-------------------------------------------------- DRAFT FOR ATTORNEY REVIEW ONLY — NOT LEGAL OR REGULATORY ADVICE This AML Policy draft is a structured preparation document only. A qualified Indian attorney and AML compliance specialist must review this policy before adoption. This policy does not guarantee regulatory compliance under PMLA 2002 India or RBI regulations. Senior management of ClearPay Digital Services Pvt Ltd remain personally responsible for AML compliance obligations regardless of this policy's existence. Failure to maintain an adequate AML policy under PMLA 2002 India may result in significant regulatory penalties and criminal liability. -------------------------------------------------- ANTI-MONEY LAUNDERING POLICY — DRAFT FOR ATTORNEY REVIEW Organization: ClearPay Digital Services Pvt Ltd Policy Version: 1.0 Effective Date: June 1 2026 Policy Owner: Chief Compliance Officer and MLRO Applicable Regulator: Reserve Bank of India RBI and Financial Intelligence Unit India FIU-IND 1. PURPOSE AND SCOPE 1.1 This Anti-Money Laundering and Counter Terrorist Financing AML CTF Policy establishes the framework by which ClearPay Digital Services Pvt Ltd detects, prevents, and reports money laundering and terrorist financing activity within its digital payment aggregation, prepaid wallet, and UPI payment processing operations. 1.2 This policy applies to all employees, officers, directors, and contractors of ClearPay Digital Services Pvt Ltd without exception. 1.3 Non-compliance with this policy is a serious disciplinary matter and may constitute a criminal offense under the Prevention of Money Laundering Act 2002 India PMLA. 2. REGULATORY FRAMEWORK 2.1 The primary legislation and regulatory guidance governing ClearPay Digital Services Pvt Ltd's AML obligations includes: 1. Prevention of Money Laundering Act 2002 India PMLA and the Prevention of Money Laundering Maintenance of Records Rules 2005. 2. RBI Master Directions on Know Your Customer KYC dated February 25 2016 as amended from time to time. 3. Foreign Exchange Management Act 1999 FEMA for cross-border remittance transactions. 4. FATF Forty Recommendations on AML CTF as adopted and implemented under Indian law. 2.2 The primary regulators are the Reserve Bank of India RBI and Financial Intelligence Unit India FIU-IND. 2.3 Consequences of non-compliance include monetary penalty under PMLA 2002, criminal prosecution of the reporting entity and its principal officers, attachment of property, and revocation of the RBI prepaid payment instrument license. 2.4 Note: All applicable PMLA 2002 and RBI KYC obligations must be confirmed with a qualified Indian financial crime compliance attorney before adopting this policy. 3. RISK-BASED APPROACH 3.1 ClearPay Digital Services Pvt Ltd adopts a risk-based approach to AML CTF compliance, allocating enhanced controls to higher-risk business relationships and transactions. 3.2 Key risk categories assessed include: 1. Customer risk: Individual users, SME merchants, and high-volume merchants present different ML risk levels. Cross-border remittance customers present elevated risk. 2. Geographic risk: Customers and counterparties located in FATF- listed high-risk jurisdictions or jurisdictions on the MHA designated list present elevated risk. 3. Product and service risk: Prepaid wallets with cash loading capability and cross-border remittance services present higher ML risk than domestic UPI transactions. 4. Delivery channel risk: Fully digital and remote onboarding without in- person verification is a higher-risk delivery channel requiring adequate digital verification controls. 3.3 ClearPay Digital Services Pvt Ltd's overall business risk is assessed as medium, elevated to high for cross- border remittance transactions. 4. MONEY LAUNDERING REPORTING OFFICER 4.1 ClearPay Digital Services Pvt Ltd designates the Chief Compliance Officer as the Money Laundering Reporting Officer MLRO. 4.2 The MLRO's responsibilities include: 1. Receiving all internal suspicious activity reports from employees. 2. Evaluating each internal report and making independent decisions on STR filing with FIU-IND. 3. Filing Suspicious Transaction Reports with FIU-IND within 7 days where grounds for suspicion exist. 4. Maintaining AML compliance records and reporting to senior management. 5. Overseeing CDD and EDD procedures and ensuring adequate staff training. 4.3 The MLRO must be a fit and proper person with appropriate financial crime compliance expertise. The MLRO appointment must be notified to RBI in accordance with applicable reporting obligations. 4.4 Note: RBI reporting requirements for MLRO designation and applicable FIU-IND registration obligations must be confirmed with a qualified Indian compliance specialist. 5. CUSTOMER DUE DILIGENCE 5.1 ClearPay Digital Services Pvt Ltd must complete CDD on all customers before or at the time of establishing a business relationship, in accordance with the RBI Master Directions on KYC 2016. 5.2 CDD for individual customers requires: 1. Identity verification via Aadhaar OTP-based KYC or Video KYC as permitted under RBI Master Directions. 2. Permanent Account Number PAN verification for transaction limits above applicable thresholds. 3. Address verification via Aadhaar or other officially valid document. 5.3 CDD for merchant or corporate customers requires: 1. Certificate of Incorporation and GST registration. 2. PAN of the entity and authorized signatories. 3. Identity and address verification of beneficial owners holding 25 percent or more of the entity. 5.4 Ongoing CDD monitoring applies to all active customer relationships. Re-verification is triggered by material changes in customer profile or transaction behavior inconsistent with the declared business purpose. 5.5 Failure to complete satisfactory CDD is grounds for refusing to establish or for terminating an existing business relationship in accordance with PMLA 2002. 6. ENHANCED DUE DILIGENCE 6.1 EDD applies to the following higher- risk customer categories: 1. Politically Exposed Persons PEPs and their immediate family members and known close associates. 2. Customers located in FATF-listed high-risk jurisdictions or jurisdictions on the MHA India designated list. 3. Merchants with monthly transaction volumes above INR 10,00,000 whose transaction pattern does not match declared business activity. 4. Customers with complex or opaque ownership structures where beneficial ownership cannot be readily verified. 6.2 EDD measures include: 1. Senior management approval before establishing the relationship. 2. Enhanced identity and source of funds documentation. 3. More frequent transaction monitoring and review cycles. 6.3 Note: Applicable FATF high-risk jurisdiction lists and MHA India designated lists must be confirmed with a qualified Indian compliance specialist before this policy is implemented. 7. SUSPICIOUS TRANSACTION REPORTING 7.1 Every employee of ClearPay Digital Services Pvt Ltd is obligated to report to the MLRO immediately upon forming any suspicion that a transaction or customer activity may involve money laundering or terrorist financing. 7.2 The MLRO must evaluate each internal suspicious activity report and file a Suspicious Transaction Report STR with FIU-IND within 7 days of forming reasonable grounds for suspicion, in accordance with PMLA 2002 and the FIU-IND reporting format. 7.3 The MLRO must maintain a register of all internal suspicious activity reports received and all STRs filed with FIU-IND. 7.4 Note: STR filing obligations, FIU-IND reporting format requirements, and applicable PMLA 2002 reporting deadlines must be confirmed with a qualified Indian AML compliance specialist. 8. TIPPING-OFF PROHIBITION **IT IS A CRIMINAL OFFENSE UNDER SECTION 3 READ WITH SECTION 70 OF THE PREVENTION OF MONEY LAUNDERING ACT 2002 INDIA FOR ANY EMPLOYEE, OFFICER, OR DIRECTOR OF CLEARPLAY DIGITAL SERVICES PVT LTD TO DISCLOSE TO ANY CUSTOMER, THIRD PARTY, OR UNAUTHORIZED PERSON THAT A SUSPICIOUS TRANSACTION REPORT HAS BEEN FILED, THAT AN AML INVESTIGATION IS UNDERWAY, OR THAT THE CUSTOMER OR TRANSACTION IS UNDER SUSPICION.** 8.1 Any employee found to have tipped off a customer or third party faces immediate disciplinary action and potential personal criminal liability under PMLA 2002. 8.2 Employees must refer any customer inquiry about the status of their account or transaction to the MLRO without confirming or denying any investigation. 8.3 Note: Applicable tipping-off criminal provisions under PMLA 2002 and their precise scope must be confirmed with a qualified Indian attorney. 9. SANCTIONS SCREENING 9.1 ClearPay Digital Services Pvt Ltd must screen all customers at onboarding and all transactions against the following sanctions lists: 1. United Nations Security Council consolidated sanctions list. 2. OFAC Specially Designated Nationals SDN list. 3. Ministry of Home Affairs MHA India designated terrorist and banned organization lists under the Unlawful Activities Prevention Act 1967 UAPA. 9.2 Sanctions screening must be conducted in real-time or near real-time for all transactions. Full re-screening must occur at each sanctions list update. 9.3 If a confirmed sanctions match is identified the transaction must be blocked immediately, the relationship frozen, and the matter reported to the MLRO for notification to applicable authorities. 9.4 Note: Applicable Indian sanctions obligations, the UAPA designated list, and the interaction between sanctions compliance and FEMA obligations must be confirmed with a qualified Indian attorney. 10. PEP SCREENING 10.1 ClearPay Digital Services Pvt Ltd must identify all domestic and foreign Politically Exposed Persons at onboarding and throughout the customer relationship. 10.2 PEPs, their immediate family members, and known close associates are subject to EDD as described in Section 6. 10.3 Senior management approval is required before establishing or continuing any business relationship with a PEP. 11. RECORD RETENTION 11.1 ClearPay Digital Services Pvt Ltd must retain the following records for a minimum of 5 years as required under PMLA 2002 Rule 3: 1. CDD documentation for all customers. 2. Transaction records for all transactions processed through the platform. 3. All STRs filed with FIU-IND and supporting documentation. 4. Staff AML training records. 11.2 All records must be maintained in a retrievable format and produced to RBI, FIU-IND, or any lawfully authorized authority on request. 11.3 Note: The interaction between the PMLA 2002 5-year retention obligation and the DPDP Act 2023 India data minimization and storage limitation principles must be confirmed with a qualified Indian attorney before this policy is adopted. 12. STAFF TRAINING 12.1 All employees, officers, and directors of ClearPay Digital Services Pvt Ltd must complete AML CTF training at onboarding and at a minimum annually thereafter. 12.2 Training must cover: 1. Money laundering and terrorist financing red flags relevant to digital payment and prepaid wallet operations. 2. The internal suspicious activity reporting obligation and procedure. 3. The tipping-off criminal prohibition and its consequences. 4. Applicable PMLA 2002 and RBI KYC regulatory obligations. 12.3 Training completion must be recorded and retained for 5 years. 13. INTERNAL AUDIT AND REVIEW 13.1 ClearPay Digital Services Pvt Ltd must conduct an internal review or independent compliance audit of this AML CTF policy and implemented controls at least annually. 13.2 The review is the responsibility of the MLRO or an appropriately qualified independent reviewer. 13.3 This policy must be updated promptly for material changes in PMLA 2002, RBI Master Directions, FATF recommendations, or the organization's business risk profile. 14. SENIOR MANAGEMENT RESPONSIBILITY 14.1 The Board of Directors and senior management of ClearPay Digital Services Pvt Ltd are responsible for ensuring adequate resources, oversight, and a culture of AML CTF compliance throughout the organization. 14.2 Under PMLA 2002 Section 70 every person in charge of and responsible for the conduct of the business of a reporting entity at the time of a PMLA offense is deemed guilty of the offense and liable to be prosecuted. 14.3 Note: Senior management personal criminal liability under PMLA 2002 Section 70 must be confirmed with a qualified Indian attorney. 15. DATA PROTECTION AND PRIVACY 15.1 CDD and AML records contain personal data of customers and associated persons. All such data is processed and retained only in accordance with the Digital Personal Data Protection Act 2023 India DPDP Act. 15.2 The MLRO must ensure AML record retention obligations under PMLA 2002 are balanced against DPDP Act 2023 data minimization and storage limitation principles in consultation with qualified legal counsel. 16. GOVERNING LAW AND REGULATOR 16.1 Laws of Maharashtra India, PMLA 2002, and applicable RBI regulations govern this policy. 16.2 ClearPay Digital Services Pvt Ltd cooperates fully with all lawful requests from RBI, FIU-IND, and any other applicable regulatory authority. 17. POLICY APPROVAL AND REVIEW 17.1 This policy is approved by the Board of Directors of ClearPay Digital Services Pvt Ltd. 17.2 This policy must be reviewed and re-approved at a minimum annually and updated promptly for any material change in applicable law or business risk profile. Next scheduled review: June 1 2027. POLICY SIGN-OFF: Approved by: ____________________ Designation: ____________________ Date: ____________________________ MLRO Name: ______________________ Note: This policy must be reviewed by a qualified Indian financial crime compliance attorney and AML specialist before adoption. PMLA 2002 obligations, RBI Master Directions on KYC compliance, FIU-IND STR filing procedure and format, MLRO regulatory notification obligations, DPDP Act 2023 interaction with PMLA record retention, applicable UAPA and MHA sanctions list obligations, and senior management criminal liability under PMLA 2002 Section 70 must all be confirmed before this policy is adopted. -------------------------------------------------- This AML Policy draft was generated by an AI drafting tool as a structured preparation and documentation aid only. It does not constitute legal advice, regulatory advice, or compliance certification. Senior management of ClearPay Digital Services Pvt Ltd remain personally criminally liable under PMLA 2002 Section 70. Always have this policy reviewed by a qualified Indian attorney and AML compliance specialist before adoption. --------------------------------------------------