FINZOOPAY SOLUTIONS LLP

1. PURPOSE

This Policy establishes a risk-based framework to prevent, detect, investigate and respond to fraudulent, suspicious or abusive activity involving FINZOOPAY SOLUTIONS LLP's customers, accounts, transactions, gift cards, vouchers, payment channels, APIs and related services.

2. OBJECTIVES

• Prevent fraud before or during transaction processing where feasible.
• Identify unusual, suspicious or high-risk transaction patterns.
• Protect customers, partners, Company funds and transaction integrity.
• Support timely investigation, escalation and corrective action.
• Maintain appropriate fraud records, controls and audit trails.

3. SCOPE

This Policy applies to relevant customers, merchants, partners, employees, transaction channels, payment integrations, voucher/gift-card operations, APIs, applications, databases and third-party services supporting the Company's business.

4. FRAUD RISK GOVERNANCE

Management shall establish appropriate fraud-risk ownership, resources, thresholds and escalation arrangements. Fraud controls shall be proportionate to the Company's products, transaction profile and risk exposure.

5. FRAUD TYPES

• Account takeover and credential compromise
• Payment fraud and transaction manipulation
• Stolen or compromised payment instruments
• Gift-card / voucher theft, resale or misuse
• Refund or reversal abuse
• Identity or account impersonation
• Bot, automated or scripted abuse
• Promotion / incentive abuse
• Collusion or coordinated transaction activity
• Merchant or partner-related fraud

6. FRAUD PREVENTION CONTROLS

• Customer and account verification where applicable
• Authentication and access controls
• Transaction limits and velocity controls
• Device, IP or behavioural indicators where appropriate
• Risk-based transaction screening
• Voucher issuance and redemption controls
• Manual review for selected high-risk events
• Reconciliation and exception management

7. TRANSACTION MONITORING

Transactions may be monitored using rules, thresholds, alerts, risk indicators and analytical methods appropriate to the Company's systems and risk profile.

8. MONITORING INDICATORS

• Unusual transaction frequency or velocity
• Unusual transaction values
• Repeated failed or reversed transactions
• Multiple accounts or instruments showing coordinated behaviour
• Rapid voucher purchase and redemption patterns
• Transactions inconsistent with expected customer activity
• Repeated refund or cancellation activity
• Suspicious account, device, IP or API behaviour

9. FRAUD RULES & THRESHOLDS

Fraud rules and thresholds shall be periodically reviewed and adjusted based on observed fraud patterns, false positives, customer impact, product changes and risk assessments. Sensitive rule configurations shall be restricted to authorised personnel.

10. ALERT MANAGEMENT

Alerts shall be reviewed according to severity and available evidence. Outcomes may include clearance, additional verification, transaction restriction, account restriction, escalation or investigation.

11. MANUAL REVIEW

Selected transactions or accounts may be subject to manual review where automated controls identify elevated risk or where customer, partner or internal reports indicate potential fraud.

12. TRANSACTION RESTRICTION

Where reasonable and proportionate, the Company may delay, decline, restrict or suspend transactions or related services to prevent suspected fraud, subject to applicable law, contractual obligations and customer-protection requirements.

13. CUSTOMER REPORTS

Reports of suspected fraud shall be recorded and assessed. Relevant transaction, account and supporting information shall be reviewed, and appropriate escalation shall occur under the Company's incident and unauthorised-transaction procedures.

14. INVESTIGATION

Fraud investigations may consider transaction history, account information, authentication records, device or network indicators, communications, payment records, voucher records and other relevant evidence.

15. EVIDENCE & RECORDS

Material fraud investigations shall maintain appropriate evidence, chronology, decisions, actions and closure records. Records shall be protected and retained according to applicable requirements.

16. FRAUD LOSS & RECOVERY

Where fraud causes financial loss, the Company may coordinate with customers, payment partners, banks, processors, merchants or competent authorities for investigation, recovery, reversal or other appropriate action.

17. THIRD-PARTY FRAUD

Material fraud risks involving payment gateways, banks, processors, merchants, technology providers or other partners shall be escalated through relevant contractual and operational channels.

18. AML / CFT COORDINATION

Potential financial-crime indicators identified through fraud monitoring shall be escalated under the Company's AML/CFT & KYC Policy where applicable.

19. CYBER FRAUD COORDINATION

Cyber-enabled fraud, account compromise, phishing, malware, unauthorised access or data compromise shall also be handled under the Company's Cyber Incident Response & Cyber Fraud Management Policy.

20. DATA & PRIVACY

Fraud monitoring information shall be collected, accessed, used, shared and retained only for legitimate purposes and in accordance with applicable privacy, security and data-protection requirements.

21. FALSE POSITIVES

Fraud controls shall be periodically reviewed to minimise unnecessary customer disruption while maintaining appropriate risk protection. Legitimate transactions incorrectly flagged shall be handled through documented review and resolution processes.

22. FRAUD METRICS & REPORTING

• Fraud alerts and confirmed cases
• Fraud loss and attempted fraud value
• False-positive rates where measured
• Transaction blocks or reviews
• Recovery / reversal outcomes
• High-risk patterns and emerging threats
• Open investigations and remediation

23. TESTING & CONTROL REVIEW

Fraud rules, monitoring controls and processes shall be tested or reviewed periodically according to risk. Material gaps shall be assigned remediation owners and target dates.

24. STAFF AWARENESS

Relevant personnel shall receive appropriate awareness on fraud indicators, escalation procedures, social engineering, voucher abuse, payment fraud and secure handling of customer information.

25. CONFIDENTIALITY

Fraud rules, detection logic, investigation information and sensitive case details shall be restricted to authorised personnel and shall not be disclosed where such disclosure could facilitate fraud or compromise an investigation.

26. RESPONSIBILITY MATRIX

27. POLICY EXCEPTIONS

Exceptions shall be documented, risk-assessed and approved by authorised management. Exceptions shall not override mandatory legal, regulatory or contractual requirements.

28. REVIEW & AMENDMENT

This Policy shall be reviewed at least annually and after material fraud events, major product changes, significant changes in transaction patterns or applicable requirements.

29. APPROVAL