AML & KYC Policy

Paywize Technologies Pvt. Ltd. (“Paywize”) is a Technology Service Provider (TSP) providing API-driven technology infrastructure that enables businesses to integrate with licensed banking and payment partners.

Paywize maintains risk-management, business-verification, security, and compliance-support controls designed to prevent misuse of its technology platform for unlawful activities.

Where KYC, AML, Countering Financing of Terrorism (CFT), transaction monitoring, regulatory reporting, account restrictions, or other regulated compliance obligations apply to services provided by a licensed banking or payment partner, such obligations are performed by the applicable regulated entity in accordance with Applicable Law.

Paywize may facilitate information collection, technology controls, screening, monitoring support, and information exchange with applicable licensed partners to support their compliance processes.

• Define Paywize’s risk, merchant-verification, and AML/KYC compliance-support framework for its technology platform.
• Support compliance with applicable AML/CFT requirements relevant to Paywize’s role as a TSP and facilitate applicable compliance processes of licensed banking and payment partners.
• Facilitate appropriate cooperation with licensed partners, competent authorities, and law-enforcement agencies where legally required.

This Policy applies to:

• Merchants and businesses accessing Paywize’s technology platform;
• Employees, authorised representatives, consultants, and other personnel involved in onboarding, verification, risk, compliance, and platform operations;
• Paywize technology services supporting payout, collection, reconciliation, connected banking, and other applicable workflows through licensed partners; and
• Compliance-support activities performed by Paywize within its role as a Technology Service Provider.

Paywize does not independently perform regulated fund movement, settlement, banking, or payment-processing activities solely by providing its technology services. Such underlying regulated activities are performed by applicable licensed partners.

Money laundering is the process of disguising the origin of illegally obtained funds to make them appear legitimate. It typically involves three stages

• Placement – Introducing illegal funds into the financial system.
• Layering – Concealing the source through complex transactions.
• Integration – Reintroducing funds into the legitimate economy.

Paywize is committed to preventing misuse of its technology platform for activities associated with money laundering or other financial crime and to supporting applicable licensed partners in their AML/CFT controls.

We recognize and actively mitigate the following AML-related risks

• Reputational Risk
• Compliance Risk
• Operational Risk
• Legal Risk
• Financial Risk

Paywize applies a risk-based approach to merchant onboarding, platform-risk assessment, business verification, and technology-based monitoring within the scope of its services. Where transaction monitoring constitutes a regulatory obligation of a licensed partner, Paywize may provide technology, data, alerts, or operational support to facilitate that partner’s monitoring processes.

Paywize maintains an internal compliance and risk-management framework appropriate to its role as a Technology Service Provider. This may include:

• Defined merchant onboarding and verification standards;
• Internal compliance and risk responsibilities;
• Escalation procedures for suspicious or prohibited platform activity;
• Periodic training for relevant personnel;
• Internal reviews and control assessments; and
• Coordination with applicable licensed partners where regulated AML/KYC requirements arise.

Legal should separately confirm whether 'Designated Director' and 'Principal Officer' are legally applicable titles for Paywize.

Paywize may assign merchants an internal platform-risk classification based on factors such as:

• Business type and operating model;
• Expected transaction activity;
• Geographic exposure;
• Integration and delivery channels;
• Product usage;
• Compliance or fraud-risk indicators; and
• Other relevant risk factors.

Higher-risk cases may be subject to additional review, documentation, approval, monitoring, or partner escalation. Applicable licensed partners may independently assign their own risk classifications and conduct additional due diligence.

Paywize’s platform-risk classification is an internal technology and operational assessment. It is not, and should not be treated as, the regulatory risk rating of a licensed banking or payment partner.

Where elevated risk indicators are identified, Paywize may request additional business information or documentation for platform-risk assessment or facilitate additional due-diligence requirements requested by the applicable licensed partner.

Additional information may include business financials, ownership information, transaction-use cases, source-related information where relevant, licences, agreements, invoices, or other supporting documentation.

Where formal Enhanced Due Diligence is required under Applicable Law for a regulated financial service, such EDD is performed by or under the requirements of the applicable licensed partner.

Paywize may use automated and manual technology controls to identify unusual, suspicious, prohibited, fraudulent, or potentially unlawful activity occurring through or affecting its platform.

Indicators may include:

• Activity inconsistent with the Merchant's declared business profile;
• Unusual transaction patterns;
• Unexpected changes in platform usage;
• Potential fraud indicators;
• High-risk or prohibited activity; and
• Other risk signals identified through Paywize's technology or partner notifications.

Where Paywize identifies activity requiring further review, it may restrict platform access, request additional information, conduct an internal review, or escalate relevant information to the applicable licensed banking or payment partner.

Where the applicable licensed partner is the entity responsible for statutory suspicious-transaction reporting, the partner will determine whether an STR or other regulatory report is required and will make such filing with the appropriate authority in accordance with Applicable Law.

Where Paywize receives a valid legal, regulatory, law-enforcement, or licensed-partner instruction affecting a Merchant, Paywize may take appropriate action within the scope of its technology platform, including restricting or suspending access to Paywize systems, APIs, credentials, or technology services.

Where an instruction requires freezing, unfreezing, blocking, withholding, or otherwise restricting an account or funds maintained by a licensed banking or payment partner, such action will be undertaken by the applicable partner in accordance with Applicable Law and valid regulatory or legal directions.

Paywize may provide reasonable technical and operational assistance to facilitate implementation of such requirements where legally permitted.

Paywize may retain records relevant to its technology services, merchant onboarding, verification, platform activity, risk assessments, compliance escalations, and partner communications for periods required under Applicable Law, applicable contractual requirements, internal policies, or legitimate operational requirements.

Such records may include:

• Merchant onboarding and verification documentation;
• Platform and transaction-related technology records;
• API and system logs;
• Risk and compliance review records;
• Partner escalation records; and
• Other records required for audit, security, dispute, or legal purposes.

Regulatory records required to be maintained by a licensed partner remain subject to that partner’s statutory obligations.

• Maintain Paywize's internal risk and compliance-support controls;
• Review platform-risk alerts and escalations;
• Coordinate with applicable licensed partners where required;
• Maintain appropriate merchant verification and compliance-support records;
• Respond to authorised legal or regulatory requests within Paywize's applicable responsibilities; and
• Conduct relevant staff training and internal reviews.

If Paywize genuinely has formally appointed statutory officers under an applicable legal requirement, Legal can separately specify those roles.

Appropriate AML/KYC, financial-crime-risk, platform-risk, and compliance training relevant to each employee’s responsibilities.

Training may cover:

• Suspicious-activity indicators
• Merchant verification requirements
• Escalation procedures
• Confidentiality obligations
• Documentation standards
• Applicable partner processes

Paywize’s merchant-verification, platform-risk, AML/KYC support, and related compliance controls may be subject to periodic internal review or audit based on applicable requirements and Paywize’s internal governance framework.

This Policy will be periodically reviewed and updated to reflect material changes in Applicable Law, partner requirements, technology services, risk controls, and operational practices.

Paywize is committed to safeguarding its technology platform against misuse for fraud, money laundering, terrorist financing, and other unlawful activity.

As a Technology Service Provider, Paywize maintains appropriate platform-risk and compliance-support controls and works with applicable licensed banking and payment partners to support their regulatory compliance requirements.

Underlying regulated financial services and associated statutory AML/KYC obligations remain the responsibility of the applicable regulated entity where required under Applicable Law.

Paywize Technologies Pvt. Ltd. is a Technology Service Provider (TSP). Paywize provides API-driven technology infrastructure enabling businesses to integrate with licensed banking and payment partners. Paywize does not independently operate as a bank, payment aggregator, payment system operator, NBFC, wallet provider, or custodian of Merchant funds unless expressly authorised under Applicable Law. Regulated banking and payment services, including applicable KYC/AML obligations, transaction execution, settlement, account or fund restrictions, and regulatory reporting, are performed by the relevant licensed partner where required under Applicable Law.