Know Your Customer and Anti- Money Laundering Policy

1. Background

Respo Financial Capital Private Limited (hereafter referred to the “Company”) is a private limited company incorporated under the provisions of the Companies Act, 2013 and is a non-banking finance company (“NBFC”) registered with Reserve Bank of India (“RBI”).

In terms of the provisions of Prevention of Money Laundering Act, 2002 and the Prevention of Money Laundering (Maintenance of Records) Rules, 2005, as amended from time to time, RBI has issued comprehensive Reserve Bank of India (Non-Banking Financial Companies – Know Your Customer) Directions, 2025 dated November 28, 2025(“KYC Directions”)directions applicable to all NBFCs, as amended from time to time. In view of the same, the board of directors of the Company has duly approved and adopted this policy framework on anti-money laundering (“AML”), countering financing of terrorism (“CFT”) and KYC measures in line with RBI directions.

The Company has formulated this KYC & AML Policy based on KYC Directions, the provisions of Prevention of Money Laundering Act, 2002 and the Prevention of Money Laundering (Maintenance of Records) Rules, 2005 and it is to be read in conjunction with and shall stand auto-corrected with related operational guidelines issued or any changes/modifications which may be advised from time to time by the RBI, Financial Intelligence Unit-India (“FIU-IND”) and/or other regulators.

2. Objectives

2.1.To prevent money laundering or terrorist financing activities;

2.2.To enable the Company to know and understand its Customers and their financial dealings better which in turn help the Company to manage its risks prudently;

2.3.To put in place appropriate controls for detection and reporting of suspicious activities in accordance with applicable laws/laid down procedures;

2.4.To comply with applicable laws and regulatory guidelines; and

2.5.To ensure that the concerned staff are adequately trained in KYC/AML/CFT procedures.

3. Definitions

Terms used in this KYC & AML Policy shall, unless contrary to the meaning thereof, have the meaning as assigned to them in the KYC Directions, Prevention of Money Laundering Act, 2002 and the Prevention of Money Laundering (Maintenance of Records) Rules, 2005, the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, Aadhaar and Other Laws (Amendment) Act, 2019 and the rules and regulations made thereunder, as amended from time to time.

3.1.“Act” and “Rules” means the Prevention of Money-Laundering Act, 2002 and the Prevention of Money- Laundering (Maintenance of Records) Rules, 2005, respectively and amendments thereto as updated from time to time.

3.2.“Periodic Updation” means steps taken to ensure that documents, data or information collected under the CDD process is kept up-to-date and relevant by undertaking reviews of existing records at periodicity prescribed by the Reserve Bank.

3.3.“Customer” means a person who is engaged in a financial transaction or activity with the Company and includes a person on whose behalf the person who is engaged in the transaction or activity, is acting.

3.4.“Customer Due Diligence (CDD)” means identifying and verifying the Customer and the Beneficial Owner using reliable and independent sources of identification.

Explanation – The CDD, at the time of commencement of an account-based relationship or while carrying out occasional transaction of an amount equal to or exceeding rupees fifty thousand, whether conducted as a single transaction or several transactions that appear to be connected, or any international money transfer operations, shall include:

(a) Identification of the Customer, verification of their identity using reliable and independent sources of identification, obtaining information on the purpose and intended nature of the business relationship, where applicable;

(b) Taking reasonable steps to understand the nature of the Customer’s business, ownership and control;

(c) Determining whether a Customer is acting on behalf of a Beneficial Owner, identifying the beneficial owner and taking all reasonable steps to verify the identity of the Beneficial Owner, using reliable and independent sources of identification.

3.5.“Designated Director” means the Managing Director or a Whole-time Director, duly authorized by the Board of Directors of the Company to ensure overall compliance with the obligations imposed under chapter IV of the Act and the Rules.

Explanation – For the purpose of this clause, the terms “Managing Director” and “Whole-time Director” shall have the meaning assigned to them in the Companies Act, 2013.

3.6.“Equivalent e-document” means an electronic equivalent document, issued by the issuing authority with its valid digital signature, including documents issued to the digital locker account of the Customer as per Rule 9 of the Information Technology (Preservation and Retention of Information by Intermediaries Providing Digital Locker Facilities) Rules, 2016.

3.7.“Officially Valid Document” (“OVD”) means the passport, the driving license, proof of possession of Aadhaar number, the Voter’s Identity Card issued by the Election Commission of India, job card issued by NREGA duly signed by an officer of the State Government and letter issued by the National Population Register containing details of name and address. Provided that:

1. where the Customer submits his proof of possession of Aadhaar number as an OVD, he may submit it in such form as are issued by the Unique Identification Authority of India.
2. where the OVD furnished by the Customer does not have updated address, the following documents or the Equivalent e-documents thereof shall be deemed to be OVDs for the limited purpose of proof of address: –
   
   1. utility bill which is not more than two months old of any service provider (electricity, telephone, post-paid mobile phone, piped gas, water bill);
   2. property or Municipal tax receipt;
   3. pension or family pension payment orders (PPOs) issued to retired employees by Government Departments or Public Sector Undertakings, if they contain the address; or
   4. letter of allotment of accommodation from employer issued by State Government or Central Government Departments, statutory or regulatory bodies, public sector undertakings, scheduled commercial banks, financial institutions and listed companies and leave and license agreements with such employers allotting official accommodation.
3. the Customer shall submit OVD with current address within a period of three months of submitting the documents specified at 2.7 ‘b’ above
4. where the OVD presented by a foreign national does not contain the details of address, in such case the documents issued by the Government departments of foreign jurisdictions and letter issued by the Foreign Embassy or Mission in India shall be accepted as proof of address.

Explanation: For the purpose of this clause, a document shall be deemed to be an OVD even if there is a change in the name subsequent to its issuance provided it is supported by a marriage certificate issued by the State Government or Gazette notification, indicating such a change of name.

3.8.“Video-based Customer Identification Process (V-CIP)”: Video based Customer Identification Process (V- CIP) is an alternate method of customer identification with facial recognition and customer due diligence by authorized official of the Company by undertaking seamless, secure, live, informed-consent based audio- visual interaction with the customer to obtain identification information required for CDD purpose, and to ascertain the veracity of the information furnished by the customer through independent verification and maintaining audit trail of the process.

4. KYC Process

4.1.Customer Acceptance Policy (“CAP”) as set down under Annexure 1. Customer Acceptance Policy will treat all clients at par without even discriminating against members of the general public and will not result in denial of financial facility to members of the general public, especially those, who are financially or socially disadvantaged.

4.2.Customer Identification Procedures (“CIP”) as set down under Annexure 2 and 4 as per the regulatory triggers set out under paragraph 21 of the KYC Directions.

4.3.Customer Due Diligence Procedures: The Company shall verify the identity and address of Customers using OVDs, Equivalent e-Documents, or digital verification modes in accordance with Annexure 3.

4.4.Risk Management – The Company will have a risk-based approach for categorisation. Customers will be categorised as low, medium and high-risk category, based on the assessment and risk perception of the Company. Risk categorisation will be undertaken on the basis of parameters such as Customer’s identity, social/financial status, nature of business activity, and information about the clients’ business and their location, geographical risk covering Customers as well as transactions, type of products/ services offered, delivery channel used for delivery of products/services, types of transaction undertaken – cash, cheque/monetary instruments, wire transfers, forex transactions, etc mode of sourcing, nature of underlying loan etc. While considering Customer’s identity, the ability to confirm identity documents through online or other services offered by issuing authorities may also be factored in. The risk categorisation of a Customer and the specific reasons for such categorisation will be kept confidential and will not be revealed to the Customer to avoid tipping off the Customer. However, while preparing Customer profile, the Company will take care to seek only such information from the Customer which is relevant to the risk category and is not intrusive. FATF Public Statement, the reports and guidance notes on know your Customer/anti money laundering issued by the Indian Banks Association and other agencies, etc. may also be used by the Company in risk assessment.

4.5.Beneficial ownership identification and verification

The Company shall have the right to determine whether the Customer is acting on behalf of a beneficial owner or any other third party.

4.6.Accounts of Politically Exposed Persons

The Company shall put in place appropriate risk management to determine whether a Customer is a PEP as per the KYC Directions.

4.7.CDD through Equivalent e-documents

The Company may permit a customer to satisfy the CDD requirements under these directions by submitting equivalent e-documents in lieu of physical Officially Valid Documents (“OVDs”) or other documents required under the customer identification procedure.

Where a customer furnishes an equivalent e-document of any OVD, the Company shall verify the such document in accordance with the the KYC Directions. Onboarding conducted through digital channels — including through DigiLocker or equivalent e-documents — shall constitute non-face-to-face onboarding for the purposes of these directions and shall accordingly be subject to the enhanced due diligence measures prescribed under Paragraph 44 of the KYC Directions.

4.8.Central KYC Records Registry (CKYCR)

1. Online Retrieval and Reliance on CKYCR Records: For the purpose of establishing an account-based relationship, conducting Periodic Updation, or verifying the identity of a customer, the Company may seek the KYC Identifier from the Customer or retrieve it from the Central KYC Records Registry (CKYCR). The Customer shall not be required to resubmit KYC records, information, or identification documents already available in CKYCR, unless:
   
   1. there is a change in the customer’s information as available in the records of CKYCR;
   2. the KYC records or information retrieved from CKYCR are incomplete or do not conform to the applicable KYC requirements;
   3. the validity of any document retrieved from CKYCR has expired or lapsed; or
   4. the Company considers it necessary to obtain additional information or documents for verifying the identity or address (including current address) of the customer, conducting enhanced due diligence, or assessing and maintaining an appropriate risk profile of the customer.
2. The Company shall comply with the corresponding CDD requirements under KYC Directions in case it undertakes the above CKYCR requirements.

5. Responsibility

5.1.The Company has a Designated Director nominated, appointed, duly authorised and designated by its Board of Directors for the purpose of ensuring overall compliance by the Company with the obligations imposed under Act and its Rules. The Company has communicated the name, designation, address and contact details of the Designated Director to the FIU-IND and RBI. The Designated Director of the Company is a person other than Principal Officer of the Company.

5.2.The Company has appointed the ‘Principal Officer’, who is an officer at the management level nominated by the board of directors of the Company and who is responsible for ensuring compliance with RBI requirements and such other requirements, monitoring transactions and sharing and reporting information as required under applicable law and regulations. The Company has communicated the name, designation, address and contact details of the Principal Officer to the FIU-IND and RBI.

5.3.The Company will ensure compliance with its KYC & AML Policy through –

1. Chief Risk Officer of the Company, Chief Risk Officer of the Company and Chief Financial Officer of the Company/ Chief Operational Officer of the Company will constitute senior management of the Company (“Senior Management”) for the purpose of KYC compliance and for its effective implementation.
2. Concurrent/ internal audit system to verify the compliance with KYC/AML policies and procedures.
3. Submission of quarterly audit reports of the auditors and compliance to its Board.
4. The Senior Management of the Company will play an important role in providing an independent evaluation of the Company’s own policies and procedures, including legal and regulatory requirements.

5.4.The Company will ensure that decision-making functions of determining compliance with KYC norms are not outsourced.

6. On-going due diligence (“ODD”) & evaluation

6.1.The Company will carry out on-going due diligence of Customers with respect to the business relationship with every Customer and closely examine the transactions in order to ensure that they are consistent with their knowledge of the Customer, business and risk profile and, the source of funds/wealth. The Company can effectively control and reduce the risk only if it has an understanding of the normal and reasonable activity of the Customer so that they have the means of identifying transactions that fall outside the regular pattern of activity. However, the overarching principle for ODD is that the extent of ODD/monitoring will be aligned with the risk category of the Customer. High-risk Customers will be subjected to intensified monitoring in accordance with KYC Directions.

6.2.The Company has adopted Risk Based Approach for Periodic Updation of KYC. ensuring that the information or data collected under CDD is kept up-to-date and relevant, particularly where there is high risk. Full KYC exercise will be carried out, at least once in every two years for high-risk Customers, at least once in every eight years for medium risk Customers and at least once in every ten years for low-risk Customers, from the date of opening of account/last KYC updation.

6.3.The Company shall comply with any relaxation or extension granted by RBI from time to time for periodic updation of KYC for low-risk customers, as communicated through regulatory circulars and amendments to KYC Directions. The Company shall subject accounts of such customers to regular monitoring.

6.4.While conducting CDD, the Company shall conduct ongoing due diligence and scrutiny, i.e. perform ongoing scrutiny of the transactions throughout the course of the commercial relationship with the Customer to ensure that the transactions being conducted are consistent with the Company’s knowledge of the Customer, its business and risk profile, taking into account, where necessary, the Customer’s utilisation of the funds deployed and its end-beneficiaries.

6.5.The Company shall also undertake ongoing due diligence of Customers through tracking the investigation of the Customer by any financial sector regulator and / or law enforcement agency.

1.    Individual Customers:

1. No change in KYC information: In case of no change in the KYC information, a self-declaration from the Customer in this regard will be obtained through Customer’s email-id registered with the Company, Customer’s mobile number registered with the Company, digital channels (such as online /mobile application of the Company), letter etc.
2. Change in address: In case of a change only in the address details of the Customer, a self-declaration of the new address will be obtained from the Customer through Customer’s email-id registered with the Company, Customer’s mobile number registered with the Company, digital channels (such as online /mobile application of the Company), letter etc., and the declared address will be verified by the Company through positive confirmation within two months, by means such as address verification letter, contact point verification, deliverables. etc. Further, the Company, at their option, may obtain a copy of OVD or deemed OVD or the Equivalent e-documents thereof, for the purpose of proof of address, declared by the Customer at the time of updation/ Periodic Updation. The Company shall conduct greater scrutiny for Customers who frequently make requests for change of address without providing sufficient / genuine reasons.

6.6.The Company does not currently establish account-based relationships with, or provide financing facilities to, minor Customers.

6.7.In the event that a customer fails to comply with the requirements of periodic updation of KYC, the Company shall proceed in accordance with the provisions of the KYC Directions

6.8.Aadhaar OTP based e-KYC in non-face to face mode may be used for updation/ Periodic Updation.

6.9.Declaration of current address, if the current address is different from the address in Aadhaar, will not require positive confirmation in this case. The Company will advise the Customers that in order to comply with the Rules, in case of any update in the documents submitted by the Customer at the time of establishment of business relationship / account-based relationship and thereafter, as necessary, Customers will submit to the Company the update of such documents. This will be done within 30 days of the update to the documents for the purpose of updating the records at the Company’ end.

In case of existing Customers, the Company will obtain the Permanent Account Number or Equivalent e-document thereof or Form No.60 of the Customer failing which the Company will temporarily cease operations in the account till the time the Permanent Account Number or Equivalent e-document thereof or Form No. 60 is submitted by the Customer. Provided that before temporarily ceasing operations for an account, the Company will give the Customer an accessible notice and a reasonable opportunity to be heard. Further, the Company will provide appropriate relaxation(s) for continued operation of accounts for Customers who are unable to provide Permanent Account Number or Equivalent e-document thereof or Form No. 60 owing to injury, illness or infirmity on account of old age or otherwise, and such like causes. Such accounts will, however, be subject to enhanced monitoring. Provided further that if a Customer having an existing account-based relationship with the Company gives in writing to the Company that he does not want to submit his Permanent Account Number or Equivalent e-document thereof or Form No.60, the Company will close the account and all obligations due in relation to the account will be appropriately settled after establishing the identity of the Customer by obtaining the identification documents as applicable to the Customer.

6.10.As a risk-mitigating measure for such accounts, the Company will ensure that transaction alerts, OTP, etc., are sent only to the mobile number of the Customer registered with Aadhaar. In case of request of change of mobile number from the Customer, below steps to be followed:

1. The Customer to initiate formal request from registered email id or letter to the Company for change of mobile number, (the mobile number should be linked with Aadhaar),
2. On receipt of formal request from the Customer, the Company will initiate Aadhaar based OTP verification of mobile number,
3. Post successful verification of mobile number, the Customers’ details to be updated in the records of the Company.

6.11.For ongoing due diligence, the Company may consider adopting appropriate innovations including artificial intelligence and machine learning (AI & ML) technologies to support effective monitoring.

6.12.Enhanced Due Diligence of Accounts of non-face-to-face customers (other than Aadhaar OTP based E-KYC on-boarding): Non-face-to-face onboarding facilitates the Company to establish relationship with the customer without meeting the customer physically or through V-CIP. Such non-face-to-face modes for the purpose of this Section includes use of digital channels such as CKYCR, Digi Locker, equivalent e-document, etc., and non-digital modes such as obtaining copy of OVD certified by additional certifying authorities as allowed for NRIs and PIOs. Following EDD measures shall be undertaken by the Company:

▪ In case the Company has introduced the process of V-CIP, the same shall be provided as the first option to the customer for remote onboarding. However, the facility shall be available only during the working hours and on a day which is not a public holiday of the Company. It is reiterated that processes complying with prescribed standards and procedures for V-CIP shall be treated on par with face-to-face CIP.

▪ For customers, except in case of embedded finance loans, with annual disbursed loan amount >= INR 60,000 in case of new loans and INR 1,00,000 in case of repeat loans, V-CIP shall be carried out and no further due diligence shall be needed for such accounts, and they will be classified as low-risk customers (from KYC perspective). Customers which are not undergoing the V-CIP shall be treated as high- risk customers (from KYC perspective). In order to prevent fraud, alternate mobile numbers shall not be linked post CDD with such accounts for transaction OTP, transaction updates, etc. Transactions shall be permitted only from the mobile number used for account opening. In case of request of a change of mobile number from the customer, below steps to be followed:

▪ The customer to initiate a formal request from the registered email id or letter to the Company for a change of mobile number, (efforts may be made to ensure that the new/updated mobile number is linked with Aadhaar).

▪ On receipt of a formal request from the Customer, the Company to initiate Aadhaar-based OTP verification of mobile number.

▪ Post successful verification of mobile number, the Customers’ details to be updated in the records of the Company.

▪ The Company shall obtain PAN from the Customer and the PAN shall be verified from the verification facility of the issuing authority.

▪ The Company is in the business of digital lending through mobile based application ‘ZYPE”. Thus, for operational efficiency, first transaction in such accounts shall be a debit from an existing KYC-complied bank account of the Customer (in the form of a penny-drop).

6.13 Trigger-Based Risk Reassessment

Notwithstanding the periodic risk categorisation review conducted at least once every six months, the Company shall have the right to initiate a review of a customer’s risk categorisation, upon occurrence of any of the following trigger events (including but not limited to):

• Suspicious Transaction Report (STR) filing: Where the Principal Officer files an STR with FIU-IND, the customer’s risk category shall be elevated to High Risk and re-KYC initiated. The STR filing shall remain confidential and shall not be disclosed to the customer in any manner.
• Regulatory action or law enforcement inquiry: Receipt of any inquiry, summons, notice, or communication from any financial sector regulator, law enforcement agency, or court in connection with the customer’s account or transactions.
• Sanctions list match: A positive or potential match against UNSC Sanctions Lists, UAPA Schedule lists, or any other sanctions or debarment list verified by the Company on a daily basis. .
• Material change in risk profile: Any circumstance that materially changes the customer’s risk profile including but not limited to: detection of adverse media or adverse information;
• identification of a customer as a Politically Exposed Person (PEP) or close relative/associate of a PEP at any point in the relationship; or transaction patterns that are materially inconsistent with the customer’s known profile.
• ) Request to change material KYC details: A request by the customer to change material KYC details including mobile number, bank account, registered address or employment details, where such change cannot be verified through existing KYC documents.

7. Record Management

7.1.All transaction records between the Company and the Customer, both domestic and international, including KYC documents obtained from Customers will be maintained by the Company for a period of Five (5) years from the date of transaction.

7.2.The Company will preserve the records pertaining to the identification of the Customers and their addresses obtained while opening the account and during the course of business relationship, for at least five years after the business relationship is ended;

7.3.The Company will make available swiftly the identification records and transaction data to the competent authorities upon request;

7.4.The Company will maintain proper records of the identity and address of their Customer, and proper records, including in respect of transactions prescribed under rule 3 of Rules.

7.5.The Company will maintain all necessary information in respect of transactions prescribed under rule 3 of Rules, so as to permit the reconstruction of the individual transaction including the following information:

• Nature of the transactions,
• Amount of the transaction and the currency in which it was denominated,
• The date on which the transaction was conducted,
• Parties to the transaction

7.6.The Company has a system for proper maintenance and preservation of account information in a manner that allows data to be retrieved easily and quickly whenever required or when requested by the competent authorities.

7.7.The Company will maintain records of the identity and address of their Customer, and records in respect of transactions referred to in rule 3 of Rules in hard or soft format.

Explanation. – For the purpose of this Clause, the expressions “records pertaining to the identification”, “identification records”, etc., will include updated records of the identification data, account files, business correspondence and results of any analysis undertaken.

8. Monitoring of Transactions

8.1.On-going monitoring is an essential element of effective KYC procedures. Monitoring of transactions and its extent will be conducted taking into consideration the risk profile and risk sensitivity of the account.

8.2.The Company will pay special / close attention to, and monitor all large, complex, unusually large transactions, all unusual patterns, inconsistent with the normal and expected activity of the Customer, which have no apparent economic rationale or visible lawful purpose. v Customers have to be subjected to intensified monitoring.

8.3.The Principal Officer shall particularly consider the red flag indicators and other guiding principles prescribed by FIU-IND from time to time.

8.4.The Principal Officer shall assess the nature of the transaction in respect of a red flag alert raised by any personnel of the Company. The Principal Officer shall gather all possible information in respect of the transaction from relevant sources, before concluding if the transaction is a suspicious transaction.

8.5.In assessment of a flagged transaction, the Principal Officer (and such other staff of the Company assisting the Principal Officer) shall consider, inter alia, the following aspects:

• The number of criteria / red flags through which the transaction is identified as an alert;
• Any relevant public information which may supplement the alert; and
• Linkage of any previous alert / STR against the same Customer.

8.6.The red flag indicators / alerts that are employed in the assessment of a transaction as suspicious may include, inter alia, the following:

• transactions involving a location with a high terrorist financing risk;
• transactions involving sudden and unusually large amounts for the Customer;
• high-value transactions that are inconsistent with the profile of the Customer; and
• Any other indicators as the Principal Officer may determine and communicate internally from time to time.

8.7.The Principal Officer shall update the list of ‘red flag indicators’ and ‘watch list’ on such periodic basis as determined by the Board.

8.8. The Company shall also undertake ongoing monitoring of transactions by undertaking, inter alia, the following:

• Analysis and review of media reports;
• Tracking the investigation of the Customer by any financial sector regulator and / or law enforcement agency;
• Any other aspect as the Principal Officer may determine and communicate internally from time to time.

8.9.The Principal Officer shall, from time to time, review the risks posed by each Customer and prepare a list of Customers who should be put on a ‘watch list’ for heightened monitoring and due diligence.

9. Reporting Transactions

9.1.The Company will, to the extent applicable to it, ensure compliance with the reporting requirement under Foreign Account Tax Compliance Act (FATCA) and Common Reporting Standards (CRS). The Company will adhere to provisions of Income Tax Rules.

9.2.The Company will not put any restriction on operations in the accounts where a suspicious transaction report (“STR”) has been made. Robust software, throwing alerts when the transactions are inconsistent with risk categorization and updated profile of the Customers are put in to use as a part of effective identification and reporting of suspicious transactions It should also be ensured that there is no tipping off to the Customer at any level.

9.3.If a transaction is concluded as a ‘suspicious transaction’, the Principal Officer shall file an STR with the FIU-IND in respect of such transaction; and if closed otherwise, the Principal Officer shall clearly record the specific reasons for not classifying such transaction as a ‘suspicious transaction’. The Principal Officer shall maintain the records of all such assessment for audit purposes.

9.4.Where a transaction is concluded to be suspicious, the Principal Officer shall file an STR. The Company, its directors, officers, and all employees will ensure that the fact of maintenance of records referred to in rule 3 of Rules and furnishing of the information to the Director, FIU-IND is confidential. However, such confidentiality requirement will not inhibit sharing of information under paragraph 8 of KYC Directions of any analysis of transactions and activities which appear unusual, if any such analysis has been done.

9.5.Such STR shall be filed within 7 working days from the date on which the Principal Officer concludes that the transaction is suspicious, in the prescribed format via FINNET 2.0.

10. Internal ML/ TF Risk Assessment

The Company will carry out ‘Money Laundering (ML) and Terrorist Financing (TF) Risk Assessment’ exercise periodically to identify, assess and take effective measures to mitigate its money laundering and terrorist financing risk for clients, countries or geographic areas, products, services, transactions or delivery channels, etc.

The assessment process considers the relevant risk factors before determining the level of overall risk and the appropriate level and type of mitigation to be applied. While preparing the internal risk assessment, the Company will take cognizance of the overall sector-specific vulnerabilities, if any, that the regulator/supervisor may share from time to time. Further, the risk assessment by the Company will be properly documented and be proportionate to the nature, size, geographical presence, complexity of activities/structure, etc. of the Company.

Also, the Company will apply a Risk Based Approach (RBA) for mitigation and management of the risks (identified on their own or through national risk assessment) and has board approved policies, controls and procedures in this regard. The Company will implement the Customer Due Diligence programme, having regard to the ML/TF risks identified and the size of business. Further, the Company will monitor the implementation of the controls and enhance them if necessary.

The periodicity of such risk assessment exercise will be determined by the Board, in alignment with the outcome of the risk assessment exercise. However, it will be reviewed at least annually.

The outcome of the exercise will be put up to the Board and should be available to competent authorities and self-regulating bodies.

11. Employee Training

Periodic training programmes will be organized for employees to have adequate screening mechanism, including know your employee/ staff policy, as an integral part of their personnel recruitment/hiring process.

The Company will ensure that the staff dealing with/ being deployed for KYC/AML/CFT matters have high integrity and ethical standards, good understanding of extant KYC/AML/CFT standards, effective communication skills and ability to keep up with the changing KYC/AML/CFT landscape, nationally and internationally. The Company will also strive to develop an environment which fosters open communication and high integrity amongst the staff.

On-going employee training programme will be put in place so that the employees are adequately trained in the KYC/AML/CFT policy. The focus of the training will be different for frontline staff, compliance staff and staff dealing with new Customers. The front desk staff will be specially trained to handle issues arising from lack of Customer education. Proper staffing of the audit function with persons adequately trained and well-versed in the KYC/AML/CFT policies of the Company, regulation and related issues will be ensured will be put in place in AML procedures.

The Company will prepare specific literature/pamphlets etc. so as to educate the Customer of the objectives of the KYC programme.

12. Confidentiality

The Company will maintain secrecy regarding the Customer information which arises out of the contractual relationship between the Company and Customer.

Information collected from Customers for the purpose of opening of account will be treated as confidential and details thereof will not be divulged for the purpose of cross selling, or for any other purpose without the express permission of the Customer. The exceptions to the said rule will be as under:

12.1 Where disclosure is under compulsion of law;

12.2 Where there is a duty to the public to disclose;12.3 Where the disclosure is made with the express consent of the Customer.

13. Other Information

13.1.The Company will pay adequate attention to any money-laundering and financing of terrorism threats that may arise from new or developing technologies and it will be ensured that appropriate KYC procedures issued from time to time are duly applied before introducing new products/services/technologies.

13.2.Unique Customer Identification Code (“UCIC”) will be allotted while entering new relationships with the individual Customers as also the existing individual Customers by the Company.

13.3.The Board of the Company will review the KYC & AML Policy on an annual basis or at earlier intervals, if there any regulatory changes necessitating such interim reviews.

14. Introduction of New Technologies:

14.1.The Company will identify and assess the ML/TF risks that may arise in relation to the development of new products and new business practices, including new delivery mechanisms, and the use of new or developing technologies for both new and pre-existing products.

14.2.Further, the Company will ensure:

(a) to undertake the ML/TF risk assessments prior to the launch or use of such products, practices, services, technologies; and

(b) adoption of a risk-based approach to manage and mitigate the risks through appropriate enhanced due diligence measures and transaction monitoring, etc.

15. Obligations under the Unlawful Activities (Prevention) (UAPA) Act, 1967:

The Company will ensure that in terms of the Unlawful Activities (Prevention) Act, 1967 and amendments thereto (UAPA), the name of the Customer does not appear in the lists of individuals and entities, suspected of having terrorist links, which are approved by and periodically circulated by the United Nations Security Council. The Company will also refer to the lists as available in the Schedules to the Prevention and Suppression of Terrorism (Implementation of Security Council Resolutions) Order, 2007, as amended from time to time. The aforementioned lists, i.e., UNSC Sanctions Lists and lists as available in the Schedules to the Prevention and Suppression of Terrorism (Implementation of Security Council Resolutions) Order, 2007, as amended from time to time, will be verified on daily basis and any modifications to the lists in terms of additions, deletions or other changes will be taken into account by the Company for meticulous compliance.

Freezing of Assets under Section 51A of UAPA, 1967: The procedure laid down in the UAPA Order dated February 2, 2021, will be strictly followed by the Company and meticulous compliance with the Order issued by the Government will be ensured.

16. Obligations under Weapons of Mass Destruction (WMD) and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005 (WMD Act, 2005)

The Company will ensure meticulous compliance with the “Procedure for Implementation of Section 12A of the Weapons of Mass Destruction (WMD) and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005” laid down in terms of Section 12A of the WMD Act, 2005 vide Order dated September 1, 2023, by the Ministry of Finance, Government of India. The Company will verify every day, the ‘UNSCR 1718 Sanctions List of Designated Individuals and Entities‘, as available at https://www.mea.gov.in/Implementation-of-UNSC-Sanctions-DPRK.htm, to take into account any modifications to the list in terms of additions, deletions or other changes and also ensure compliance with the ‘Implementation of Security Council Resolution on Democratic People’s Republic of Korea Order, 2017’, as amended from time to time by the Central Government. Additionally, the Company will also take into account – (a) other UNSCRs and (b) lists in the first schedule and the fourth schedule of UAPA, 1967 and any amendments to the same for compliance with the Government orders on implementation of Section 51A of the UAPA and section 12A of the WMD Act.

17. Combating Financing of Terrorism

The Company will consider the Financial Action Task Force (“FATF”) Statements circulated by the Reserve Bank of India from time to time, and publicly available information, for identifying countries, which do not or insufficiently apply the FATF Recommendations. The Company will apply enhanced due diligence measures, which are effective and proportionate to the risks, to business relationships and transactions with natural and legal persons (including financial institutions) from countries for which this is called for by the FATF. Special attention will be given to business relationships and transactions with individuals (including legal persons and other financial institutions) from or in countries that do not or insufficiently apply the FATF Recommendations and jurisdictions included in FATF Statements.

18. Policy Review

This Policy shall be reviewed at least annually by the Board and may be amended, modified or revised from time to time in accordance with applicable laws, regulatory requirements and business needs. Any amendment, clarification, circular or direction issued by the RBI, or any other applicable regulatory authority shall automatically apply to this Policy and prevail in case of any inconsistency, until the Policy is accordingly updated.

19. Annexures

1.     Customer Acceptance Policy

In addition to the provisions of the Company’s Customer Acceptance Policy, the Company will ensure that:

1.1.No account will be opened by the Company in anonymous or fictitious/benami names.

1.2.No account will be opened where the Company is unable to apply appropriate CDD measures, either due to non-cooperation of the Customer or non-reliability of the documents/information furnished by the Customer. The Company will consider filing a STR, if necessary, when it is unable to comply with the relevant CDD measures in relation to the Customer.

1.3.No transaction or account-based relationship is undertaken without following the CDD procedure

1.4.The mandatory information to be sought for KYC purpose while opening an account and during the Periodic Updation will be as specified in Annexure 3 of this KYC &AML Policy and as amended or specified from time to time. Any exceptions will be discussed with the Principal Officer and the decision of Principal Officer (in compliance with the KYC & AML Policy) will be final and binding.

1.5.If any additional information, is required to be obtained from the Customer(s), which is not specified in this KYC & AML Policy, the Company will obtain such additional information with the explicit consent of the Customer.

1.6.There is denial of financial facilities to members of the general public, especially those who are financially or socially disadvantaged, including Persons with Disabilities.

1.7.The Company will apply the CDD procedure at the UCIC level. Thus, if an existing KYC compliant Customer of the Company desires to open another account or avail any other product or service with the Company, there will be no need for a fresh CDD exercise as far as identification of the customer is concerned.

1.8.CDD procedure is followed for all the joint account holders, while opening a joint account.

1.9.Circumstances in which, a Customer is permitted to act on behalf of another person/entity, is clearly spelt out.

1.10.Suitable system is put in place to ensure that the identity of the Customer does not match with any person or entity, whose name appears in the sanctions lists indicated in the KYC Directions.

1.11.Details of accounts resembling any of the individuals/entities in the lists will be reported to FIU-IND apart from advising Ministry of Home Affairs as required under UAPA notification dated February 21, 2021.

1.12.The Company will take into account other UNSCRs and lists in the first and fourth schedule of UAPA, 1967 and any amendments to the same for compliance with the Government orders on implementation of section 51A of the UAPA and section 12A of the WMD Act.

1.13.Where Permanent Account Number (PAN) is obtained, the same will be verified from the verification facility of the issuing authority.

1.14.Where the Company forms a suspicion of money laundering or terrorist financing, and it reasonably believes that performing the CDD process will tip-off the Customer, it will not pursue the CDD process, and instead file an STR with FIU-IND.

1.15.The Customer Acceptance Policy shall not result in the denial of a financial facility to members of the general public, particularly those who are financially or socially disadvantaged, including Persons with Disabilities (PwDs). The Company shall not reject an application for onboarding or periodic updation of KYC without due consideration and application of mind. The concerned officer shall duly record the reason(s) for any such rejection.

1.16.The Company shall mandatorily conduct periodic accessibility audits through certified accessibility professionals and involve persons with blindness in the User Acceptance Testing (UAT) phase while designing any application or website, or when launching any new feature, to ensure accessibility and inclusivity for all users.

2.     Annexure 2

Customer Identification Procedures

Customer identification means identifying the Customer and verifying his / her / its identity by using reliable, independent source documents, data or information while establishing a relationship. The Company will obtain sufficient information such as PAN, Voter ID card / Passport / Officially Valid Documents, etc. necessary to establish, to its satisfaction, the identity of each new Customer, whether regular or occasional and the purpose of the intended nature of relationship.

The Company will undertake identification of Customers in the following cases:

2.1.Commencement of an account-based relationship with the Customer.

2.2.When there is a doubt about the authenticity or adequacy of the Customer identification data it has obtained.

3.     Annexure 3

3.1.Certified documents or its Equivalent e-documents, as set out under the KYC Directions, will be obtained from the individual at the time of establishing an account-based relationship.

3.2.The Customer Due Diligence/ verification of the Company’s individual Customers may be carried out by the Company itself or through an independent agency/ third party. For the purpose of verifying the identity of Customers at the time of commencement of an account-based relationship, the Company, may rely on Customer Due Diligence done by a third party, subject to the following conditions:

1. Records or the information of the Customer Due Diligence carried out by the third party is obtained immediately from the third party or from the Central KYC Records Registry.
2. Adequate steps are taken by the Company to satisfy themselves that copies of identification data and other relevant documentation relating to the Customer Due Diligence requirements will be made available from the third party upon request without delay.
3. The third party is regulated, supervised or monitored for, and has measures in place for, compliance with Customer Due Diligence and record-keeping requirements in line with the requirements and obligations under the Act.
4. The third party will not be based in a country or jurisdiction assessed as high-risk.
5. The ultimate responsibility for Customer Due Diligence and undertaking enhanced due diligence measures, as applicable, will be with the Company.
6. Decision-making functions of determining compliance with KYC norms are not outsourced.
7. While undertaking identification of Customers, introduction is not sought while opening accounts.

4.     Annexure 4

Video based Customer Identification Process (V-CIP)

The Company may undertake live V-CIP to be carried out by its official for establishment of an account based relationship with a new individual customer, proprietor (in case of proprietorship firm), authorized signatories and Beneficial Owner (BO) (in case of Legal Entity (LE) customers), conversion of existing accounts opened in non-face to face mode using Aadhaar OTP based eKYC authentication and updation/ periodic updation of KYC for eligible customers, after obtaining his informed consent and shall adhere to the following stipulations:

A. V-CIP Infrastructure

1. The Company shall comply with the RBI guidelines on minimum baseline cyber security and resilience framework, as well as other general guidelines on IT risks.

2. The Company shall have in-house infrastructure in its own premises and the V-CIP connection and interaction shall originate from its own secured network domain. The Company shall also comply with the Outsourcing Guidelines issued by RBI for any technology related outsourcing activities.

3. Where cloud deployment model is used, it shall be ensured that the ownership of data in such model rests with the Company only and all the data including video recording is transferred to the Company’s exclusively owned / leased server(s) including cloud server, if any, immediately after the V-CIP process is completed and no data shall be retained by the cloud service provider or third-party technology provider assisting the V-CIP of the company.

4. The Company shall ensure end-to-end encryption of data between customer device and the hosting point of the V-CIP application, as per appropriate encryption standards. The customer consent should be recorded in an auditable and alteration proof manner.

5. The V-CIP infrastructure / application should be capable of preventing connection from IP addresses outside India or from spoofed IP addresses.

6. The video recordings should contain the live GPS co-ordinates (geo-tagging) of the customer undertaking the V-CIP and date-time stamp. The quality of the live video in the V-CIP shall be adequate to allow identification of the customer beyond doubt

7. The application shall have components with face liveness / spoof detection as well as face matching technology with high degree of accuracy, even though the ultimate responsibility of any customer identification rests with the Company. Appropriate artificial intelligence (AI) technology can be used to ensure that the V-CIP is robust.

8. The Company shall regularly upgrade technology infrastructure including application software as well as workflows based on experience of detected / attempted / ‘near-miss cases of forged identity. Any detected case of forged identity through V-CIP shall be reported as a cyber event under extant regulatory guidelines.

9. The Company shall conduct necessary tests such as Vulnerability Assessment, Penetration testing and a Security Audit to ensure its robustness and end-to-end encryption capabilities of V-CIP Infrastructure. Such tests should be conducted by the empanelled auditors of Indian Computer Emergency Response Team (CERT-In). Any critical gap reported under this process shall be mitigated before rolling out its implementation. The Company shall engage suitably accredited agencies as prescribed by RBI to conduct such tests periodically in conformance to internal / regulatory guidelines.

B. V-CIP Procedure

1. The Company shall formulate a clear workflow and standard operating procedure for V-CIP and ensure adherence to it. The V-CIP process shall be operated only by officials of the Company specially trained for this purpose. The official should be capable to carry out liveliness check and detect any other fraudulent manipulation or suspicious conduct of the customer and act upon it.

2. Disruption of any sort including pausing of video, reconnecting calls, etc., should not result in creation of multiple video files. If pause or disruption is not leading to the creation of multiple files, then there is no need to initiate a fresh session by the Company. However, in case of call drop / disconnection, fresh session shall be initiated.

3. The official of the Company shall ensure that if there is a disruption in the V-CIP procedure, the same shall be aborted and a fresh session shall be initiated.

4. The sequence and/or type of questions, including those indicating the liveness of the interaction, during video interactions shall be varied in order to establish that the interactions are real-time and not pre-recorded.

5. Any prompting, observed at end of customer shall lead to rejection of the account opening process.

6. The fact of the V-CIP customer being an existing or new customer, or if it relates to a case rejected earlier or if the name appearing in some negative list should be factored in at appropriate stage of workflow.

7. The authorised official of the Company performing the V-CIP shall record audio-video as well as capture photograph of the customer present for identification and obtain the identification information using any one of the following:

a. OTP based Aadhaar e-KYC authentication.

b. Offline Verification of Aadhaar for identification

c. KYC records downloaded from CKYCR, in accordance with Section 57, using the KYC identifier provided by the customer.

d. Equivalent e-document of Officially Valid Documents (OVDs) including documents issued through Digi locker.

The Company shall ensure to redact or blackout the Aadhaar number.

In case of offline verification of Aadhaar using XML file or Aadhaar Secure QR Code, the Company shall ensure that the XML file or QR code generation date is not older than 3 days from the date of carrying out V-CIP.

In case of offline verification of Aadhaar using XML file or Aadhaar Secure QR Code, The Company shall ensure that the XML file or QR code generation date is not older than 3 working days from the date of carrying out V-CIP. Further, in line with the aforesaid prescribed period, The Company shall ensure that the video process of the V-CIP is undertaken within three working days of downloading / obtaining the identification information through CKYCR / Aadhaar authentication / equivalent e-document, if in the rare cases, the entire process cannot be completed at one go or seamlessly. However, the Company shall ensure that no incremental risk is added due to this.

8. If the address of the customer is different from that indicated in the OVD, suitable records of the current address shall be captured. The Company shall ensure that the economic and financial profile/information submitted by the customer is also confirmed from the customer while undertaking the V-CIP in a suitable manner.

9. The Company shall capture a clear image of PAN card to be displayed by the customer during the process, except in cases where e-PAN is provided by the customer. The PAN details shall be verified from the database of the issuing authority including through Digi locker.

10. Use of printed copy of equivalent e-document including e-PAN is not valid for the V-CIP.

11. The authorised official of the Company shall ensure that photograph of the customer in the Aadhaar/OVD and PAN/e-PAN matches with the customer undertaking the V-CIP, and the identification details in Aadhaar/OVD and PAN/e-PAN shall match with the details provided by the customer.

12. All accounts opened through V-CIP shall be made operational only after being subject to concurrent audit, to ensure the integrity of process and its acceptability of the outcome.

13. The Company shall comply with all such matters required under other statutes, such as the Information Technology (IT) Act.

C. V-CIP Records and Data Management

1. The Company shall store the entire data and recordings in a system(s) located in India, in a safe and secured manner and shall bear time and date stamp for easy historical search.

2. The Company shall follow the provisions of Record Management as contained in this Policy.

3. The activity log along with credential of the official performing V-CIP shall be preserved.

4. All recordings, logs, and credentials shall be stored securely on servers located within India.