DIGITTPAY SOLUTIONS LLP

This Policy establishes a risk-based framework for preventing and managing money-laundering and terrorist-financing risks relevant to DIGITTPAY SOLUTIONS LLP's actual business model, legal role, products, transaction flows and contractual arrangements.

AML/CFT obligations depend on the Company's regulatory status, products, transaction role, applicable Indian law and relationships with regulated entities. This Policy shall be applied to the extent applicable. Where a regulated bank, payment partner or other obligated entity performs statutory AML/CFT functions, the Company shall support such controls within its contractual and lawful role.

• Identify and assess relevant AML/CFT risks.
• Apply proportionate customer and counterparty due diligence where required.
• Monitor unusual activity using risk-based controls.
• Escalate potentially suspicious activity appropriately.
• Maintain required records and confidentiality.
• Prevent misuse of gift cards, vouchers, accounts or related services for unlawful purposes.

This Policy applies to relevant customers, merchants, business counterparties, transactions, gift card/voucher activities, refunds, redemptions, partners, vendors and personnel to the extent AML/CFT controls are applicable.

Management shall establish appropriate responsibility and resources for AML/CFT risk management. Compliance shall coordinate the framework, while Risk, Fraud, Operations, Finance, Technology and relevant partners shall support implementation.

The Company shall consider relevant risk factors including customer type, product and service characteristics, transaction behaviour, geographic exposure where relevant, delivery/redemption channels, third-party relationships and known fraud or financial-crime indicators.

Where required, customer identification and verification shall be performed in accordance with the KYC / Customer Verification Policy and applicable law or partner requirements.

Where applicable, business customers or merchants may be subject to verification of legal identity, authorised representatives, business activity, ownership/control and other relevant information.

Where applicable to the Company's obligations, beneficial ownership information shall be identified and verified using reasonable and legally permitted methods.

Where required by applicable law, regulation or partner arrangements, relevant customers, counterparties or transactions may be screened against applicable sanctions or restricted-party information. Potential matches shall be escalated for review.

• Unusual transaction value or frequency
• Rapid purchase and redemption patterns
• Transactions structured to avoid controls
• Unusual refund or reversal patterns
• Multiple accounts showing suspicious common characteristics
• Activity inconsistent with known customer or business profile
• Fraud or security alerts with potential financial-crime implications

The Company shall consider risks associated with gift card or voucher purchase, issuance, transfer, redemption, refund and resale, including potential misuse for fraud, layering, concealment or unlawful value transfer.

Where risk warrants, the Company may obtain additional information, increase monitoring, restrict activity or refer the matter to an appropriate partner or obligated entity, subject to applicable law.

Potentially suspicious activity shall be escalated internally to authorised Compliance/Risk personnel and, where legally required, through the appropriate reporting or partner channels. Internal suspicion shall not automatically be treated as proof of unlawful activity.

Where applicable law imposes confidentiality or tipping-off restrictions, personnel shall not disclose the existence or details of a suspicious-activity review or report except to authorised persons.

AML/CFT, KYC, transaction-monitoring, escalation and related records shall be retained for the period required by applicable law, regulation, contract and the Company's Data Retention & Record-Keeping Policy.

AML/CFT information shall be accessed only by authorised personnel and protected against unauthorised disclosure, alteration or loss.

Where AML/CFT controls are performed by a regulated partner, bank, payment service provider or other obligated entity, the Company shall cooperate with lawful requests, contractual monitoring and information requirements within its role.

AML/CFT controls shall operate alongside fraud prevention and transaction monitoring. Fraud indicators may trigger additional review, but fraud and money-laundering assessments shall remain distinct where appropriate.

Personnel shall be subject to appropriate access controls, confidentiality obligations and monitoring. Suspected insider misuse involving financial-crime risk shall be escalated under applicable incident and disciplinary procedures.

Relevant personnel shall receive role-appropriate AML/CFT awareness covering applicable obligations, risk indicators, escalation, confidentiality, KYC and transaction monitoring.

The Company may conduct periodic control reviews, internal assessments or independent assurance activities proportionate to its AML/CFT risk and regulatory obligations.

• Customer-risk trends
• Transaction-monitoring alerts
• Material escalations
• Sanctions screening exceptions where applicable
• Fraud and financial-crime trends
• Control deficiencies and remediation

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory AML/CFT, sanctions, KYC, legal or regulatory requirements shall not be bypassed.

This Policy shall be reviewed at least annually and following material changes in applicable law, regulatory status, business model, products, payment arrangements, partner requirements or audit findings.