DIGITTPAY SOLUTIONS LLP

This Policy establishes a framework for managing compliance with applicable payment-network, card-scheme, payment-processor and partner requirements where DIGITTPAY SOLUTIONS LLP participates directly or indirectly in card or other payment transactions.

The specific obligations applicable to the Company depend on its contractual role, payment flows, products, partners and applicable rules. Where a regulated payment partner or processor is responsible for a particular network obligation, the Company shall support that partner within its agreed role.

This Policy covers applicable card-network and payment-scheme requirements, transaction processing, authorisation, settlement, dispute/chargeback coordination, data security, merchant/service-provider obligations, operational controls and partner oversight.

• RuPay
• Visa
• Mastercard
• Other card or payment schemes used through authorised partners
• Payment processors, gateways, acquiring or issuing partners, where applicable

Management shall assign appropriate ownership for payment-scheme compliance. Compliance, Operations, Technology, Risk, Finance and relevant business teams shall coordinate with payment partners to satisfy applicable obligations.

• Maintain records of relevant agreements and operating responsibilities.
• Identify obligations assigned to the Company and to each payment partner.
• Monitor material partner notices and rule changes.
• Escalate material compliance gaps or partner breaches.

• Use authorised payment channels and integrations.
• Maintain appropriate transaction validation and reconciliation.
• Apply applicable transaction limits and fraud controls.
• Maintain accurate transaction identifiers and audit trails.
• Prevent duplicate or unauthorised transaction processing.

Payment-related information shall be protected using appropriate technical and organisational controls. Where card data is handled by the Company or its service providers, applicable security and contractual requirements shall be followed.

The Company shall minimise collection and storage of sensitive payment-card information. Where applicable, tokenisation, masking, encryption and access restrictions shall be used in accordance with partner and security requirements.

Where applicable to the Company's role and card-data environment, the Company and relevant service providers shall maintain appropriate Payment Card Industry Data Security Standard (PCI DSS) controls or rely on compliant partners where processing is outsourced. Scope and responsibility shall be documented.

Authorisation responses shall be processed through approved integrations. Declines, timeouts, duplicate responses and technical errors shall be handled using controlled procedures to prevent inconsistent customer or financial outcomes.

Payment transactions and settlement reports shall be reconciled with internal records. Material mismatches, delayed settlements, duplicate credits/debits or unexplained adjustments shall be investigated and escalated.

Card disputes and chargebacks shall be managed in accordance with applicable scheme/partner procedures and the Company's Chargeback & Dispute Management Policy.

Payment transactions shall be subject to applicable fraud prevention and transaction-monitoring controls. Suspicious or abnormal activity shall be escalated under the Fraud Prevention & Transaction Monitoring Policy.

The Company shall maintain appropriate processes for transaction disputes, unauthorised transactions, refunds and customer complaints, subject to applicable payment rules and contractual arrangements.

Refunds, reversals and cancellations shall be processed through approved payment channels and reconciled against the original transaction wherever possible. Applicable scheme and partner requirements shall be followed.

Payment-system incidents, data-security incidents, suspected compromise or material fraud shall be escalated under the Cyber Fraud Prevention & Incident Response Policy and relevant partner procedures.

Payment gateways, processors, technology vendors and other service providers shall be subject to proportionate due diligence, contractual controls and ongoing oversight under the Third-Party Vendor Risk Management Policy.

Payment transaction, reconciliation, dispute, settlement, incident and compliance records shall be retained according to applicable law, scheme requirements, contracts and the Company's Data Retention & Record-Keeping Policy.

Relevant payment-network and partner updates shall be reviewed for applicability. Material changes shall be assigned to responsible teams, assessed for impact and implemented within applicable timelines.

Personnel involved in payment operations, customer support, finance, risk, technology and compliance shall receive role-appropriate training on applicable payment controls and escalation procedures.

The Company may conduct periodic reviews of payment controls, partner compliance, reconciliation, access management, dispute handling and security requirements. Material findings shall be tracked to remediation.

Actual or suspected breaches of payment-scheme, partner or security requirements shall be documented, assessed and escalated. Corrective actions shall be assigned and tracked.

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory network, contractual, legal, security or regulatory requirements shall not be bypassed.

This Policy shall be reviewed at least annually and following material changes in payment networks, partners, transaction flows, products, security requirements or applicable law.