KYC and AML Policy

GrowBit is committed to maintaining procedures for the prevention of money laundering, terrorist financing, fraud, sanctions evasion, proliferation financing, and other illicit activities in connection with the use of the GrowBit online gaming platform available at https://growbit.net/ as the primary domain, together with its official mirror domains, and any related software, games, wallets, tools, features, or services operated in connection with the platform (collectively, the "Website" or the "Services").

The Website is operated by 0-000-000000 Sociedad de Responsabilidad Limitada, a company duly incorporated under the laws of the Republic of Costa Rica, corporate identification number 0-000-000000, with its registered office at Calle 4, Paso de la Vaca, San José, Costa Rica (the "Company", "GrowBit", "we", "us", or "our").

This KYC and AML Policy (the "Policy") forms part of the contractual framework governing your use of the Website, together with the Terms and Conditions, Privacy Policy, Responsible Gaming Policy, System Fairness Policy, Risk Disclosure Statement, and other policies published on the Website.

GrowBit is an independent platform and is not affiliated with, endorsed by, or sponsored by Ubisoft or Growtopia, or by any of their respective owners, publishers, developers, affiliates, officers, employees, licensors, or representatives. References to Growtopia, World Locks, Diamond Locks, Blue Gem Locks, or DLS are used solely to identify supported virtual items, virtual currencies, or user-facing gameplay integrations.

GrowBit is a gaming platform supporting gameplay involving:

• Growtopia-related virtual items and currency, including World Locks, Diamond Locks, and Blue Gem Locks, counted on the Website as Diamond Locks (DLS); and
• Supported cryptocurrencies or digital assets, where enabled by the Website.

DLS is a virtual in-game currency associated with the Growtopia game economy. One Diamond Lock equals 100 World Locks, and one Blue Gem Lock equals 100 Diamond Locks. DLS is not legal tender, e-money, a security, a financial instrument, an official payment instrument, or an official currency, and it has no cash value outside the Website.

Users may deposit and withdraw DLS through operator-controlled in-game bots, where such functionality is available. A deposit is made by trading World Locks, Diamond Locks, or Blue Gem Locks to the bot in a world named by the Website, and the account is credited with exactly what the bot collects. A withdrawal places a hold on the requested DLS, after which the bot drops the locks to the Growtopia account named by the user. Each withdrawal is subject to minimum and maximum limits, may require fresh two-factor authentication above a threshold set by the Company, and may be reviewed before it is paid out. Cryptocurrency deposits and withdrawals are processed through the Website where enabled, subject to the controls described in this Policy.

The Company does not buy, sell, or exchange fiat currency or payment cards unless fiat functionality is expressly enabled and supported on the Website. Any third party that offers to trade fiat currency, in-game currency, virtual items, or cryptocurrency outside the Website is not affiliated with the Company, and the Company accepts no responsibility for such trades.

Our policies and internal controls are designed to comply with applicable laws, regulations, and supervisory guidance, including in particular:

• Law No. 7786: Law on Narcotics, Psychotropic Substances, Unauthorized Drugs, Related Activities, Money Laundering and Terrorism Financing, including Article 15, which subjects certain non-bank financial activities, such as substantial or systematic fund transfers or remittances, to AML/CFT obligations and supervision by SUGEF;

• Executive Decree No. 44390-H, which establishes beneficial ownership transparency obligations applicable to Costa Rican legal entities;

• SUGEF Regulation 12-21, the Regulation for the Prevention of Money Laundering, Terrorist Financing, and the Financing of the Proliferation of Weapons of Mass Destruction (ML/TF/FPADM), applicable to entities supervised under Article 14 of Law No. 7786, including requirements for the independent evaluation of the effectiveness of AML/CFT programs;

• SUGEF Agreement 13-19, applicable to obligated entities under Articles 15 and 15 bis of Law No. 7786, including entities conducting substantial fund transfers, casinos, and real estate intermediaries, establishing AML/CFT obligations such as customer due diligence (KYC), transaction monitoring, reporting, and external audit requirements;

• CONASSIF corporate governance and risk management regulations, including CONASSIF Agreement 4-16 and SUGEF Agreement 2-10, as well as provisions concerning the suitability of managers under CONASSIF 15-22 and information technology risk management under CONASSIF 5-24, which aim to ensure sound governance practices, appropriate risk management, and the proper functioning of management and control bodies; and

• The Financial Action Task Force (FATF) Recommendations and Interpretive Notes, which inform Costa Rica’s AML/CFT framework and guide the Company’s risk-based approach, as well as any instructions, reporting formats, or technical filing standards issued by the Unidad de Inteligencia Financiera of Costa Rica (UIF-Costa Rica) for the reporting of suspicious transactions or activities.

As part of our global operations, the Company has implemented compliance measures that are proportionate to the nature, scope, and risk profile of the Website, Services, supported currencies, supported virtual items, cryptocurrency functionality, and player activity.

These measures are reasonably designed to deter, detect, and prevent illicit activity in connection with the use of the Website, including abuse of in-game trade flows, cryptocurrency movements, redemptions, tips, transfers, wagering activity, and account balances.

The Company is not a traditional financial institution within the meaning of applicable Costa Rican law and is therefore not directly subject to all statutory and regulatory regimes applicable to certain financial institutions, money transmission businesses, or virtual asset service providers.

Notwithstanding the foregoing, and in accordance with applicable anti-money laundering regulations and risk-based compliance standards, the Company expressly prohibits and rejects the use of the Website or Services for any form of illicit activity, including money laundering, terrorist financing, proliferation financing, fraud, sanctions violations, trade laundering, tip laundering, collusion, or abuse of in-game or cryptocurrency flows.

The Company continuously monitors regulatory developments and norm-setting standards promulgated by the FATF, Costa Rican authorities, relevant gaming industry bodies, and applicable legislation, and will take such actions as it deems necessary and appropriate to reflect changes in law, regulatory expectations, or risk profile.

Our intention is to follow globally recognized and Costa Rica-aligned best practices to prevent our products and services from being used to facilitate illicit activities.

Such practices include, without limitation:

• The adoption and maintenance of written policies, procedures, and internal controls reasonably designed to prevent money laundering, terrorist financing, proliferation financing, fraud, sanctions violations, and other unlawful conduct;
• Where appropriate, the designation of personnel responsible for overseeing the implementation and effectiveness of such policies, procedures, and controls;
• The provision of relevant education and training to applicable personnel;
• Customer onboarding and compliance screening procedures;
• Transaction-based, gameplay-based, redemption-based, and activity-based monitoring controls;
• Internal escalation procedures for suspicious or high-risk activity;
• Ongoing monitoring, independent review where appropriate, and periodic maintenance of such policies, procedures, and controls.

In order to comply with applicable laws, regulations, provider requirements, risk-management standards, and internal policies, the Company implements anti-money laundering procedures, including customer due diligence and Know Your Customer (KYC) measures.

By using the Website, you agree to the rules set forth in this Policy and authorize the Company, at its sole discretion or as required by applicable law, third-party providers, infrastructure providers, game providers, payment providers, blockchain analytics providers, or competent authorities, to conduct verification checks in order to confirm your identity, eligibility, account ownership, wallet ownership, contact information, and the integrity of your activity.

You acknowledge and agree that, for the purposes of such identification and verification checks, the Company may use technical solutions and services provided by third-party service providers.

In order to access and use the Services available on the Website, the Customer must complete personal registration and maintain an active account on the Website.

Upon registration, you may be required to provide certain information for identification and verification purposes, including, without limitation:

• First name and last name, where required;
• Username;
• Date of birth, where required;
• Country of residence, where required;
• Residential address, where required;
• Contact email address;
• Secure password;
• Two-factor authentication enrolment, where available or required.

All personal information provided by you during account registration must be accurate, current, and complete.

You undertake to notify the Company without undue delay, and in any event no later than five (5) days, of any material change to such personal information and to provide the updated information accordingly.

You must own and personally control any Growtopia account (including the GrowID used for DLS deposits and withdrawals), cryptocurrency wallet, payment method, or other account used in connection with deposits, withdrawals, redemptions, or gameplay.

You may not register or operate multiple accounts, share accounts, use another person’s account, sell accounts, transfer accounts, or use accounts on behalf of third parties except as expressly permitted by the Terms and Conditions.

You shall promptly inform the Company if you are, or become, a politically exposed person (PEP), Head of an International Organization (HIO), or a family member or close associate of such persons.

In such case, you may be subject to enhanced due diligence and verification procedures, and your account may be restricted, suspended, or closed in accordance with applicable laws and the Company’s internal policies.

You may be required to undergo identity verification procedures at any time for security, compliance, legal, provider, fraud-prevention, responsible-gaming, or risk-management purposes.

This includes, without limitation, where a Customer conducts a single transaction or multiple related transactions exceeding ten thousand United States dollars (USD 10,000.00) or its equivalent in another currency, supported virtual item, in-game balance, cryptocurrency, or other supported balance type.

The Company also reserves the right to verify your identity even if such threshold has not been reached, including, but not limited to, the following circumstances:

• When you request a withdrawal, redemption, payout, or return of balances;
• When you deposit or withdraw cryptocurrency;
• When a cryptocurrency transaction exceeds internal thresholds;
• When you reach internal risk, transaction, trade, wager, redemption, tip, transfer, or activity thresholds established by the Company;
• Where the Company suspects money laundering, terrorist financing, proliferation financing, fraud, sanctions violations, collusion, multi-accounting, bonus abuse, trade laundering, tip laundering, exploit abuse, or other unlawful or prohibited activity, regardless of thresholds or transaction amounts;
• Where verification is required by third-party software providers, game providers, payment providers, blockchain analytics providers, infrastructure providers, or other relevant service providers;
• Where verification is mandated by applicable law or by a competent authority;
• Where fresh two-factor authentication is required at the moment of a redemption or withdrawal request; or
• In other cases during registration or ongoing monitoring of your activity where such verification is, at the Company’s sole discretion, deemed necessary.

Verification means the process by which the Company reviews and confirms the information provided by you during registration or account use by comparing it against valid personal identification documents, reliable sources, account records, blockchain data, provider records, game-account ownership evidence, or other information reasonably required under the Company’s risk-based assessment.

As part of the verification process, you may be required to provide one or more of the following documents or information:

• A valid passport, including the biographical page;
• A valid government-issued identification document, front and back;
• A valid driver’s license;
• Proof of residential address, such as a utility bill, bank statement, or equivalent document issued within the last three (3) months;
• A photograph or selfie of you holding your passport or government-issued identification document;
• A liveness check, video, or other identity-confirmation method, where reasonably required;
• Proof of ownership or control of the Growtopia account (GrowID) used for in-game trades, deposits, and withdrawals;
• Proof of ownership or control of cryptocurrency wallets used to deposit or withdraw through the Website;
• Source-of-funds information;
• Source-of-wealth information;
• Transaction history;
• Wallet history;
• Payment-related documents;
• Copies of bank cards used to fund or top up the account, with sensitive data appropriately masked, where applicable;
• Other documentation reasonably required to confirm eligibility, account integrity, lawful possession, or the legitimate origin of funds, cryptocurrency, virtual items, or in-game value.

In certain cases, where, in accordance with the Company’s internal risk management framework, a Customer is classified as a medium-risk or high-risk Customer, where verification is required by partners, including software providers, game providers, payment institutions, blockchain analytics providers, or infrastructure providers, or where otherwise warranted under the Company’s risk-based assessment approach, the Company may request additional information or documentation for verification purposes.

All documents must be provided as clear, high-resolution color photographs unless the Company specifies otherwise.

Scanned copies may be rejected where the Company requires live, photographic, or provider-verified submissions.

All pages of the documents must be fully visible, complete, current, readable, unobstructed, and unaltered.

The Company may reject documents that are expired, cropped, edited, blurred, black-and-white, incomplete, inconsistent, suspicious, forged, altered, or otherwise unsuitable for verification.

The requested documents must be provided by the Customer within two (2) days of receiving the verification request, unless a different deadline is specified in such request or the Company agrees to an extension in writing.

The Company monitors account activity, deposits, withdrawals, redemptions, in-game trade flows, gameplay, wagering patterns, tips, transfers, cryptocurrency transactions, wallet activity, bonuses, promotions, device activity, IP activity, and related behaviour for indicators of fraud, abuse, collusion, multi-accounting, money laundering, terrorist financing, proliferation financing, sanctions exposure, or other conduct inconsistent with legitimate use of the Website.

The Company may use internal systems, manual review, blockchain analytics tools, third-party risk-scoring tools, device intelligence, IP intelligence, game-account checks, and other technical measures to identify suspicious activity or violations of this Policy or the Terms and Conditions.

Transactions or activity deemed suspicious may be delayed, restricted, blocked, reversed, refused, reported, or escalated internally or externally in accordance with applicable law and internal procedures.

Where required or permitted by law, the Company may report suspicious transactions, suspicious activity, or other relevant information to competent authorities, including UIF-Costa Rica, law-enforcement bodies, regulatory authorities, or other competent authorities.

The Company may be legally prohibited from informing you of such reports due to applicable confidentiality, anti-tipping-off, or investigative requirements.

The Company retains relevant records for periods consistent with the Privacy Policy and applicable Costa Rican legal requirements.

Data relating to identity verification, transactions, AML/CFT monitoring, fraud prevention, account ledgers, and security-related records may be retained for at least five (5) years following account closure, the last transaction, or the end of the relevant business relationship, unless a longer retention period is required or permitted by applicable law.

After expiry of applicable retention periods, personal data and records may be securely deleted, archived, or anonymized unless a legal hold, investigation, dispute, enforcement need, or other lawful basis applies.

The Company reserves the right, at its sole discretion and in accordance with applicable law, to cancel or void any bets and related winnings, reverse transactions, claw back balances, restrict, suspend, or close accounts, exclude you from participating in games or promotions, withhold or retain payments, delay or refuse withdrawals or redemptions, and/or report relevant information to competent authorities where:

• Any information provided by you is false, inaccurate, misleading, expired, or incomplete;
• There are discrepancies between the information provided during registration and the information contained in verification documents or reliable sources;
• You fail to provide requested verification documents or information;
• Requested documents or information are incomplete, inaccurate, expired, altered, forged, invalid, or otherwise unsuitable;
• You violate the one-account-per-user rule;
• You engage in account sharing, multi-accounting, botting, collusion, exploit abuse, bonus abuse, trade laundering, tip laundering, or other prohibited conduct;
• The Company reasonably suspects money laundering, terrorist financing, proliferation financing, fraud, sanctions violations, or any other unlawful or prohibited activity;
• Continued access to the Website would expose the Company, other users, supported game economies, providers, account ledgers, cryptocurrency flows, or the integrity of the Website to legal, regulatory, security, operational, financial, or reputational risk.

In addition, the Company reserves the right to refuse any account registration or to block, suspend, restrict, or terminate any account at any time, for any reason permitted by law, at its sole discretion, and without prior notice where immediate action is required to protect the Website, other users, providers, account ledgers, supported game economies, or the integrity of the Services.

This Policy must be read together with the Terms and Conditions, Privacy Policy, Responsible Gaming Policy, System Fairness Policy, Risk Disclosure Statement, Bonus Terms, Virtual Currency Policy, and any other policies published on the Website.

Where this Policy refers to verification, restrictions, withdrawals, redemptions, account suspensions, balance reviews, transaction delays, monitoring, or reporting, those measures are without prejudice to your rights under mandatory consumer-protection law in your jurisdiction, to the extent such rights apply.

growbit.net is the primary domain of the Website.

Any other domains designated by the Company may operate as official mirror domains for redundancy, accessibility, continuity of service, or regional availability.

The same Terms and Conditions, Privacy Policy, AML/KYC controls, responsible-gaming controls, security measures, restrictions, monitoring, and enforcement rights apply regardless of which official domain is used.

Users should ensure that they access only official GrowBit domains. The Company is not responsible for phishing websites, impersonation domains, fake support accounts, malicious links, wallet-draining websites, or third-party websites falsely claiming to be associated with GrowBit.

This Policy is governed by and construed in accordance with the laws of the Republic of Costa Rica, unless mandatory law in your jurisdiction requires otherwise.

For questions about this Policy, verification requests, legal notices, privacy matters, or compliance-related matters, contact:

legal@growbit.net

For general account or support inquiries, contact:

support@growbit.net

You should contact the Company from the email address associated with your GrowBit account whenever possible.