KYC & CUSTOMER DUE
DILIGENCE POLICY

This Policy establishes a risk-based framework for customer identification, verification, due diligence, record management and escalation applicable to CYBERVED AI PRIVATE LIMITED's gift-card, voucher and related services. It also defines coordination with the authorised PPI or regulated partner where KYC obligations are performed by that partner.

• Identify customers appropriately where KYC is required.
• Prevent impersonation, misuse, fraud and prohibited activity.
• Apply risk-based customer due diligence.
• Maintain accurate and secure KYC records.
• Define enhanced review and escalation controls.
• Clearly allocate KYC responsibilities between CYBERVED AI PRIVATE LIMITED and applicable regulated partners.

This Policy applies to customer onboarding, account creation where applicable, gift-card/voucher purchases or services where customer identification is required, customer support interactions involving identity verification, and partner-operated KYC processes.

Where an authorised PPI issuer, bank or other regulated partner is legally responsible for KYC, CYBERVED AI PRIVATE LIMITED shall support the partner within the agreed contractual scope and shall not represent itself as independently performing regulated KYC functions unless legally authorised.

Where applicable, the customer shall be identified using information and documents permitted by the relevant legal, regulatory and partner requirements. The information collected shall be limited to what is reasonably necessary for the applicable purpose.

• Validate submitted identity information through approved methods.
• Check document or verification status where applicable.
• Identify obvious inconsistencies or suspected manipulation.
• Record verification outcome and relevant reference.
• Escalate failed or suspicious verification.

• Name and contact information where applicable
• Identity/verification information where required
• Transaction or order references
• Relevant customer account information
• Risk indicators and verification outcome

Customer due diligence shall be proportionate to the nature and risk of the product, transaction, customer relationship and applicable legal/partner requirements. Higher-risk situations may require additional verification or review.

Where a customer, transaction or activity presents elevated risk, additional checks may be performed or requested by the responsible regulated partner. The scope shall be documented and proportionate to the identified risk.

Where required by applicable law, partner procedures or the Company's role, appropriate screening or screening support shall be performed against relevant sanctions, prohibited-party or other legally applicable lists.

KYC information and verification outcomes shall support applicable AML/CFT controls. Suspicious matters shall be escalated under the AML/CFT and Fraud Prevention policies and, where required, to the responsible regulated partner.

• Detect inconsistent customer information.
• Identify repeated or suspicious onboarding attempts.
• Use appropriate transaction and account signals.
• Escalate suspected identity misuse or document fraud.
• Coordinate with PPI/bank partners where required.

Before disclosing sensitive account, voucher or transaction information or performing a restricted support action, customer-support personnel shall use appropriate verification procedures.

Where ongoing customer relationships exist and applicable requirements require updated information, the responsible function or regulated partner shall follow an appropriate refresh process.

Where required KYC information is incomplete, inconsistent or cannot be satisfactorily verified, the relevant service or transaction may be restricted, delayed or declined in accordance with applicable requirements and partner procedures.

• KYC/verification information where lawfully collected
• Verification results and references
• Due-diligence review records
• Risk classification where applicable
• Escalation records
• Partner KYC confirmations
• Customer communications relating to verification

KYC information is confidential and shall be collected, accessed, shared, retained and disposed of in accordance with the Data Protection, Privacy & Retention Policy and applicable requirements.

Access to KYC information shall be restricted on a need-to-know and role-based basis. Privileged access shall be authorised, monitored and periodically reviewed.

Where a third party performs verification or related services, the relationship shall be governed by appropriate due diligence, security, privacy, contractual and performance controls.

Where KYC is operated by an authorised PPI issuer or bank partner, CYBERVED AI PRIVATE LIMITED shall follow the agreed operating model, provide required information within its lawful possession and promptly escalate material KYC issues.

Where activity appears inconsistent with applicable law, product terms, partner requirements or risk controls, the Company may restrict processing and escalate the matter for review.

Customer-facing communications shall be clear about information required for verification and, where appropriate, the purpose of the request. The Company shall avoid collecting unnecessary information.

Any suspected compromise, unauthorised access, leakage or misuse of KYC information shall be handled under the Information Security & Cyber Security Policy and Cyber Incident Response & Cyber Fraud Policy.

Periodic quality checks may be performed to assess accuracy, completeness, access controls, exception handling and compliance with applicable procedures.

Personnel handling customer verification or KYC-related information shall receive appropriate training on verification procedures, privacy, fraud indicators, escalation and secure handling.

Exceptions shall be documented, risk-assessed and approved by authorised management. Applicable legal, regulatory and partner requirements shall not be bypassed.

This Policy shall be reviewed at least annually and whenever there is a material change in the business model, customer journey, partner arrangement, technology or applicable requirements.