PPI ISSUER / BANK PARTNER
MANAGEMENT POLICY

This Policy establishes the framework for selecting, onboarding, contracting, monitoring and managing PPI issuers, banks and other regulated or critical partners used by CYBERVED AI PRIVATE LIMITED for its gift-card and voucher business.

• Ensure partners are appropriately identified and assessed before onboarding.
• Confirm relevant authorisation or regulatory status where applicable.
• Define clear contractual responsibilities and service boundaries.
• Protect customers, funds, data and transaction integrity.
• Monitor partner performance, security, fraud and operational risks.
• Maintain documented escalation, review and exit arrangements.

This Policy applies to PPI issuers, banks, payment processors, merchants, gift-card issuers, technology providers and other partners whose services are material to the Company's gift-card / voucher operations.

• Regulated / PPI partner
• Banking partner
• Payment / transaction partner
• Gift-card / voucher issuer or merchant partner
• Technology / API partner
• Other critical service provider

Before onboarding a material partner, the Company shall conduct risk-based due diligence appropriate to the relationship, including legal identity, business profile, regulatory status where relevant, ownership/control information where appropriate, operational capability, security, fraud controls and financial/settlement arrangements.

Where a partner performs regulated PPI or payment activities, the Company shall verify the partner's applicable authorisation or regulatory status through appropriate official or contractual evidence and maintain records of the assessment.

• Defined services and scope
• Roles and responsibilities
• Settlement and reconciliation terms
• Customer support responsibilities
• Data protection and confidentiality
• Information-security requirements
• Incident notification
• Audit/assurance rights where appropriate
• Business continuity
• Termination and exit arrangements

Contracts shall clearly distinguish the responsibilities of CYBERVED AI PRIVATE LIMITED and the regulated/partner entity, including issuance, redemption, KYC where applicable, transaction processing, customer support, fraud monitoring, settlement and regulatory reporting.

1. Complete due diligence.
2. Obtain required internal approvals.
3. Complete contractual documentation.
4. Complete technical/security assessment where applicable.
5. Configure systems and access securely.
6. Test critical transaction and reconciliation flows.
7. Approve production activation.

Where a PPI issuer provides the regulated product or wallet infrastructure, CYBERVED AI PRIVATE LIMITED shall operate only within the approved service model and shall not undertake functions reserved for the authorised issuer unless legally permitted and appropriately authorised.

Bank relationships shall define payment, settlement, reconciliation, account/service responsibilities, operational contacts, security requirements, dispute handling and escalation procedures as applicable.

• Use approved authentication and authorisation.
• Protect API credentials and certificates.
• Use secure communication.
• Maintain transaction and error logs.
• Apply appropriate timeout, retry and reconciliation controls.
• Review material API changes before production.

Partner settlement statements and transaction records shall be reconciled against internal records at appropriate intervals. Unmatched items, failed transactions, refunds and reversals shall be investigated and closed with evidence.

Partner arrangements shall support appropriate customer complaint handling, refund/cancellation processes, unauthorised transaction handling and protection of customer information.

The Company shall coordinate with relevant partners for fraud monitoring, suspicious transaction escalation, account/voucher restrictions and other applicable financial-crime controls within the agreed responsibilities.

Partners handling Company or customer information shall be subject to appropriate confidentiality, information-security and data-protection requirements based on risk and contractual obligations.

Material partners may be monitored against availability, transaction success, settlement, incident response, customer support, reconciliation and other agreed service measures.

Material security, fraud, data, transaction or service incidents affecting the Company's customers or operations shall be escalated promptly through agreed partner contacts.

• Regulatory/authorisation status where applicable
• Service performance
• Security and incident history
• Fraud trends
• Settlement/reconciliation issues
• Complaints
• Material contractual or business changes
• Continuity and concentration risks

Changes in ownership, regulatory status, product scope, API architecture, settlement process, data flows or material service arrangements shall be assessed before implementation where appropriate.

Where a partner uses material subcontractors or sub-processors, appropriate disclosure, risk assessment, contractual controls and oversight shall be considered based on the risk of the service.

The Company may use contractual reports, certifications, assessments, audits, security reviews, service reports or other reasonable evidence to assess partner control effectiveness.

The Company may restrict or suspend a partner integration or product where there is a material security, fraud, regulatory, service, settlement or customer-protection concern, subject to contractual requirements and management approval.

Material partner relationships shall have appropriate exit arrangements addressing data return/deletion, customer impact, outstanding transactions, settlement, credential revocation, service transition and record retention.

• Due diligence documents
• Authorisation/regulatory evidence
• Contracts and amendments
• Partner assessments
• Service reports
• Incident communications
• Settlement/reconciliation records
• Review and approval records
• Termination/exit records

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory or contractual requirements shall not be bypassed.

This Policy shall be reviewed at least annually and whenever there is a material change in partner arrangements, products, technology, regulatory requirements or risk profile.