Anti-Money Laundering Policy

Version 1.1 · Effective October 29, 2026 · Last updated October 29, 2026 · Download PDF

Pullfox is for collecting cards, not for moving money. This policy sets out how we guard against money laundering, terrorist financing, fraud and sanctions violations, and what that means for you. It's part of our Terms of Use.

1. Our business

Pullfox is a brand of INGAMES LTD (אינגיימס בע"מ), a company registered in Israel under company number 516735057. It sells digital packs of real trading cards to adults in the US states where it's offered. Players can ship their cards home or sell them back for balance, which they can withdraw.

Card, Apple Pay and Google Pay payments, payouts and identity checks are run by Breeze, our payment provider and the merchant of record, under its own compliance program. We don't accept cryptocurrency, cash or transfers between players. Our controls are scaled to that model.

2. Policy statement

Pullfox prohibits and rejects any use of its service for money laundering, terrorist financing, fraud or sanctions violations. We follow US law and the recommendations of the Financial Action Task Force (FATF), as they apply to a business like ours. Our program includes:

• 2.1this written policy, with procedures and controls designed to prevent, detect and report illicit activity;
• 2.2a designated compliance officer who oversees it;
• 2.3training for everyone who can see player accounts;
• 2.4a review of the policy and its controls at least once a year, and whenever our products, payment methods or the law change.

3. Definitions

• 3.1Money laundering: making money from crime look legitimate. It usually happens in three stages:
  • placement: putting the money into the financial system;
  • layering: moving it through transactions to hide where it came from;
  • integration: bringing it back as apparently clean money.
• 3.2Terrorist financing: providing or collecting money, from any source, to support terrorism.
• 3.3Suspicious activity: activity suggesting that someone may be acting for fraudulent or illegal purposes, or trying to avoid our controls.
• 3.4Sanctions: restrictions governments place on dealings with certain countries, organizations and people. In the US, they're administered by the Treasury's Office of Foreign Assets Control (OFAC).

4. Governance

• 4.1Our compliance officer is responsible for this policy and has the authority to put it into effect. Their duties:
  • keeping it current with the law and our products;
  • reviewing alerts and unusual activity;
  • deciding on suspensions and reports;
  • working with Breeze on any shared concern.
• 4.2Every review of an account, and every hold, correction or closure, is recorded with who did it, when and why.
• 4.3Staff who can see player accounts sign in with a code and an authenticator app every time, and see only what their role needs.

5. Knowing our customers

Customer due diligence

We take a risk-based approach: the more someone uses Pullfox, and the more unusual their activity, the more we know about them.

• 5.1At sign-up:
  • email and mobile number, each confirmed with a code;
  • first name, date of birth (18 or older) and state;
  • location from the connection. Pullfox is US-only and not offered in some states.
• 5.2One person, one account. We link accounts that share a device, email address, phone number, name with date of birth, delivery address or payment card. One person can't hold several accounts. A self-excluded person's new account starts excluded, and we can see when someone we removed comes back.
• 5.3Before the first withdrawal: Breeze verifies identity (full name, date of birth, address, phone and Social Security number, and photo ID where needed). It also screens the person against sanctions and watch lists.
• 5.4As withdrawals grow: further identity checks, at levels set by the account's risk, before more can be withdrawn.
• 5.5Pullfox accounts are for individuals only, not companies or other organizations.

Enhanced due diligence

When an account raises a red flag (section 6), we suspend deposits, purchases or withdrawals as needed and ask for more. That can include:

• 5.6full legal name and citizenship;
• 5.7residential street address, with proof such as a utility bill or bank statement;
• 5.8a government ID number and a copy of the ID;
• 5.9source of funds (where the money used on Pullfox came from);
• 5.10source of wealth (how the person came to have it), such as payslips or bank statements.

We may use Breeze or other providers to verify what we're given. The account stays suspended until we're satisfied. Players can always respond to a suspension with more information, and we'll review it.

Who we don't accept

We refuse or close accounts of people who:

• 5.11don't provide the identification we ask for, or provide false or altered documents;
• 5.12hide or misstate where they are, for example with a VPN or proxy;
• 5.13live in, or use Pullfox from, a state or country where it isn't offered;
• 5.14are on US or other applicable sanctions or watch lists, or act for someone who is;
• 5.15use money from crime, from someone else, or from a place under comprehensive sanctions;
• 5.16are under 18;
• 5.17are self-excluded, or show signs that their spending is out of control. See Responsible Play.

6. Monitoring transactions

We combine rules built into the wallet with reviews by our team.

Rules that run on every transaction

• 6.1Deposits must be used. Money deposited has to be spent on packs or shipping before an equal amount can be withdrawn. A deposit that isn't wanted is refunded to the card it came from, never to another account.
• 6.2Own payment methods only. Withdrawals go only to an account or card in the player's name, and where possible back to the method they deposited with.
• 6.3Every withdrawal is approved before it's sent.
• 6.4No transfers between players. Gifts are pack credit: they can only buy packs and can't be withdrawn. Trying to get around this is treated as a red flag.
• 6.5Sanctions screening. Names on delivery addresses are checked against the OFAC list, which we refresh every day. A possible match pauses withdrawals until our team reviews it.
• 6.6Limits and breaks set by players, and self-exclusion, are enforced before any charge.

Red flags we look for

• 6.7Deposits followed by withdrawal requests with little or no play.
• 6.8Activity of unusual size, frequency or pattern for the account, or for a collector in general.
• 6.9Deposits or withdrawals split up to stay under limits or checks.
• 6.10Several accounts linked to one person, device, address or payment card. Groups of accounts acting together, for example to collect offers.
• 6.11Money from several cards, or from cards in other names.
• 6.12A location that doesn't match the account, or signs of a VPN or proxy.
• 6.13Refusing to provide information, or giving information that doesn't add up.
• 6.14Alerts from Breeze, such as a fraud report, a payment dispute or a flagged review.

Handling alerts

Each alert is investigated, decided and documented by our team: what triggered it, what we found, and what we did. Possible outcomes:

• 6.15no action;
• 6.16asking for more information;
• 6.17limiting or suspending the account;
• 6.18closing it and reversing what came from fraud;
• 6.19reporting it (section 9).

Money that is legitimately the player's is paid out once a review ends, unless a court or authority orders otherwise.

7. Service providers

We rely on reputable providers for parts of this program, chiefly Breeze for payments, payouts, identity checks and fraud screening. We review their performance periodically. If a provider doesn't meet its obligations or our needs change, we add controls or change providers.

8. Training

Everyone who can see player accounts is trained, before they start and then at least once a year, on:

• 8.1this policy;
• 8.2how to recognize the red flags above;
• 8.3how to escalate them to the compliance officer.

9. Reporting

We share concerns about suspicious activity with Breeze, which has its own reporting obligations as a payment provider. We report to law enforcement and other authorities where the law requires it, including any account found to belong to someone on a sanctions list. Where the law doesn't allow us to tell a player about a report or an investigation, we won't.

10. Records

We keep identity, transaction, alert and review records for at least 5 years after an account closes, or longer if the law requires. Our Privacy Policy explains how we protect them.

11. Questions or reports

If you notice suspicious activity on Pullfox, or have a question about this policy, write to hello@pullfox.com with "AML" in the subject.

Version history: 1.0, October 29, 2026, first published. 1.1, October 29, 2026, company details added (section 1).