KYC Policy

1. RBI Circular on KYC

The master direction ‐ “Reserve Bank of India (Non-Banking Financial Companies – Know Your Customer) Directions, 2025 Notified for Non-Banking Financial Companies (including Housing Finance Companies) on November 28, 2025 (updated on December 29,2025) and amendment there in time to time.

The objective of “Know Your Customer (KYC)” guidelines is to prevent any Financial Institution (FI) from being used, intentionally or unintentionally, by criminal elements for money laundering or terrorist financing activities. KYC procedure also enables FI to know/ understand their customer and their financial dealings better which in turn help them to manage their risk prudently.

2. Applicability of Circular

This Policy applies to all business units, products, services, delivery channels and customer interfaces of Company, including branches and majority-owned subsidiaries located abroad to the extent not inconsistent with local law.

The Know Your Customer (KYC) and AML policy shall approve by the Board of Directors or any committee of the Board to which power has been delegated.

The provisions of this policy are in line with the Guidelines issued by RBI and shall apply (with updates and amendments) to Company at all times.

3. Relevant Definitions

In these policy, unless the context otherwise requires, the following meanings are assigned to the terms herein: Terms bearing meaning assigned in terms of the Prevention of Money-Laundering Act, 2002, and the Prevention of MoneyLaundering (Maintenance of Records) Rules, 2005:

i) ‘Aadhaar number’ shall have the meaning assigned to it in clause (a) of section 2 of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (18 of 2016);

ii) ‘Act’ and ‘Rules’ mean the Prevention of Money-Laundering Act, 2002 and the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005, respectively and amendments thereto.

iii) ‘Authentication’, in the context of Aadhaar authentication, means the process as defined under sub-section (c) of section 2 of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016.

iv) ‘Beneficial Owner (BO)’

i. Where the customer is a company, the beneficial owner is the natural person(s), who, whether acting alone or together, or through one or more juridical persons, has / have a controlling ownership interest or who exercises control through other means.
Explanation: For the purpose of this sub-clause- ‘Controlling ownership interest’ means ownership of / entitlement to more than 10 percent of the shares or capital or profits of the company.

‘Control’ shall include the right to appoint the majority of the directors or to control the management or policy decisionsincluding by virtue of theirshareholding or management rights or shareholders agreements or voting agreements.

ii. Where the customeris a partnership firm, the beneficial owneristhe natural person(s), who, whether acting alone or together, or through one or more juridical person(s), has / have ownership of / entitlement to more than 10 percent of capital or profits of the partnership or who exercises control through other means.
Explanation: For the purpose of this sub-clause, ‘control’ shall include the right to control the management or policy decision.

iii. Where the customer is an unincorporated association or body of individuals, the beneficial owner is the natural person(s), who, whether acting alone or together, or through one or more juridical person, has /have ownership of / entitlement to more than 15 percent of the property or capital or profits of the unincorporated association or body of individuals.
Explanation: Term ‘body of individuals’ includes societies. Where no natural person is identified under (a), (b)or(c) above,thebeneficialowneristherelevantnaturalperson who holds the position of senior managing official.

iv. Where the customer is a trust, the identification of beneficial owner(s) shall include identification of the author of the trust, the trustee, the beneficiaries with 10 percent or more interest in the trust and any other natural person exercising ultimate effective control over the trust through a chain of control or ownership.

 

v) ‘Central KYC Records Registry (CKYCR)’ means an entity defined under Rule 2(1) of the Rules, to receive, store, safeguard and retrieve the KYC records in digital form of a customer.

vi) ‘Designated Director’ means a person whom the Company designates to ensure overall compliance with the obligations imposed under chapter IV of the PML Act and the Rules and shall include the Managing Director or a whole-time Director, whom the Board of Directors has duly authorised.
Explanation: For the purpose of this clause, the terms ‘Managing Director’ and ‘Whole-time Director’shall have the meaning assigned to them in the Companies Act, 2013.

vii) ‘Digital KYC’ means that an authorised officer of the Company captures a live photo of the customer and officially valid document or the proof of possession of Aadhaar (where offline verification cannot be carried out), along with the latitude and longitude of the location where such live photo is being taken, as per the provisions contained in the Act.

viii) ‘Digital Signature’ shall have the same meaning as assigned to it in clause (p) of sub-section (1) of section (2) of the Information Technology Act, 2000 (21 of 2000).

ix) Know Your Client (KYC) Identifier’ means the unique number or code that the Central KYC Records Registry assigns to a customer.
Explanation: A customer can obtain his KYC Identifierthrough the following ways:
In the process of opening an account, once the customer’s KYC Identifieris generated by CKYCR and provided to the Company, the latter shall share the same with the concerned customer. The customer can also access his KYC Identifier on CKYCR Portal (www.ckycindia.in).

x) Non-profit organisations (NPO)’ means any entity or organisation, constituted for religious or charitable purposes referred to in clause (15) of section 2 of the Income-tax Act, 1961 (43 of 1961), that isregistered as a trust or a society under the Societies Registration Act, 1860 or any similar State legislation or a company registered under section 8 of the Companies Act, 2013 (18 of 2013).

xi) Officially Valid Document (OVD)’ means the passport, the driving licence, proof of possession of Aadhaar number, the Voter's Identity Card that the Election Commission of India issues, the job card that NREGA issues and an officer of the State Government duly signs, and the letter that the National Population Register issues containing details of name and address.

Provided that,

a) where the customer submits his proof of possession of Aadhaar number as an OVD, he may submit it in such form that the Unique Identification Authority of India (UIDAI) issues

b) When the customer furnishes an OVD does not have updated address, the following documents shall be deemed to be OVDs for the limited purposes of proof of address:

• Utility bill which is not more than two months old of any service provider (electricity, telephone, post-paid mobile phone, piped gas, water bill);
• Property or Municipal tax receipt;
• Pension or family pension payment orders (PPOs) issued to retired employees by Government Departments or Public Sector Undertakings, if they contain the address;
• Letter of allotment of accommodation from employer issued by State Government or Central Government Departments, statutory or regulatory bodies, public sector undertakings, scheduled commercial banks, financial institutions and listed companies and leave and licence agreements with such employers allotting official accommodation;

 

c) The Customer shall submit OVD with current address within period of three months of submitting the documents specified ay (b) above

d) The cases, where the OVD presented by a foreign national does not contain the details of address, in such case the documents issued by the Government departments of foreign jurisdictions and letter issued by the Foreign Embassy or Mission in India shall be accepted as proof of address

xii) Offline verification’ shall have the same meaning as assigned to it in clause (pa) of section 2 of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (18 of 2016).

xiii) Person’ hasthe same meaning assigned in the Act and includes an individual;
a HUF;
a company;
an association of person or body of individuals, whether incorporated or not;
Every artificial juridical person, not falling within any one of the above persons;
Any office, agency, branch owned or controlled by any of the above persons.

Where the customer is a trust, the identification of beneficial owner(s) shall include identification of the author of the trust, the trustee, the beneficiaries with 10 percent or more interest in the trust and any other natural person exercising ultimate effective control over the trust through a chain of control or ownership.

Unless the context otherwise requires, terms in the policy shall bear the meaning assigned to them below:

1. ‘Customer’ means a person who is engaged in a financial transaction or activity with the company and includes a person on whose behalf the person who is engaged in the transaction or activity, is acting.
2. ‘Customer Due Diligence (CDD)’ means identifying and verifying the customer and the beneficial owner using reliable and independent sources of identification.
   Explanation: The CDD, at the time of commencement of an account-based relationship or while carrying out occasional transaction of an amount equal to or exceeding ₹50,000 whether conducted as a single transaction or several transactions that appear to be connected, or any international money transfer operations, shall include

   (a) Identification of the customer, verification of their identity using reliable and independent sources of identification, obtaining information on the purpose and intended nature of the business relationship, where applicable;

   (b) Taking reasonable steps to understand the nature of the customer's business, and its ownership and control;

   (c) Determining whether a customer is acting on behalf of a beneficial owner and identifying the beneficial owner and taking all steps to verify the identity of the beneficial owner, using reliable and independent sources of identification.

3. ‘Customer identification’ means undertaking the process of CDD.
4. ‘FATCA’ means Foreign Account Tax Compliance Act of the United States of America (USA) which, inter alia, requires foreign financial institutions to report about financial accounts held by U.S. taxpayers or foreign entities in which U.S. taxpayers hold a substantial ownership interest.
5. ‘IGA’ means Inter Governmental Agreement between the Governments of India and the USA to improve international tax compliance and to implement FATCA of the USA
6. KYC Templates’ means templates prepared to facilitate collating and reporting KYC data to the CKYCR, for individuals and legal entities.
7. On-going Due Diligence’ means regular monitoring of transactions in accounts to ensure that transactions are consistent with theNBFC’s knowledge about the customers, customers’ business and risk profile, the source of funds / wealth.
8. Periodic Updation’ means the steps taken to ensure that documents, data or information collected under the CDD process are kept up-to-date and relevant by undertaking reviews of existing records at the periodicity prescribed by the RBI.

Other General Guidelines:

“Designated Director” means a person designated by the company to ensure overall compliance with the obligations imposed under Chapter IV of the PML Act and the Rules and shall include:

• The Managing Director or a whole-time Director, duly authorized by the Board of Directors, if a company,
Explanation - For the purpose of this clause, the terms "Managing Director" and "Whole-time Director" shall have the meaning assigned to them in the Companies Act, 2013.
The Name, Designation and address of designated director shall be communicated to the FIU‐IND and RBI.
The company shall not nominate the principal officer as “designated director”

“Principal officer”: Company to nominate an officer at management level, who shall be responsible for furnishing information as per rule 8 of Prevention of Money‐Laundering (Maintenance of Records) Rules, 2005. The Principal Officer shall be responsible for ensuring compliance, monitoring transactions, and sharing and reporting information as required under the law/regulations. The name, designation, contact details and address of the Principal Officer shall be communicated to the FIU‐IND and RBI

4. Key Elements

KYC is an ongoing process which starts with the beginning of relationship and runs through the life cycle of our relationship with the borrower. KYC Policy includes below 4 key elements:

(a) Customer Acceptance Policy;

(b) Risk Management;

(c) Customer Identification Procedures (CIP); and

(d) Monitoring of Transactions

5. Compliance of the KYC Policy

 

• Senior Management or HOD ofthe respective departments are responsible forthe purpose of KYC compliance, allocation of the responsibility of effective implementation of policies and procedures to their teams.
• Company also ensures independent evaluation of the compliance function of the policies and procedures including legal and regulatory requirement.
• Company has Concurrent/internal audit system to verify the compliance with KYC/AML policies and procedures.
• Submission of quarterly audit notes and compliance to the Audit Committee.
• Company shall ensure that decision‐making functions of determining compliance with KYC norms are not outsourced.
  In terms of PML Rules, groups shall implement group-wide policies for the purpose of discharging obligations under the provisions of Chapter IV of the PML Act, 2002. Accordingly, every company which is part of a group, shall implement group‐wide programs against money laundering and terror financing, including group‐wide policies for sharing information required for the purposes of client due diligence and money laundering and terror finance risk management and such programs shall include adequate safeguards on the confidentiality and use of information exchanged, including safeguards to prevent tipping‐off.

 

6. Money Laundering and Terrorist Financing Risk Assessment

Company shall carry out ‘Money Laundering (ML) and Terrorist Financing (TF) Risk Assessment’ exercise periodically to identify, assess and take effective measures to mitigate its money laundering and terrorist financing risk for clients, countries or geographic areas, products, services, transactions or delivery channels, etc.

The assessment process should consider all the relevant risk factors before determining the level of overall risk and the appropriate level and type of mitigation to be applied.While preparing the internalrisk assessment,the Company shall take cognizance of the overall sector‐specific vulnerabilities, if any, that the regulator may share with the Company from time to time.

The risk assessment by Company shall be properly documented and be proportionate to the nature, size, geographical presence, complexity of its activities/structure, etc. Further, the periodicity of risk assessment exercise shall be determined by the Board or any other committee of the board to which power has been delegated, in alignment with the outcome of the risk assessment exercise. However, it should be reviewed at least annually.

The outcome of the exercise shall be put up to the Board or any committee of the Board to which power in this regard has been delegated and should be available to competent authorities and self‐regulating bodies.

Company shall apply a Risk Based Approach (RBA) and implement a CDD program to identify ML/TF risks , size of business for mitigation and management of the identified risk and should have Board approved policies, controls and procedures in this regard. Further, it shall monitor the implementation of the controls and enhance them if necessary.

7. Customer Acceptance Policy

Below guidelines must be followed while appraisal a loan application:

(a) No loan to be sanctioned in anonymous orfictitious/benami name.

(b) No loan to be sanctioned where we are unable to collect proper KYC documents (as per policy) either due to non‐cooperation ofthe borrower or due to non‐reliability ofthe documents/information furnished by the borrower(FCU Fraud).The Company shall consider filling a STR, if necessary, when it is unable to comply with the relevant CDD measures in relation to customer.

(c) No loan to be disbursed without following the CDD (Customer Due Diligence) procedure.

(d) The mandatory information to be sought for KYC purpose prior to disbursal of a loan and during the periodic updation (post disbursal), has been mentioned in this policy.

(e) Optional/ additional information to be obtained with the explicit consent of the customer afterloan disbursal.

(f) CDD measures should be applied at CUID/ UCIC level. Thus, If an existing CKYC compliant customer of Company desires to avail Top Up or another loan, there shall be no need for a fresh CDD exercise except for scenarios where address of borrower has changed and/ or in case of change in Risk Category

(g) KYC documentation is mandatory for all borrowers, co‐borrower, Guarantor & POA Holder while disbursing a loan.

(h) Circumstances in which a borrower is permitted to act on behalf of another person/ entity, is allowed as per defined guidelines in this policy.

(i) Credit department to ensure that the identity of the borrower does not match with any person or entity, whose name appears in the sanctions lists circulated by Reserve Bank of India from time to time.

(j) Where a Permanent Account Number (PAN) is obtained, same shall be verified from issuing authority.

(k) Verify the customer’s digital signature on the equivalent e-document (if obtained) as perthe provisions of the Information Technology Act, 2000.

(l) Where GST details are available, TheGST numbershall be verified fromthe search/verification facility of issuing authority (GST portal)

Note: a) The Company ensure that no individual is denied access to its financial services solely on the basis of being financially or socially disadvantaged, including Persons with Disabilities (PwDs). All applications for onboarding and for periodic KYC updation shall be assessed with due diligence and cannot be rejected without proper consideration. In the event an application is rejected, the responsible officer shall record the specific and justified reasons for such rejection.

b) Where Company forms a suspicion of money laundering or terrorist financing, and it reasonably believes that performing the CDD process will tip-off the customer, it shall not pursue the CDD process, and instead file an STR with FIU-IND.

8. Risk Management /Categorisation norms

For Risk management, Company have a risk-based approach which included the following:

• Th borrowershall be categorized as a low, medium and high risk category based on parameters defined in this policy.

• The customers/Borrower(s), basis their profile, identity, social/ financial status, nature of business activity, and information about the borrower’s business & their location etc., are categorized under 3 types of Risk. While considering customer’s identity, the ability to confirm identity documents through online or other services offered by issuing authorities may also be factored in.

• The risk categorization of a customer and the specific reasons for such categorization shall be kept confidential and shall not be revealed to the customer to avoid tipping off the customers.

(i) Low Risk: Individuals (other than High Net Worth) and entities whose identities and sources of wealth can be easily identified and transactions in whose accounts by and large conform to the known profile may be categorized as low risk. Illustrative examples of low-risk customers could be salaried employees whose salary structures are well defined, people belonging to lower economic strata of the society whose accounts show small balances and low turnover, Government Departments & Government owned companies, regulators and statutory bodies, etc.

(ii) Medium Risk: Customers that are likely to pose a higher than average risk may be categorized as medium risk depending on customer's background, nature and location of activity, country of origin, sources of funds and profile, Non Resident Indians.

(iii) High Risk: Examples of customersrequiring higher due diligence may include:

• High net worth individuals,

• Companies having close family shareholding or beneficial ownership (BO)*

• Politically exposed persons (PEPs), including relatives or close associates of PEP’s and accounts where PEP is the Ultimate Beneficial Owner.

• Marketing firms, specially accounts of Multi-level -Marketing (MLM) companies,

• Customers with Suspicious Transactions

• Those with dubious reputation as per public information available,

• Customers from FATF high risk jurisdiction and increased monitoring jurisdiction.

• Trusts/NGO/NPO

• High-risk Industry (e.g. Arms and Ammunition business, Lottery, Gambling, Gems and Jewellery business etc.)

*Beneficial Owner –

(a) Where the customer is a company, the beneficial owner is the natural person(s), who, whether acting alone or together, or through one or more juridical person, has/have a controlling ownership interest or who exercise control through other means.

Explanation ‐ For the purpose of this sub‐clause:‐

(i) "Controlling ownership interest" means ownership of/entitlement to more than 10% of the shares or capital or profits of the company.

(ii) "Control" shall include the right to appoint a majority of the directors or to control the management or policy decisions including by virtue of their shareholding or management rights or shareholders agreements or voting agreements.

(b) Where the customer is a partnership firm, the beneficial owner is the natural person(s), who, whether acting alone or together, or through one or more juridical person, has/have “ownership of” or “entitlement to” more than 10% of capital or profits of the partnership or who exercises control through other means. For the purpose of this sub-clause, “control” shall include the right to control the management or policy decision.

(c) Where the customer is an unincorporated association or body of individuals, the beneficial owner is the natural person(s), who, whether acting alone or together, or through one or more juridical person, has/have ownership off entitlement to more than 15% of the property or capital or profits of the unincorporated association or body of individuals.

Explanation‐ Term 'body of individuals' includes societies. Where nobody natural person is identified under (a), (b) or (c) above, the beneficial owner is the relevant natural person who holds the position of senior managing official.

(d) Where the customer is a Trust, the identification of beneficial owner(s) shall include identification of the author of the trust, the trustee, the beneficiaries with 10% or more interest in the trust and any other natural person exercising ultimate effective control over the trust through a chain of control or ownership.

9. Customer Identification Procedure (CIP)

Customer Identification means undertaking client due diligence (CDD) measures while commencing relationship including identifying and verifying the customer on the basis of the Officially Valid Documents.

The Company shall undertake identification of customers in the following cases:

1. Commencement of an account-based relationship with the customer

2. Carrying out any international money transfer operations for a person who is not an account holder of the Company.

3. When there is a doubt about the authenticity or adequacy of the customer identification data it has obtained.

4. Selling third-party products as agents, selling its own products, payment of dues of credit cards / sale and reloading of prepaid / travel cards and any other product for more than ₹50,000.

5. Carrying out transactions for a non-account-based customer, i.e., a walk-in customer, where the amount involved is equal to or exceeds ₹50,000 whether conducted as a single transaction or several transactions that appear to be connected.

6. When the company has reason to believe that a customer (account-based or walk-in) is intentionally structuring a transaction into a series of transactions below the threshold of ₹50,000.

7. The Company shall ensure it does not seek introductions while opening accounts.

For the purpose of verifying the identity of customers at the time of commencement of an account‐based relationship or while carrying out occasion transaction of an amount equal to or exceeding rupees fifty thousand, whether conducted as a single transaction or several transactions that appear to be connected, or any international money transfer operations. Company may rely on customer due diligence done by a third party, subject to the following conditions:

(a) Records orthe information ofthe customer due diligence carried out by the third party is obtained immediately from the third party or from the Central KYC Records Registry.

(b) Adequate steps are taken by Companys to satisfy themselves that copies of identification data and other relevant documentation relating to the customer due diligence requirements shall be made available from the third party upon request without delay.

(c) The third party is regulated, supervised or monitored for, and has measures in place for, compliance with customer due diligence and record‐keeping requirements in line with the requirements and obligations under the PML Act.

(d) The third party shall not be based in a country or jurisdiction assessed as high risk.

(e) The ultimate responsibility for customer due diligence and undertaking enhanced due diligence measures, as applicable, will be with the Company.

10. Customer Due Diligence (CDD) Procedure

Procedure for obtaining identification/ Customer Due Diligence (CDD) Procedure:

For Individuals: For undertaking CDD, Comapny shall obtain the following from individual while establishing account‐based relationship or while dealing with the individual who is beneficial owner, authorised signatory or power of attorney holder related to any legal entity:

(a) The Aadhaar number:

i. Where borroweris desirous ofreceiving any benefit orsubsidy under any scheme any scheme notified under section 7 of the Aadhaar (Targeted Delivery of Financial and Other subsidies, Benefits and Services) Act, 2016 ; or

ii. He decidesto submit his Aadhaar number voluntarily to Company notified under the first proviso to sub-section (1) of section 11A of the PML Act

Note: A borrower may submit only the “proof of possession of Aadhaar number” s.t. any other OVD containing the details of his identity and address has been submitted.
The KYC identifier with an explicit consent to download records from CKYCR.
Company shall retrieve KYC records online from the CKYCR in accordance with section “CDD Procedure and sharing KYC information with Central KYC Records Registry (CKYCR)”

(b) The Permanent Account Number or Form No. 60 if PAN is not available; and

(c) Such other documentsincluding in respect of the nature of business and financial status of the customer.

Points to be noted:

Where the customer hassubmitted,

i) Aadhaar number under (a) above, then Company shall carry out authentication of the customer’s Aadhaar number using e‐KYC authentication facility provided by the UIDAI. Further, in such a case, if customer wants to provide a correspondence/current address, different from the address as per Aadhaar, then he shall give a self‐declaration to that effect to Company.

ii) Any OVD or proof of possession of Aadhaar number where offline verification cannot be carried out, then Company shall carry out verification asspecified under Digital KYC process.

iii) KYC Identifier, the Company shall retrieve the KYC Records online from the CKYCR in accordance to with paragraph CDD Procedure and sharing KYC information with Central KYC Records Registry (CKYCR)

Customer due diligence procedure is performed by Company employees.

Officially Valid Document (OVD): OVDincludes:

1. Passport
2. Driving licence,
3. Proof of possession of Aadhaar number (in such a form as is issued by the Unique Identification Authority of India)
4. Voter's Identity Card issued by the Election Commission of India
5. Job card issued by NREGA duly signed by an officer of the State Government
6. Letter issued by the National Population Register containing details of name and address.

Provided that where the OVD furnished by the customer does not have updated address, the following documents shall be deemed to be OVDs for the limited purpose of proof of address:-

1. Utility bill which is not more than two months old of any service provider (electricity, telephone, post-paid mobile phone, piped gas, water bill);
2. Property or Municipal tax receipt;
3. Pension or family pension payment orders (PPOs) issued to retired employees by Government Departments or Public Sector Undertakings, if they contain the address;
4. Letter of allotment of accommodation from employer issued by State Government or Central Government Departments, statutory or regulatory bodies, public sector undertakings, scheduled commercial banks, financial institutions and listed companies and leave and licence agreements with such employers allotting official accommodation;

The customer shall submit OVD with current address within a period of three months of submitting the documents specified above.

The cases, where the OVD presented by a foreign national does not contain the details of address, in such case the documents issued by the Government departments of foreign jurisdictions and letter issued by the Foreign Embassy or Mission in India shall be accepted as proof of address

Note:

1. Self attestation & OSV is mandatory on above documents.
2. PAN Card and/or Form 60 is mandatory
3. In absence of PAN (in special scenarios as mentioned above in policy document), any of above-mentioned alternate documents under ID proof can be accepted. Form 60 is mandatory in such cases.
4. Above mentioned OVD (Address Proof) can be accepted for Permanent Address also. Credit Departement to ensure that both the current address and permanent address are captured in system. Residence FI is mandatory and no digital waiver is allowed.
5. Aadhaar number should be masked at every stage during the customer loan life cycle, whether it pertains to the borrower’s or seller’s Aadhaar number. In cases where a copy of the Aadhaar is uploaded, the first 8 digits should be masked with a black font, leaving only the last 4 digits visible. Additionally, wherever the Aadhaar number is captured, only the last 4 digits should be displayed. Any individual or departements who collects Aadhaar cards should ensure that the Aadhaar number is appropriately masked or redacted at the time of collection. Under no circumstances should the complete Aadhaar number be collected, stored, or processed in an unmasked form.

Procedure for obtaining identification/ Customer Due Diligence (CDD) Procedure:

For Individuals: For undertaking CDD, IIFL HFL shall obtain the following from individual while establishing account‐based relationship or while dealing with the individual who is beneficial owner, authorised signatory or power of attorney holder related to any legal entity:

(a.) the Aadhaar number:

i. Where borrower is desirous of receiving any benefit or subsidy under any scheme like CLSS etc.; or

ii. he decides to submit his Aadhaar number voluntarily

Note: A borrower may submit only the “proof of possession of Aadhaar number” s.t. any other OVD containing the details of his identity and address has been submitted. The KYC identifier with an explicit consent to download records from CKYCR

11. Digital KYC Process

Digital KYC” means the capturing live photo of the customer and officially valid document or the proof of possession of Aadhaar, where offline verification cannot be carried out, along with the latitude and longitude of the location where such live photo is being taken by an authorized officer of the FI as per the provisions contained in the Act.

Digital KYC Process

a) Company shall develop an application for digital KYC process which shall be made available at customer touch points for undertaking KYC of their customers and the KYC process shall be undertaken only through this authenticated application of Company.

b) The access of the Application shall be controlled by Company and it should be ensured that the same is not used by unauthorized persons. The Application shall be accessed only through login‐id and password or Live OTP or Time OTP controlled mechanism given by Company to its authorized officials.

c) The customer, for the purpose of KYC, shall visit the location of the authorized official of Company or vice‐versa. The original OVD (ID & Address proof document) shall be in the possession of the customer.

d) Company must ensure that the Live photograph of the customer is taken by the authorized officer and the same photograph is embedded in the Customer Application Form (CAF). Further, the system Application of Compnay shall put a water‐mark in readable form having CAF number, GPS coordinates, authorized official’s name, unique employee Code (assigned by REs) and Date (DD:MM:YYYY) and time stamp(HH:MM:SS) on the captured live photograph of the customer.

e) The Application of Company shall have the feature that only live photograph of the customer is captured and no printed or video‐graphed photograph of the customer is captured. The background behind the customer while capturing live photograph should be of white colour and no other person shall come into the frame while capturing the live photograph of the customer.

f) Similarly, the live photograph of the original OVD or proof of possession of Aadhaar where offline verification cannot be carried out (placed horizontally), shall be captured vertically from above and watermarking in readable form as mentioned above shall be done. No skew or tilt in the mobile device shall be there while capturing the live photograph of the original documents.

g) The live photograph of the customer and his original documents shall be captured in proper light so that they are clearly readable and identifiable.

h) Thereafter, all the entries in the CAF shall be filled as per the documents and information furnished by the customer. In those documents where Quick Response (QR) code is available, such details can be auto‐populated by scanning the QR code instead of manual filing the details. For example, in case of physical Aadhaar/e‐Aadhaar downloaded from UIDAI where QR code is available, the details like name, gender, date of birth and address can be auto‐populated by scanning the QR available on Aadhaar/e‐Aadhaar.

i) Once the above mentioned process is completed, a One Time Password (OTP) message containing the text that ‘Please verify the details filled in form before sharing OTP’ shall be sent to customer’s own mobile number. Upon successful validation of the OTP, it will be treated as customer signature on CAF. However, if the customer does not have his/her own mobile number, then mobile number of his/her family/relatives/known persons may be used for this purpose and be clearly mentioned in CAF. In any case, the mobile number of authorized officer registered with Compnay shall not be used for customer signature. Company must check that the mobile number used in customer signature shall not be the mobile number of the authorized officer.

j) The authorized officer shall provide a declaration about the capturing of the live photograph of customer and the original document. For this purpose, the authorized official shall be verified with One Time Password (OTP) which will be sent to his mobile number registered with Company. Upon successful OTP validation, it shall be treated as authorized officer’s signature on the declaration. The live photograph of the authorized official shall also be captured in this authorized officer’s declaration

k) Subsequent to all these activities, the Application shall give information about the completion of the process and submission of activation request to activation officer of Company, and also generate the transaction‐id/reference‐id number of the process. The authorized officer shall intimate the details regarding transaction‐id/reference‐id number to customer for future reference.

The authorized officer of Company shall check and verify that:‐ (i) information available in the picture of document matches the information entered by authorized officer in CAF. (ii) live photograph of the customer matches with the photo available in the document.; and (iii) all of the necessary details in CAF including mandatory field are filled properly.

On Successful verification, the CAF shall be digitally signed by authorized officer of Company who will take a print of CAF, get Signatures/thumb‐impression of customer at appropriate place, then scan and upload the same in system. Original hard copy may be returned to the customer.

12. CDD for Non Individual:

Below documents are required as Business Proof for Non‐Individuals:

Identification of beneficial owner

For opening an account of a Legal Person who is not a natural person, the Company shall identify the beneficial owner(s) and shall undertake all reasonable steps to verify their identity, keeping in view the following:

1. Where the customer or the owner of the controlling interest is:

• an entity listed on a stock exchange in India, or
• it is an entity resident in jurisdictions notified by the Central Government and listed on stock exchanges in such jurisdictions, or
• it is a subsidiary of such listed entities;
• it is not necessary to identify and verify the identity of any shareholder or beneficial owner of such entities.

2. In cases oftrust/ nominee orfiduciary accounts,the companydetermines whether the customer is acting on behalf of another person as trustee / nominee or any other intermediary. In such cases,the company shall obtain satisfactory evidence ofthe identity of the intermediaries and of the persons on whose behalf they are acting, as well as details of the nature of the trust or other arrangements in place.

Aadhaar number should be masked at every stage during the customer loan life cycle, whether it pertains to the borrower’s or seller’s Aadhaar number. In cases where a copy of the Aadhaar is uploaded, the first 8 digits should be masked with a black font, leaving only the last 4 digits visible. Additionally, wherever the Aadhaar number is captured, only the last 4 digits should be displayed. Any individual or team who collects Aadhaar cards/Aadhaar numbers to ensure that the Aadhaar number is appropriately masked or redacted at the time of collection. Under no circumstances should the complete Aadhaar number be collected, stored, or processed in an unmasked form.

13. On- Going Due Diligence

Ongoing monitoring is an essential element of effective KYC procedures. The Company can control and reduce their risk only if they have an understanding of the normal and reasonable activity of the customer so that they have the means of identifying transactions that fall outside the regular pattern of activity.

The Company shall undertake ongoing due diligence of customers to ensure that their transactions are consistent with their knowledge about the customers, customers’ business and risk profile, the source of funds / wealth.

A) Company to pay special attention to all complex, unusually large transactions and all unusual patterns which have no apparent economic or visible lawful purpose.

B) The extent of monitoring shall be aligned with the risk category of the customer. High-risk accounts shall be subjected to intensified monitoring. The company shall set key indicators for such accounts, taking note of the background of the customer, such as the country of origin, sources of funds, the type of transactions involved and other risk factors.

C) The company shall put in place a system of periodical review of risk categorization of accounts with such periodicity being at least once in six months, and the need for applying enhanced due diligence measures.

D) The records of transactions in the accounts shall be preserved and maintained as required under PML Act, 2002. The Principal Officer shall ensure the reporting of transactions of suspicious nature to the appropriate authority.

14. Updation/periodic updation of KYC

Company shall adopt a risk-based approach for periodic updation of KYC ensuring that the information or data collected under CDD is kept up-to-date and relevant, particularly where there is high risk. However, periodic updation shall be carried out at least once in every two years for high-risk customers, once in every eight years for medium risk customers and once in every ten years for low-risk customers from the date of opening of the account / last KYC updation.

Notwithstanding the provisions stated above, in the case of individual customers classified as low risk, Company shall permit all transactions and ensure that KYC is updated either within one year from the date it becomes due or by June 30, 2026, whichever is later. Such accounts shall continue to be subject to regular monitoring as per the prescribed norms. This provision shall also apply to low-risk individual customers whose periodic KYC updation is already overdue.

(i) Individual

(a) No Change in KYC information: In case of no change in the KYC information, a self-declaration from the customer in this regard shall be obtained through customer’s email-id registered with the IIFL HFL, customer’s mobile number registered with the IIFL HFL, digital channels (such as mobile application of IIFL HFL), letter, etc.

(b) Change in Address : In case of a change only in the address details of the customer, a self-declaration of the new address shall be obtained from the customer through customer’s email-id registered with the RE, customer’s mobile number registered with the IIFL HFL, digital channels (such as mobile application of IIFL HFL),letter, etc.,

(ii) Customers other than individuals

(a) No change in KYC information: In case of no change in the KYC information of the LE customer, a self-declaration in this regard shall be obtained from the LE customer through its email id registered with the IIFL HFL, digital channels (such as mobile application of IIFL HFL), letter from an official authorized by the LE in this regard, board resolution, etc. Further, IIFL HFL shall ensure during this process that Beneficial Ownership (BO) information available with them is accurate and shall update the same, if required, to keep it as up-to-date as possible.

(b) Change in KYC information: In case of change in KYC information, IIFL HFL shall undertake the KYC process equivalent to that applicable for onboarding a new LE customer.

Additional Measures : In addition to the above, IIFL HFL ensure that,

(i)The KYC documents of the customer as per the current CDD standards are available with them. This is applicable even if there is no change in customer information but the documents available with the IIFL HFL are not as per the current CDD standards. Further, in case the validity of the CDD documents available with the IIFL HFL has expired at the time of periodic updation of KYC, IIFL HFL shall undertake the KYC process equivalent to that applicable for on-boarding a new customer.

(ii)Customer’s PAN details, if available with the IIFL HFL, is verified from the database of the issuing authority at the time of periodic updation of KYC.

(iii)Acknowledgment is provided to the customer mentioning the date of receipt of the relevant document(s), including self-declaration from the customer, for carrying out periodic updation. Further, it shall be ensured that the information / documents obtained from the customers at the time of periodic updation of KYC are promptly updated in the records /database of the IIFL HFL and an intimation, mentioning the date of updation of KYC details, is provided to the customer.

(iv) In order to ensure customer convenience, IIFL HFL may consider making available the facility of updation/ periodic updation of KYC at any branch.

IIFL HFL also advise the customers that in order to comply with the PML Rules, in case of any update in the documents submitted by the customer at the time of establishment of business relationship / account-based relationship and thereafter, as necessary; customers shall submit to the IIFL HFL the update of such documents. This shall be done within 30 days of the update to the documents for the purpose of updating the records at IIFL HFL end.

Due notice of Periodic updation of the KYC

IIFL HFL shall ensure that customers are proactively informed, well in advance, about the need to update their Know Your Customer (KYC) information. This process shall be implemented on or before January 1, 2026 :

1. Advance Intimation

• Prior to the due date for periodic KYC updation, IIFL HFL shall issue a minimum of three advance intimations to the customer.

• These shall be sent at appropriate intervals using available communication channels, and at least one of these intimations must be delivered via letter.

2. Post due date Reminders

• In cases where customers do not comply with the KYC updation requirements despite advance notices, IIFL HFL shall issue at least three reminders after the due date.

• These reminders shall also be sent at suitable intervals and must include at least one reminder by letter.

Customers who have still not complied with the above requirements, despite advance intimations. The letter of intimation/ reminder may, inter alia, contain easy to understand instructions for updating KYC, escalation mechanism for seeking help, if required, and the consequences, if any, of failure to update their KYC in time.

3. Recordkeeping and audit trail

The issuance of each intimation and reminder shall be appropriately recorded in IIFL HFL’s system against the respective customer’s profile, to ensure traceability for audit and compliance purposes.

15. Politically Exposed Persons (PEPs)

“Politically Exposed Persons" (PEPs) are individuals who are or have been entrusted with prominent public functions in India and /or foreign country including Heads of States/ Governments, Senior politicians, senior government/ judicial/ military officers, senior executives of state‐owned corporations, important political party officials, etc.

(a) Company has appropriate risk management system for determining whether customer or beneficial owner is PEP. For opening an account with PEP senior management approval (Credit Head/CRO/MD & CEO) is required to be obtained. Also, if existing customer or beneficial owner becomes PEP then senior management approval (Credit Head/CRO/MD & CEO) is required for continued business relationship.

(b) Reasonable measures are taken by the IIFL HFL for establishing the source of funds / wealth;

(c) All such accounts are subjected to enhanced monitoring on an on-going basis;

(d) These instructions shall also be applicable to family members or close associates of PEPs.

16. Record Management

The following steps shall be taken regarding maintenance, preservation and reporting of customer information, with reference to provisions of PML Act and Rules. IIFL HFL shall,

(a) Maintain all necessary records of transactions between the IIFL HFL and the customer, both domestic and international, for at least five years from the date of transaction;

(b) Preserve the records pertaining to the identification of the customers and their addresses obtained while opening the account and during the course of business relationship, for at least five years after the business relationship is ended;

(c) Make available swiftly, the identification records and transaction data to the competent authorities upon request;

(d) Introduce a system of maintaining proper record of transactions prescribed under Rule 3 of Prevention of Money Laundering (Maintenance of Records) Rules, 2005 (PML Rules, 2005);

(e) Maintain all necessary information in respect of transactions prescribed under PML Rule 3 so as to permit reconstruction of individual transaction, including the following:

(i) the nature of the transactions;

(ii) the amount of the transaction and the currency in which it was denominated;

(iii) the date on which the transaction was conducted; and

(iv) the parties to the transaction.

(f) Evolve a system for proper maintenance and preservation of account information in a manner that allows data to be retrieved easily and quickly whenever required or when requested by the competent authorities;

(g) Maintain records of the identity and address of their customer, and records in respect of transactions referred to in Rule 3 in hard or soft format.

Explanation. – For the purpose of this Section, the expressions "records pertaining to the identification", “identification records”, etc., shall include updated records of the identification data, account files, business correspondence and results of any analysis undertaken.

The Company shall ensure that in case of customers who are non-profit organizations, the details of such customers are registered on the DARPAN Portal of NITI Aayog. If the same are not registered, RE shall register the details on the DARPAN Portal. The Company shall also maintain such registration records for a period of five years after the business relationship between the customer and the RE has ended or the account has been closed, whichever is later.

17. Reporting Requirements to Financial Intelligence Unit - India

Company shall furnish to the Director, Financial Intelligence Unit‐India (FIU‐IND), information referred to in Rule 3 of the PML (Maintenance of Records) Rules, 2005 in terms of Rule 7 thereof.

The reporting formats and comprehensive reporting format guide, prescribed/released by FIU‐IND and Report Generation Utility and Report Validation Utility developed to assist reporting entities in the preparation of prescribed reports shall be taken note of to file CTR/STR.

While furnishing information to the Director, FIU‐IND, delay of each day in not reporting a transaction or delay of each day in rectifying a mis‐represented transaction beyond the time limit as specified in the Rule shall be constituted as a separate violation. IIFL HFL shall not put any restriction on operations in the accounts where an STR has been filed. IIFL HFL shall keep the fact of furnishing of STR strictly confidential. It shall be ensured that there is no tipping off to the customer at any level.

The Company, its directors, officers, and all employees shall ensure that the fact of maintenance of records referred to in rule 3 of the PML (Maintenance of Records) Rules, 2005, and furnishing of the information to the FIU-IND is confidential. However, such confidentiality requirement shall not inhibit sharing of information under the in terms of PML rules provisions of Chapter IV of the PML Act, 2002. of any analysis of transactions and activities which appear unusual, if the company has done any such analysis.

18. Requirements/ obligations under International Agreements

(A) Communication from international Agencies

(i) Company shall ensure adherence to provisions and ongoing screening of Unlawful Activities (Prevention) (UAPA) Act, 1967 or Weapons of mass destruction act, 2005, United Nations Security Council (UNSC, UNSCRs circulated by the Reserve Bank, Schedules to the Prevention and Suppression of Terrorism (Implementation of Security Council Resolutions) Order, 2007 and amendments thereto, wherever applicable.

(ii) Company will take measures to ensure that there is no account/relationship opened in the name of individuals/entities appearing in the lists of individuals and entities, suspected of having terrorist links, which are approved by and periodically circulated by the United Nations Security Council (UNSC) from time to time. The Company shall verify the aforementioned lists, i.e., UNSC Sanctions Lists and lists as available in the Schedules to the Prevention and Suppression of Terrorism (Implementation of Security Council Resolutions) Order, 2007, as amended from time to time, on a daily basis, and any modifications to the lists in terms of additions, deletions or other changes shall be taken into account by the Company for meticulous compliance.

The Company shall report the details of accounts resembling any of the individuals / entities in the lists to FIU-IND in addition to advising the Ministry of Home Affairs (MHA) as required under UAPA notification dated February 2, 2021.

(B) Freezing of Assets under Section 51A of Unlawful Activities (Prevention) Act, 1967 ‐ Company shall follow the relevant procedure laid down in the UAPA Order dated February 2, 2021, wherever applicable.

(C) Order to freeze assets under section 12A of WMD Act, 2005 is received from the CNO, Company shall take necessary to comply with the order. Company shall undertake countermeasures when called upon to do so by any international or intergovernmental organisation of which India is a member and accepted by the Central Government.

(D) FATF Statements circulated by Reserve Bank of India from time to time, and publicly available information, for identifying countries, which do not or insufficiently apply the FATF Recommendations, shall be considered. Company shall apply enhanced due diligence measures, which are effective and proportionate to the risks, to business relationships and transactions with natural and legal persons (including financial institutions) from countries for which this is called for by the FATF.

19. Secrecy Obligations and Sharing of Information

(a) Company maintained secrecy regarding the customer information which arises out of the contractual relationship between the IIFL HFL and customer.

(b) Information collected from customers for the purpose of opening of account shall be treated as confidential and details thereof shall not be divulged for the purpose of cross selling, or for any other purpose without the express permission of the customer.

(C) While considering the requests for data/information from Government and other agencies, IIFL HFL shall satisfy themselves that the information being sought is not of such a nature as will violate the provisions of the laws relating to secrecy in the transactions.

(d) The exceptions to the said rule shall be as under:

i. Where disclosure is under compulsion of law
ii. Where there is a duty to the public to disclose,
iii. The interest of IIFL HFL requires disclosure and
iv. Where the disclosure is made with the express or implied consent of the customer.

20. CDD Procedure and sharing KYC information with Central KYC Records Registry (CKYCR)

Company shall capture the KYC information for sharing with the CKYCR in the manner mentioned in the Rules, as required by the revised KYC templates prepared for 'individuals' and 'Legal Entities' as the case may be.

Government of India has authorised the Central Registry of Securitisation Asset Reconstruction and Security Interest of India (CERSAI), to act as, and to perform the functions of the CKYCR vide Gazette Notification No. S.O. 3183(E) dated November 26, 2015. The ‘live run’ of the CKYCR would start with effect from July 15, 2016 in phased manner beginning with new ‘individual accounts’. Accordingly, IIFL HFL shall take the following steps:

(i) IIFL HFL shall upload the KYC data pertaining to all new individual accounts opened on or after from April 1, 2017 with CERSAI in terms of the provisions of the Prevention of Money Laundering (Maintenance of Records) Rules, 2005.

(ii) IIFL HFL shall capture customer’s KYC records and upload onto CKYCR within 10 days of commencement of an account‐based relationship with the customer.

(iii) Operational Guidelines for uploading the KYC data have been released by CERSAI.

(iv) IIFL HFL shall upload KYC record pertaining to accounts Les opened on or after April 1, 2021, with CKYCR in terms of the provision of the rules ibid. The KYC record have to uploaded as per LE template released by CERSAI.

(v) Once the KYC identifier is generated by CKYCR, IIFL HFL shall ensure that the same is communicated to the customers.

(vi) In order to ensure that all KYC records are incrementally uploaded on to CKYCR, IIFL HFL shall upload/update the KYC data pertaining to accounts of individual customers and LEs opened prior to the above-mentioned dates specified in the above point (i) and (iv), respectively, at the time of periodic updation or earlier, when the updated KYC information is obtained/received from the customer. Also, whenever the IIFL HFL obtains additional or updated information from any customers, the IIFL HFL shall furnish the updated information to CKYCR for updating the KYC records of the existing customer in CKYCR within seven days or within such period as may be notified by the Central Government.
CKYCR shall thereafter inform electronically all the reporting entities who have dealt with the concerned customer regarding updation of KYC record of the said customer. Once CKYCR informs IIFLHFL regarding an update in the KYC record of an existing customer, IIFL HFL shall retrieve the updated KYC records from CKYCR and accordingly update the KYC record maintained.

(vii) IIFL HFL has to ensure that during periodic updation, the customers are migrated to the current CDD standard.

(viii) Where a customer, for the purposes of establishing an account‐based relationship, submits a KYC Identifier to a IIFL HFL, with an explicit consent to download records from CKYCR, then IIFL HFL shall retrieve the KYC records online from the CKYCR using the KYC Identifier and the customer shall not be required to submit the same KYC records or information or any other additional identification documents or details, unless:‐

(a) there is a change in the information of the customer as existing in the records of CKYCR;
(b) the correspondence address of the customer is required to be verified;
(c) the IIFL HFL considers it necessary in order to verify the identity or address of the customer, or to perform enhanced due diligence or to build an appropriate risk profile of the client.
(d) the validity period of documents downloaded from CKYCR has lapsed.

Explanation: The Regulated Entity that has last uploaded or updated the customer’s KYC records in the CKYCR shall be responsible for verifying the identity and / or address of the customer, as applicable. Accordingly, any NBFC downloading and relying on such records from the CKCYR shall not be required to re-verify the authenticity of the customer’s identity and / or address, provided the KYC records downloaded from CKYCR are current and compliant with the PML Act, 2002 /PML Rules, 2005. The Company downloading and relying on KYC records downloaded from the CKCYR shall remain responsible for all aspects of CDD procedure and provisions of these Directions, except verification of identity and / or address of the customer.

21. Reporting requirement under Foreign Account Tax Compliance Act (FATCA) and Common Reporting Standards (CRS)

Under FATCA and CRS, Company shall adhere to the provisions ofIncome Tax Rule 114F,114Gand 114H and determine whether they are a Reporting Financial Institution as defined in Income Tax Rule 114Fand ifso, shall take applicable steps for complying with the reporting requirements as mentioned in Master Directions ‐KYC.

22. Issuance of Unique Customer identification Code (UCIC)

A Unique CustomerIdentification Code (UCIC)shall be allotted while entering into new relationships with individual customers as also the existing individual customers by Company

23. Introduction of New technologies

Company shall identify and assess the ML/TF risks that may arise in relation to the development of new products and new business practices, including new delivery mechanisms, and the use of new or developing technologies for both new and preexisting products.

24. Quoting of PAN

Permanent account number (PAN) of customers shall be obtained and verified while undertaking transactions as per the provisions of Income Tax Rule 114B applicable to banks, as amended from time to time. Form 60 shall be obtained from persons who do not have PAN.

25. Selling Third Party Products

Company acting as agents while selling third party products will comply with the applicable laws/regulations, wherever applicable.

26. Hiring of employees and Employee training

(a) Adequate screening mechanisms as an integral part oftheir personnel recruitment/hiring processshould be put in place.

(b) The Company shall ensure that staff handling KYC/AML/CFT functions demonstrate high integrity, ethical conduct, sound knowledge of applicable regulations, effective communication skills, and the ability to keep pace with evolving national and international KYC/AML/CFT requirements. The Company shall also foster a work environment that promotes integrity and open communication among staff.

(c) On‐going employee training program shall be put in place so that the members of staff are adequately trained in KYC/AML/CFT policy. Proper staffing of the audit function with persons adequately trained and well‐versed in KYC/AML/CFT policies of the Company, regulation and related issues shall be ensured.

Last updated: 20th Jan 2026