FINZOOPAY SOLUTIONS LLP

1. PURPOSE

This Policy establishes a risk-based framework for customer identification, verification, anti-money laundering, counter-terrorist financing, sanctions screening and related controls applicable to FINZOOPAY SOLUTIONS LLP to the extent relevant to its products, services, role and applicable legal or contractual obligations.

2. IMPORTANT APPLICABILITY

The exact AML, KYC, reporting and record-keeping obligations applicable to the Company depend on its legal status, products, payment flows, regulatory permissions, role in the transaction chain and applicable law. This Policy is an internal control framework and shall be read together with applicable legislation, regulatory directions, partner requirements and product-specific procedures.

3. OBJECTIVES

• Prevent misuse of the Company's services for money laundering, terrorist financing, fraud or other unlawful activity.
• Apply proportionate customer and transaction risk controls.
• Establish customer identification and verification procedures where applicable.
• Monitor unusual activity and escalate material concerns.
• Maintain appropriate records and audit trails.

4. SCOPE

This Policy applies to customer onboarding, account usage, relevant transactions, gift card/voucher activity, merchant or partner relationships and other activities where AML/KYC controls are legally, contractually or operationally applicable.

5. GOVERNANCE

Management shall designate appropriate responsibility for AML/KYC compliance and provide adequate resources, procedures, training and oversight proportionate to the Company's activities.

6. CUSTOMER IDENTIFICATION

Where KYC is required, the Company shall obtain appropriate identification information and documentation in accordance with applicable requirements and the Company's approved onboarding procedures.

7. CUSTOMER VERIFICATION

Customer information shall be verified using reliable and permitted methods appropriate to the risk and applicable requirements. Verification shall be completed before providing services where mandatory.

8. CUSTOMER RISK CLASSIFICATION

Where a risk-based KYC framework applies, customers may be classified according to relevant risk factors such as product use, transaction behaviour, geography, customer type, ownership or control information and other lawful risk indicators.

9. ENHANCED DUE DILIGENCE

Enhanced due diligence may be applied to higher-risk relationships or transactions, including additional information, verification, source-of-funds information or enhanced monitoring where legally or operationally appropriate.

10. SIMPLIFIED DUE DILIGENCE

Simplified measures may be applied only where permitted by applicable law and based on documented risk assessment. Simplification shall not be used where prohibited or where suspicious activity indicators are present.

11. BENEFICIAL OWNERSHIP

For applicable business or legal relationships, beneficial ownership and control information shall be identified and verified in accordance with applicable requirements.

12. POLITICALLY EXPOSED PERSONS

Where applicable, PEP-related relationships shall be handled using enhanced risk assessment, approval, monitoring and other measures required by applicable law or partner arrangements.

13. SANCTIONS SCREENING

Where required or appropriate, relevant customers, counterparties or transactions may be screened against applicable sanctions or restricted-party lists. Potential matches shall be investigated and escalated according to established procedures.

14. TRANSACTION MONITORING

Transactions may be monitored for unusual patterns, high-risk activity, structuring indicators, rapid movement of value, abnormal velocity, repeated failed attempts, suspicious counterparties or other risk indicators.

15. RED FLAGS

• Unusual transaction size or frequency
• Activity inconsistent with known customer behaviour
• Rapid or unexplained movement of value
• Multiple accounts or instruments showing coordinated activity
• Repeated attempts to bypass transaction controls
• Suspected identity or document manipulation
• Transactions linked to known fraud indicators
• Other patterns identified through risk monitoring

16. SUSPICIOUS ACTIVITY ESCALATION

Potentially suspicious activity shall be escalated to the designated Compliance/Risk function for review. Appropriate action shall be determined based on applicable law, evidence, risk and the Company's role in the transaction.

17. REGULATORY REPORTING

Where the Company is legally required to make reports or disclosures to competent authorities, such reporting shall be handled by authorised personnel in accordance with applicable requirements. The Company shall not make unsupported assumptions about regulatory reporting obligations.

18. NO TIPPING-OFF

Personnel shall not disclose restricted information about an investigation, suspicious activity review or regulatory report where such disclosure is prohibited by applicable law or contractual requirements.

19. RECORD KEEPING

KYC records, customer identification information, transaction records, screening results, investigations, decisions and relevant communications shall be retained according to applicable legal, regulatory, contractual and internal retention requirements.

20. DATA PROTECTION

KYC and AML information shall be protected under the Company's Data Protection, Privacy, Retention & Record-Keeping Policy and applicable data-protection requirements.

21. THIRD-PARTY RELIANCE

Where KYC or AML functions are performed by banks, payment processors, regulated partners or other service providers, the Company shall maintain appropriate contractual and risk-management controls and define responsibilities clearly.

22. EMPLOYEE DUE DILIGENCE

Where appropriate, personnel involved in sensitive financial, customer or security functions may be subject to suitable screening and role-based controls consistent with applicable law.

23. TRAINING

Relevant employees shall receive periodic awareness or training on KYC, AML/CFT, sanctions, fraud indicators, escalation and record-keeping appropriate to their responsibilities.

24. INDEPENDENT REVIEW

The Company may conduct internal or independent reviews of AML/KYC controls based on risk, business scale, partner requirements and applicable obligations.

25. CONTROL TESTING

Relevant KYC, screening, transaction monitoring and record-keeping controls should be periodically tested for effectiveness and material deficiencies should be remediated.

26. ACCOUNT / TRANSACTION RESTRICTION

Where permitted and appropriate, the Company may restrict onboarding, transactions, redemption, withdrawals or other services pending verification, investigation or risk review.

27. RESPONSIBILITY MATRIX

28. POLICY EXCEPTIONS

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal or regulatory requirements shall not be waived through an internal exception.

29. REVIEW & AMENDMENT

This Policy shall be reviewed at least annually and following material regulatory changes, product changes, significant risk events, audit findings or changes in the Company's transaction model.

30. APPROVAL