Account security · Financial crime prevention
Anti-Money Laundering (AML) & Know Your Customer (KYC) Policy
An explanation of identity verification, customer due diligence, transaction monitoring and the safeguards designed to reduce the risk of money laundering, fraud and terrorist financing.
Part of the Nova88 Malaysia information website.
Purpose and scope of this policy
Anti-money laundering (AML) and know your customer (KYC) procedures help businesses identify the people using their services, understand financial activity and respond to signs of unlawful conduct. In online gaming, these safeguards are particularly important because accounts may involve deposits, withdrawals, payment intermediaries and transactions across different jurisdictions.
This page explains the main principles commonly used in a risk-based AML and counter-terrorist financing (CTF) framework. These include identifying customers, verifying information, assessing financial risk, maintaining appropriate records and escalating suspicious activity where the applicable law requires it.
A useful compliance policy should be more than a statement of good intentions. It should describe why information may be requested, what can cause additional verification, how concerns are reviewed and what customers should expect if an account is temporarily restricted.
The actual legal obligations and operational responsibilities depend on the licensed operating entity, the jurisdiction governing the service and the relevant regulatory framework. Publication of this page does not, by itself, establish the licensing status of a gaming website or prove that every described safeguard has been implemented.
Core principles of AML and KYC
A credible financial crime prevention programme combines customer verification with ongoing scrutiny of account activity. No single document check is sufficient for every situation.
Identify the customer
Establish the identity of the individual or legal entity associated with an account, using information appropriate to the product and relevant law.
Verify reliable evidence
Check the accuracy and authenticity of submitted information through suitable independent evidence or verification services.
Assess and monitor risk
Consider activity patterns, payment methods, geographic factors and other relevant indicators when deciding whether a deeper review is necessary.
Protect customer data
Limit access to identity information and retain it according to the applicable privacy, security and recordkeeping requirements.
Escalate concerns
Investigate unusual transactions and refer reportable concerns to authorised compliance personnel or competent authorities as required by law.
Review procedures
Reassess controls when risks, products, payment channels, regulations or methods of financial crime change.
Know Your Customer: identity verification
Customer identity checks help ensure that an account is linked to a real, identifiable person and is not being used under a false identity. They can also support age verification, account recovery, payment ownership checks and the prevention of unauthorised access.
Depending on the account and applicable requirements, verification may occur during registration, before a withdrawal, when account details change or when activity warrants additional scrutiny. A request for further identification does not automatically mean wrongdoing has been detected.
Information that may be required
Personal identification
Legal name, date of birth, nationality and other identifying details, collected only where appropriate and necessary.
Proof of identity
A current identification document, with validity and authenticity checks where supported by the applicable verification procedure.
Contact and address details
A verified email address, telephone number or proof of residential address, where those details are relevant to compliance or account security.
Payment ownership
Evidence linking a payment instrument to the account holder, particularly when deposits and withdrawals raise ownership questions.
Additional financial information
Where a higher-risk review is justified, information explaining the source of funds or the nature of particular transactions.
Reverification
Updated information when documents expire, important details change or existing verification can no longer be relied upon.
Customers should provide accurate details and should never submit forged, altered or borrowed identity documents. When documents are incomplete or inconsistent, the service may request clarification before an account or transaction can proceed.
Customer due diligence and risk assessment
Customer due diligence (CDD) is the process of gathering and evaluating enough information to understand who is using a service and whether the associated financial activity is consistent with the available evidence.
A risk-based approach recognises that different situations require different levels of scrutiny. The purpose is not to assume that particular customers are dishonest, but to allocate verification and review efforts proportionately to identifiable risks.
| Review approach | When it may apply | Illustrative measures |
|---|---|---|
| Simplified due diligence | Lower-risk situations, only where the law permits simplification. | Appropriate identity checks and proportionate monitoring; not a complete exemption from verification. |
| Standard due diligence | Ordinary customer relationships and transactions. | Identity verification, relevant account records, risk assessment and ongoing monitoring. |
| Enhanced due diligence | Higher-risk circumstances such as unusually complex transactions, material inconsistencies or certain politically exposed person relationships. | Additional evidence, source-of-funds review, closer monitoring and appropriate management approval where required. |
A politically exposed person (PEP) may require additional assessment because of risks associated with a prominent public position. However, being a PEP does not automatically establish involvement in financial crime.
Other risk indicators may include unusual transaction patterns, inconsistent identity information, the use of payment methods belonging to third parties or activity that cannot be reasonably explained. These indicators require context; one irregular transaction alone may have an innocent explanation.
Any decision to reject, suspend or terminate a relationship should follow the actual operator’s documented procedures and applicable legal obligations. This page does not create additional grounds for account suspension beyond those stated in the relevant terms.
Monitoring deposits, withdrawals and unusual activity
Transaction monitoring aims to identify activity that may be inconsistent with the account holder’s known profile, the nature of the service or legitimate use of the payment facilities. Reviews may be automated, manual or a combination of both.
For instance, an account that receives deposits from several unrelated payment sources and quickly requests withdrawal to a different beneficiary may call for clarification. Similarly, repeated attempts to change identity details during a withdrawal request could justify additional authentication.
These examples are not proof of criminal conduct. Effective monitoring requires considering context, transaction history, product behaviour and the evidence available at the time.
Examples of activity that may merit review
Unexplained transaction patterns
Deposits and withdrawals that differ significantly from the activity reasonably expected for the account.
Unclear payment ownership
Use of payment instruments or receiving accounts that cannot be adequately linked to the verified customer.
Inconsistent customer information
Material conflicts between submitted documents, account details and other reliable records.
Where a concern is identified, the appropriate response may include requesting information, reviewing supporting records, temporarily delaying a transaction where authorised, or escalating the matter for compliance assessment.
Customers should not interpret a routine verification request as evidence that their account has been accused of wrongdoing. A legitimate compliance review should be handled through documented channels while protecting confidential information.
Suspicious activity reporting and confidentiality
Where applicable law establishes a duty to report suspicious transactions, the responsible regulated entity must assess relevant information and make the appropriate report to the designated authority. Reporting obligations, deadlines, monetary thresholds and recordkeeping periods vary by jurisdiction.
For that reason, a general website policy should not promise one universal reporting threshold or imply that every transaction of a particular size is automatically suspicious. Compliance reviews consider the legal framework and the circumstances surrounding the activity.
Reporting processes commonly involve identifying a concern, recording the supporting information, assessing whether statutory criteria are met and ensuring that authorised personnel handle any required submission.
Confidentiality is essential. Certain jurisdictions prohibit revealing the existence or content of a suspicious transaction report to a customer or other unauthorised party. This principle is sometimes described as avoiding “tipping off.”
Document retention, security and data accuracy
Identity information, transaction history and relevant compliance assessments may need to be retained for a period specified by applicable law. Retention rules can depend on the type of record, the jurisdiction and whether a customer relationship remains active.
Records should be accurate enough to support an appropriate review and protected against unauthorised access, improper alteration and unnecessary disclosure. Appropriate safeguards can include access restrictions, audit logs, secure transmission and controlled handling of sensitive documents.
Customers can support accurate recordkeeping by keeping their contact information current, informing the authorised support team when important account details change and responding to reasonable verification requests through trusted channels.
Privacy and AML responsibilities must be considered together. Collecting more information than is necessary does not automatically improve compliance. The purpose of a request, the lawful basis for processing and the applicable retention obligations should guide data handling.
For additional information on how customer data is described on this website, review the Privacy Policy. Where the operator has separate binding privacy terms, those documents should be consulted as well.
What happens when verification cannot be completed?
Verification sometimes takes longer because a document is unclear, the submitted name does not match the account record, a payment method requires ownership confirmation or the requested information is incomplete.
In such cases, the service may request a clearer document, updated information or an explanation of the discrepancy. If required checks cannot be completed, the applicable terms and law may restrict account functions or prevent a transaction from being processed.
The correct course is to contact the verified support channel, ask which specific information is needed and provide it through a secure submission method. Repeatedly sending the same unusable document may delay resolution.
Do not attempt to bypass verification using another person’s identity, an unrelated payment account or a newly created account intended to avoid an existing review. Such actions can create additional security and compliance concerns.
For general access information, consult the Nova88 Login guide. That page covers website access and account troubleshooting; it does not replace the operator’s actual compliance process.
Governance, staff awareness and policy reviews
Within a regulated business, effective financial crime controls require clear accountability. Personnel responsible for customer verification, payments, security and compliance need to understand the circumstances in which they must seek advice or escalate a concern.
Training may cover recognising unusual activity, securely handling identity documents, understanding relevant legal duties, protecting confidential reports and avoiding inappropriate disclosures.
Management oversight is also important. Written procedures should be reviewed when new payment methods are introduced, products change, regulatory obligations are updated or control weaknesses are identified.
These are core governance expectations rather than a claim that a specific training frequency, compliance officer appointment or external audit has been independently verified for this domain. Any such operational details should be included only when supported by current records from the responsible entity.
Frequently asked questions about AML and KYC
Why might a gaming account require KYC verification?
What documents are normally requested?
Is KYC required for every withdrawal?
Does a verification request mean my account is suspicious?
Can I use a family member’s bank account?
How long does identity verification take?
What happens if I refuse to provide required documents?
Does this policy prove a particular gaming licence?
Related policies and account information
These pages cover separate aspects of account security, personal information and customer responsibilities.
Policy content should be reviewed whenever the responsible operating entity, applicable regulations or published account procedures change. It should not be represented as a substitute for legal advice or binding operator terms.
Identity protection and responsible account use
Clear verification procedures, accurate records and appropriate oversight help reduce financial crime risk while protecting legitimate customers. Always use verified channels when submitting personal information.
Information for adults only. Financial and gaming services are subject to applicable local laws and eligibility requirements.