FINZOOPAY SOLUTIONS LLP

1. PURPOSE

This Policy establishes a risk-based framework for selecting, onboarding, assessing, contracting, monitoring and exiting third-party vendors, service providers, technology partners and other external parties that support FINZOOPAY SOLUTIONS LLP.

2. OBJECTIVES

• Identify and manage risks arising from third-party relationships.
• Protect customer, transaction, financial, security and confidential information.
• Ensure critical vendors are appropriately assessed before engagement.
• Establish contractual security, confidentiality, service and incident requirements.
• Monitor vendor performance and material risk throughout the relationship.
• Maintain appropriate exit and transition arrangements.

3. SCOPE

This Policy applies to vendors, payment partners, banks, processors, gateways, API providers, cloud and hosting providers, KYC or verification providers, communication providers, technology vendors, consultants and other material third parties.

4. VENDOR CLASSIFICATION

Vendors shall be classified according to criticality and risk. Factors may include access to customer or transaction data, financial impact, system dependency, service criticality, regulatory relevance, business continuity impact and substitutability.

5. VENDOR RISK CATEGORIES

• Critical / High Risk – material impact on payments, transactions, customer data, security or business continuity.
• Medium Risk – meaningful operational or data dependency with manageable alternatives.
• Low Risk – limited access, low business impact and limited information or system dependency.

6. PRE-ONBOARDING DUE DILIGENCE

• Legal entity and ownership information
• Business capability and service scope
• Relevant licences, registrations or authorisations where applicable
• Information-security controls
• Data-protection practices
• Business continuity and disaster recovery capability
• Financial and operational stability where relevant
• Reputation and adverse-risk checks where appropriate

7. SECURITY & DATA DUE DILIGENCE

Where a vendor handles sensitive information or connects to critical systems, the Company may assess access controls, encryption, vulnerability management, incident response, logging, backup, secure development and data-protection practices proportionate to risk.

8. CONTRACTUAL REQUIREMENTS

Material vendor agreements should address, as appropriate, scope, service levels, confidentiality, data protection, information security, access controls, incident notification, audit or assurance rights, subcontracting, business continuity, termination and data return or deletion.

9. ACCESS CONTROL

Vendor access shall be authorised, limited to business need, periodically reviewed and revoked when no longer required. Privileged or production access shall receive enhanced controls where appropriate.

10. SUBCONTRACTING

Material subcontracting arrangements shall be disclosed or controlled according to contract and risk. Vendors shall remain responsible for applicable obligations relating to their approved subcontractors.

11. SERVICE LEVEL MANAGEMENT

Critical vendors shall have appropriate service expectations, performance measures, escalation contacts and issue-management processes.

12. ONGOING MONITORING

Vendor risk shall be monitored through performance reviews, security assessments, incidents, audit reports, service-level results, changes in ownership or service, regulatory developments and other relevant indicators.

13. VENDOR INCIDENT MANAGEMENT

Vendors shall promptly report material security, data, availability, fraud or operational incidents affecting the Company or its customers, in accordance with contractual requirements and applicable obligations.

14. BUSINESS CONTINUITY

Critical vendors shall be assessed for continuity capability, recovery arrangements and dependency risk. Where appropriate, alternative providers, contingency arrangements or documented recovery measures shall be considered.

15. AUDIT & ASSURANCE

For material vendors, the Company may obtain appropriate assurance such as security questionnaires, audit reports, certifications, penetration-test summaries or other evidence proportionate to risk.

16. RISK REMEDIATION

Identified vendor risks shall be documented and assigned an owner. Material deficiencies may require corrective action plans, compensating controls, deadlines, management escalation or restriction of services.

17. PAYMENT & FINANCIAL CONTROLS

Vendor onboarding and payment arrangements shall be subject to appropriate verification, approval, invoice validation, reconciliation and segregation of duties.

18. CONFLICTS & ETHICAL CONDUCT

Vendor selection and management shall be conducted fairly and professionally. Conflicts of interest, suspected misconduct or inappropriate inducements shall be disclosed and escalated.

19. DATA RETENTION & RETURN

Upon termination or completion of services, vendors shall return, delete or securely dispose of Company and customer information as required by contract and applicable requirements, subject to lawful retention obligations.

20. VENDOR OFFBOARDING

Offboarding shall include service transition where required, access revocation, credential/token rotation, data return or deletion, outstanding reconciliation, asset recovery and closure of contractual obligations.

21. CRITICAL VENDOR REGISTER

The Company shall maintain an appropriate record of material vendors, their services, owners, risk classification, contract status, review dates and material issues.

22. EXCEPTIONS

Vendor-risk exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory, contractual and security requirements shall not be waived without lawful authority.

23. RESPONSIBILITY MATRIX

24. REVIEW & AMENDMENT

This Policy shall be reviewed at least annually and following material vendor incidents, major changes in critical services, significant outsourcing arrangements or changes in applicable requirements.

25. APPROVAL