Risk Management Policy

Our risk management framework is built on a three-lines-of-defence model that ensures comprehensive risk oversight at every level of the organisation:

• First Line — Operational Management: Business teams own and manage risks within their processes through established controls and standard operating procedures.
• Second Line — Risk & Compliance: The risk management and compliance functions establish policies, set risk limits, monitor exposures, and ensure regulatory adherence.
• Third Line — Internal Audit: Independent internal audit provides objective assurance on the effectiveness of governance, risk management, and controls.

The Board of Directors approves this Policy and reviews it periodically to ensure it remains aligned with the evolving risk landscape and regulatory requirements.

Credit risk — the risk of financial loss due to a borrower's failure to repay — is the most significant risk we manage. Our credit risk management framework includes:

• Credit Assessment & Underwriting: AI-driven credit scoring models evaluate borrower creditworthiness using bureau data (CIBIL, Experian, Equifax), alternative data sources, income verification, and repayment capacity analysis.
• Portfolio Monitoring: Continuous tracking of portfolio performance including delinquency trends, concentration risks, and early warning indicators.
• Collection Practices: Fair and transparent collection processes aligned with RBI guidelines, with graduated escalation from gentle reminders to formal recovery procedures.
• Provisioning: Adequate provisioning is maintained as per regulatory norms for identified stressed assets and NPAs.

Operational risk encompasses the risk of loss resulting from inadequate or failed internal processes, people, systems, or external events. Our approach includes:

• Process Controls: Documented standard operating procedures for all critical processes with built-in checks and approvals.
• Fraud Prevention: Multi-layered fraud detection systems including device fingerprinting, behavioural analytics, and transaction pattern monitoring.
• Business Continuity: Comprehensive business continuity and disaster recovery plans to ensure uninterrupted service delivery.
• Employee Training: Regular training programs on operational risk awareness, data privacy, and code of conduct.

With increasing digitisation of financial services, managing technology and cybersecurity risk is a top priority. Our measures include:

• Data Encryption: 256-bit SSL/TLS encryption for all data in transit and AES-256 encryption for data at rest, ensuring customer information remains secure.
• Access Controls: Role-based access management, multi-factor authentication, and strict least-privilege principles for all systems.
• Security Monitoring: 24/7 security operations centre monitoring for threats, intrusions, and anomalous activity.
• Vulnerability Management: Regular penetration testing, vulnerability assessments, and timely patching of identified issues.
• Incident Response: Documented incident response plan with defined escalation procedures and communication protocols.

Liquidity risk — the risk of being unable to meet financial obligations as they fall due — is managed through:

• Cash Flow Forecasting: Regular projections of cash inflows and outflows over various time horizons to maintain adequate liquidity buffers.
• Diversified Funding: Access to multiple funding sources including bank credit lines, capital markets, and partner NBFC arrangements.
• Stress Testing: Regular scenario analysis to assess the impact of adverse market conditions on liquidity positions.
• Contingency Funding Plan: A formal plan outlining actions to be taken under various stress scenarios to ensure continued operations.

Fraud risk is managed through a comprehensive framework that combines technology, process controls, and investigation capabilities:

• Identity Verification: DigiLocker-based eKYC, Aadhaar authentication, PAN verification, and liveness detection to prevent identity fraud.
• Transaction Monitoring: Real-time monitoring of applications and transactions using rule-based and machine learning models to detect suspicious patterns.
• Red Flag Indicators: Systematic identification and investigation of red flags including inconsistent documentation, unusual application patterns, and device anomalies.
• Reporting: Suspicious transaction reports are filed with relevant authorities as required under applicable laws.

Compliance with all applicable laws and regulations is fundamental to our operations. Our compliance framework includes:

• Regulatory Compliance: Adherence to RBI guidelines, Information Technology Act, Digital Personal Data Protection Act, and all other applicable regulations.
• KYC & AML: Robust Know Your Customer and Anti-Money Laundering procedures in line with statutory requirements and regulatory guidelines.
• Periodic Audits: Regular internal and external audits to assess compliance effectiveness and identify areas for improvement.
• Regulatory Reporting: Timely and accurate submission of all required returns and reports to regulatory authorities.

We engage with various third-party service providers including lending partners, technology vendors, and collection agencies. Risks associated with these relationships are managed through:

• Due Diligence: Comprehensive assessment of all material third-party service providers before engagement, including financial health, security practices, and regulatory compliance.
• Service Level Agreements: Clearly defined SLAs with performance metrics, data security obligations, and termination clauses.
• Ongoing Monitoring: Regular reviews of third-party performance, compliance, and security posture.
• Data Protection: Contractual provisions ensuring customer data is protected, not misused, and returned or destroyed upon termination.

Effective risk management requires timely and accurate information. Our monitoring and reporting framework includes:

• Risk Dashboards: Real-time dashboards providing management with visibility into key risk indicators across all risk categories.
• Periodic Reviews: Quarterly risk reviews with senior management and annual reviews with the Board of Directors.
• Incident Reporting: Structured process for reporting and escalating risk incidents, near-misses, and control failures.
• Audit Trail: Comprehensive logging of all system activities, policy changes, and decision workflows for audit and forensic purposes.