PPI & GIFT CARD REGULATORY COMPLIANCE POLICY

This Policy establishes the regulatory-compliance framework for REMPINDIA MULTITRADE PRIVATE LIMITED's gift-card and gift-voucher business operated through authorised PPI, bank, payment or other regulated partners. It is intended to ensure that the Company's activities remain within the role, responsibilities and permissions applicable to the Company and its partners.

REMPINDIA MULTITRADE PRIVATE LIMITED shall not describe itself as a PPI issuer, issuer of regulated stored-value instruments, bank or other regulated entity unless it holds the applicable authorisation. Where a gift card or voucher is issued, processed, funded, settled or otherwise regulated through an authorised partner, the Company's activities shall be performed in accordance with the partner agreement, applicable law and the partner's approved operating framework.

• Maintain a clear regulatory responsibility matrix between the Company and its authorised partners.
• Ensure products and customer journeys are reviewed before launch or material change.
• Prevent unauthorised representation of regulatory status.
• Maintain appropriate customer-protection, fraud, security, privacy and record-keeping controls.
• Support authorised PPI / bank / payment partners with information and operational cooperation.
• Monitor regulatory changes relevant to the Company's business model.

This Policy applies to gift cards, gift vouchers, digital voucher products, websites, applications, APIs, merchant relationships, payment flows, PPI/bank/payment integrations, customer support, marketing material, settlement processes and employees or vendors involved in the relevant services.

Compliance shall maintain a regulatory obligation register identifying requirements applicable to the Company's role and each partner-led product flow. The mapping should identify the responsible entity, source requirement, operational control, evidence and owner.

Where an authorised PPI issuer or other regulated partner performs regulated issuance or payment functions, the Company shall operate only within the agreed scope. Responsibilities for KYC, AML/CFT, transaction monitoring, issuance, redemption, settlement, refunds, grievances, unauthorised transactions, reporting and customer communications shall be documented between the parties.

1. Define the product and customer journey.
2. Identify whether any regulated activity is involved.
3. Identify the responsible PPI/bank/payment partner.
4. Complete legal, compliance, risk and security review.
5. Document applicable limits, restrictions, validity and customer terms.
6. Obtain required management and partner approvals before launch.

• Product terms shall be documented and made available to customers.
• Validity, redemption and usage restrictions shall be clearly stated.
• Product configuration shall be controlled.
• Issuance and redemption records shall be maintained.
• Material product changes shall undergo review.

Customer-facing information shall be accurate and not misleading. The Company shall provide appropriate information regarding purchase, activation, redemption, validity, restrictions, refunds, cancellation, disputes and support, consistent with the product and partner arrangements.

Where KYC, customer due diligence or AML/CFT obligations apply to the relevant activity, the Company shall follow the applicable partner process and its KYC & Customer Due Diligence Policy and AML/CFT Policy. The Company shall not bypass or weaken controls imposed by an authorised regulated partner.

The Company shall maintain risk-based fraud controls appropriate to its role, including monitoring of unusual voucher activity, repeated failed transactions, suspicious purchase patterns, account compromise, misuse, abnormal redemption and other relevant indicators.

Payment collection, settlement and reconciliation shall be conducted through approved channels and according to documented partner arrangements. Relevant controls are detailed in the Payment, Settlement & Reconciliation Policy.

Systems, APIs, customer information and transaction data shall be protected through appropriate security controls. Material cyber incidents shall be escalated under the Cyber Incident Response & Cyber Fraud Policy.

Personal and confidential information shall be collected, used, shared, retained and disposed of in accordance with applicable privacy requirements, partner arrangements and the Data Protection, Privacy & Retention Policy.

A documented grievance process shall be maintained. Where the authorised partner has primary responsibility for a regulated complaint, the Company shall promptly route and support the complaint according to the agreed process.

Reports of unauthorised transactions, account compromise or voucher misuse shall be recorded, investigated and coordinated with the relevant PPI, bank, payment or technology partner as applicable.

Vendors and service providers that affect regulated or customer-facing functions shall be subject to appropriate due diligence, contractual controls, information-security requirements and monitoring.

The Company shall maintain appropriate records and provide information required by authorised partners, regulators or competent authorities where applicable to its role. Regulatory reporting responsibility shall be clearly allocated in partner agreements.

Regulatory approvals, product assessments, partner agreements, customer terms, reports, incidents, complaints, transaction records and other relevant evidence shall be retained according to applicable legal, regulatory, contractual and business requirements.

• Marketing material shall accurately describe the Company's role.
• Marketing shall not state or imply that the Company itself is an authorised PPI issuer unless it holds such authorisation.
• References to regulated partners shall be accurate and approved where required.
• Product features, fees, validity and restrictions shall not be misrepresented.

Compliance shall monitor material changes in applicable laws, regulatory directions and partner requirements. Material changes shall be assessed for impact on products, contracts, customer journeys, technology and policies.

Material compliance, fraud, cyber, privacy, settlement or customer-protection incidents shall be escalated to management and relevant partners promptly. Reporting to authorities shall be handled where legally required or appropriate.

Relevant employees and contractors shall receive appropriate training or guidance on regulatory responsibilities, customer protection, fraud prevention, information security, privacy, reporting and escalation.

The Company may conduct periodic compliance reviews, partner reviews, control testing and audits appropriate to the business and risk profile. Material findings shall be documented and remediated.

Exceptions to this Policy shall be documented, risk-assessed and approved by authorised management. No exception may override mandatory legal, regulatory or contractual requirements.

This Policy shall be reviewed at least annually and whenever there is a material change in the Company's business model, product, PPI/bank/payment partner, technology, applicable law or regulatory requirements.