusual deposit pattern, sudden very-high-value play, complaint linked to identity, sanctions-list update) trigger an out-of-cycle review.
• Sanctions or politically-exposed-person (PEP) lists are updated and the screening re-run produces a possible match.

You are obliged under our Terms of Service to inform us promptly of changes to your name, residential address, or country of residence. Failure to do so may delay withdrawals or constitute an account-integrity breach.

KYC documents are stored encrypted at rest (AES-256) and in transit (TLS 1.3 or higher). Access is restricted to verification staff and members of the Compliance team on a need-to-know basis; every access event is logged in the immutable audit trail described in our Privacy Policy.

KYC documents are retained for 5 years after account closure, as required by Anjouan AML rules. Transaction records linked to identity verification are retained for 7 years. After retention expiry the documents are automatically deleted from primary storage; cryptographic hashes of the documents are retained in the immutable audit trail for 7 years to evidence that verification took place.

We never share KYC documents with marketing teams, affiliates, or third-party analytics. Sharing is restricted to: licensed payment providers (when required by card-scheme rules), regulators on lawful demand, and law enforcement under valid legal process.

For KYC-specific queries — document upload help, verification status, appeal requests — please email kyc@huli.bet.

For data-protection questions about your KYC information, our Data Protection Officer (DPO name TBC) is reachable at privacy@huli.bet.

This policy mirrors Anjouan Offshore Financial Authority (AOFA) License Conditions APR-2026 §4 and applicable AML rules. It is drafted in good faith but is subject to final review by qualified counsel before relied upon for any specific legal purpose.