Anti-Money Laundering and Know Your Customer Policy

1. About this policy

1.1 This Anti-Money Laundering and Know Your Customer Policy (the "Policy"), which also covers countering the financing of terrorism and of proliferation, explains how Rust50 Entertainment Ltd ("we", "us", "our"), the operator of RUST50/50 at https://rust50.com (the "site"), works to stop the site being used for money laundering, terrorist financing, the financing of proliferation of weapons of mass destruction, sanctions evasion and related fraud. It also explains what we may ask you to provide, when, and what happens if you do not.

1.2 This Policy forms part of our Terms and Conditions (the "Terms"). If this Policy conflicts with the Terms or with another of our documents, the order of precedence in clause 1.2 of the Terms applies. Under that order, this Policy prevails for identification, screening, monitoring, reporting and record keeping; only the terms of a specific promotion (for that promotion) and the Promotions and Referral Terms (for promotions and referrals) rank ahead of it. Where the Terms and this Policy deal differently with any of those matters, this Policy therefore applies to that matter.

1.3 This is the public summary of our internal AML/CFT/CFP programme. The internal programme contains our business risk assessment, detailed monitoring rules and internal trigger values, and our reporting procedures. It is provided to the CGA, which supervises us, but it is not published, because publishing it would help people avoid it. Nothing in this public Policy limits what the internal programme or the law requires.

1.4 This Policy applies to everyone who signs in to the site and to every account activity that moves or could move items of value: creating, joining or cancelling a round, depositing items, receiving a payout, applying a referral code and taking part in any promotion.

1.5 Current status. Real Steam trading is currently disabled. The site runs a public test mode with simulated items. Simulated items cannot be withdrawn to Steam, sold or exchanged for anything of value. While that remains the case, no items of value are deposited or paid out and the identification and screening steps in this Policy are not performed. They apply from the day real trading is enabled. Accounts created during the test mode must complete the account-opening steps in section 7 before they can deposit any real item.

1.6 Rust50 Entertainment Ltd, registered with the Curaçao Chamber of Commerce under number HE 452139, operates the site under Curaçao Gaming Authority (CGA) licence HE 452139, issued on 5 November 2026. You can check the licence at https://www.nba.gov.cy. The CGA is also our supervisor for anti-money laundering and counter-terrorist financing.

1.7 We are not a bank, payment service provider or other financial institution and we pay no interest. We do not accept cash, card payments, bank transfers or cryptocurrency, and we do not pay out money. The only things that enter or leave the site are Steam items. We do not buy items from you, sell items to you or exchange items for money or other assets.

1.8 Item values shown on the site are reference values used to match stakes, calculate win chances and fees, and apply this Policy. They are not a promise that any item can be sold for that amount, and we do not guarantee that items have any cash value.

2. Definitions

2.1 In this Policy:

• AML/CFT/CFP means anti-money laundering, countering the financing of terrorism and countering the financing of proliferation.
• CGA means the Curaçao Gaming Authority, the licensing authority and supervisor for games of chance in and from Curaçao.
• FIU means the Financial Intelligence Unit of Curaçao (FIU Curaçao), which receives reports of unusual transactions.
• LOK means the National Ordinance on Games of Chance (Landsverordening op de kansspelen), P.B. 2024 no. 157.
• NOIS means the National Ordinance on Identification of Clients when Rendering Services (Landsverordening identificatie bij dienstverlening), P.B. 2017 no. 92, as amended.
• NORUT means the National Ordinance on the Reporting of Unusual Transactions (Landsverordening melding ongebruikelijke transacties), P.B. 2017 no. 99, as amended.
• CGA AML Regulations means the CGA Regulations for the Combating of Money Laundering, the Financing of Terrorism and Proliferation (November 2026).
• Customer due diligence (CDD) means identifying you, verifying your identity, understanding the purpose and intended nature of your use of the site, establishing that you act for yourself, assessing your risk and monitoring your activity.
• Enhanced due diligence (EDD) means the additional measures we apply to higher-risk players (section 10).
• PEP means a politically exposed person, including family members and close associates (section 11).
• Item means a Rust cosmetic item held as a Steam Community item (Steam app 252490, context 2).
• Item value means the value in US dollars that our pricing source the Steam Community Market assigns to an item at the relevant time and that the site shows before you confirm a stake.
• Deposit means a transfer of items from your Steam account to one of our bot accounts by a Steam trade offer that you confirm in Steam. A deposit counts only once Steam has settled the trade.
• Payout (or withdrawal) means a transfer of items from one of our bot accounts to your Steam account by a trade offer sent to your trade URL. It includes winnings, items returned when a round is cancelled, refunds and promotional prizes.
• Round means a 1v1 coinflip in which a creator and a joiner each stake items. Pot means all items staked in a round.
• House fee means the whole items taken from the pot at settlement, chosen so that their total value is as close as possible to, but not more than, 8% of the pot value, with the 8% cap calculated to the nearest cent. It can be lower, including zero when no item fits, and it is not a percentage of profit.
• Financial transaction means a deposit or a payout. Gambling transaction means a stake or a win inside a round.
• Threshold means XCG 4,000 (Caribbean guilders) of cumulative deposits plus payouts, the level at which full CDD must be complete (section 8).
• Gaming day means the 24-hour period we use for daily calculations, set in our internal procedures (proposed as 00:00 to 24:00 Curaçao time).
• Unusual transaction means an intended or completed transaction that meets an objective or subjective indicator under NORUT and the Indicators Decree (section 18).
• Linked accounts means two or more accounts that we reasonably believe are controlled by the same person or by people acting together.
• Compliance Officer means the person we appoint under NOIS and NORUT to run this programme (section 4).

3. Legal and regulatory framework

3.1 Games of chance. The LOK has been in force since 24 December 2024. It replaced the former offshore gaming regime and made the CGA the sole licensing authority. Under LOK art. 1.1(d) a game of chance is a game in which participants, in return for money or monetary value, compete for prizes of money or monetary value and whose outcome depends wholly or largely on chance. Rust items can be traded for value on the Steam Community Market and elsewhere, so we treat item stakes and item prizes as falling within that definition and apply the AML rules to them in full. The CGA has not published guidance specific to Steam items.

3.2 Identification. NOIS requires service providers, including providers of games of chance, to identify and verify their customers, apply risk-based due diligence and keep records.

3.3 Reporting. NORUT requires service providers to report intended and completed unusual transactions to the FIU without delay. NOIS and NORUT were both amended by P.B. 2024 no. 41.

3.4 Indicators. The Indicators Decree (P.B. 2015 no. 73, amended by P.B. 2024 no. 60) sets the objective and subjective indicators that make a transaction reportable. Reports are filed through the FIU's goAML portal (P.B. 2020 no. 157).

3.5 Sanctions. We apply the Sanctions National Ordinance (P.B. 2014 no. 55), the Kingdom Sanctions Act (P.B. 2016 no. 54), through which European Union sanctions bind Curaçao, and the sanctions decrees in force, including the Omnibus Sanctions Decree (2025 no. 52).

3.6 CGA rules. The CGA, and before it the Gaming Control Board, has been the AML/CFT supervisor for gaming in and from Curaçao since 15 February 2019. We follow:

1. the CGA AML Regulations, effective 1 November 2026, with full compliance required by 1 February 2027, which replace the CGA AML/CFT policy that took effect on 9 January 2025;
2. the CGA Provisions for Identification and Verification without Physical Contact (July 2026), which govern online identity checks;
3. the CGA Requirements for the Compliance Officer based on NOIS/NORUT (January 2025);
4. the CGA licence conditions, which require a written AML/CFT policy (art. 14), periodic reports by an independent expert approved by the CGA on our compliance with NOIS and NORUT (art. 13(2)(d)) and segregation of player funds (art. 9(2)); and
5. the CGA Policy Guideline on Terms and Conditions, which sets out what we must tell you about KYC, AML monitoring, screening and withdrawals (sections 4.5, 4.6, 6 and 7).

3.7 Other law. We also apply the Curaçao National Ordinance Personal Data Protection when we handle your data for these purposes and, where it applies to us, the EU or UK General Data Protection Regulation (section 21). You are responsible for complying with the law of the place where you live and play.

3.8 This Policy describes our obligations in plain language. It is not a full statement of the law, and where the law imposes a stricter rule, the stricter rule applies.

4. Governance and the Compliance Officer

4.1 The senior management of Rust50 Entertainment Ltd approves this Policy and the internal programme behind it, provides the resources to run it and is ultimately responsible for compliance.

4.2 We formally appoint a Compliance Officer under NOIS and NORUT. The Compliance Officer:

1. is a senior manager who is independent of game operations and has direct, timely access to all CDD records, round records, trade records and staff;
2. has been found fit and proper, supported by a Personal History Disclosure form and CV as the CGA requires;
3. has the qualifications the CGA requires: at least two years of AML/CFT reporting experience together with a bachelor's degree or an ACAMS or AMLFC certification, or at least four years of relevant experience, or at least two years as a money laundering reporting officer elsewhere;
4. completes at least 10 hours of AML/CFT training every year; and
5. works under a signed and dated job description.

4.3 The Compliance Officer role cannot be combined with the role of ultimate beneficial owner, chief executive, chief financial officer, chief operating officer or any other operational role, or with internal audit. The role may be outsourced to a qualified provider; under the CGA requirements one person may serve as compliance officer for at most 10 operators.

4.4 The Compliance Officer is responsible for:

1. keeping this Policy and the internal procedures up to date;
2. preparing and reviewing the business risk assessment (section 5);
3. approving, with senior management where required, the acceptance or continuation of high-risk players and PEPs;
4. receiving internal reports from staff, deciding whether to report to the FIU and documenting the reasons when no report is made;
5. acting as our contact point for the FIU and the CGA on AML/CFT matters;
6. setting and reviewing monitoring rules and acting on sanctions list changes;
7. arranging staff training and keeping training records;
8. making sure records are kept as section 19 requires; and
9. reporting to senior management at least once a year on the effectiveness of the programme.

4.5 Responsible gaming duties, such as limits, cooling-off and self-exclusion, sit with our separate compliance function under the LOK and are described in our Responsible Gambling Policy. Age verification belongs to both: the age rules are set in the Responsible Gambling Policy, and the identity checks in this Policy are how we verify age. The two functions share information where that helps protect players, for example when a player's behaviour suggests both financial crime risk and gambling harm.

4.6 You can contact the compliance team at compliance@rust50.com.

5. Our risk-based approach

5.1 We apply measures in proportion to risk. Higher-risk players, products and activity receive more checks and closer monitoring. Lower risk never reduces our checks below the legal minimum described in sections 7 and 8.

5.2 Business risk assessment. We keep a documented assessment of the money laundering, terrorist financing, proliferation financing and sanctions risks of our business. We review it at least once a year and whenever our products, target markets, payment methods or technology change. We also carry out and document a risk assessment before launching any new product, practice or technology. That includes, for example, the planned Mazalito giveaway, any referral reward, the planned mode in which winnings would be kept on the site, and any new identity verification solution.

5.3 Customer risk assessment. Each player receives a risk rating when the account is opened, and the rating is updated as we learn more. Factors include:

1. country of residence, nationality and the location from which the site is used;
2. PEP status and sanctions screening results;
3. the value, frequency and pattern of deposits and payouts;
4. the characteristics of the items involved, such as value, how easily they can be sold and where they came from;
5. who the player plays against and whether accounts appear to be linked; and
6. the consistency of the information the player has given us.

5.4 Risk categories. We use four categories: low, medium, high and unacceptable. We do not open or continue accounts in the unacceptable category, which includes sanctioned persons, residents of comprehensively sanctioned jurisdictions, anonymous or fictitious accounts and people who refuse to complete required checks.

5.5 Risk factors in our product. The CGA lists several higher-risk factors that apply to a peer-to-peer item game. We have identified the following:

1. Peer-to-peer play. In each round value moves directly between two players. People controlling two accounts, or acting together, can use rounds to move items between accounts (section 15).
2. Virtual items. Items can be bought and sold outside the site, their values can be disputed, and they can be acquired without any identity check.
3. Little or no play. A creator can cancel an open round before anyone joins and receive the items back. Repeated deposit-and-cancel cycles can be used to pass items through our accounts without genuine play.
4. Multiple accounts. Steam accounts are cheap to create and are sometimes sold, so a SteamID64 does not by itself identify a person.
5. Stolen items and identity fraud. Items may come from compromised Steam accounts.
6. High values. A creator can stake items worth USD 1 to USD 5,000, and the joiner's stake must be within 6% of the creator's stake, so it can range from roughly USD 0.94 to USD 5,300. A single pot can therefore be worth up to about USD 10,300.

5.6 Features that reduce risk. The product already has these features:

1. it is items only, with no cash, card or cryptocurrency deposits or withdrawals;
2. there is no function for sending items to another player, other than by playing a round;
3. a player cannot join their own round;
4. a joiner's stake must be within 6% (plus or minus) of the creator's stake value, so both sides stake comparable values;
5. the site accepts only a Steam trade URL that belongs to the Steam account that is signed in, so items are sent only to that account;
6. every round is recorded with its participants, item lists and values, seeds, roll, result, fee, trade offer IDs and timestamps, and fairness records are never rewritten; and
7. no administrative, promotional or test control can change a result, odds, seeds or payouts, and the owner console cannot change balances or payouts.

6. How these rules apply to item stakes and trades

6.1 Items are the only thing of value that enters or leaves the site. We treat them as "monetary value" and apply every value-based rule in this Policy to the USD item value of the items concerned.

6.2 Valuation. Item values are set in US dollars by the Steam Community Market. The site shows you the value of your stake before you confirm it, and values can change between rounds. For compliance purposes we use the item value recorded in the round record, which is the value shown to you when you confirmed the stake and the value used to calculate win chances and the house fee for that round. The current test mode uses the owner's reference prices, not live market quotes.

6.3 Conversion. Curaçao thresholds are set in Caribbean guilders (XCG). We convert USD item values to XCG at the official XCG/USD rate (XCG 1.79 to USD 1 at the date of this Policy). On that basis the XCG 4,000 threshold is about USD 2,235 and the XCG 5,000 reporting indicator is about USD 2,793. The XCG amounts are the rule; the USD amounts are approximations.

6.4 What we count.

1. Deposits: every transfer of items into our bot accounts to create or join a round (or, if a promotion requiring a deposit is ever launched, to qualify for it), counted at item value once Steam has settled the trade.
2. Payouts: every transfer of items from our bot accounts to you, including winnings, items returned when you cancel your open round or when a round is cancelled or voided, refunds and prizes.
3. Stakes and wins: recorded for each round and used for monitoring. The threshold itself is calculated on deposits plus payouts.

6.5 Because every round you play starts with a deposit, and the winner receives a payout, your cumulative total grows with every round, including rounds you lose. The total is calculated daily and covers all deposits and payouts since your account was opened. Items you win from another player count in full, because the CGA rules include peer-to-peer transfers in the calculation.

6.6 The house fee. At settlement we take as the house fee the set of whole pot items whose total value is as close as possible to, but not more than, 8% of the pot value, with the 8% cap calculated to the nearest cent. The fee can be lower, including zero. Fee items become our property, are not counted as a payout to you, and are kept separate from player items (clause 6.10).

6.7 Our interpretation. Neither the CGA nor the FIU has published guidance on how Steam items should be counted. We apply the cautious reading set out above: item values count like money, each deposit and each payout counts separately, and returned items count as payouts.

6.8 No conversion and no credit. We do not exchange items for cash, cryptocurrency or other items outside a round. We do not lend items, give credit or let anyone play on credit (LOK art. 1.4(c)). You may not sell, assign, pledge or otherwise transfer a claim you have against us (LOK art. 1.3(c)).

6.9 Same-account returns. Items are sent only to the Steam account you are signed in with, using your trade URL. The site already refuses a trade URL that belongs to a different Steam account. We do not send items to a third party at your request, and we do not accept deposits made on behalf of another person.

6.10 Custody and segregation. When real trading starts, player items will be held in dedicated bot accounts owned or controlled by Rust50 Entertainment Ltd only while a round is in progress or a payout is pending. They will be kept separate from our own items, including fee items, and reconciled regularly.

6.11 Promotions and referrals. Each account gets a referral code, created automatically the first time you open your Profile page, and a new account can apply another player's code once; the site refuses self-referral and second referrals. A promotional eligibility field of "2.5%" exists but is inactive: no referral rewards are credited, and it never changes odds. A planned hourly giveaway (Mazalito) exists only as a test feature in the preview, where labelled test bots also enter; it is not offered with real items. If a referral reward or a giveaway is ever launched with real items, any qualifying deposit counts as a deposit and any prize or reward counts as a payout under clause 6.4, the risk assessment in clause 5.2 is completed first, and full terms are published in our Promotions and Referral Terms.

7. Opening an account: identification and screening

7.1 You sign in to the site with Steam (OpenID). We never see or store your Steam password. Steam gives us your SteamID64, display name and avatar, and you add your Steam trade URL. Steam accounts can be created from age 13 and without any identity check, so signing in with Steam does not identify you and does not prove your age.

7.2 Before you can deposit any real item, you must give us at least:

1. your first name and surname;
2. your permanent residential address, including country; and
3. your date of birth.

We screen this information against PEP and sanctions lists before your account is activated for real items.

7.3 When you register you must also confirm, by actively ticking each statement, that:

1. you are at least 18, or the higher age of majority or legal gambling age where you live;
2. you play only on your own behalf and not for or with the money or items of anyone else;
3. the items you deposit belong to you, were lawfully obtained and are not the proceeds of crime;
4. you are not resident in, and will not use the site from, a restricted territory listed in our Terms;
5. you will tell us if you are, or become, a PEP; and
6. you accept the Terms and this Policy.

We log each confirmation. We do not rely on these statements alone: we also check for play on behalf of third parties and for linked accounts on an ongoing basis.

7.4 One person, one account. Each verified person may hold only one account, linked to one Steam account. Anonymous and fictitious accounts are not allowed. Duplicate accounts may be closed under section 17.

7.5 Test-mode accounts. If you created your account during the test mode, you must complete clauses 7.2 and 7.3 before your first real deposit.

7.6 We may refuse to activate an account for real items without giving reasons where the law prevents us from explaining (section 18).

8. Full customer due diligence at the threshold

8.1 When full CDD is required. We carry out full CDD:

1. when your cumulative deposits plus payouts reach XCG 4,000, or when a series of linked transactions does;
2. whenever we suspect money laundering or terrorist financing, whatever the amount;
3. when we doubt the accuracy or adequacy of identification data we already hold;
4. when a risk factor calls for EDD (section 10); and
5. whenever the law, the CGA or another competent authority requires it.

8.2 What full CDD involves.

1. verifying your identity with a valid government-issued photo identity document and a live check that you are the person in the document;
2. collecting your place of birth, nationality and identity document number;
3. verifying your residential address with a document less than six months old;
4. understanding how you intend to use the site, for example the values you expect to stake;
5. a declaration of your source of wealth and, where the risk calls for it, evidence of your source of funds and wealth (section 13); and
6. screening against PEP and sanctions lists again with the verified data.

8.3 Our timing. The law requires full CDD to be complete when the threshold is reached. Because a single round can move a large value and winnings are paid out at settlement, we will ask you to complete full CDD before you make a deposit that would take your cumulative total to or above the threshold. We may also ask for it before you create or join a round whose payout, if you win, would take your total to or above the threshold, so that your winnings do not have to be held. We may ask for it earlier still, at internal trigger values set by risk, and that request does not mean we suspect you of anything.

8.4 If a deposit reaches the threshold. If the threshold is nevertheless reached by a deposit, for example after a correction of item values or a technical failure, no further deposits or payouts are allowed until full CDD is complete. A round already in progress completes normally under the provably fair rules, and any payout from it is held in our custody until CDD is complete.

8.5 If a payout reaches the threshold. If the threshold is reached by a payout, the account is fully frozen: no deposits, no new rounds and no payouts until full CDD is complete. The payout that reached the threshold is held in our custody.

8.6 Thirty-day limit. If you do not provide what we need within 30 days of our request, we will end our relationship with you. If we presume money laundering or terrorist financing, we will report to the FIU and items may stay frozen as the law requires. Otherwise, items held for you are returned by trade offer to the Steam account from which you deposited them.

8.7 When we ask for CDD we tell you what we need, how to submit it and the deadline. We aim to complete our review within up to 3 business days of receiving complete documents. Incomplete, unclear or inconsistent submissions restart the review.

9. Verification methods and documents we may request

9.1 Our provider. Identity checks are carried out through an EU-approved identity verification provider, an identity verification provider acting on our instructions and our procedures under a written agreement. We assess the provider periodically and remain fully responsible for CDD. We may rely on a regulated third party for identification only where the information reaches us immediately, copies are available on request under a tested agreement, and the third party is regulated or supervised. We never delegate the risk assessment, the PEP determination or ongoing monitoring. Signing in with Steam is not a source of identity verification we rely on.

9.2 Standards for online checks. Our online verification follows the CGA Provisions for Identification and Verification without Physical Contact. Accepted documents are a passport, a national identity card or a driving licence. Checks use live image capture, liveness detection and face matching to recognised standards. Before any verification solution goes live we document a pre-implementation assessment and test it end to end, and we monitor it afterwards.

9.3 Documents we may request.

9.4 Documents must be clear, in colour, complete and readable. If a document is not in English we may ask for a translation. We may reject documents that are expired, altered, blurred, cropped or inconsistent with other information.

9.5 What we will never ask for. We will never ask for your Steam password, Steam Guard codes, Steam Web API key, full payment card number or security code, or any banking password. We only request documents through the verification flow on rust50.com or by email from compliance@rust50.com, never in public chat or by Steam message. If you receive any other request that claims to come from us, do not respond, and tell us at compliance@rust50.com.

9.6 Updates and re-verification. You must tell us promptly if your name, address, nationality or PEP status changes. We ask for updated documents when a document expires, during periodic reviews and when our information appears out of date.

9.7 Account closure. When you close your account we will not ask for more information than we asked for when the account was opened, unless that is strictly necessary to meet our AML obligations.

10. Enhanced due diligence

10.1 We apply EDD when the risk is higher, including where:

1. you live in, are a national of or use the site from a higher-risk jurisdiction;
2. you are a PEP, or a family member or close associate of one (section 11);
3. your deposit or payout values or volumes are high or rise sharply;
4. your activity matches red flags in section 15;
5. there is relevant adverse information about you in reliable public sources; or
6. the information or documents you have given us are inconsistent.

10.2 EDD measures may include:

1. evidence of source of funds and source of wealth;
2. approval by the Compliance Officer or senior management before the relationship starts or continues;
3. closer monitoring, with lower review triggers and more frequent reviews;
4. additional identity or address evidence;
5. limits on the values you may stake or on the items you may deposit; and
6. a statement of how and where you acquired particular items.

10.3 Operators that take money can require a first payment from a bank account in the player's own name. We take no payments, so instead we may require that the items you deposit come from a Steam account whose history is consistent with the source you have declared.

10.4 If EDD cannot be completed to our satisfaction, we will not start or continue the relationship, and section 17 applies.

11. Politically exposed persons

11.1 A PEP is a person who holds, or has held, a prominent public function. Examples include heads of state or government, ministers, members of parliament, senior judges, central bank board members, ambassadors, senior military officers, senior executives of state-owned enterprises and senior officials of international organisations. Family members and known close associates of a PEP are treated in the same way.

11.2 We screen every player against PEP data when the account is opened and periodically afterwards.

11.3 For a foreign PEP we always apply EDD: approval by senior management or the Compliance Officer, verification of source of wealth and source of funds, and enhanced ongoing monitoring. For a domestic PEP or a PEP of an international organisation we apply EDD where the risk is higher.

11.4 If you become a PEP while you have an account, tell us at compliance@rust50.com. If our screening shows that you have become a PEP, we apply the required measures within 30 days. If they cannot be completed in that time, the relationship ends under section 17.

11.5 Being a PEP is not an accusation of wrongdoing. It means the law requires us to take extra care.

12. Sanctions screening and high-risk jurisdictions

12.1 Lists. We screen players against the United Nations Security Council Consolidated List, the European Union consolidated sanctions list, the Dutch national terrorism list and any Curaçao list. We also take into account other lists relevant to our risk, such as the list of the US Office of Foreign Assets Control.

12.2 When we screen. We screen when the account is opened, whenever the lists change (by re-screening all existing players) and before every payout. A payout trade offer is sent only after a current sanctions check.

12.3 If there is a possible match. We may restrict the account while we check whether a possible match is a real one, and we may ask you for information to rule it out. If the match is confirmed, we freeze without delay all items we hold for you, send no payout, and report to the FIU and any other authority the law requires. Frozen items are released only as the law or a competent authority permits.

12.4 High-risk jurisdictions. We do not accept players who live in a country or region subject to comprehensive sanctions or on the Financial Action Task Force (FATF) list of high-risk jurisdictions subject to a call for action. Players connected with jurisdictions under increased FATF monitoring are subject to EDD. Separately, our Terms list the territories from which the site may not be used because of local gambling law.

12.5 Location. We check where you are using your verified address and the network location of your connection. You must not use a VPN, proxy, Tor or any other tool to hide your location. If we find that you have done so to get around a restriction, we may close your account under section 17.

13. Source of funds and source of wealth

13.1 Meaning. Source of funds means where the particular items you deposit came from: how you obtained them, or the money used to buy them. Source of wealth means how you built up your overall wealth, for example through employment, a business, savings, investments or an inheritance, which explains why you can play at the level you do.

13.2 When we ask. We may ask for a source of wealth declaration as part of full CDD. We ask for evidence where EDD applies, including for high-value item flows: single deposits or payouts above internal trigger values, cumulative flows above internal trigger values, activity that does not fit what you have told us about yourself, and PEPs. For players who are not high risk, a self-declaration of source of wealth may be enough.

13.3 Evidence about items. Because our stakes are items, evidence of source of funds usually concerns how you acquired them. It can include:

1. your Steam purchase history, showing Steam Wallet top-ups and item purchases;
2. your Steam Community Market transaction history;
3. your Steam trade history or inventory history, showing from whom and when you received the items;
4. receipts or account statements from third-party marketplaces; and
5. an explanation of items obtained in the game itself.

13.4 Evidence of wealth. This can include recent payslips, an employment contract, bank statements showing income, tax returns, business accounts, or documents showing the sale of property or investments or an inheritance.

13.5 Items received from others. If you received high-value items from other people shortly before depositing them, we may ask who sent them, why, and what you gave in return.

13.6 How we assess evidence. We consider whether the evidence is genuine and plausible given your age, occupation, location and activity. We may limit the value you may deposit to what your evidence supports, or decline the relationship if the evidence is insufficient.

13.7 We ask only for what we need, and we handle these documents as described in section 21.

14. Ongoing monitoring

14.1 We monitor every deposit, round and payout for the life of the account. The site already records, for every round, the participants, the item lists and item values, the seeds, the roll, the result, the fee, the trade offer IDs and the timestamps, and keeps a record of trade offers. Fairness records are never rewritten.

14.2 Monitoring combines automated rules with review by trained staff. Alerts are reviewed and the outcome is documented. Anything that may be unusual is escalated to the Compliance Officer.

14.3 Monitoring covers, among other things:

1. each player's cumulative deposits plus payouts against the threshold;
2. daily totals against the XCG 5,000 reporting indicator;
3. pairs or groups of accounts that repeatedly play each other;
4. create-and-cancel cycles and deposits with little or no play;
5. the time between receiving items in Steam and depositing them;
6. sudden changes in stake values or patterns;
7. shared connection or device signals between accounts; and
8. chat messages that suggest coordination.

14.4 We review player profiles periodically, more often for higher-risk players, and refresh documents when they expire or our information is out of date.

14.5 Moderation actions (mutes of 1 hour, 24 hours or 7 days, and bans) are recorded with their reason in an audit log, and that log can support an investigation.

14.6 Public chat currently keeps only the latest 50 messages, in memory, and they are lost when the server restarts. Chat therefore cannot yet support collusion monitoring.

15. Red flags we look for

15.1 The patterns below lead to review. A red flag is not proof of wrongdoing: we look at it in context and may ask you to explain. The list is not complete.

Collusion and chip-dumping between accounts

15.2 Coinflip results are random, so colluding players cannot choose who wins. By playing each other repeatedly, however, accounts controlled by the same person or by people acting together can move items between accounts, give items an apparent origin as gambling winnings, or mix doubtful items with clean ones. We look for:

1. the same accounts repeatedly joining each other's rounds, especially within seconds of creation or at times when few other players are online;
2. value flowing consistently in one direction between a group of accounts over time;
3. accounts that share connection or device signals, a verified identity, or other identifying details;
4. one side repeatedly staking obscure or hard-to-sell items against easily sold, high-demand items on the other side, which can turn hard-to-sell or doubtful items into clean ones through a "win"; and
5. chat messages arranging who will join which round.

Rapid in-and-out item flows

15.3 We look for:

1. rounds that are created and then cancelled again and again, so that items pass through our accounts with little or no play;
2. a high-value deposit, a single round and then no further activity;
3. items deposited very soon after being received from other Steam accounts;
4. accounts that seem only to pass items along; and
5. activity that is out of line with what you have told us, or that rises suddenly.

Stolen items and compromised accounts

15.4 We look for:

1. a Steam account that is new, or has long been inactive, suddenly holding high-value items;
2. an inventory filled from many different accounts just before a deposit;
3. reports from Valve, other players or authorities that items or accounts were compromised;
4. a player who cannot explain how they got their items; and
5. a sign-in from a new country followed at once by a trade URL change and a high-value deposit.

Trade reversals and trade scams

15.5 We look for:

1. attempts to reverse or dispute a settled trade, or claims that a deposit was unauthorised that are made only after losing a round;
2. items later revoked or removed by Valve or Facepunch, for example after a payment dispute on the Steam account used to buy them;
3. Steam trade bans or restrictions appearing shortly after a payout; and
4. impersonation of our bot accounts, fake trade offers or attempts to obtain other players' Steam Web API keys.

Identity and account red flags

15.6 We look for more than one account per person; altered, borrowed or inconsistent documents; a refusal to provide information; a third party directing someone's play; accounts that are shared, sold or bought; use of VPNs, proxies or Tor to hide location; attempts to play from a restricted territory; and signs that a player may be under age.

Values, promotions and insiders

15.7 We look for:

1. items whose reference value looks out of line with their real market, for example because the market for them is very thin;
2. attempts to exploit changes in item values between rounds, or the use of items obtained through bugs or exploits;
3. multiple accounts used to apply referral codes or to enter promotions; the site already refuses self-referral and second referrals, and the referral reward field is inactive, so no rewards are credited; and
4. play by our staff, key persons or test accounts.

15.8 The LOK bars our key persons from playing (art. 1.3(b)), and we extend that ban to all our staff and their accounts. The test mode uses simulated items and test accounts that we operate, such as the sample rounds and test bots shown in the preview. They are not real players, and no test account, test bot or simulated item may ever take part in a real round or prize draw.

16. Item provenance, stolen items and trade reversals

16.1 Items you deposit must be yours, lawfully obtained, held in your own Steam account and free of any claim by another person.

16.2 Every trade needs your confirmation through Steam Guard. A deposit is credited only once Steam has settled the trade. Steam trade holds and restrictions can delay or block a trade; a trade offer for a round must be accepted within 90 seconds, so an account under a trade hold may be unable to take part. We are not responsible for holds, cooldowns, restrictions or bans imposed by Steam.

16.3 If we reasonably believe that items were stolen, obtained by fraud or obtained through a compromised account, we may refuse to include them in a round, restrict or suspend the account, hold any items we have in custody, and inform Valve, the police, the FIU or other authorities. We keep held items until the matter is resolved by agreement between the people involved, by an instruction from a competent authority or court, or under our internal procedure. We do not hand items to someone who says they are the true owner without evidence and a lawful basis.

16.4 Valve's Steam Trade Protection, which lets some trades be reversed for seven days, is reported at the date of this Policy to apply to Counter-Strike 2 items, and Valve has indicated that it may extend it to other games; third-party sources report that it does not yet cover Rust. If a deposit is reversed, revoked or removed after a round has settled, we may restrict the accounts involved, recover items from the account responsible where we lawfully can, and report the matter. If Valve extends trade reversal to Rust items, we may introduce a settlement period before payouts, as described in the Terms.

16.5 Valve and Facepunch can restrict, change or revoke items and accounts, including items obtained through bugs or exploits. These actions are outside our control.

17. Refusal, suspension and termination

17.1 We may refuse to open an account, restrict it, suspend it or close it where:

1. required CDD or EDD is not completed in time;
2. you give false or misleading information or forged documents;
3. there is a confirmed sanctions match;
4. a PEP or high-risk relationship is not approved;
5. we suspect money laundering, terrorist financing or fraud, or red flags remain unexplained;
6. you use the site from a restricted territory or hide your location;
7. you hold duplicate or linked accounts in breach of the Terms;
8. you are under age;
9. a competent authority instructs us to; or
10. continuing would breach the law or our licence.

17.2 Types of measure. A restriction blocks new deposits and joins, but lets a round already in progress finish. A payout hold keeps items in our custody instead of sending them. A suspension blocks all activity while we investigate. Termination ends the relationship.

17.3 What happens to items.

17.4 Returned items are sent as a trade offer to the trade URL of the Steam account you are signed in with, which must be accepted within 3 days. A failed or unaccepted offer can be resent on request.

17.5 Compliance measures affect only whether and when items are delivered. A round in progress is always decided by the provably fair calculation described on our Fairness and Round Verification page. We never change a result, odds, seeds or payouts as a compliance measure. House fees taken on settled rounds are not refunded unless a round is voided under the Terms.

17.6 Where we can, we tell you what we need and why. Where the law forbids it, we may restrict your account without explaining (section 18).

17.7 If you disagree with a decision, contact compliance@rust50.com or use our Complaints and Dispute Resolution procedure, which includes free independent dispute resolution through the Cyprus Consumer Protection Service (Ministry of Energy, Commerce and Industry). Some complaints may be answered only in general terms because of the tipping-off rule.

18. Reporting to the FIU and the tipping-off rule

18.1 Under NORUT we report intended and completed unusual transactions to the FIU without delay, through goAML and in English. Reporting through goAML has been mandatory since 1 January 2021. We register with the FIU before accepting any real item.

18.2 Objective indicators. These include transactions reported to the police or the Public Prosecutor in connection with money laundering or terrorist financing; transactions in which any party is on a sanctions list; and transactions of XCG 5,000 or more in any form of payment, including electronic or other non-physical means, such as deposits and payouts, alone or as a series in one gaming day. We treat item deposits and payouts at their item value as such transactions. Because a creator can stake up to USD 5,000 and a joiner up to about USD 5,300, high-value rounds will be reported routinely. A report on an objective indicator is required by law and is not an accusation.

18.3 Subjective indicators. We also report any transaction, of any value, that gives us reason to suspect money laundering or terrorist financing, including attempted transactions that we refuse.

18.4 Internal process. Staff report concerns to the Compliance Officer, who decides whether to file a report. When the Compliance Officer decides not to file, the reasons are documented.

18.5 Tipping-off. The law prohibits "tipping off": we may not tell the player concerned, or anyone else who is not entitled to know, that a report has been or will be made. We treat any related enquiry by the authorities as confidential, and we will not confirm or deny whether a report exists. This may limit what we can say in answer to support questions, complaints or data protection requests, and it may mean that we restrict an account without explaining why.

18.6 Protection. Curaçao law protects those who report unusual transactions under NORUT from liability for making the report. We support staff who raise concerns and do not penalise them for doing so.

18.7 Cooperation. We cooperate with the FIU, the CGA, the Public Prosecutor and the police, answer lawful requests for information, and may disclose information to them without telling you where the law requires or allows it.

19. Record keeping

19.1 We keep transaction data, including the records of rounds, trades and house fees, for at least five years after each transaction, in a form that allows every transaction to be reconstructed (NOIS art. 7(1)).

19.2 We keep CDD data, including your risk profile, copies of identity documents, account files and correspondence, for at least five years after the business relationship with you ends (NOIS art. 7(3)).

19.3 For transactions passed on to law enforcement or declared suspicious, the FIU or another competent authority may order us to keep records for up to 10 years (NOIS art. 7(2); NORUT art. 11a(2) as amended in 2024).

19.4 We also keep our risk assessments, reports to the FIU and decisions not to report, training records and audit reports, and make all of these records available to the CGA on request.

19.5 Records currently kept, or to be kept:

19.6 When a retention period ends we delete or anonymise the records, unless an authority has asked us to keep them or they are needed for a legal claim.

19.7 The CGA requires critical player, game and financial records to be accessible to it through a server in a Tier-IV certified data centre in Curaçao.

20. Training, staff screening and independent review

20.1 Everyone who works for us with access to player data, rounds, trades or moderation is trained when they join and at least once a year. Training covers money laundering and terrorist financing methods, red flags in peer-to-peer item games, sanctions, PEPs, internal reporting and the tipping-off rule, record keeping and data protection. Our annual staff training under LOK art. 5.9(4) also covers mental wellbeing, anti-bribery, crime, responsible gaming, player communication and responsible advertising.

20.2 The Compliance Officer completes at least 10 hours of AML/CFT training each year. We keep records of all training.

20.3 We screen staff in key roles before hiring and periodically afterwards, in line with the CGA's fit-and-proper expectations.

20.4 An independent auditor with at least two years of AML experience, a degree and a CAMS or AMLFC certification reviews our programme at least once a year. Under the CGA licence conditions, an independent expert approved by the CGA also reports periodically on our compliance with NOIS and NORUT. The findings go to senior management, and we fix any weaknesses found.

21. Data protection

21.1 We handle personal data collected under this Policy as described in our Privacy Policy. We use it only for AML/CFT/CFP, sanctions compliance, fraud prevention, age verification, responsible gaming and our other legal obligations. We do not use it for marketing and we do not sell it.

21.2 We process this data to meet our obligations under Curaçao law, in line with the National Ordinance Personal Data Protection. Where the EU or UK General Data Protection Regulation applies to us, the legal basis we rely on is set out in the Privacy Policy.

21.3 Identity checks may involve images of your face and a comparison with your identity document. an EU-approved identity verification provider processes this only to verify your identity, under the safeguards set out in the Privacy Policy.

21.4 We share this data only with an EU-approved identity verification provider; our hosting provider an EU data centre operator, which stores it on our behalf; the FIU, the CGA, law enforcement and courts where required; and our auditors and the independent expert approved by the CGA. We do not send your identity documents to Valve or to other players.

21.5 You have rights to access and correct your data and other rights described in the Privacy Policy. Some rights are limited by the retention periods in section 19 and by the tipping-off rule in section 18. Privacy questions go to privacy@rust50.com.

22. Your obligations

22.1 When you accept the Terms and this Policy, you agree to:

1. give us true, accurate and complete information and keep it up to date;
2. hold only one account, linked to one Steam account, and never share, sell, lend or buy an account;
3. play only for yourself, with items that belong to you and were lawfully obtained;
4. never use the site to hide the origin of items or money, to move value to another person, or to evade sanctions;
5. never collude with other players, operate linked accounts or arrange the outcome or pairing of rounds;
6. provide requested documents within the deadline we give you, and in any case within 30 days;
7. tell us if you are or become a PEP, or if your name, address or nationality changes;
8. never use the site from a restricted territory or hide your location;
9. keep your Steam account secure, use Steam Guard and accept trade offers only from our official bot accounts as shown on the site; and
10. never give anyone your Steam password, Steam Guard codes or Steam Web API key.

22.2 If you break these obligations, we may take any of the measures in section 17 and report to the authorities where the law requires.

23. Changes, review and contact

23.1 We review this Policy at least once a year and whenever the law, our products or our risks change. The version number and effective date at the top of this page show the current version. We tell you about material changes before they take effect.

23.2 We provide this Policy in English. If we offer the site in another language, we will also provide this Policy in that language.

23.3 Contact details:

• Compliance (AML and KYC): compliance@rust50.com
• General support: support@rust50.com
• Complaints: complaints@rust50.com
• Privacy: privacy@rust50.com
• Registered office: Rust50 Entertainment Ltd, 28 Omonias Avenue, 1010 Nicosia, Cyprus, Chamber of Commerce number HE 452139

23.4 RUST50/50 is not affiliated with, endorsed by or sponsored by Valve Corporation or Facepunch Studios. Steam and Rust are trademarks of their respective owners.

24. Implementation status before launch