Bettor Identification and Verification Policy (KYC)

1. Purpose and scope

This Policy describes how jogodobicho, a commercial brand operated by [to be provided], registered under CNPJ no. [to be provided], with its registered office at [to be provided], authorised by the Secretaria de Prêmios e Apostas of the Ministério da Fazenda (SPA/MF) under authorisation [to be provided], identifies and verifies anyone who opens a betting account on the domain jogodobicho.com.

The procedure described here is known by the acronym KYC — know your customer. It is not a registration formality: it is the condition for a bet placed with a financial stake to be accepted, for a prize to be paid to the right person, and for your account not to be used by somebody else.

This Policy applies to every bettor and to everyone who attempts to open an account on jogodobicho.com, whatever the game on offer, and forms part of the Terms of Use. It is to be read together with the Privacy Policy, the Anti-Money Laundering and Counter-Terrorist Financing Policy, and the Responsible Gaming page.

• Who must be identified and what is required at each stage.
• How we confirm that the CPF provided exists, is in good standing, and belongs to the person registering.
• When facial recognition with liveness detection is required.
• What happens if verification is pending, refused, or has to be repeated.

Legal basis: Lei 14.790/2023 (regulation of fixed-odds betting) · Portaria SPA/MF nº 827/2024 (requirements for authorisation of the operating agent) · Portaria SPA/MF nº 1.231/2024 (rights and duties of the bettor, and registration) · Portaria SPA/MF nº 1.475/2024 (mandatory use of the .bet.br domain)

2. Why we require identification — legal basis

Identifying the bettor is not a commercial choice of ours. Lei nº 14.790 of 29 December 2023, which regulates the fixed-odds betting lottery modality created by Lei nº 13.756 of 12 December 2018, together with the SPA/MF instruments that detail it, require the operating agent to keep a bettor registration record and to confirm the identity of the bettor before accepting bets.

In addition, the operating agent is subject to Lei nº 9.613 of 3 March 1998, which requires it to identify customers, keep registration records up to date, record transactions, and report to the Conselho de Controle de Atividades Financeiras (COAF) any transaction showing signs of money laundering or terrorist financing.

The data collected under this Policy is processed on the basis of compliance with a legal and regulatory obligation, under the General Data Protection Law (Lei nº 13.709/2018). This means we do not ask for your consent in order to require it: without it, the account cannot exist. What we do with that data, how long we keep it, and what your rights are is set out in sections 15 and 16 of this Policy and in the Privacy Policy.

• Confirm that whoever bets is over 18 and is not barred from betting.
• Ensure that the prize is paid to the account holder, and to nobody else.
• Prevent money laundering, terrorist financing, and identity fraud.
• Give effect to responsible gaming tools, including self-exclusion, which only work if the person can be recognised.

Legal basis: Lei 13.756/2018, art. 29 (creation of the fixed-odds betting lottery modality) · Lei 14.790/2023, art. 23 (identification procedures and verification of the validity of the bettor identity) · Lei 9.613/1998, art. 10 and art. 11 (customer identification, records, and reporting to COAF) · Lei 13.709/2018, art. 7º, II (processing for compliance with a legal or regulatory obligation) · Portaria SPA/MF nº 1.143/2024 (anti-money laundering and counter-terrorist financing)

3. Who may open an account

The account is personal and non-transferable and may only be opened by a natural person over 18 years of age, acting in their own name and on their own behalf.

We do not open an account — and we close an existing account when the fact comes to light later — for anyone falling within any of the situations below. The prohibition applies even where the person has already completed registration and made a deposit.

• Persons under 18, even if assisted or represented by a legal guardian.
• Persons able to influence the outcome of an event offered for betting by jogodobicho, or having access to inside information about that outcome.
• Persons barred from betting by judicial decision, by administrative decision, or by an applicable statutory prohibition.
• Bettors under an active self-exclusion, whether requested with us or registered with the SPA/MF, for as long as the chosen period lasts.
• Persons acting as intermediaries, betting with funds belonging to third parties or on behalf of third parties.
• Persons whose identity cannot be confirmed by the means described in this Policy.

Legal basis: Lei 14.790/2023 (prohibition on betting by persons under 18 and by those able to influence the outcome of the event) · Portaria SPA/MF nº 1.231/2024 (rights and duties of the bettor, registration, and responsible gaming)

4. Data required at registration

Registration is completed on jogodobicho.com itself and requires the data listed below, in accordance with art. 31 of Portaria SPA/MF nº 1.231/2024. All of it is mandatory: there is no partial registration that allows betting with money.

The data must match exactly the official document presented and the Receita Federal database. Spelling discrepancies, a preferred name given without the legal name, and an out-of-date address are the most common causes of a refused verification — and all of them can be corrected, as section 12 describes.

Providing false information at registration is grounds for refusal and, where an account has already been opened, for immediate suspension, without prejudice to any other applicable measures.

• Full name, exactly as it appears on the official identification document.
• Registration number in the Cadastro de Pessoas Físicas (CPF).
• Date of birth.
• Parentage, with the full name of the mother and, where applicable, of the father.
• Nationality and place of birth.
• Full residential address, including street, number, unit, district, municipality, federative unit, and postal code.
• Mobile telephone number with area code, validated by a code sent to the handset.
• Email address, validated by link or code.
• Official photographic identity document: type, number, issuing authority, and date of issue.
• Facial image captured with liveness detection, as set out in section 6.
• Details of a payment account held by the bettor, used for deposits and withdrawals.
• A declaration that the person is over 18, is not barred from betting, and is acting in their own name.
• Information on politically exposed person status, or on a close relationship with a person holding such status.
• Acceptance of the game rules, the Terms of Use, the Privacy Policy, and this Policy, with a record of the date, time, and version accepted.

Legal basis: Portaria SPA/MF nº 1.231/2024, art. 31 (data required in the bettor registration record) · Lei 9.613/1998, art. 10, I (customer identification and up-to-date registration record) · Lei 13.709/2018, art. 6º (principles of purpose, suitability, and necessity)

5. CPF validation against the Receita Federal database

The CPF provided is checked against the database of the Secretaria Especial da Receita Federal do Brasil. The check verifies whether the number exists, whether its registration status is in good standing, and whether the name and date of birth provided match those held in that database.

The check is performed at registration and repeated at the revalidations described in section 13. Until the CPF is confirmed, the account remains subject to the restrictions in section 11.

We do not accept a CPF whose registration status is suspended, cancelled, void, or belongs to a deceased holder. If your CPF is not in good standing, it must be regularised with the Receita Federal — we cannot do this for you, and we charge nothing for it.

• Existence of the number and registration status of the CPF.
• Match between the full name provided and the holder of the CPF.
• Match of the date of birth and confirmation that the holder is over 18.
• Absence of any indication that the holder is deceased.

Legal basis: Portaria SPA/MF nº 1.231/2024, art. 31 (registration data and its validation) · Lei 9.613/1998, art. 10, I (duty to identify the customer)

6. Facial recognition with liveness detection

In addition to the data you declare, we require biometric facial verification with liveness detection. In practice, you are guided to look at the camera of your device and follow simple instructions; the system compares the captured image with the photograph on the official document and confirms that there is a living person in front of the camera, rather than a photograph, a video, or a mask.

The facial image is sensitive personal data. It is processed for compliance with a legal and regulatory obligation, with restricted access, and is not used for advertising or commercial profiling. It is not shared with third parties other than the contracted identity verification provider, the competent authorities, and the SPA/MF where required.

Facial verification with liveness detection is required at the following moments.

If liveness detection fails for a technical reason — insufficient lighting, a low-quality camera, an unstable connection — you may try again. Repeated failures send the account to manual review, described in section 12.

• On opening the account, before the first bet placed with a financial stake.
• Before the first withdrawal, and whenever the registered payment account is changed.
• Where there is any indication that the account is being used by someone other than the account holder.
• At the periodic revalidations of the registration record, as set out in section 13.
• Where AML/CTF risk analysis so recommends, or in compliance with a determination by the SPA/MF or another competent authority.

Legal basis: Portaria SPA/MF nº 1.231/2024 (verification of the identity of the bettor, including by facial recognition) · Lei 13.709/2018, art. 5º, II (biometric data as sensitive personal data) · Lei 13.709/2018, art. 11, II, "a" (processing of sensitive data for compliance with a legal or regulatory obligation) · Portaria SPA/MF nº 722/2024 (information security requirements)

7. Accepted documents and supplementary information

For documentary evidence we accept an official photographic identification document, within its validity period where it has one, legible and intact, submitted as a colour image of the original document. We do not accept a copy of a copy, or a document that has been cropped, edited, or has data obscured.

Depending on the outcome of risk analysis, the value bracket of the amounts moved, or an applicable regulatory requirement, we may request supplementary information. The request is always made through the official channels of jogodobicho, and never by telephone asking for a password, an access code, or a transfer of funds.

• Identity card (RG), driving licence (CNH), passport, or a professional document with public authority status.
• For resident foreign nationals, a migrant identity document or equivalent, together with the CPF.
• A recent proof of address, where the declared address cannot be confirmed by other means.
• Information on the source of funds and on the declared occupation, in cases of enhanced due diligence.
• Declaration and evidence of politically exposed person status, where applicable.

Legal basis: Lei 9.613/1998, art. 10 (identification, registration records, and transaction records) · Portaria SPA/MF nº 1.143/2024 (enhanced due diligence and politically exposed persons) · Portaria SPA/MF nº 1.231/2024 (bettor registration record)

8. One account per CPF

Each bettor has a single account, linked to their CPF. It is not possible to hold two accounts, not even with different email addresses or devices, and not even for different games offered under the same brand.

If we identify duplicate accounts, we keep the oldest verified one and block the others for new bets and new deposits. The balance of the blocked accounts, less any bets already settled, is consolidated into the account that is kept or returned to the holder, following AML/CTF checks.

The single-account rule exists because responsible gaming tools — deposit limits, time limits, cooling-off, and self-exclusion — lose all effect if the same person can open another account to get around them.

• One CPF, one account, one holder.
• Limits and self-exclusion apply to the person, not to the login.
• Duplicate accounts create no entitlement to bonuses, promotions, or accrued benefits.

Legal basis: Portaria SPA/MF nº 1.231/2024 (single bettor account and responsible gaming) · Lei 9.613/1998, art. 10, I (single and up-to-date customer registration record)

9. Prohibition of third-party accounts

The account is for strictly personal use. It is prohibited to open, use, lend, rent, sell, or transfer a betting account to third parties, and it is prohibited to bet with funds belonging to another person.

All deposits and withdrawals must be made through a payment account held by the bettor, under the same registered CPF. We do not accept deposits from, nor pay prizes into, the account of a third party under any circumstances, including that of a spouse, a family member, or a representative.

The third-party account is the typical vehicle for three problems the regulation obliges us to prevent: the minor who bets through the account of an adult, the self-excluded person who resumes betting through the account of somebody else, and the use of a front to conceal the origin or destination of funds.

Where use by a third party is identified, we suspend the account, hold withdrawals under review, investigate the facts, and report to the competent authorities where appropriate. Bets placed by someone other than the account holder may be voided.

• A single holder per account, with no exceptions.
• Payment methods under the same CPF as the account holder.
• Prizes paid exclusively to the verified account holder.
• Sharing credentials amounts to transferring the account and exposes the account to suspension.

Legal basis: Portaria SPA/MF nº 1.231/2024 (ownership of the account and of the payment methods) · Lei 9.613/1998, art. 10 and art. 11 (identification, records, and reporting of suspicious transactions) · Portaria SPA/MF nº 1.143/2024 (anti-money laundering and counter-terrorist financing)

10. Demonstration mode without registration

jogodobicho offers a demonstration mode that can be accessed without registration and without identification. It exists so that a visitor can learn the rules and the mechanics of the games before deciding whether to open an account.

In demonstration mode there is no financial stake from the bettor and no economic value at play: the credits shown are fictitious, cannot be purchased, transferred, or withdrawn, generate no cash prize or any other economic benefit, and the outcome obtained creates no entitlement whatsoever. Since no value is at risk, there is no bet within the meaning of Lei nº 14.790/2023.

Betting with money is a different matter, and there no exception exists: any bet placed with a financial stake requires an open account, complete registration, and an identity verified in accordance with this Policy. There is no deposit, no cash bet, no prize, and no withdrawal without completed verification.

Demonstration mode follows the same responsible communication rules that apply to advertising: it is not directed at persons under 18, it displays responsible gaming notices, and it does not suggest that performance in the demonstration will be repeated with real money.

• Without registration: demonstration mode only, with no economic value.
• With money: a verified account, always, with no exception.
• Demonstration credits are not convertible, transferable, or withdrawable.
• The outcome of the demonstration neither represents nor guarantees a real-money outcome.

Legal basis: Lei 14.790/2023, art. 2º, I (a bet presupposes a value placed at risk by the bettor) · Lei 14.790/2023, art. 2º, VIII (definition of online game) · Portaria SPA/MF nº 1.231/2024 (identification prior to acceptance of the bet, and responsible gaming) · Portaria SPA/MF nº 615/2024 (communication, advertising, and promotion)

11. While verification is pending

Once the data has been submitted, verification is usually automatic and immediate. Where human review is required — because of a registration discrepancy, a document that could not be read, or a risk alert — the account is placed in a pending state and you are told what is missing.

We aim to complete the review as quickly as possible and, where it depends on an additional document, we say exactly which document and why. You are notified by email and within the account itself at each change of state.

While verification is pending, the following rules apply.

• Betting with money and taking part in cash promotions are not possible.
• Withdrawal is not possible, even where a deposited balance exists.
• Deposits may be blocked or limited until the review is complete.
• Demonstration mode remains available.
• If verification is not completed, any amount deposited is returned to the same originating payment account, held by the depositor, following AML/CTF checks.

Legal basis: Portaria SPA/MF nº 1.231/2024 (verification prior to acceptance of bets) · Lei 9.613/1998, art. 10 (customer identification before the transaction) · Portaria SPA/MF nº 1.143/2024 (monitoring and due diligence)

12. Refused verification and resubmission of documents

Verification may be refused. When that happens, we state the reason in plain language, by email to the registered address and within the account. We do not use refusals without explanation.

Most refusals can be corrected and stem from simple problems: an illegible photograph, an expired document, a name typed differently from the one held against the CPF, an out-of-date address, or liveness detection attempted in poor light.

To resubmit, go to the verification area on jogodobicho.com, correct the point raised, and send it again. You may resubmit documentation as many times as necessary; each resubmission triggers a fresh review and a fresh response. If you prefer, send the documentation to [to be provided], quoting the registered CPF.

If the refusal stands, you may request human review of the decision, including where it was taken by an automated system, and submit supplementary documents. The review request is made to [to be provided]. Failing a resolution, the matter may be taken to the ombudsman at [to be provided] and, after that, to the SPA/MF and to the consumer protection authorities.

A final refusal means the account is not opened, or is closed. Any balance corresponding to deposits not yet staked is returned to the originating payment account, held by the same person, unless the law provides otherwise. A refusal based on suspected fraud, on the use of the identity of another person, or on a statutory prohibition confers no right to attempt registration again, and is reported to the authorities where appropriate.

• Document photograph illegible, cropped, showing glare, or with data obscured.
• Document outside its validity period.
• Discrepancy between the data declared and the Receita Federal database.
• Liveness detection failure, or low similarity with the photograph on the document.
• Indication that the documents belong to another person or have been tampered with.

Legal basis: Portaria SPA/MF nº 1.231/2024 (rights of the bettor and communication of decisions) · Lei 8.078/1990, art. 6º, III (right to adequate and clear information) · Lei 13.709/2018, art. 20 (review of decisions taken by automated processing)

13. Periodic revalidation and keeping the record current

The registration record has to reflect reality over time, and not only on the day the account was opened. That is why we revalidate the record periodically, and you have a duty to keep your data up to date, notifying us of any change.

The frequency of revalidation follows the risk profile of the bettor: the higher the identified risk, the more frequent the review. Beyond the periodic cycle, certain triggers prompt immediate revalidation.

During revalidation, the account may continue to operate normally. If the deadline given for updating the data passes without a response, the account moves to the pending state described in section 11 until the matter is put right.

• Change of name, address, telephone number, email address, or registered payment account.
• Change in politically exposed person status.
• Activity inconsistent with the declared profile or the stated occupation.
• Indication of access by someone other than the account holder, or of shared credentials.
• AML/CTF alerts, restrictive lists, or a request from a competent authority.
• Reactivation of a dormant account, as set out in section 14.

Legal basis: Lei 9.613/1998, art. 10, I (keeping the registration record up to date) · Portaria SPA/MF nº 1.143/2024 (risk-based approach and ongoing due diligence) · Portaria SPA/MF nº 1.231/2024 (updating the registration record)

14. Dormant accounts

We treat an account as dormant where there has been no access, bet, deposit, or withdrawal for 12 (twelve) consecutive months.

Before treating the account as dormant, we notify you in advance by the registered email address and telephone number, explaining what will happen and how to reactivate it.

Reactivation requires a fresh login and revalidation of the registration record, including fresh facial verification with liveness detection where the data is out of date or where the dormancy has been prolonged.

A balance held in a dormant account continues to belong to you. We do not confiscate balances for dormancy. If the account is closed, the balance is made available to the verified account holder and returned to their payment account; if return is not possible for want of valid data, the amount remains recorded and identified until the holder claims it or until the law directs another destination.

• Dormancy: 12 months with no access, bet, deposit, or withdrawal.
• Advance notice by email and telephone before any measure is taken.
• Reactivation with revalidation of the record and, where applicable, fresh liveness detection.
• Balance preserved and returned to the holder; never confiscated for dormancy.

Legal basis: Portaria SPA/MF nº 1.231/2024 (duties of the operating agent regarding the bettor account) · Lei 9.613/1998, art. 10 (up-to-date registration record and transaction records) · Lei 13.709/2018, art. 15 (end of personal data processing)

15. Retention and safekeeping of documents

Registration data, the documents submitted, the results of verifications, and the records of bets and of financial movements are retained for a minimum of 5 (five) years counted from the end of the relationship with the bettor or from completion of the transaction, whichever is longer, and for a longer period where a competent authority so determines or where proceedings are under way.

Application access logs are retained for the period laid down in the Marco Civil da Internet.

Retention observes the information security requirements applicable to the sector: storage on infrastructure located in Brazil, encryption, role-based access control, logging of who accessed what and when, and backup copies.

Once the retention period has expired, and where no legal, regulatory, or judicial obligation justifies keeping the data, it is deleted or anonymised.

• Registration data and documents: at least 5 years after the end of the relationship.
• Records of bets, deposits, withdrawals, and prizes: at least 5 years after the transaction.
• Facial verification images: for the period needed to evidence due diligence, under restricted access.
• Application access logs: for the period laid down in the Marco Civil da Internet.
• Access limited to the compliance, fraud prevention, and authorised customer service teams, with an audit trail.

Legal basis: Lei 9.613/1998, art. 10 (keeping registration and transaction records for the minimum statutory period) · Lei 12.965/2014, art. 15 (retention of internet application access logs) · Lei 13.709/2018, art. 16 (deletion once processing ends, save for the statutory exceptions) · Lei 13.709/2018, art. 46 (security measures) · Portaria SPA/MF nº 722/2024 (information security requirements)

16. Your rights, contact channels, and validity

You may exercise the rights provided for in the General Data Protection Law over the data processed under this Policy. Some of them have limits: we cannot erase data the law requires us to retain, nor halt processing required by a regulatory rule, and deleting the registration data entails closing the account.

The data protection officer can be contacted at [to be provided]. Questions about verification and registration are handled at [to be provided]. Unresolved complaints may be taken to the ombudsman at [to be provided] and then to the SPA/MF, to the Autoridade Nacional de Proteção de Dados, and to the consumer protection authorities.

We never ask for a password, a verification code received by SMS, or payment of a fee to release registration, a withdrawal, or a prize. Any contact doing so is not ours — tell us at [to be provided].

This Policy is identified by version and effective date. Material changes are notified with reasonable advance notice through the registered channels and published on jogodobicho.com, with the version history available for consultation.

• Confirmation that processing takes place, and access to your data.
• Correction of incomplete, inaccurate, or out-of-date data.
• Anonymisation, blocking, or deletion of unnecessary or excessive data.
• Portability and information about the sharing carried out, under the terms of the law.
• Review of decisions taken solely on the basis of automated processing.
• Petition to the Autoridade Nacional de Proteção de Dados.

Legal basis: Lei 13.709/2018, art. 18 (rights of the data subject) · Lei 13.709/2018, art. 41 (data protection officer) · Lei 14.790/2023, art. 23 (identification procedures and verification of the validity of the bettor identity) · Portaria SPA/MF nº 1.231/2024 (customer service channels and rights of the bettor)