KYC & CUSTOMER DUE DILIGENCE POLICY

This Policy establishes a risk-based framework for customer identification, verification, due diligence, record management and escalation for activities performed by REMPINDIA MULTITRADE PRIVATE LIMITED in connection with its gift-card and gift-voucher business. The controls shall be applied according to the Company's role and the responsibilities allocated to its authorised PPI, bank or payment partners.

Where an authorised PPI issuer, bank or other regulated partner has primary responsibility for KYC, customer due diligence or regulated customer onboarding, REMPINDIA shall follow the partner-approved process and shall not bypass, weaken or contradict mandatory partner controls. REMPINDIA shall not represent itself as a regulated KYC entity or PPI issuer unless separately authorised.

• Establish appropriate customer identification and verification controls.
• Apply risk-based customer due diligence where applicable.
• Prevent misuse of gift-card/voucher services for fraud, money laundering or other unlawful purposes.
• Maintain appropriate customer records and audit trails.
• Identify and escalate unusual or higher-risk activity.
• Support authorised partners and competent authorities where legally required.

This Policy applies to customer onboarding, account creation, gift-card/voucher purchase or use where customer identification is required, business/customer relationships, partner-led onboarding, transaction-related verification, customer support and relevant third-party processes.

Where identification is required, the customer shall be identified using information and documents permitted by applicable law and the relevant authorised partner process. The information collected shall be proportionate to the product, transaction and risk.

• Use approved verification methods.
• Verify required customer information before providing services where applicable.
• Ensure verification results are appropriately recorded.
• Escalate failed or inconsistent verification.
• Do not knowingly proceed where required verification cannot be completed.

Customer due diligence shall be proportionate to the relevant risk. Risk factors may include transaction behaviour, product type, geographic considerations, customer profile, unusual usage, fraud indicators and partner-defined risk criteria.

Where a customer or transaction presents elevated risk, additional verification, information or review may be required by the authorised partner or applicable requirements. Higher-risk cases may be subject to restrictions, enhanced monitoring or escalation.

• Identity information where required
• Contact information
• Transaction-related information
• Information required by the authorised partner
• Risk or verification information where legally permitted and necessary

Where documents are collected, reasonable controls shall be used to identify incomplete, inconsistent, altered or suspicious documentation. Suspected document fraud shall be escalated under the Fraud Prevention & Transaction Monitoring Policy.

Where the business model involves corporate or merchant customers, appropriate legal-entity identification, ownership/control information and authorised-representative verification shall be performed according to applicable requirements and partner procedures.

Where applicable to the Company's role and partner process, customers or relevant parties shall be screened against applicable sanctions, restricted-party or other required lists. Potential matches shall be escalated for review and shall not be treated as confirmed matches without appropriate verification.

• Unusual transaction frequency or value
• Repeated failed verification
• Multiple accounts or identities showing common risk indicators
• Suspicious device, account or payment behaviour
• Unusual voucher purchase/redemption patterns
• Known or suspected fraud indicators
• Information inconsistencies

Where an ongoing customer relationship exists and ongoing due diligence is applicable, relevant customer information and activity shall be reviewed according to risk and partner requirements. Material changes or suspicious behaviour shall be escalated.

KYC/CDD controls shall operate together with fraud and transaction-monitoring controls. Verification information may be used, where lawful and necessary, to support risk assessment and investigation.

Where the authorised PPI issuer, bank or payment partner performs customer onboarding or verification, REMPINDIA shall provide required operational support and information in accordance with the agreement and applicable law.

Only information reasonably necessary for an applicable KYC/CDD purpose shall be collected. Customer information shall be protected under the Data Protection, Privacy & Retention Policy and shall not be disclosed except as authorised or legally required.

KYC/CDD records shall be retained for the applicable period required by law, regulation, partner requirements or legitimate business purposes. Records shall support traceability of verification decisions and escalations.

Where required verification cannot be completed, information is materially inconsistent, or applicable risk controls require restriction, the relevant service may be declined, suspended or escalated according to the applicable partner process and legal requirements.

Suspected identity fraud, account takeover, money laundering, terrorist financing or other unlawful activity shall be escalated through the relevant fraud, AML/CFT and incident-management processes.

Employees handling customer onboarding or verification shall follow approved procedures, protect customer information, avoid bypassing controls and promptly escalate suspected misuse or control failures.

Relevant personnel shall receive appropriate training on KYC/CDD procedures, privacy, fraud indicators, escalation and partner requirements.

Management may conduct periodic quality checks, sample reviews, control testing or partner assurance reviews to assess the effectiveness of KYC/CDD processes.

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory or partner requirements shall not be overridden.

This Policy shall be reviewed at least annually and whenever there is a material change in applicable law, partner requirements, product design, customer journey, technology or risk profile.