ANTI-MONEY LAUNDERING / COUNTER-TERRORIST FINANCING POLICY

This Policy establishes REMPINDIA MULTITRADE PRIVATE LIMITED's framework for identifying, assessing and mitigating money-laundering and terrorist-financing risks arising from its gift-card and gift-voucher business, to the extent applicable to the Company's role and contractual arrangements with authorised PPI, bank and payment partners.

The Company shall comply with AML/CFT obligations applicable to its activities. Where an authorised PPI issuer, bank or other regulated partner has primary responsibility for regulated AML/CFT controls, customer due diligence, monitoring or reporting, REMPINDIA shall support that partner and operate within the agreed framework. This Policy does not make REMPINDIA a regulated reporting entity where it does not otherwise have that status.

• Identify and assess AML/CFT risks relevant to the business.
• Apply appropriate customer and transaction controls.
• Prevent misuse of gift cards, vouchers and related services.
• Identify and escalate suspicious or unusual activity.
• Support authorised partners and competent authorities where required.
• Maintain appropriate records, confidentiality and audit trails.

This Policy applies to relevant customer, merchant, partner, payment, gift-card/voucher, transaction, refund, redemption, employee and third-party activities within the Company's role and risk profile.

Management shall provide oversight of AML/CFT risk. Compliance shall coordinate applicable requirements, risk assessments, partner obligations, escalation and periodic review.

The Company shall consider risks arising from products, customers, transactions, geography, delivery channels, payment methods, partners, technology and emerging fraud typologies. The risk assessment shall be reviewed periodically and when material changes occur.

Where KYC/CDD applies, customer identification and verification shall be performed according to applicable requirements and the authorised partner's approved process. Controls shall not be bypassed to complete a transaction.

Higher-risk customers, transactions or scenarios may require enhanced verification, additional information, increased monitoring, restrictions or escalation in accordance with applicable requirements.

Where applicable, relevant parties shall be screened against legally applicable sanctions or restricted-party lists. Potential matches shall be escalated for appropriate review and action.

• Monitor unusual transaction frequency or value.
• Identify repeated purchases or redemptions inconsistent with expected use.
• Review suspicious account or payment patterns.
• Identify rapid movement or redemption patterns where relevant.
• Monitor repeated failed verification or fraud indicators.
• Use risk-based rules, thresholds or alerts where appropriate.

• Unusual high-value or repeated purchases
• Multiple transactions linked to common identifiers or devices
• Rapid purchase and redemption patterns
• Unusual refund or cancellation behaviour
• Activity inconsistent with the stated customer profile
• Suspected account takeover or identity misuse
• Use associated with known fraud indicators

Potentially suspicious activity shall be documented and escalated to the designated Compliance/Risk function and, where relevant, the authorised PPI/bank/payment partner. The Company shall not make unauthorised disclosures to customers or third parties where such disclosure could compromise an investigation or violate applicable requirements.

Where the regulated partner is responsible for AML/CFT monitoring or reporting, REMPINDIA shall provide relevant information and cooperation within contractual and legal limits. Responsibilities shall be documented and periodically reviewed.

Fraud indicators and AML/CFT indicators may overlap. Material fraud cases shall be assessed for potential financial-crime implications and escalated through the appropriate fraud and AML processes.

Relevant KYC/CDD, transaction, monitoring, alert, investigation, escalation, partner communication and reporting records shall be retained for the applicable period under law, regulation, contract or legitimate business requirement.

AML/CFT investigations, alerts and related information shall be handled confidentially and shared only with authorised personnel, relevant partners or competent authorities as permitted or required.

Employees involved in customer, transaction, operations, compliance, fraud or partner activities shall receive appropriate AML/CFT awareness and escalation guidance.

Training shall be risk-based and may include suspicious transaction indicators, sanctions awareness, customer verification, fraud typologies, escalation procedures and confidentiality requirements.

The effectiveness of AML/CFT controls may be assessed through periodic management review, compliance testing, internal audit, partner assurance or other appropriate review mechanisms.

Material AML/CFT concerns, sanctions concerns, suspected financial crime, significant fraud patterns or control failures shall be escalated promptly to senior management and the relevant regulated partner.

The Company shall cooperate with lawful requests from competent authorities and authorised partners, subject to applicable legal process, confidentiality and data-protection requirements.

No employee or partner may override mandatory AML/CFT controls without lawful authority and documented approval where an exception is legally permissible. Any internal exception shall be risk-assessed and approved by authorised management.

Management reporting may include AML/CFT risk assessments, material alerts, investigation status, partner escalations, control issues, training completion and remediation actions, subject to confidentiality requirements.

This Policy shall be reviewed at least annually and whenever there is a material change in applicable law, regulatory requirements, product design, partner arrangements, transaction patterns or risk profile.