Haripay INDIA PRIVATE LIMITED

This Policy establishes the framework for identifying, preparing, reviewing, approving, submitting, storing and retrieving regulatory, statutory, contractual and management records maintained by Haripay India Private Limited.

• Maintain complete and reliable records.
• Support applicable legal and regulatory reporting obligations.
• Ensure reports are accurate, timely and properly approved.
• Preserve evidence for audits, disputes and investigations.
• Maintain controlled access and confidentiality.
• Enable prompt retrieval of records.

This Policy applies to regulatory submissions, statutory records, customer and transaction records, KYC/verification records, AML/CFT records, fraud records, settlement and reconciliation records, security records, grievances, contracts, partner records, audit records and other business records required to support Haripay's activities.

• Accuracy
• Completeness
• Timeliness
• Consistency
• Traceability
• Confidentiality
• Authorised approval
• Evidence-based reporting

Compliance shall maintain an appropriate register of applicable reporting obligations based on Haripay's business model, contractual arrangements, applicable law, regulatory status and activities performed through authorised partners.

Where applicable, a reporting calendar shall identify the report, recipient, frequency, due date, responsible owner, reviewer and evidence of submission.

1. Identify applicable reporting requirement.
2. Collect source data.
3. Validate completeness and accuracy.
4. Prepare report in required format.
5. Obtain required review/approval.
6. Submit through the approved channel.
7. Retain submission evidence.

Material regulatory or statutory reports shall be reviewed by the designated responsible function before submission. Where required, management or an authorised signatory shall approve the report.

Reports shall be submitted through authorised portals, email channels, partner processes or other officially designated mechanisms, as applicable.

• Acknowledgement/reference number
• Submission date/time
• Submitted report
• Portal confirmation
• Official communication
• Approval evidence

If an error is identified in a submitted report, the responsible function shall assess the impact, escalate as appropriate and make correction or re-submission where required.

Customer, transaction, order, redemption, refund, payment-reference and related records shall be retained according to applicable legal, contractual, operational and fraud-prevention requirements.

KYC/verification, customer due diligence, AML/CFT review, transaction monitoring, suspicious activity review and fraud investigation records shall be maintained according to applicable requirements and internal policies.

• Settlement statements
• Bank/payment references
• Partner statements
• Reconciliation reports
• Exception records
• Refund/reversal records
• Approval and closure evidence

Customer complaints, grievance correspondence, dispute records, chargeback records, unauthorised transaction investigations and resolution evidence shall be maintained for the applicable retention period.

• Security logs where required
• Incident reports
• Access review evidence
• Vulnerability/security assessment records
• Backup/recovery test records
• Cyber incident evidence

Executed agreements, amendments, due diligence records, partner communications, SLA records, vendor reviews and termination/exit documentation shall be securely maintained.

• Public – approved for public disclosure
• Internal – business use
• Confidential – restricted business/customer information
• Restricted – highly sensitive security, fraud, legal or personal information

Each material record category shall have a responsible business owner who ensures completeness, retention, accessibility and appropriate disposal.

Records shall be maintained in a manner that protects them from unauthorised alteration, deletion or destruction. Where appropriate, version control, access logs or other integrity mechanisms shall be used.

Electronic records shall be stored in approved systems with appropriate access control, backup, security and retention controls.

Where physical records are maintained, they shall be stored securely and protected from unauthorised access, damage, loss or destruction.

Records shall be retained for the period required by applicable law, regulatory requirements, contractual obligations, legitimate business needs and approved internal schedules. Where requirements differ, the longer applicable period may be followed unless otherwise determined by authorised legal/compliance advice.

Records subject to litigation, investigation, audit, regulatory review, dispute or other authorised hold shall not be destroyed until the hold is formally released.

Access to records shall follow least-privilege and need-to-know principles. Confidential or restricted records shall only be shared with authorised persons or entities for legitimate purposes.

Personal and sensitive information contained in records shall be handled in accordance with the Data Protection, Privacy & Retention Policy and applicable requirements.

Records shall be organised and indexed sufficiently to allow reasonable retrieval for audits, customer matters, partner reconciliation, investigations, legal requirements and management review.

Material regulatory submissions and controlled records should maintain sufficient evidence to identify who prepared, reviewed, approved, submitted or amended the record, where practicable.

Haripay shall provide appropriate records and evidence to authorised auditors, regulators, legal advisers or other authorised parties, subject to confidentiality and applicable law.

Records shall be securely deleted, destroyed or anonymised when the applicable retention period has expired and no legal, regulatory, contractual or business hold applies.

Where records are maintained by a PPI issuer, bank, payment processor, cloud provider or other vendor, contractual arrangements shall address access, availability, confidentiality and retrieval requirements appropriate to the service.

Critical records shall have appropriate backup and recovery arrangements consistent with the Business Continuity & Disaster Recovery Policy.

Missing, inaccurate, unauthorised, altered or improperly disclosed records shall be investigated and corrective action shall be taken as appropriate.

Exceptions shall be documented, risk-assessed and approved by an authorised function. Mandatory legal or regulatory record-keeping requirements shall not be overridden.

Relevant personnel shall receive appropriate awareness regarding reporting obligations, record accuracy, confidentiality, retention and secure handling.

This Policy shall be reviewed at least annually and whenever there is a material change in Haripay's business model, partner arrangements, regulatory obligations, systems or applicable requirements.