Secure Verification.
Responsible Finance.

The Prevention of Money Laundering Act, 2002 (PMLA), together with applicable rules and regulatory directions, establishes measures intended to prevent money laundering and related financial crimes.

The Reserve Bank of India (RBI) has prescribed Know Your Customer (KYC) requirements and measures for preventing money laundering and terrorist financing. Bubna Financial Services Private Limited shall comply with the provisions applicable to its business and regulatory status.

This policy establishes procedures for identifying customers, verifying information, assessing customer risk, monitoring transactions and maintaining appropriate records. It shall be read together with applicable laws and regulatory directions, including subsequent amendments.

• Prevent the company from being used for money laundering or terrorist financing.
• Comply with applicable AML, KYC and counter-terrorist-financing requirements.
• Identify and escalate suspicious activities through appropriate procedures.
• Cooperate with competent authorities as required by applicable law.

This policy shall be reviewed periodically and approved by the competent authority or Board of Directors, as applicable. Additional reviews may be undertaken whenever changes in legislation, regulatory directions, business operations or identified risks require amendments.

The company's KYC and AML framework is based on the following principal elements:

The company shall follow appropriate customer acceptance standards before establishing a business relationship or processing transactions.

• Customer due diligence shall be completed as required before establishing the relevant relationship.
• A customer relationship shall not be established where required identity verification cannot be satisfactorily completed.
• Accounts shall not be opened in anonymous, fictitious or prohibited names.
• Appropriate screening shall be undertaken against applicable sanctions and regulatory lists.
• Information relating to joint account holders and beneficial owners shall be obtained and verified wherever required.
• PAN and electronic documents shall be verified through appropriate facilities wherever applicable.
• Additional or optional information shall be obtained with the customer's consent wherever required.
• Customer acceptance procedures shall be applied fairly and shall not be unnecessarily restrictive, subject to legal and regulatory requirements.

The company shall assess customer risk using relevant information and adopt a risk-based approach to due diligence and monitoring. Risk categories may include low, medium and high risk, as appropriate.

Customer identification and verification shall be performed when establishing a business relationship, opening an account, undertaking relevant financial transactions or when doubts arise regarding the authenticity or adequacy of previously collected information.

• Obtain sufficient information to establish the customer's identity and understand the purpose of the relationship.
• Verify identification information using reliable and independent sources.
• Collect documents and information prescribed for the applicable customer category.
• Verify electronic documents and digital signatures wherever required.
• Use permitted digital or video-based identification methods only in accordance with applicable requirements.
• Where reliance is placed on a third party for due diligence, ensure that all applicable regulatory conditions are met. Ultimate responsibility remains with the company.

Individual Customers

For individual customers, the company shall obtain and verify the identity and address documents prescribed by applicable KYC directions. These may include an eligible officially valid document, Aadhaar-related proof where legally permitted, PAN or Form 60, and other information required according to the customer's profile.

Proprietorship Firms

For a sole proprietorship, the identity of the proprietor shall be verified along with appropriate evidence of the firm's business activity, as required by applicable rules.

Companies and Other Legal Entities

For companies, partnership firms, trusts and other legal entities, the company shall obtain the relevant registration, identity, address, ownership and authorisation documents required for the entity type.

Beneficial Ownership

Where applicable, reasonable steps shall be taken to identify and verify beneficial owners and persons exercising ultimate control. Appropriate evidence shall also be obtained where a customer acts as a trustee, nominee or intermediary for another person.

Ongoing monitoring helps identify transactions that are inconsistent with the customer's known profile, expected activity or legitimate business purpose. The level of monitoring shall be proportionate to the customer's assessed risk.

• Pay particular attention to unusually large, complex or unexplained transactions.
• Review activity that appears inconsistent with the customer's profile or stated purpose.
• Apply enhanced monitoring to higher-risk relationships where required.
• Document relevant reviews and escalate suspicious activity through the appropriate compliance channel.
• Make regulatory reports where required under applicable law.

Monitoring procedures shall reflect the company's actual products, services and permitted transaction types.

Customer KYC information shall be reviewed and updated at the intervals prescribed by applicable regulatory directions. The frequency shall depend on customer risk classification and any subsequent changes in identity, address, ownership or other relevant information.

• Obtain updated documents or declarations as permitted by applicable directions.
• Verify changes in customer identity and address through prescribed procedures.
• Review beneficial ownership information for legal entities where applicable.
• Verify PAN information through the relevant issuing authority wherever required.
• Provide acknowledgement of KYC updation where prescribed.
• Carry out additional reviews where required by changes in risk or applicable law.

The company shall maintain appropriate records of transactions and customer identification information in accordance with applicable laws and regulatory requirements.

• Maintain transaction records in a form that allows individual transactions to be reconstructed where required.
• Preserve customer identification and address records for the prescribed retention period.
• Maintain records securely in physical or electronic form, as appropriate.
• Make records available to competent authorities when legally required.
• Apply appropriate access controls and safeguards to protect customer information.

Reporting of Suspicious Transactions

Transactions requiring reporting under applicable anti-money-laundering laws shall be escalated to the designated compliance personnel and reported to the competent authority within the prescribed requirements.

Sanctions and International Obligations

The company shall comply with applicable sanctions requirements, directions and legally enforceable instructions issued by competent authorities. Appropriate screening and escalation procedures shall be followed.

Confidentiality of Customer Information

Customer information shall be handled confidentially and disclosed only where permitted or required by applicable law, regulatory directions or a lawful request from a competent authority.

Central KYC Records Registry

Where applicable, KYC information shall be captured and submitted to the Central KYC Records Registry in accordance with the prescribed requirements and formats.