AML and Prohibited Activities Policy

1. Our commitment

[LEGAL ENTITY NAME] ("Nodal Pay", "we", "us") is building an app based protected payment platform in India. From the outset, the platform is being designed to deter misuse for money laundering, terrorist financing and other financial crime.

This draft policy explains the standards we expect from everyone who will use Nodal Pay, the controls we plan to build, and how we intend to work with authorities and regulated payment partners. Because the app is still under development, the details below describe our planned approach; the final policy will be published before launch.

2. Applicable framework

Our planned controls are being shaped with reference to applicable Indian law, including the Prevention of Money Laundering Act 2002 and the rules made under it, the Information Technology Act 2000, the Digital Personal Data Protection Act 2023 and applicable RBI regulations, in each case as relevant to the final structure of the platform.

Which specific obligations apply directly to us, and which apply to the regulated payment partners we expect to work with, will depend on the final legal and operational structure of the platform. References to legislation in this document describe the framework we are designing towards; they are not a claim of registration, licensing or certification, none of which has been obtained at this stage.

3. Prohibited activities

The following activities will be strictly prohibited on Nodal Pay. You must not use, or attempt to use, the platform to:

• launder, move, conceal or disguise the proceeds of crime, or deal with property derived from any unlawful activity;
• finance, facilitate or support terrorism or any terrorist organisation, directly or indirectly;
• evade, circumvent or breach sanctions, trade restrictions or asset freeze obligations under applicable law;
• structure, split or sequence transactions with the intention of avoiding verification requirements, transaction limits or reporting thresholds;
• send or receive payments on behalf of an undisclosed third party, or allow another person to transact through your account;
• open or operate an account using a false, stolen or synthetic identity, forged documents or misrepresented information;
• use the platform for any category of goods, services or conduct prohibited under our Acceptable Use Policy or under applicable law.

This list is illustrative, not exhaustive. Any conduct that is unlawful, or that is designed to disguise the true origin, ownership, purpose or destination of funds, is prohibited even if it is not listed above.

4. Planned controls

The platform is being designed with layered controls intended to deter and detect financial crime. Our current plans include:

4.1 Identity verification

Users are expected to complete identity verification before transacting, as described in our draft KYC and Verification Policy. Verification requirements may increase with transaction size, frequency or risk indicators.

4.2 Transaction monitoring

We plan to monitor transaction patterns for indicators of misuse, such as unusual volumes, rapid movement of funds, mismatches between stated deal purpose and behaviour, and repeated transactions just below limit thresholds. Flagged activity may be paused pending review.

4.3 Limits

Transaction, velocity and account limits are planned, and are expected to vary by verification level and risk profile. Final limits will depend on applicable law and the arrangements agreed with regulated payment partners.

4.4 Record keeping

We plan to retain records of verification, transactions and related communications for the periods required by applicable law, as described in our draft Data Retention and Deletion Policy and handled in line with our Privacy Policy.

5. Reporting and cooperation with authorities

Where required by applicable law, suspicious activity identified on the platform is expected to be reported to the appropriate authorities, whether by us, by our regulated payment partners, or both, depending on the final structure.

Consistent with the confidentiality obligations that typically apply to such reports, we will not confirm to a user whether a report has been made about them, and users must not be "tipped off" about any review or report. We also plan to cooperate with lawful requests from law enforcement agencies, courts and regulators, including the preservation and disclosure of records where legally required.

6. Consequences of violations

If we reasonably believe an account is being used for a prohibited activity, planned responses include one or more of the following:

• pausing or declining specific transactions pending review;
• requesting additional information or re verification;
• suspending or restricting the account;
• terminating the account and ending our relationship with the user, in line with our Terms of Use;
• reporting the activity to authorities and regulated partners where required or permitted by law.

Where funds are connected to suspected unlawful activity, their handling, holding or release may be restricted in accordance with applicable law and the instructions of competent authorities or regulated payment partners.

7. Role of regulated payment partners

Nodal Pay does not intend to hold user funds itself outside a legally permitted structure. The final payment and fund handling structure will depend on applicable law and on the regulated payment partners we engage before launch.

Under such an arrangement, certain monitoring, reporting and record keeping responsibilities may sit with those regulated partners rather than with us, or may be shared. We will describe the final division of responsibilities, and name the relevant partners, in the launch version of this policy.

8. Your obligations

By using Nodal Pay once it launches, you will be expected to:

• provide true, complete and current information during verification and keep it up to date;
• transact only for yourself, for lawful purposes, and describe deals accurately;
• not lend, sell or share your account, credentials or verified identity with anyone else;
• respond promptly and honestly to reasonable requests for information about a transaction;
• report suspected misuse of the platform to us through the in app tools or the contact route below.

9. Changes to this policy

This draft will evolve as the product, its legal structure and its partner arrangements are finalised. The launch version, and any later material changes, will be published on this page with an updated "Last updated" date.

10. Contact

Questions about this draft policy, or reports of suspected misuse, can be sent to [SUPPORT EMAIL]. Concerns and complaints may also be raised through the process described in our Grievance Redressal Policy. General questions are answered in our Help Centre.