FINZOOPAY SOLUTIONS LLP

1. PURPOSE

This Policy establishes a risk-based framework for customer identification, verification, financial-crime risk management, monitoring, escalation and record keeping applicable to FINZOOPAY SOLUTIONS LLP's business activities, to the extent required by applicable law, regulation, contractual obligations and the role of the Company in a particular transaction or service.

2. IMPORTANT APPLICABILITY PRINCIPLE

The Company shall apply AML/CFT and KYC controls to the extent applicable to its legal and operational role. Where a regulated bank, payment system operator, issuer, processor or other regulated partner is responsible for a particular KYC or AML/CFT function, the Company shall support that partner through appropriate contractual, technical and operational controls and shall not represent itself as performing regulated functions that it is not authorised to perform.

3. OBJECTIVES

• Prevent misuse of the Company's services for money laundering, terrorist financing, fraud or other financial crime.
• Apply proportionate customer and transaction risk controls.
• Identify and verify customers or counterparties where required.
• Monitor suspicious or unusual activity within the Company's capabilities and responsibilities.
• Escalate material concerns appropriately.
• Maintain reliable records and audit trails.

4. SCOPE

This Policy applies to relevant customers, merchants, business partners, agents, employees, contractors, payment relationships, transaction channels, voucher/gift-card activities and third parties, subject to the Company's legal and contractual role.

5. GOVERNANCE

Management shall provide oversight and ensure that appropriate resources, controls and responsibilities are established. A designated compliance or risk owner may coordinate implementation and reporting.

6. CUSTOMER IDENTIFICATION

Where KYC is required, the Company shall collect and verify information appropriate to the customer type and applicable requirements. Information may include identity, address, contact details, business information, beneficial ownership information and other information required by applicable law or partner procedures.

7. CUSTOMER VERIFICATION

• Use reliable and appropriate identification information.
• Verify information using permitted sources or authorised partner processes.
• Maintain evidence of verification.
• Apply enhanced review where risk warrants it.
• Re-verify or refresh information when required.

8. BUSINESS / MERCHANT DUE DILIGENCE

For business customers, merchants or relevant partners, the Company may assess legal existence, ownership and control, authorised representatives, business activity, expected transaction profile and other risk factors appropriate to the relationship.

9. BENEFICIAL OWNERSHIP

Where applicable, the Company shall identify and verify beneficial ownership or controlling persons in accordance with applicable requirements and the Company's role in the relationship.

10. CUSTOMER RISK ASSESSMENT

• Nature and purpose of the relationship
• Customer or business profile
• Geographic exposure
• Products and services used
• Transaction volume and value
• Delivery / redemption patterns
• Use of intermediaries or third parties
• Adverse or suspicious information
• Other applicable risk indicators

11. RISK CATEGORIES

Customers or relationships may be classified as low, medium or high risk, or by another approved risk methodology. Risk categories shall guide the level and frequency of due diligence and monitoring.

12. ENHANCED DUE DILIGENCE

Where higher risk is identified, the Company may apply enhanced verification, additional information requests, closer transaction monitoring, management approval or other proportionate controls, subject to applicable requirements.

13. POLITICALLY EXPOSED PERSONS

Where applicable, the Company shall follow legally required or partner-mandated controls relating to politically exposed persons and associated higher-risk relationships.

14. SANCTIONS & SCREENING

Where applicable to the Company's role, customer or transaction information may be screened against legally applicable sanctions, restricted-party or other relevant lists using appropriate processes or authorised partners.

15. TRANSACTION MONITORING

Relevant transactions may be monitored for unusual patterns, rapid or repeated transactions, abnormal value or velocity, suspected fraud, inconsistent customer behaviour, voucher abuse or other risk indicators within the Company's systems and responsibilities.

16. SUSPICIOUS ACTIVITY ESCALATION

Potentially suspicious activity shall be documented and escalated to the designated compliance/risk function. The Company shall determine appropriate action based on applicable law, contractual obligations and available evidence.

17. NO TIPPING-OFF

Where applicable, the Company shall protect confidential investigations and shall not improperly disclose information that could compromise a lawful investigation, report or regulatory process.

18. RECORD KEEPING

KYC, customer due diligence, screening, transaction review, escalation, investigation and relevant decision records shall be maintained for the period required by applicable law, regulation, contract and the Company's record-retention policy.

19. DATA PROTECTION

KYC and AML/CFT information shall be accessed, processed, shared and retained only for legitimate purposes and in accordance with applicable privacy, security and data-protection requirements.

20. THIRD-PARTY RELATIONSHIPS

Material third parties performing KYC, screening, transaction processing, payment or related services shall be subject to appropriate due diligence and contractual controls. The Company shall monitor material outsourced dependencies according to risk.

21. EMPLOYEE TRAINING

Relevant personnel shall receive appropriate training and awareness on customer verification, financial-crime indicators, suspicious activity escalation, fraud risks, confidentiality and record keeping.

22. FRAUD & AML COORDINATION

This Policy shall operate together with the Company's Fraud Prevention & Transaction Monitoring, Cyber Fraud, Unauthorised Transaction and Transaction Risk policies.

23. PROHIBITED / HIGH-RISK ACTIVITY

The Company may restrict, suspend or decline relationships or transactions where required by law, partner rules, risk controls, fraud indicators, sanctions requirements or material inability to complete required verification.

24. MANAGEMENT REPORTING

Management may receive periodic reports on customer-risk trends, KYC exceptions, screening alerts, suspicious activity escalations, training, high-risk relationships and control effectiveness, subject to confidentiality requirements.

25. INDEPENDENT REVIEW

Where appropriate, the effectiveness of AML/CFT and KYC controls may be reviewed through internal testing, compliance reviews, audits or independent assessments proportionate to risk.

26. POLICY EXCEPTIONS

Exceptions shall be documented, risk-assessed and approved by authorised management. No exception may override a mandatory legal or regulatory requirement.

27. RESPONSIBILITY MATRIX

28. REVIEW & AMENDMENT

This Policy shall be reviewed at least annually and whenever there is a material change in applicable law, regulation, business model, products, payment arrangements, risk profile or third-party structure.

29. APPROVAL