HitnSpin Starts ID Checks at USD/EUR 1,000 in Transactions and Accepts No Crypto Payments

HitnSpin's KYC policy runs to nine sections and sets when the casino checks a player's identity, what it asks for and what it treats as suspicious. For record-keeping it cites the EU anti-money-laundering directive 2015/849, the GDPR and a Cyprus limitation law, without stating how long documents are kept.

• USD/EUR 1,000 in total transactions. Section 4 applies Standard Verification in four cases: the total of a user's transactions reaching or exceeding USD/EUR 1,000, a significant risk of money laundering, behaviour suggesting a breach of the Terms and Conditions, and "In other cases, when the personnel of the Company consider the Verification as a necessary measure." The amount is one trigger of four, and the fourth needs no amount at all.
• A handwritten note, and possibly a tax notice. Standard Verification asks for a copy or photo of an ID document, a photo of the payment card with the cardholder's name visible and every digit but the first 6 and last 4 allowed to be covered, a photo of the player holding the documents, and a photo of the player holding a handwritten note with the account email, the date of the request and a confirmation code. In some situations it adds proof of address, a bank statement or a letter from the workplace, and in some cases a tax assessment notice. The company may also ask for a call, video included. The policy does not say which situations call for the workplace letter or the tax notice, so a player cannot tell in advance how far a request will go.
• Source of wealth for named groups, and for anyone else. Section 5 adds source-of-wealth documents and a final sign-off by senior management for politically exposed persons and their families and for residents of countries listed by the European Commission or the FATF as high-risk. Its third case reads: "C) In other cases, when the Company considers this procedure as a necessary measure." The enhanced check is written for named risk groups, then opened to any player the company chooses.
• No crypto, and names that must match. Section 7 states: "The Company does not accept payments from the anonymous payment instruments (cryptocurrencies, anonymous wallets etc.)." A card must carry the account holder's name, an e-wallet must use the email the account was registered with, and deposits are never paid out to another user's payment instrument. The policy puts cryptocurrency in the same sentence as anonymous wallets and rules out both.
• A payment error counts as suspicious. Section 6 lists suspicious activity that goes to the antifraud department, including several cards used through different payment agents, "Obtaining a specific error code when making a payment", a device ID matching another account, a geolocation mismatch between citizenship, mobile carrier, IP address and card BIN, "Opposition or unwillingness of the user to verification of his/her account or payment instrument or his/her account as a whole", and opposition to any phone or video call. An error at the payment step, which the player does not control, sits on the same list as a shared device.
• Refusal can be reported, with no deadline set. Section 5 says that when a user refuses verification, or the company has ample grounds to suppose the site is used for illegal purposes and the user gives no evidence to the contrary, the company may inform the regulatory, governmental or financial authorities. No time limit for sending documents and no action on the account appear anywhere in the policy. What a refusal does to the account and its balance is left to other documents.
• Changes by email, accepted by use. Section 9 reads: "Registered users will be notified on any changes to this Policy via e-mail address, which was used when registering an account on the Website." It continues: "Any continued usage of the Website after the notification has been sent shall be considered as a fact that user have read and accepted the changes to the Policy." Notice comes by email, and the next visit after it counts as consent.

The policy is precise about what it may ask for and open about when. One fixed figure, USD/EUR 1,000, sits beside three triggers that rest on the company's own assessment.