-------------------------------------------------- DRAFT FOR ATTORNEY REVIEW ONLY — NOT LEGAL OR REGULATORY ADVICE This KYC Policy draft is a structured preparation document only. A qualified Indian attorney and KYC compliance specialist must review this policy before adoption. This policy does not guarantee regulatory compliance under RBI Master Directions on KYC 2016 or PMLA 2002 India. Senior management of FastLend Finance Pvt Ltd remain personally responsible for KYC compliance regardless of this policy's existence. -------------------------------------------------- KNOW YOUR CUSTOMER KYC POLICY — DRAFT FOR ATTORNEY REVIEW Organization: FastLend Finance Pvt Ltd Policy Version: 1.0 Effective Date: June 1 2026 Policy Owner: Chief Compliance Officer Applicable Regulator: Reserve Bank of India RBI 1. PURPOSE AND SCOPE 1.1 This Know Your Customer KYC Policy establishes the framework by which FastLend Finance Pvt Ltd identifies, verifies, and monitors the identity of all borrowers accessing its digital personal lending and BNPL products, in compliance with the RBI Master Directions on Know Your Customer KYC dated February 25 2016 as amended. 1.2 This policy applies to all employees, officers, directors, and contractors of FastLend Finance Pvt Ltd without exception and operates alongside the organization's AML CTF compliance framework. 1.3 Non-compliance with this policy is a disciplinary matter and may constitute a criminal offense under PMLA 2002 India. 2. REGULATORY FRAMEWORK 2.1 The primary legislation and regulatory guidance governing FastLend Finance Pvt Ltd's KYC obligations includes: 1. RBI Master Directions on Know Your Customer KYC dated February 25 2016 as amended — the primary KYC regulatory instrument for NBFCs. 2. Prevention of Money Laundering Act 2002 PMLA and the PMLA Maintenance of Records Rules 2005. 3. RBI Circular on Video KYC permitting Video Customer Identification Process V-CIP for non-Aadhaar customers. 4. FATF Forty Recommendations as implemented under Indian law. 2.2 The primary regulator is the Reserve Bank of India RBI. 2.3 Consequences of inadequate KYC procedures include monetary penalties under PMLA 2002, criminal prosecution of principal officers under PMLA 2002 Section 70, and revocation of the NBFC certificate of registration. 2.4 Note: All applicable RBI Master Directions on KYC and PMLA 2002 obligations must be confirmed with a qualified Indian financial compliance attorney before adopting this policy. 3. CUSTOMER ACCEPTANCE POLICY 3.1 FastLend Finance Pvt Ltd will onboard individual and corporate borrowers who satisfy the identity verification requirements of this policy. 3.2 FastLend Finance Pvt Ltd will NOT onboard the following categories: 1. Anonymous customers or customers using fictitious names. 2. Corporate entities whose beneficial ownership cannot be identified and verified above the 25 percent threshold. 3. Customers resident in or with primary funds sourced from FATF- listed high-risk or non-cooperative jurisdictions. 4. Customers who refuse to provide required KYC documentation. 3.3 High-risk customer onboarding requires prior approval from the Chief Compliance Officer and senior management before the relationship is established. 3.4 Note: The customer acceptance policy must be reviewed by a qualified Indian attorney to ensure compliance with applicable consumer protection and anti-discrimination law. 4. CUSTOMER RISK SCORING MATRIX 4.1 Every prospective borrower is assigned a risk tier at onboarding: LOW RISK: Salaried individual borrower, Indian resident, PAN verified, Aadhaar OTP eKYC completed, loan amount below INR 2,00,000, no adverse media. MEDIUM RISK: Self-employed individual, loan amount INR 2,00,000 to INR 5,00,000, digital business income, non-resident Indian borrower. HIGH RISK: PEP or PEP-connected, customer from FATF-listed jurisdiction, complex income structure, loan above INR 5,00,000 with unverifiable income source. 4.2 Higher risk tier triggers enhanced controls including additional documentation, senior management approval, and more frequent re-KYC. 4.3 Note: This risk scoring matrix must be calibrated to FastLend Finance Pvt Ltd's specific product and borrower profile and confirmed with a qualified Indian compliance specialist. 5. IDENTITY VERIFICATION — INDIVIDUAL BORROWERS 5.1 For LOW and MEDIUM risk individual borrowers FastLend Finance Pvt Ltd uses: 1. Aadhaar OTP-based eKYC as the primary verification method, being the highest level of digital identity certainty available under RBI Master Directions. 2. PAN card verification via NSDL for all loan applications above INR 50,000 as required under income tax law. 5.2 For customers unable to complete Aadhaar OTP eKYC, Video Customer Identification Process V-CIP is used as permitted under the applicable RBI Video KYC circular. 5.3 V-CIP technical requirements include: 1. Live interaction between the customer and a trained FastLend official. 2. Liveness detection to confirm the customer is physically present. 3. Original document capture and geo-tagging of the session. 5.4 Note: RBI V-CIP technical and procedural requirements and applicable guidelines for NBFC video KYC onboarding must be confirmed with a qualified Indian compliance specialist. 6. IDENTITY VERIFICATION — CORPORATE BORROWERS 6.1 For corporate borrowers FastLend Finance Pvt Ltd requires: 1. Certificate of Incorporation from the Ministry of Corporate Affairs MCA. 2. GST registration certificate. 3. PAN of the entity. 4. Memorandum and Articles of Association. 5. Board resolution authorizing the loan application. 6. Identity verification of all directors and authorized signatories as individual borrowers above. 6.2 Complex structures including holding companies, LLPs, and partnership firms require additional documentation to trace beneficial ownership through each layer of the structure. 7. BENEFICIAL OWNERSHIP IDENTIFICATION 7.1 For all corporate borrowers FastLend Finance Pvt Ltd identifies and verifies each natural person who ultimately owns or controls 25 percent or more of the corporate entity. 7.2 Beneficial owners must complete individual identity verification as described in Section 5. 7.3 FastLend Finance Pvt Ltd must obtain a written Beneficial Ownership Declaration signed by the entity's authorized representative confirming the identity of all beneficial owners. 7.4 Where a corporate structure is so complex that beneficial ownership cannot be identified the application must be referred to the Chief Compliance Officer for review and potential refusal. 7.5 Note: Beneficial ownership verification obligations under the RBI Master Directions on KYC 2016 and applicable Companies Act 2013 India must be confirmed with a qualified Indian attorney. 8. DIGITAL EKYK AND VIDEO KYC PROCEDURES 8.1 Aadhaar OTP eKYC is the primary digital verification method for individual borrowers under FastLend Finance Pvt Ltd's fully digital onboarding model, as permitted under the Aadhaar Targeted Delivery of Financial and Other Subsidies Benefits and Services Act 2016 and applicable RBI guidelines. 8.2 For non-Aadhaar customers V-CIP Video Customer Identification Process is used as the alternative digital onboarding method per the applicable RBI circular. 8.3 FastLend Finance Pvt Ltd's digital verification system must incorporate: 1. Automated liveness detection preventing spoofing by photograph or video replay. 2. Encrypted document capture with geo-tagging and timestamping. 3. Audit trail retention for each V-CIP session for the full record retention period. 8.4 Note: Applicable RBI technical standards for Aadhaar eKYC and V-CIP and any UIDAI restrictions on Aadhaar use by NBFCs must be confirmed with a qualified Indian compliance specialist. 9. PEP IDENTIFICATION AT ONBOARDING 9.1 FastLend Finance Pvt Ltd screens all prospective borrowers against a commercially available PEP database at the point of onboarding. 9.2 The following are treated as PEPs: 1. Domestic PEPs: Senior public officials, politicians, judges, and military officers. 2. Foreign PEPs: Equivalent officials of foreign governments. 3. Immediate family members: Spouse, children, and parents of a PEP. 4. Known close associates of a PEP. 9.3 A PEP identification triggers Enhanced Due Diligence and requires Chief Compliance Officer and senior management approval before the loan relationship is established. 9.4 The organization maintains an ongoing obligation to identify borrowers who become PEPs during the loan term. 10. ONGOING MONITORING AND RE-KYC TRIGGERS 10.1 FastLend Finance Pvt Ltd conducts ongoing monitoring of all active borrower relationships. 10.2 Periodic re-KYC is required at the following minimum frequency per RBI Master Directions: LOW RISK borrowers: Re-KYC every 10 years. MEDIUM RISK borrowers: Re-KYC every 8 years. HIGH RISK borrowers: Re-KYC every 2 years. 10.3 Re-KYC is also immediately triggered by any of the following events: 1. Expiry of an identity document used for verification. 2. A loan renewal or new loan application above the previous verification threshold. 3. Transaction pattern materially inconsistent with the declared income profile. 4. Adverse media identification against the borrower's name. 10.4 Note: RBI Master Directions periodic re-KYC frequency requirements must be confirmed with a qualified Indian compliance specialist. 11. SOURCE OF FUNDS 11.1 FastLend Finance Pvt Ltd collects and verifies source of funds information for all borrowers: Salaried borrowers: Last 3 months salary slips and bank statements. Self-employed borrowers: Last 2 years ITR, GST returns, and bank statements. 11.2 For HIGH RISK borrowers source of wealth documentation including property records, investment statements, or business ownership documents is additionally required. 12. CUSTOMER REFUSAL AND EXIT PROCEDURE 12.1 FastLend Finance Pvt Ltd reserves the right to refuse an application or terminate an existing loan relationship where: 1. The applicant or borrower fails to satisfy KYC requirements within a reasonable time. 2. Satisfactory beneficial ownership verification cannot be completed. 3. The customer is identified on a sanctions or designated list. 12.2 Relationship exit requires Chief Compliance Officer approval and is documented in a restricted internal record. 12.3 FastLend Finance Pvt Ltd is not required to give reasons for refusal where providing reasons would itself breach PMLA 2002 or applicable AML law. 12.4 Note: Customer refusal interaction with Consumer Protection Act 2019 India and RBI guidelines on fair lending practices must be confirmed with a qualified Indian attorney. 13. RECORD RETENTION 13.1 FastLend Finance Pvt Ltd retains all KYC records for a minimum of 5 years after the closure or termination of the customer relationship as required under PMLA 2002 Rule 3. 13.2 Records must be maintained in retrievable digital format and produced to RBI or FIU-IND on lawful request. 13.3 Note: The PMLA 2002 5-year retention obligation and its interaction with the DPDP Act 2023 India data minimization and storage limitation principles must be confirmed with a qualified Indian attorney. 14. STAFF TRAINING 14.1 All employees must complete KYC training at onboarding and annually. 14.2 Training covers Aadhaar and V-CIP digital verification procedures, document authenticity checks, PEP screening, beneficial ownership identification, re-KYC triggers, and escalation to the Chief Compliance Officer. 14.3 Training records are retained for 5 years. 15. POLICY GOVERNANCE AND REVIEW 15.1 This policy is approved by the Board of Directors of FastLend Finance Pvt Ltd annually. Next scheduled review: June 1 2027. 16. DATA PROTECTION AND PRIVACY 16.1 KYC records including Aadhaar data, PAN, and income documents are sensitive personal data handled only in accordance with the Digital Personal Data Protection Act 2023 India. 16.2 Note: DPDP Act 2023 India APP obligations for financial data and the specific restrictions on Aadhaar data storage by NBFCs must be confirmed with a qualified Indian attorney. 17. GOVERNING LAW AND REGULATOR 17.1 Laws of Maharashtra India, RBI Master Directions on KYC, and PMLA 2002 govern this policy. 17.2 FastLend Finance Pvt Ltd cooperates fully with all lawful RBI and FIU-IND requests and inspections. POLICY SIGN-OFF: Board Approval: ________________ Date: __________________________ Chief Compliance Officer: _______ Note: This policy must be reviewed by a qualified Indian financial compliance attorney before adoption. RBI Master Directions on KYC 2016 NBFC obligations, Aadhaar eKYC UIDAI restrictions, V-CIP technical requirements, PMLA 2002 principal officer criminal liability, Companies Act 2013 beneficial ownership, DPDP Act 2023 financial data obligations, Consumer Protection Act 2019 India customer refusal interaction, and PMLA 5-year retention versus DPDP Act storage limitation tension must all be confirmed before adoption. -------------------------------------------------- This KYC Policy draft was generated by an AI drafting tool as a structured preparation and documentation aid only. It does not constitute legal advice or regulatory compliance certification. RBI Master Directions on KYC and PMLA 2002 compliance must be confirmed with a qualified Indian attorney. Senior management remain personally criminally liable under PMLA 2002 Section 70. Always have this policy reviewed before adoption. --------------------------------------------------