KYC-AML-CFT Policy

Bhawana Capital Private Limited (“the Company”) is a non-deposit-taking Non-Banking Financial Company – Base Layer registered with the Reserve Bank of India (“RBI”). This Policy is adopted in compliance with the Reserve Bank of India (Non-Banking Financial Companies – Know Your Customer) Directions, 2025, as amended from time to time (“the KYC Directions”), the Prevention of Money-Laundering Act, 2002 (“PMLA”), the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005, as amended (“the PML Rules”), the Unlawful Activities (Prevention) Act, 1967 (“UAPA”) and the Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005 (“WMD Act”).

The objectives of this Policy are to enable the Company to know and understand its customers and their financial dealings, to manage money-laundering and terrorist-financing risks prudently, and to prevent the Company from being used, intentionally or otherwise, for money laundering, terrorist financing or other unlawful activity.

Customer Due Diligence (CDD) – identifying and verifying the customer and, where applicable, the beneficial owner, using reliable and independent sources of data or information.

Officially Valid Document (OVD) – the passport, the driving licence, proof of possession of Aadhaar, the Voter Identity Card, the NREGA job card duly signed by an officer of the State Government, or the letter issued by the National Population Register containing details of name and address.

Digital KYC – capturing a live photograph of the customer along with the OVD or proof of possession of Aadhaar, and the latitude and longitude of the location of capture, by an authorised officer of the Company.

V-CIP (Video-based Customer Identification Process) – a consent-based, real-time audio-visual interaction with the customer, undertaken by an authorised official, which is treated as face-to-face for the purposes of this Policy.

Beneficial Owner – the natural person who ultimately owns or controls a customer, or on whose behalf a transaction is conducted, determined in accordance with the PML Rules.

Politically Exposed Person (PEP) – an individual who is or has been entrusted with a prominent public function by a foreign country, including heads of States or Governments, senior politicians, senior government or judicial or military officers, senior executives of state-owned corporations and important political party officials.

KYC Identifier – the unique number or code assigned to a customer by the Central KYC Records Registry (“CKYCR”).

No account is opened and no disbursal is made in an anonymous, fictitious or benami name.

A customer is accepted only after successful CDD. Where CDD cannot be completed — for example owing to non-cooperation of the customer or the unreliability of documents or information — the relationship is not established, and the case is considered for filing a Suspicious Transaction Report.

No account-based relationship or transaction is undertaken without following the CDD procedure.

Mandatory KYC information is obtained at onboarding and at periodic updation; optional information is obtained only with the explicit consent of the customer.

The identity of the customer is screened against the sanctions and designated lists referred to in Section 9 before any account-based relationship is established, and thereafter on an ongoing basis.

These safeguards are applied so as not to cause harassment to genuine customers, nor to unduly restrict access to services for financially or socially disadvantaged segments.

Ongoing monitoring is carried out on a risk-sensitive basis to identify activity outside the normal or expected pattern, with enhanced attention to complex or unusually large transactions and to transactions with no apparent economic or lawful purpose. High-risk accounts are subjected to intensified monitoring and periodic review of risk categorisation.

For an individual customer, the Company carries out CDD through its digital platform in accordance with the KYC Directions. This comprises: verification of the Permanent Account Number; obtaining an Officially Valid Document, including through offline verification of Aadhaar or an equivalent e-document retrieved from the customer’s DigiLocker account; and capturing a live photograph of the customer, which is subjected to a liveness check and matched against the photograph on the document.

Aadhaar numbers are redacted or masked as required under the Aadhaar Act, and no unmasked Aadhaar number is retained.

Equivalent e-documents, e-Aadhaar and documents retrieved from the customer’s DigiLocker account are accepted to the extent permitted by the KYC Directions.

Where Digital KYC or V-CIP is used, it is carried out with the safeguards prescribed by RBI, including liveness detection, face matching, secure storage of the record and operation by trained officials.

Where account opening through OTP-based e-KYC in non-face-to-face mode is used, it is undertaken only subject to the conditions and limits prescribed by RBI, and such accounts are subjected to full CDD within the period prescribed.

Where the customer is acting on behalf of another person or entity, the identity of the beneficial owner is also established and verified.

Non-face-to-face onboarding. Where CDD is completed in non-face-to-face mode (other than through V-CIP, which is treated as face-to-face), the Company applies the safeguards prescribed for non-face-to-face customer onboarding, including verification of the Permanent Account Number from the database of the issuing authority, verification of the customer’s mobile number and contact details, and disbursal of the first credit into the borrower’s own verified bank account. Customers onboarded in non-face-to-face mode are categorised as High risk and subjected to enhanced monitoring until their identity is verified in a face-to-face manner or through V-CIP. The form of enhanced due diligence and monitoring applied to such customers is laid down in the operating procedures approved under this Policy.

Where CDD processes are executed through a technology service provider or an LSP on the Company’s behalf, the Company remains fully and ultimately responsible for the CDD so performed (see Section 15).

The Company carries out periodic updation of KYC records on a risk-based basis, in accordance with the timelines prescribed by RBI — presently at least once every two years for High-risk customers, once every eight years for Medium-risk customers and once every ten years for Low-risk customers, from the date of opening of the account or the last KYC updation. Where there is no change in the KYC information, a self-declaration from the customer is sufficient; where only the address has changed, a self-declaration of the new address is obtained and verified within the prescribed period. Customers are given advance intimation of the requirement for periodic updation.

The Company screens customers and beneficial owners, at onboarding and on an ongoing basis, against the lists of individuals and entities designated under Sections 35 and 51A of the UAPA (including the United Nations Security Council lists), and against any other list circulated by RBI or the Government of India. The Company likewise implements, without delay, orders issued under Section 12A of the WMD Act, including the freezing, unfreezing and prohibition of transactions involving designated persons.

Where a match is found, the Company does not establish the relationship or carry out the transaction, freezes the funds and assets as required, and reports the matter without delay to the prescribed authorities and to FIU-IND.

The Board nominates a Designated Director who is responsible for ensuring overall compliance with the obligations imposed under the PMLA and the PML Rules. The Principal Officer is not nominated as the Designated Director. The details of the Designated Director are communicated to FIU-IND.

Records of transactions are maintained for at least five years from the date of the transaction. Records of the identity and address of customers, and the CDD records, are maintained for at least five years after the business relationship ends or the account is closed, whichever is later. Records are maintained in a manner that permits their retrieval and reconstruction, and their production to competent authorities, without delay.

Where onboarding or CDD processes are executed through an LSP or a technology service provider, such provider acts solely as the Company’s agent. The decision to accept a customer and the determination of compliance with KYC norms are not outsourced; all KYC records are held in, and available to, the Company’s systems; and the Company retains audit and inspection rights over the provider’s KYC processes. The Company remains fully and ultimately responsible for CDD irrespective of such arrangements.

The Company applies appropriate screening at the time of hiring employees who have access to customer information or to AML/CFT processes. Employees, and the staff of LSPs and agents who interact with customers, receive ongoing training on KYC, AML and CFT obligations, on the identification and reporting of suspicious transactions and on the prohibition against tipping off, calibrated to the role of the person concerned.

Information collected from customers for the purpose of KYC is treated as confidential and is not disclosed for any other purpose, including cross-selling, without the express consent of the customer, save where disclosure is required by law or by a competent authority.