KYC & AML Policy

1. Background:

Angel Fincap Private Limited (the "Company") is a Base Layer Non-Banking Financial Company (NBFC) operating under the regulatory purview of the Reserve Bank of India (RBI). The company is classified as Investment and Credit Company.

The company being an Investment and Credit Company is engaged in Lending and investment activity. However, it is primarily engaged in providing Loan Against Shares to the retail clients (both individuals and corporates) and engages in investment activities in mutual funds, NCDs, etc. to manage its liquidity position.

RBI has issued Master Direction "Know Your Customer (KYC) Directions, 2025" The Master Direction issued is mainly in respect of 'Know Your Customer' (KYC) Guidelines and Anti Money Laundering Standards (AML) based on 'Prevention of Money Laundering Act, 2002 and rules there under, the recommendations made by the Financial Action Task Force (FATF) on anti-money laundering standards and amendments made in the PMLA, 2002 from time to time.

In view of the same, the Company, has framed this KYC and PML Policy [this "Policy"], based on the policy framework prescribed by RBI under the KYC Directions and PMLA, along with suitable stricter modifications wherever necessary.

2. Objectives:

The objective of this policy are as follows:

    • To prevent criminal elements from using the Company for money laundering activities.

    • To enable the Company to know and understand its customers and financial dealings in a better manner, which in turn, shall help manage the risks prudently.

    • To establish appropriate, effective and efficient controls for the detection and reporting of suspicious activities in accordance with the applicable laws / laid down procedures.

    • To comply with the applicable regulations and operate within the regulatory framework prescribed by the regulator.

    • To ensure adherence to KYC / AML / Combating the Financing of Terrorism ["CFT"] is established with the concerned employees / persons dealing on behalf of the Company.

    • To ensure adequate training to the employees / persons dealing with customers on behalf of the Company in the KYC / AML / CFT procedures.

    • To update and ensure continuing adherence to the Directions as issued by RBI from time to time after deliberations by the board.

3. Scope:

This policy document covers all transactions of the Company, and is applicable organization-wide to all employees / representatives dealing on behalf of the Company.

This policy is to be read in conjunction with the operational guidelines issued by RBI from time to time. The content of this policy shall always be read in tandem / auto-corrected with the changes / modifications as may be advised by RBI and / or by PMLA and amendments of the Directions, from time to time.

In case of any discrepancy between this policy and any directions issued by RBI, the applicable directions, as amended from time to time, shall supersede this policy.

4. Definitions:

Beneficial Owner:

    • Where the customer is a company, the beneficial owner is the natural person(s), who, whether acting alone or together, or through one or more juridical persons, has/have a controlling ownership interest or who exercise control through other means.

Explanation- For the purpose of this sub-clause-

    a. "Controlling ownership interest" means ownership of/entitlement to more than 10 percent of the shares or capital or profits of the company.

    b. "Control" shall include the right to appoint majority of the directors or to control the management or policy decisions including by virtue of their shareholding or management rights or shareholders agreements or voting agreements.

    • Where the customer is a partnership firm, the beneficial owner is the natural person(s), who, whether acting alone or together, or through one or more juridical person, has/have ownership of/entitlement to more than 10 percent of capital or profits of the partnership or who exercises control through other means.

Explanation - For the purpose of this sub-clause, "control" shall include the right to control the management or policy decision.

    • Where the customer is an unincorporated association or body of individuals, the beneficial owner is the natural person(s), who, whether acting alone or together, or through one or more juridical person, has/have ownership of/entitlement to more than 15 percent of the property or capital or profits of the unincorporated association or body of individuals.

Explanation: Term 'body of individuals' includes societies. Where no natural person is identified under (a), (b) or (c) above, the beneficial owner is the relevant natural person who holds the position of senior managing official.

    • Where the customer is a trust, the identification of beneficial owner(s) shall include identification of the author of the trust, the trustee, the beneficiaries with 10 percent or more interest in the trust and any other natural person exercising ultimate effective control over the trust through a chain of control or ownership.

Certified Copy:

Obtaining a certified copy by the Company shall mean comparing the copy of the proof of possession of Aadhaar number where offline verification cannot be carried out or officially valid document so produced by the customer with the original and recording the same on the copy by the authorised officer of the Company as per the provisions contained in the PML Act and PML Rules.

Provided that in case of Non-Resident Indians (NRIs) and Persons of Indian Origin (PIOs), as defined in Foreign Exchange Management (Deposit) Regulations, 2016 (FEMA 5(R)), alternatively, the original certified copy, certified by any one of the following, shall be obtained:

    • authorised officials of overseas branches of Scheduled Commercial Banks registered in India,

    • branches of overseas banks with whom Indian banks have relationships,

    • Notary Public abroad,

    • Court Magistrate,

    • Judge,

    • Indian Embassy/Consulate General in the country where the non-resident customer resides.

Central KYC Records Registry (CKYCR):

It means an entity defined under Rule 2(1) of the Rules, to receive, store, safeguard and retrieve the KYC records in digital form of a customer.

Customer:

For the purpose of KYC norms, A customer is defined as a person who is engaged in a financial transaction or activity with the Company and includes a person or whose behalf the person who is engaged in the transaction or activity, is acting.

Designated Director:

It means Managing Director or whole time Director, duly authorized by the Board of Directors to ensure overall compliance with the obligations imposed under Chapter IV of the PML Act and the Rules.

Know Your Customer (KYC):

Identifier means the unique number or code assigned to a customer by the Central KYC Records Registry.

Officially Valid Document (OVD):

Officially Valid Document means the passport, the driving license, proof of possession of Aadhaar number, the Voter's Identity Card issued by the Election Commission of India, job card issued by NREGA duly signed by an officer of the State Government and letter issued by the National Population Register containing details of name and address.

Provided that,

    a. where the customer submits his proof of possession of Aadhaar number as an OVD, he may submit it in such form as are issued by the Unique Identification Authority of India

    b. where the OVD furnished by the customer does not have updated address, the following documents or the equivalent e-documents thereof shall be deemed to be OVDs for the limited purpose of proof of address:

        • utility bill which is not more than two months old of any service provider (electricity, telephone, post-paid mobile phone, piped gas, water bill);

        • property or Municipal tax receipt;

        • pension or family pension payment orders (PPOs) issued to retired employees by Government Departments or Public Sector Undertakings, if they contain the address;

        • letter of allotment of accommodation from employer issued by State Government or Central Government Departments, statutory or regulatory bodies, public sector undertakings, scheduled commercial banks, financial institutions and listed companies and leave and licence agreements with such employers allotting official accommodation.

    c. the customer shall submit OVD with current address within a period of three months of submitting the documents specified at 'b' above

    d. where the OVD presented by a foreign national does not contain the details of address, in such case the documents issued by the Government departments of foreign jurisdictions and letter issued by the Foreign Embassy or Mission in India shall be accepted as proof of address.

Explanation: For the purpose of this clause, a document shall be deemed to be an OVD even if there is a change in the name subsequent to its issuance provided it is supported by a marriage certificate issued by the State Government or Gazette notification, indicating such a change of name.

Principal Officer:

It means an officer nominated by the Company, responsible for furnishing information as per rule 8 of the Rules.

"Person" for the purposes of this policy shall include:

    • An Individual

    • A Hindu Undivided Family

    • A Company

    • A Firm

    • An Association of Persons / Body of Individuals, whether incorporated or not

    • Every artificial juridical person, not falling within any one of the above persons

    • Any agency / Office / Branch owned / controlled by any of the persons above

"Politically Exposed Persons (PEPs)" means individuals who are or have been entrusted with prominent public functions by a foreign country, including the Heads of States/Governments, senior politicians, senior government or judicial or military officers, senior executives of state-owned corporations and important political party officials.

"Transaction" means a purchase, sale, loan, pledge, gift, transfer, delivery or the arrangement thereof and includes:

    • opening of an account;

    • deposit, withdrawal, exchange or transfer of funds in whatever currency, whether in cash or by cheque, payment order or other instruments or by electronic or other non-physical means;

    • the use of a safety deposit box or any other form of safe deposit;

    • entering into any fiduciary relationship;

    • any payment made or received, in whole or in part, for any contractual or other legal obligation; or

    • establishing or creating a legal person or legal arrangement.

Note: Terms used under this policy and not defined hereunder shall have the same meaning as assigned to them under the Master Direction - Know Your Customer (KYC) Direction, 2025, the Banking Regulation Act, 1949, the Reserve Bank of India Act, 1935, the Prevention of Money Laundering Act, 2002, Prevention of Money Laundering (Maintenance of Records) Rules, 2005, the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and any other relevant act as may be prescribed.

5. Governance Structure:

Board of Director:

    a. The Board approves the company's KYC/AML policy, ensuring it aligns with RBI's guidelines and addresses all regulatory requirements.

    b. It ensures effective implementation of the KYC/AML policy by overseeing the activities of the KYC Compliance Officer and staff.

    c. The Board ensures a Risk-Based Approach is adopted, categorising customers by risk and applying appropriate due diligence based on these classifications.

    d. The Board regularly reviews the KYC/AML program, ensuring its effectiveness and compliance with evolving legal and regulatory standards.

    e. It ensures that suspicious transactions are identified, investigated, and reported to the relevant authorities in accordance with regulatory requirements.

    f. The Board oversees the KYC/AML process to ensure that controls are effective and compliance is maintained

    g. The board oversees the assessment of ML / TF risk faced by the company, atleast on an annual basis.

Designated Director:

    a. The Company shall appoint a Whole Time Director / Managing Director of the Company, as the Designated Director to ensure overall compliance with the obligations imposed under Chapter IV of the PML Act and the Rules, as nominated by the Board of Directors.

    b. The company shall ensure that the Designated Director of the company will not be the same as the Principal Officer of the Company.

    c. Any change in the Designated Director or their communication details shall be effected on the FINGATE portal by the Company at earliest. Such changes are also to be intimated to Reserve Bank of India via Letter / Email.

Principal Officer:

    a. The Principal Officer shall be responsible for ensuring compliance, monitoring transactions, and sharing and reporting information as required under the law/regulations.

    b. The name, designation and address of the Principal Officer shall be communicated to the FIU-IND at earliest.

    c.Further, the change in name, designation, address and contact details of the Principal Officer shall be communicated to RBI as well.

6. Responsibility of KYC Procedure:

    • Principal Officer shall be responsible for obtaining and maintaining all KYC records from the borrowers and ensure the overview of the KYC Compliance. The Board of Directors shall be reported in the form of a report on a quarterly basis about the status of KYC compliance in accordance with this policy by the board of directors.

    • Additionally, officers who are members of Company's core management team including functional heads shall be responsible to implement the policy at ground level and ensure compliance with regulatory guidance.

7. Money Laundering and Terrorist Financing Risk Assessment:

The company is required to conduct a periodic Money Laundering (ML) and Terrorist Financing (TF) risk assessment to identify and mitigate risks associated with clients, countries, products, services, and transactions. This assessment must be thorough, considering relevant risk factors and sector-specific vulnerabilities. The process should be properly documented and reviewed by the Board or its delegated committee. The outcome of the assessment must be available to regulatory authorities and self-regulating bodies for transparency and compliance.

    • Periodic Risk Assessment: The company must at least on an annual basis conduct an assessment to identify, assess, and mitigate risks related to money laundering and terrorist financing. This includes considering factors such as clients, products, services, transactions, and delivery channels.

    • Consideration of Relevant Risk Factors: The company must assess all relevant risk factors, including sector-specific vulnerabilities that may be shared by the regulator. The level of risk must guide the appropriate mitigation measures.

    • Proper Documentation: The risk assessment process results should be documented. The documentation must be commensurate with the company's size, geographical presence, complexity, and activities.

    • Board Oversight: The risk assessment outcome should be reviewed by the Board or a committee designated by the Board.

    • Availability to Authorities: The outcome of the risk assessment should be accessible to competent authorities and self-regulating bodies. This ensures transparency and accountability in mitigating ML and TF risks.

    • Alignment with Regulatory Guidelines: The company should ensure that the risk assessment and its mitigation measures are in line with any guidance provided by regulators or supervisors.

    • The company shall apply a Risk-Based Approach (RBA) for mitigation and management of the ML / TF risks and should have appropriate controls and procedures in this regard. Further, companies shall monitor the implementation of the controls and enhance them if necessary.

8. PMLA Framework & Training:

The Company shall place adequate mechanism at each stage of the lending operation from sanction, disbursement to collection, for ensuring identification of transactions Money Laundering Transactions and flow of laundered money into the system.

An updated detailed Standard Operating Procedure and checklist of ML / TF precautions has been formulated by the Operations Head and approved by the Board of Directors. The documents shall ensure timely escalation and consistent checks across organisation to the concerned personnel.

Appropriate and timely training sessions shall be held for all the employees of the company engaged in the lending operations, primarily those dealing with customer (including credit appraisal, document collection, etc.) or are responsible for setting instructions for the rule engine of the application, to ensure updated knowledge of the subject matter and effective adherence with the internal policies and framework

9. Key Elements for KYC framework:

The Company has framed its KYC framework incorporating the following five key elements:

    • Customer Acceptance Policy;

    • Customer Identification Procedures;

    • Customer Due Diligence

    • Monitoring of Transactions; and

    • Risk management

The Company shall ensure that any of the above elements may be outsourced as permitted by the Reserve Bank of India in the KYC Master Directions from time to time. Therefore, the company may obtain necessary documents and tech support from vendors ultimate decision for KYC shall be with the company or rule engines developed by it.

It is essential to highlight the key elements of KYC to guide the company and its employees towards ensuring compliance with policy (internally / externally).

Customer Acceptance Policy;

This element portrays the initial level screening of the customers/prospective customers of the company. The Company shall ensure, while dealing with the customers/prospective customers, that:

    • No account is opened in anonymous or fictitious/benami name.

    • No account is opened where the company is unable to apply appropriate CDD measures, either due to non-cooperation of the customer or non-reliability of the documents/information furnished by the customer. The company shall consider filing an STR, if necessary, when it is unable to comply with the relevant CDD measures in relation to the customer.

    • No transaction or account-based relationship is undertaken without following the CDD procedure.

    • The mandatory information to be sought for KYC purpose while opening an account and during the periodic updation, is specified.

    • Additional information, where such information requirement has not been specified in the internal KYC Policy of the company, is obtained with the explicit consent of the customer.

    • The companies shall apply the CDD procedure at the UCIC level. Thus, if an existing KYC compliant customer of a company desire to open another account or avail any other product or service from the same company, there shall be no need for a fresh CDD exercise as far as identification of the customer is concerned.

    • CDD Procedure is followed for all the joint account holders, while opening a joint account.

    • Circumstances in which, a customer is permitted to act on behalf of another person/entity, is clearly spelt out.

    • Suitable system is put in place to ensure that the identity of the customer does not match with any person or entity, whose name appears in the sanctions lists circulated by Reserve Bank of India.

    • Where Permanent Account Number (PAN) is obtained, the same shall be verified from the verification facility of the issuing authority.

    • Where an equivalent e-document is obtained from the customer, the company shall verify the digital signature as per the provisions of the Information Technology Act, 2000 (21 of 2000).

    • Where Goods and Services Tax (GST) details are available, the GST number shall be verified from the search/verification facility of the issuing authority.

    • The company shall not allow opening and/or holding of an account on behalf of customer/s by professional intermediaries, like lawyers and Chartered accountant, etc. who are unable to disclose true identity of the owner of the account/funds due to any professional obligation of customer confidentiality. Further any professional intermediary who is under any obligation that inhibits the company's ability to know and verify the true identity of the customer on whose behalf the account is held or beneficial ownership of the account or understand true nature and purpose of transaction/s, should not be allowed to open an account on behalf of a customer

    • The company shall not deny of banking/financial facility to members of the general public, especially those, who are financially or socially disadvantaged, including the Persons with Disabilities (PwDs).

    • Where the Company forms a suspicion of money laundering or terrorist financing, and it reasonably believes that performing the CDD process will tip-off the customer, it shall not pursue the CDD process, and instead file an STR with FIU-IND as described later in this policy.

Customer Identification Procedures

The company shall undertake Customer Identification Procedure for any of the below cases:

    • Commencement of an account-based relationship with the customer.

    • Carrying out any international money transfer operations for a person who is not an account holder of the company.

    • When there is a doubt about the authenticity or adequacy of the customer identification data it has obtained.

    • Selling third party products as agents, selling their own products, payment of dues of credit cards/sale and reloading of prepaid/travel cards and any other product for more than rupees fifty thousand.

    • Carrying out transactions for a non-account-based customer, that is a walk-in customer, where the amount involved is equal to or exceeds rupees fifty thousand, whether conducted as a single transaction or several transactions that appear to be connected.

    • When the company has reason to believe that a customer (account- based or walk-in) is intentionally structuring a transaction into a series of transactions below the threshold of rupees fifty thousand.

The company shall ensure that introduction is not to be sought while opening accounts.

The Company shall obtain information stated below in Annexure A necessary to establish the identity of each new customer/prospective customer, whether regular or occasional and the purpose of the intended nature of relationship, to the satisfaction of the company and regulatory authorities like RBI that the identification was conducted based on the risk profile and the nature and constitution of the customer/prospective customer in compliance with the extant guidelines in place.

Customer Due Diligence Procedure ("CDD")

The Customer Due Diligence Team or the Credit Appraisal Team must strictly follow the procedures outlined below. The due diligence conducted during this process will determine the type, duration, and amount of the credit facility to be granted. Customers can choose from the following CDD options based on the documents they possess and as permitted by regulatory guidelines.

Offline Verification

The company undertaking Customer Due Diligence procedure through offline verification shall embed the following functions in its operations

    • Obtain the necessary documents from the customer when establishing an account-based relationship or processing requests from beneficial owners, authorized signatories, or power of attorney holders. The documentation that shall be obtained from the customer are enclosed in Annexure A

    • Collect additional documents, if required, to verify the customer's business nature and financial standing.

    • Maintain strict confidentiality of all information and documents collected during the CDD process. Customer information must not be used for purposes like cross-selling without the customer's explicit consent.

    • Allow customers to submit scanned copies of required documents via the company's website, app, or email for initial verification. Ensure that original or certified copies are collected later as per a pre-scheduled arrangement.

    • Adhere to all relevant regulatory requirements and procedures as stipulated in the RBI's KYC Directions, 2025. Ensure that all verification processes align with the latest regulatory updates and compliance requirements.

    • Maintain accurate records of the documents collected and verification steps undertaken. These records should be readily available for review by regulatory authorities.

Aadhaar OTP based e-KYC, non-face-to-face mode

The company may provide credit facilities in non-face-to-face mode, subject to fulfilment of following conditions:

    • There must be a specific consent from the customer for authentication through OTP.

    • As a risk-mitigating measure for such accounts, the company shall ensure that transaction alerts, OTP, etc., are sent only to the mobile number of the customer registered with Aadhaar.

    • The company shall have a board approved policy delineating a robust process of due diligence for dealing with requests for change of mobile number in such accounts.

    • The aggregate balance of all the deposit accounts of the customer shall not exceed rupees one lakh. In case, the balance exceeds the threshold, the account shall cease to be operational, till CDD as mentioned at (vi) below is complete

    • The aggregate of all credits in a financial year, in all the deposit accounts taken together, shall not exceed rupees two lakh.

    • As regards borrowal accounts, only term loans shall be sanctioned. The aggregate amount of term loans sanctioned shall not exceed rupees sixty thousand in a year.

    • Accounts, both deposit and borrowal, opened using OTP based e-KYC shall not be allowed for more than one year unless identification as per paragraph 23 or as per paragraph 26 and 27 (V-CIP) of the KYC Directions is carried out. If Aadhaar details are used under paragraph 26 and 27, the complete KYC process shall be followed in its entirety including fresh Aadhaar OTP authentication.

    • If the CDD procedure as mentioned above is not completed within a year, in respect of deposit accounts, the same shall be closed immediately. In respect of borrowal accounts no further debits shall be allowed.

A declaration shall be obtained from the customer to the effect that no other account has been opened nor will be opened using OTP based KYC in nonface-to-face mode with any other the company. Further, while uploading KYC information to CKYCR, the company shall clearly indicate that such accounts are opened using OTP based e-KYC and other REs shall not open accounts based on the KYC information of accounts opened with OTP based e-KYC procedure in non-faceto-face mode.

The company shall have strict monitoring procedures including systems to generate alerts in case of any non-compliance/violation.

Simplified procedure for opening accounts:

In case a person who desires to open an account (including availing credit facilities) is not able to produce documents, as specified in Annexure A, the company's may at their discretion open accounts / grant credit facility subject to the following conditions:

    • The company shall obtain a self-attested photograph from the customer.

    • The designated officer of the company certifies under his signature that the person opening the account has affixed his signature or thumb impression in his presence.

    • The account shall remain operational initially for a period of twelve months, within which CDD shall be carried out.

    • Balances in all their accounts taken together shall not exceed rupees fifty thousand at any point of time.

    • The total credit in all the accounts taken together shall not exceed rupees one lakh in a year.

    • The customer shall be made aware that no further transactions will be permitted until the full KYC procedure is completed in case Directions (4) and (5) above are breached by him.

    • The customer shall be notified when the balance reaches rupees forty thousand or the total credit in a year reaches rupees eighty thousand that appropriate documents for conducting the KYC must be submitted otherwise the operations in the account shall be stopped when the total balance in all the accounts taken together exceeds the limits prescribed in direction (4) and (5) above.

    • The account shall be monitored and when there is suspicion of ML/TF activities or other high-risk scenarios, the identity of the customer shall be established.

Digital KYC

The company shall conduct Digital KYC of customer, with regard to regulatory requirements and the internal process developed/ updated from time to time, as below:

    • The Company in the current application has developed a module for digital KYC process to be conducted at customer touch points for undertaking KYC of their customers and the KYC process shall be undertaken only through this authenticated application of the Company.

    • The access of the Application shall be restricted and it should be ensured that the same is not used by unauthorized persons. The application shall be accessed only through Log-in ID and Password or Live OTP or Time OTP controlled mechanism given by the Company to its authorized officials.

    • The customer, for the purpose of KYC, shall visit the location of the authorized official of the Company or vice-versa. The original OVD shall be in possession of the customer.

    • The official shall ensure that the Live Photograph of the customer is taken by the authorized officer and the same photograph is embedded in the customer application form ("CAF"). Further, the system application shall put a watermark in readable form having CAF numbers, GPS Coordinates, authorized official name, unique employee code, and Date (DD:MM: YYYY) and time stamp (HH:MM: SS) on the live captured photograph of the customer.

    • The Application shall enable only live photograph of the customer is captured and make sure that no printed or video-graphed photograph of the customer is captured. The background behind the customer while capturing live photograph should be of white colour and the photo shall be clean with no other person coming into the frame while capturing the live photograph of the customer.

    • The live photograph of the original officially valid document or proof of possession of Aadhaar where offline verification is not carried out, shall be captured as per the RBI guidance i.e., in vertical manner and water-marking in readable form shall be done on the documents. The application shall not accept any pictures with skew or tilt in the mobile device shall be there while capturing the live photograph of the original documents.

    • The live photograph of the customer and his original documents shall be captured in proper light so that they are clearly readable and identifiable.

    • Thereafter, all the entries in the CAF shall be filled as per the documents and information furnished by the customer. In those documents where Quick Response (QR) code is available, such as Aadhar/E-Aadhar the details can be auto-populated by scanning the QR code instead of manual filing the details.

    • Once the above-mentioned process is completed, a One Time Password ("OTP") message containing the text that 'Please verify the details filled in form before sharing OTP' shall be sent to customer's own mobile number.

    • Upon successful validation of the OTP, it will be treated as customer signature on CAF. However, if the customer does not have his/her own mobile number, then mobile number of his/her family/relatives/known persons may be used for this purpose and be clearly mentioned in CAF. In any case, the mobile number of authorized officers registered with the Company shall not be used for customer signature. The Company must check that the mobile number used in customer signature shall not be the mobile number of the authorized officer.

    • The authorized officer shall provide a declaration about the capturing of the live photograph of customer and the original document. For this purpose, the authorized official shall be verified with One Time Password which will be sent to his mobile number registered with the Company. Upon successful OTP validation, it shall be treated as authorized officer's signature on the declaration. The live photograph of the authorized official shall also be captured in this authorized officer's declaration.

    • Subsequent to all these activities, the Application shall give information about the completion of the process and submission of activation request to the authorized officer of the Company, and also generate the transaction-id/reference-id number of the process. The authorized officer shall intimate the details regarding transaction-id/reference-id number to customer for future reference.

    • The authorized officer of the Company shall check and verify that the information available in the picture of a document/e- is matching with the information entered by authorized officer in CAF, and that the live photograph of the customer matches with the photo available in the document.; and all of the necessary details in CAF including mandatory field are filled properly.

    • On Successful verification, the CAF shall be digitally signed by authorized representative of the Company who will take a print of CAF, get signatures/thumb-impression of customer at appropriate place, then scan and upload the same in system. Original hard copy may be returned to the customer.

The Process flow stated above shall be formulized in a SOP for the company personnel to adhere to defined steps

Monitoring of Transaction

The company will implement a risk-based approach to transaction monitoring, ensuring that the level of oversight corresponds with the risk profile of each account. Routine monitoring will focus on understanding the customer's typical activity patterns, enabling the identification of transactions that deviate from the norm. For higher-risk accounts, enhanced monitoring measures will be applied, including the use of specific indicators such as large cash deposits, depleting assets, or missed repayments. The company will set clear threshold limits for different risk categories (high, medium, and low) based on factors such as loan quantum, tenure, and customer profile.

Special attention will be directed toward complex, unusually large, or suspicious transactions that lack an apparent lawful purpose. Any transactions that exceed the prescribed limits or exhibit unusual patterns will be flagged and escalated to the Head of Operations and the Risk Management Committee for review. Additionally, the company will remain vigilant against money laundering threats posed by new technologies and ensure that all remittances are processed through legitimate banking channels. Transactions found to be inconsistent with the customer's expected behavior will be promptly reported and investigated to mitigate risks effectively.

Risk Management

The company shall develop and adhere an internally developed Risk Categorization Matrix which shall be approved by the board. Risk Mechanism shall be always internal to the organization and shall not be outsourced at any point in time as it involves determination of the risk appetite and decision on the credit facilities to be extended.

Risk Categorisation will have a maker-checker concept to reduce chances of collusion by the official of the company. The checkers shall be high experience individuals or Head of the Operations with periodic presentation to the RMC.

The Risk categorization shall at all times be based on parameters such as:

    • customer's identity and constitution,

    • social/financial status,

    • nature of business activity, and

    • information about the customer's business and their location etc.

While considering customer's identity, the ability to confirm identity documents through online or other services offered by issuing authorities shall also be factored in. Further, a Risk Report in the form of a Risk Matrix indicating the quantum, risk factor, etc. shall be provided to the board of directors.

The Company has formulated an indicative list of customers and their respective risk categories illustrated in Annexure B

10. Enhanced Due-Diligence:

Enhanced Due Diligence (EDD) for non-face-to-face customer onboarding:

Non-face-to-face onboarding facilitates the company to establish relationship with the customer without meeting the customer physically or through V-CIP. Such non-face-to-face modes for the purpose of this paragraph includes use of digital channels such as CKYCR, DigiLocker, equivalent e-document, etc., and nondigital modes such as obtaining copy of OVD certified by additional certifying authorities as allowed for NRIs and PIOs.

Following EDD measures shall be undertaken by the company for non-face-to-face customer onboarding (other than customer onboarding through OTP based E-KYC):

    • The company has introduced the process of V-CIP and the same shall be provided as the first option to the customer for remote onboarding.

    • The company understands that processes complying with prescribed standards and procedures for V-CIP shall be treated on par with face-to-face CIP for the purpose of this Master Direction

    • In order to prevent frauds, alternate mobile numbers shall not be linked post CDD with such accounts for transaction OTP, transaction updates, etc. Transactions shall be permitted only from the mobile number used for account opening.

    • The company shall have a robust process of due diligence for dealing with requests for change of registered mobile number. If the customer is not able to adhere to the process, the customer shall restart its KYC journey.

    • Apart from obtaining the current address proof, the company shall verify the current address through positive confirmation before allowing operations in the account. Positive confirmation may be carried out by means such as address verification letter, contact point verification, deliverables, etc

    • The company shall obtain PAN from the customer and the PAN shall be verified from the verification facility of the issuing authority

    • Such customers shall be categorized as high-risk customers and accounts opened in non-face to face mode shall be subjected to enhanced monitoring until the identity of the customer is verified in face-to-face manner or through V-CIP.

Accounts of Politically Exposed Persons (PEPs)

The Company generally does not establish any relationship with PEPs but it shall have the option of establishing a relationship with PEPs, the Company shall comply with RBI regulations. Any sanction to a Politically Exposed Person shall be pre-authorized by the Board of Directors of the Company.

Customer accounts via intermediaries

The Company shall ensure while opening customer accounts through professional intermediaries, that Customers shall be identified when customer account is opened by a professional intermediary.

The Company shall not open accounts of such professional intermediaries who are bound by any customer confidentiality that prohibits disclosure of the customer details to the Company.

The Company shall, at its discretion, rely on the 'customer due diligence' (CDD) done by an intermediary, provided that the intermediary is a regulated and supervised entity and has adequate systems in place to comply with the KYC requirements of the customers. The ultimate responsibility for knowing the customer and decision of opening the account lies with the Company.

The Company shall ensure that the latest best practices and standards prescribed on Outsourcing / Digital Lending are complied with.

Third-party Customer Due Diligence

For the purpose of verifying the identity of customers at the time of commencement of an account-based relationship, the company shall rely on customer due diligence done by a third party, subject to the following conditions:

    • Records or the information of the customer due diligence carried out by the third party is obtained immediately from the third party or from the central KYC records registry.

    • Adequate steps are taken by bank to satisfy itself that copies of identification data and other relevant documentation relating to the customer due diligence requirements shall be made available from the third party upon request without delay.

    • The third party is regulated, supervised or monitored for, and has measures in place for, compliance with customer due diligence and record keeping requirements in line with the requirements and obligations under the PML Act.

    • The third party shall not be based in a country or jurisdiction assessed as high risk.

    • The ultimate responsibility for customer due diligence and undertaking enhanced due diligence measures, as applicable will be with the bank.

11. Record Management:

Effective record management is crucial for ensuring compliance with the provisions of the PML Act and associated rules. The company shall maintain comprehensive records of customer transactions and identification details to facilitate transparency and meet regulatory requirements. These records must be securely stored, readily accessible, and preserved for the stipulated period, enabling timely retrieval for audits or investigations by competent authorities.

    • Maintain all records of customer transactions, both domestic and international, for a minimum of five years from the transaction date.

    • Preserve identification and address records collected during account opening and the business relationship for at least five years after the relationship ends.

    • Ensure that identification records and transaction data are swiftly accessible to competent authorities upon request.

    • Keep detailed records of transactions as prescribed under Rule 3 of the PML Rules, 2005.

    • Maintain transaction details to allow for reconstruction of individual transactions, including:

        a. Nature of the transaction

        b. Transaction amount and currency

        c. Date of the transaction

        d. Parties involved in the transaction

    • Implement a system for easy retrieval of account information when needed or requested by authorities.

    • Maintain customer identity and address records, as well as transaction records, in either hard or soft format.

    • For non-profit organisations, ensure details are registered on the DARPAN Portal of NITI Aayog and keep these records for five years after the business relationship ends or the account is closed.

12. On – Going Due Diligence:

The Company shall undertake on-going due diligence of customers to ensure that the transactions are consistent with the knowledge about the customers, customers' business and risk profile; and the source of funds.

The extent of monitoring shall be aligned with the risk category of the customer.

A system of periodic review of risk categorization of accounts, with such periodicity being at least once in six months, and the need for applying enhanced due diligence measures shall be done.

The transactions in accounts of marketing firms, especially accounts of Multi-level Marketing (MLM) Companies shall be closely monitored.

13. Periodic Updation:

Periodic updation of KYC documents needs to be done for following type of customers:

    • High Risk - at least once in every two years

    • Medium Risk - once in every eight years

    • Low Risk - once in every ten years

Individual Customers

    • No change in KYC information: In case of no change in the KYC information, a self-declaration in the format prescribed by the company shall be obtained over physical/digital modes of communication including customer's email-id registered with the Company, customer's mobile number registered with the Company, digital channels (such as online platform, mobile application of the Company), letter etc.

    • Change in address: In case of a change only in the address details of the customer, a self-declaration of the new address shall be obtained from the customer through modes prescribed above. The declared address may be verified, if required for high risk/medium risk customers, through positive confirmation within two months, by means such as address verification letter, contact point verification, deliverables etc. A copy of OVD or deemed OVD or the equivalent e-documents thereof for the purpose of proof of address, declared by the customer shall be obtained by the company at the time of periodic updation.

    • Accounts of customers, who were minor at the time of opening account, on their becoming major: In case of customers for whom account was opened when they were minor, fresh photographs shall be obtained on their becoming a major and at that time it shall be ensured that CDD documents as per the current CDD standards are available with the company. Wherever required, company may carry out fresh KYC of such customers i.e., customers for whom account was opened when they were minor, on their becoming a major.

Customer other than Individual

    • No change in KYC information: In case of no change in the KYC information of the non-Individual customer, a self-declaration in the format prescribed by the company, shall be obtained from the authorized representatives of such customer over physical or digital modes of communication including email id registered with the Company, digital channels (such as online platform, mobile application of the Company), letter from an official authorized by the Borrower in this regard, board resolution etc. Further, the Company shall ensure during this process that Beneficial Ownership (BO) information available with them is accurate and shall update the same, if required, to keep it as up-to-date as possible.

    • Change in KYC information: In case of change in KYC information, the Company shall undertake the KYC process equivalent to that applicable for on-boarding a new customer.

General Measures

The Company shall ensure that:

    • The KYC documents of the customer are as per the current CDD standards. Irrespective of the accuracy of the information, in case the document produced is not as per CDD standards, the company shall obtain alternate documents or intimate the customer to submit the document in the desired format.

    • Further, in case the validity of the CDD documents available with the Company has expired at the time of periodic updation of KYC, the Company shall undertake the KYC process equivalent to that applicable for on-boarding a new customer.

    • The company shall ensure that the customer's PAN details, if available within the company, then it is to be verified from the database of the issuing authority at the time of periodic updation of KYC.

    • Acknowledgment is provided to the customer mentioning the date of receipt of the relevant document(s), including self-declaration from the customer, for carrying out updation/ periodic updation. Further, it shall be ensured that the information / documents obtained from the customers at the time of updation/ periodic updation of KYC are promptly updated in the records / database of the company and an intimation, mentioning the date of updation of KYC details, is provided to the customer.

Due Notice for the Periodic Updation of KYC

The Company shall intimate its customers in advance regarding the requirement to update their KYC details. Prior to the due date of periodic KYC updation, the Company shall issue at least three advance intimations, including at least one intimation by letter, at appropriate intervals through available communication channels. In cases where customers fail to update their KYC within the stipulated time, the Company shall send at least three reminders, including at least one reminder by letter, after the due date.

Each intimation or reminder shall contain clear instructions for updating KYC, details of the escalation mechanism for customer assistance, and information on possible consequences of non-compliance. All such communications shall be duly recorded in the Company's system against each customer to maintain a proper audit trail.

14. Requirements/obligations under International Agreements Communications from International Agencies:

The Company shall ensure that in terms of Section 51A of the Unlawful Activities (Prevention) (UAPA) Act, 1967, it does not have any account in the name of individuals/entities appearing in the lists of individuals and entities, suspected of having terrorist links, which are approved by and periodically circulated by the United Nations Security Council (UNSC).

Details of accounts resembling any of the individuals/entities in the lists shall be reported to FIU-IND apart from advising Ministry of Home Affairs.

15. Reporting to Regulatory Authorities:

Central KYC Records Registry (CKYCR)

The Company shall register itself on the Central Know Your Customer Records Registry ["CKYCR"] maintained by the Central Registry of Securitisation. The Company shall ensure that the KYC data is regularly shared / verified from the CKYCR.

The Company shall nominate officers for the purpose of holding the roles of User Administrators for the Company on the CKYCR platform. The compliance officers/other officers so appointed shall function as maker and checker. Further, a structured SOP shall be formulated and approved by the board in order to smoothly upload the KYC documents of the customers post verifying the accuracy of the information collected therewith.

Government of India has authorized the Central Registry of Securitization Asset Reconstruction and Security Interest of India (CERSAI), to act as, and to perform the functions of the CKYCR vide Gazette Notification No. S.O. 3183(E) dated November 26, 2015.

Financial Intelligence Unit – India and registration with FINGATE Portal

The company shall furnish the details of the transaction to the director, as per the rule 7 of the The PML (Maintenance of Records) Rules, 2005, on the Financial Intelligence Unit – India (FIU-Ind) bearing the information referred in rule 3.

Hence, the company shall subject all the transactions to scrutiny, in order to identify suspicious transactions, considering the illustrative list of Suspicious Transactions laid down in Annexure C.

The transactions detected shall then be reported to the Director, Financial Intelligence Unit India (FIU-Ind) as advised in terms of the PML Rules, in the prescribed formats as designed and instructed by RBI in the KYC Directions. The reporting shall be made as per the reporting formats and comprehensive reporting formatting guide prescribed/released by FIU-IND; extracted through the Report Generation Utility and Report Validation Utility developed to assist Company in preparation of prescribed reports.

The company has developed Robust software, throwing alerts when the transactions are inconsistent with risk categorization and updated profile of the customers shall be put in to use as a part of effective identification and reporting of suspicious transactions.

In addition, the Company shall register on the FINGATE portal, along with undertaking registration of the Principal Officer. The reports shall be filed by the Company online only. Any change in the Principal Officer shall be affected on the FINGATE portal by the Company within one month of the date of such change. Such changes are also to be intimated to Reserve Bank of India via Letter / Email as well as on the XBRL reporting platform.

16. KYC in case of Top – Up / Renewal:

In case of Top-up/Renewals, where KYC documents collected are not more than 12 months old, the Company will not strive to collect new KYC documents provided that there is no change in shareholding structure/partnership arrangement, change in authorised signatory of company/firm. In case of change, KYC documents of new beneficial owners/applicants/co-applicants/guarantors to be collected.

In case of change in address, new address proof to be collected and the Company employee be empanelled person will visit the current address.

17. Documents in Vernacular Language:

In case of any documents submitted/signed by the applicant/guarantor in vernacular language, the Document certifying the Company official should satisfy about the contents of the document submitted and certify the contents in the document by affixing the stamp on the face of the document.

For cases where documents are sent by the customer from his/her email ID registered with the Company in application form, the documents would be considered as self-attested by the customer.

18. Closure of Business Relationship:

Where Company is unable to apply appropriate KYC measures due to non-furnishing of information and / or non-operation by the Customer, Company shall terminate Financing / Business Relationship after issuing due notice to the Customer explaining the reasons for taking such a decision. Such decision shall be taken with the approval of a Director and / or key managerial persons authorized for the purpose.

The Company shall ensure compliance with records maintenance parameters on closure / termination of account / business relationship with a customer.

19. Customer Education:

Company shall educate Customers on the objectives of the KYC policy so that Customer understands and appreciates the motive and purpose of collecting such information. The Company shall prepare specific literature / pamphlets, terms and conditions etc. so as to educate the Customer about the objectives of this policy.

20. Exception Handling:

The policy shall always be updated with extant regulatory provisions. However, in case of conflict between the Policy and regulations, the regulatory provisions shall always supersede the policy.

The updated policy shall be adhered at all the times and exceptions if any to the policy shall be approved by the board of directors after recording a reason in writing.

21. Adoption, Effective Date and Review:

This policy has been adopted vide resolution of the Board of Directors of the Company dated ______________. This policy shall be applicable organization wide with effect from _____________. This policy shall be reviewed by the Board of Directors on at least an Annual basis.