AML / CFT & KYC / CUSTOMER VERIFICATION POLICY

This Policy establishes the framework for customer identification, customer due diligence, risk assessment, transaction monitoring, suspicious-activity escalation, record keeping and financial-crime controls relevant to the Company's gift-card/gift-voucher business and its authorised regulated partners.

The Policy is intended to operate consistently with applicable Indian anti-money-laundering, counter-terrorist-financing, KYC, sanctions and payment/PPI requirements, as applicable to the Company's role and the relevant regulated partner. RBI's KYC framework includes customer acceptance, risk management, customer identification, customer due diligence, beneficial-owner identification and ongoing due diligence.

Where the Company's product or activity falls within a regulated PPI/payment arrangement, the applicable RBI directions and the Prevention of Money Laundering Act, 2002 and rules, as amended, shall be followed by the responsible regulated entity/issuer and the Company shall support its contractual and legal obligations. RBI's PPI framework has specifically addressed KYC/AML/CFT and PMLA applicability to PPI issuers.

• Prevent misuse of products and services for money laundering or terrorist financing.
• Identify and verify customers as required.
• Apply risk-based customer due diligence.
• Identify beneficial owners where applicable.
• Monitor transactions and suspicious patterns.
• Escalate and report concerns through authorised channels.
• Maintain appropriate records and audit trails.

This Policy applies to customers, merchants, relevant counterparties, agents/service providers and transactions within the Company's operational role, including gift-card/voucher issuance, purchase, activation, redemption, refunds and related payment activity.

• Customers shall be accepted only where required identification and risk controls can be satisfactorily completed.
• Anonymous or fictitious relationships shall not be knowingly maintained where prohibited.
• Customers presenting unacceptable financial-crime risk may be declined or restricted subject to applicable requirements.

Customer identification and verification shall be performed using documents, data, digital methods or partner-provided KYC information permitted under applicable requirements and the Company's role in the transaction.

• Identify the customer and verify identity where required.
• Understand the purpose and expected nature of the relationship or transaction.
• Assess customer risk.
• Obtain additional information where risk warrants enhanced due diligence.
• Maintain relevant KYC records.

For applicable business or legal-entity relationships, the Company or responsible regulated partner shall identify the legal entity and determine the beneficial owner(s) in accordance with applicable KYC requirements.

Customers and relevant relationships may be categorised as lower, standard or higher risk using factors including customer type, geography, product, transaction behaviour, delivery/redemption pattern, unusual activity, sanctions exposure and other relevant risk indicators.

• Obtain additional customer or beneficial-owner information where appropriate.
• Understand source of funds or purpose where required.
• Apply enhanced transaction monitoring.
• Require higher-level approval for higher-risk relationships where appropriate.
• Increase review frequency where warranted.

Simplified measures may be applied only where permitted by applicable law, regulation and partner requirements and where the assessed risk supports such treatment.

Customer information and transaction behaviour shall be reviewed on a risk-sensitive basis to identify material changes, inconsistencies or suspicious activity.

• Monitor transactions for unusual value, frequency, velocity or patterns.
• Identify repeated purchases, redemptions, refunds or transfers that may indicate misuse.
• Monitor rapid movement or redemption patterns where relevant.
• Use rules, alerts and manual review proportionate to risk.

• Unusual transaction volume or velocity
• Repeated transactions inconsistent with known activity
• Structuring or splitting activity designed to avoid controls
• Unusual refund or cancellation patterns
• Multiple accounts or instruments showing linked suspicious behaviour
• Identity inconsistencies or suspected document misuse
• Sanctions or adverse financial-crime indicators
• Patterns associated with fraud, mule activity or other suspicious conduct

Where applicable to the Company's role and partner arrangements, relevant customers, counterparties or transactions shall be screened against applicable sanctions or prohibited-party requirements. Potential matches shall be escalated for review before action is taken.

Where PEP identification is required under applicable KYC rules, the prescribed enhanced measures and approval/escalation procedures shall be followed.

Employees shall promptly escalate material suspicious activity to the designated Compliance/Principal Officer or MLRO-equivalent function. Employees shall not disclose confidential suspicious-activity investigations or filings to customers where prohibited.

Where the Company or its regulated partner has a legal reporting obligation, suspicious transaction reporting and other required regulatory filings shall be made by the designated responsible person/entity within applicable timelines and through prescribed channels.

AML/CFT controls shall operate alongside the Company's Fraud Prevention and Transaction Monitoring Policy. Financial-fraud indicators shall be shared internally on a need-to-know basis and escalated to relevant payment/PPI partners.

KYC records shall be maintained securely and retrievably for the period required by applicable law, regulation, partner requirements and the Company's Data Retention Policy.

Relevant customer identification, transaction, monitoring, alert, investigation, decision and reporting records shall be maintained with appropriate integrity and access controls.

AML/CFT and KYC information shall be accessed and shared only for legitimate purposes and protected according to applicable privacy, security and confidentiality requirements.

Where KYC or AML functions are performed by a regulated PPI issuer, bank or other authorised partner, the Company shall follow agreed responsibilities and provide required information and cooperation.

Relevant personnel shall receive periodic training on KYC, AML/CFT, sanctions, red flags, customer verification, suspicious-activity escalation, confidentiality and record keeping.

The effectiveness of AML/CFT and KYC controls shall be reviewed periodically based on risk, including through internal testing, compliance review or independent assurance where appropriate.

Management reporting may include customer-risk trends, KYC exceptions, monitoring alerts, suspicious cases, fraud linkages, sanctions alerts, training status, partner issues and remediation.

Employees and agents shall not knowingly assist in evasion of KYC/AML controls, falsify customer records, suppress legitimate alerts, disclose confidential suspicious-activity information improperly or bypass mandatory requirements.

Exceptions to this Policy shall be documented, risk-assessed and approved by authorised management and shall not override mandatory legal, regulatory or partner requirements.

This Policy shall be reviewed at least annually and whenever there is a material change in applicable AML/CFT or KYC requirements, product structure, PPI/payment arrangements, risk profile or regulatory expectations.