Fraud Prevention, Risk Management and Anti-Fraud Policy

1. INTRODUCTION

This Fraud Prevention, Risk Management and Anti-Fraud Policy ("Policy") has been formulated and adopted by PROSPER PROFESSIONAL DEVELOPMENT LIFE PRIVATE LIMITED ("PROSPER", "Company", "We", "Us", or "Our"), a technology-enabled B2B financial services and fintech company incorporated under the Companies Act, 2013, engaged in providing digital financial services, payment solutions, business correspondent services, merchant acquiring services, and financial inclusion services through its authorized agents, distributors, retailers, merchants, and banking partners across India.

PROSPER recognizes that fraud prevention, risk management, and financial crime mitigation are critical to maintaining trust, protecting customers, ensuring regulatory compliance, and preserving the integrity of the financial ecosystem. This Policy establishes a comprehensive framework to prevent, detect, investigate, report, and mitigate fraud, cybercrime, money laundering, identity theft, account takeover, payment fraud, and other financial crimes.

This Policy shall apply to all employees, agents, distributors, merchants, customers, service providers, technology partners, and third-party entities associated with PROSPER.

2. PURPOSE OF THE POLICY

The objectives of this Policy are:

• To establish a robust fraud prevention framework;
• To identify and mitigate operational and financial risks;
• To protect customers and agents from fraudulent activities;
• To ensure compliance with RBI, NPCI, FIU-IND, and other regulatory requirements;
• To establish procedures for fraud detection and reporting;
• To prevent money laundering and terrorist financing;
• To protect customer funds and data;
• To maintain the integrity of PROSPER's services and operations;
• To facilitate cooperation with law enforcement agencies.

3. REGULATORY FRAMEWORK

This Policy has been developed in accordance with:

• Prevention of Money Laundering Act, 2002 (PMLA);
• Prevention of Money Laundering Rules, 2005;
• Information Technology Act, 2000;
• Digital Personal Data Protection Act, 2023;
• Reserve Bank of India Act, 1934;
• Payment and Settlement Systems Act, 2007;
• RBI Master Directions on KYC;
• RBI Payment Aggregator Guidelines;
• RBI Cyber Security Framework;
• NPCI Operational Guidelines;
• FIU-IND Guidelines;
• CERT-In Directions;
• Aadhaar Act, 2016;
• FATF Recommendations;
• Other applicable laws and regulations.

4. SCOPE OF THE POLICY

This Policy applies to all services facilitated through PROSPER, including but not limited to:

• Bharat Bill Payment System (BBPS);
• Aadhaar Enabled Payment System (AEPS);
• Micro ATM Services;
• Domestic Money Transfer (DMT);
• Merchant Payment Services;
• UPI Payment Services;
• Prepaid Card Services;
• Business Correspondent Services;
• Account Opening Services;
• Insurance Facilitation Services;
• Loan Facilitation Services;
• Financial Inclusion Services;
• Other digital financial services.

5. DEFINITIONS

6. TYPES OF FRAUD COVERED

This Policy covers, but is not limited to:

7. FRAUD RISK MANAGEMENT FRAMEWORK

PROSPER adopts a three-layer fraud management framework:

8. CUSTOMER VERIFICATION CONTROLS

PROSPER shall implement:

• KYC verification;
• PAN verification;
• Aadhaar verification;
• Mobile OTP verification;
• Device verification;
• Bank account validation;
• Video KYC where applicable;
• Beneficial ownership verification.

No customer shall be onboarded anonymously.

9. AGENT AND MERCHANT DUE DILIGENCE

Before onboarding agents or merchants, PROSPER shall conduct:

• KYC verification;
• Business verification;
• AML screening;
• PEP screening;
• Sanctions screening;
• Criminal background checks;
• Bank verification;
• Fraud history assessment.

10. TRANSACTION MONITORING

PROSPER shall continuously monitor:

• Transaction frequency;
• Transaction velocity;
• Geographic anomalies;
• Device changes;
• Behavioral changes;
• Duplicate transactions;
• Unusual payment patterns;
• High-risk transactions.

Transactions may be automatically flagged, restricted, or blocked.

11. FRAUD DETECTION SYSTEMS

PROSPER may utilize:

• Artificial Intelligence (AI);
• Machine Learning models;
• Rule-based monitoring engines;
• Device fingerprinting;
• Behavioral analytics;
• Geo-location analysis;
• Velocity monitoring;
• Risk scoring engines;
• Fraud analytics systems.

12. HIGH-RISK ACTIVITIES

The following activities shall be treated as high-risk:

• Multiple failed login attempts;
• Rapid fund movement;
• Suspicious IP addresses;
• Multiple accounts from same device;
• Fake documentation;
• Large-value transactions;
• Sudden changes in transaction behavior;
• Transactions from restricted jurisdictions;
• High-volume cash transactions.

13. SUSPICIOUS ACTIVITY REPORTING

Employees, agents, and partners shall immediately report:

• Suspected fraud;
• Unauthorized transactions;
• Identity theft;
• Cyber incidents;
• Money laundering concerns;
• Security breaches.

14. ACCOUNT FREEZING AND TRANSACTION HOLD

PROSPER reserves the right to:

• Freeze accounts;
• Hold transactions;
• Suspend services;
• Restrict withdrawals;
• Block customers;
• Disable agents.

Such actions may be taken without prior notice where fraud is suspected.

15. FRAUD INVESTIGATION PROCEDURE

Upon identification of suspicious activity:

16. REPORTING TO AUTHORITIES

PROSPER may report fraudulent activities to:

• FIU-IND;
• RBI;
• NPCI;
• CERT-In;
• Cyber Crime Cell;
• State Police;
• Enforcement agencies;
• Courts of competent jurisdiction.

17. LAW ENFORCEMENT COOPERATION

PROSPER shall cooperate with:

• Cyber Crime Police;
• Financial Investigation Agencies;
• RBI;
• NPCI;
• FIU-IND;
• CERT-In;
• Courts and Tribunals.

The Company may provide:

• Transaction details;
• IP addresses;
• Device identifiers;
• Account information;
• KYC documents;
• Audit trails;
• Server logs;
• Digital evidence.

18. CYBER SECURITY CONTROLS

PROSPER implements:

• AES-256 encryption;
• TLS 1.2+ encryption;
• Multi-factor authentication;
• Device binding;
• Role-based access control;
• Intrusion detection systems;
• Firewalls;
• Security monitoring;
• Endpoint protection;
• Vulnerability assessments;
• Penetration testing.

19. CUSTOMER RESPONSIBILITIES

Customers shall:

• Maintain confidentiality of credentials;
• Protect OTPs;
• Verify beneficiaries;
• Report fraud immediately;
• Avoid sharing sensitive information;
• Exercise due care.

PROSPER shall not be liable for losses caused by customer negligence.

20. EMPLOYEE TRAINING

PROSPER shall conduct regular training on:

• Fraud awareness;
• Cyber security;
• AML/CFT;
• Social engineering;
• Financial crime prevention;
• Incident response.

21. DATA RETENTION

Fraud-related records shall be retained for:

• Minimum five (5) years;
• Or longer if required by law or investigation.

Records include:

• Transaction logs;
• KYC records;
• Investigation reports;
• Audit logs;
• Communication records.

22. PENALTIES AND DISCIPLINARY ACTION

Violations may result in:

• Warning;
• Suspension;
• Termination;
• Commission forfeiture;
• Financial recovery;
• Civil proceedings;
• Criminal prosecution.

23. GRIEVANCE AND FRAUD REPORTING

24. POLICY REVIEW

This Policy shall be reviewed:

• Annually;
• Upon regulatory changes;
• Following fraud incidents;
• Upon introduction of new products.

25. GOVERNING LAW AND JURISDICTION

This Policy shall be governed by the laws of India.

Any disputes arising under this Policy shall be subject to the exclusive jurisdiction of the competent courts at Lucknow, Uttar Pradesh.

26. EFFECTIVE DATE

This Policy shall become effective on 01 July 2026 and remain in force until modified or withdrawn.

27. DECLARATION

This Fraud Prevention, Risk Management and Anti-Fraud Policy has been approved by the management of PROSPER PROFESSIONAL DEVELOPMENT LIFE PRIVATE LIMITED and shall be binding upon all employees, agents, distributors, merchants, customers, service providers, and business partners.