Anti-Money Laundering (AML) & Counter-Terrorist Financing (CFT) Policy

Prosper Professional Development Life Private Limited ("Prosper") is committed to preventing its website, distribution channels, business relationships, and services from being misused for money laundering, terrorist financing, fraud, or other unlawful activity. Prosper will apply risk-based controls appropriate to its actual role, products, contractual arrangements, and applicable law, and will cooperate with relevant banks, authorised prepaid payment instrument (PPI) issuers, merchants, payment partners, and competent authorities where legally required.

This document is a company-level policy template for internal governance. The Prevention of Money Laundering Act, 2002, the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005, and regulator-specific KYC/AML directions impose obligations on entities that fall within the applicable legal definitions and regulatory scope. Prosper must obtain legal/compliance advice to determine which direct obligations apply to its specific activities. Prosper does not claim that it independently holds an RBI authorisation or an NPCI licence to issue PPI products or operate regulated payment systems. Where a product is issued or operated by a bank or authorised provider, the relevant provider's controls, product terms, and contractual requirements must also be followed.

• Identify and assess money-laundering, terrorist-financing, fraud, and related financial-crime risks.
• Use proportionate customer, merchant, agent, and business-partner due diligence where appropriate to Prosper’s role.
• Identify unusual or suspicious activity and escalate it through approved internal and partner channels.
• Maintain accurate records and protect confidential customer and transaction information.
• Provide appropriate staff training, oversight, and periodic policy reviews.

The Board or authorised senior management should approve this Policy and ensure that responsibilities, resources, and escalation channels are documented. Prosper should designate an AML/compliance owner for internal coordination. This internal designation does not, by itself, make that person a statutory Principal Officer or Designated Director under the PMLA framework. Any statutory appointment, registration, or reporting responsibility must be made only if required and in the manner prescribed by applicable law.

Staff must follow approved procedures, promptly raise concerns, preserve relevant records, and not alert a customer or other person where doing so could constitute unlawful disclosure or tipping-off.

Prosper should document and periodically refresh a risk assessment covering, as relevant, customer and beneficial-owner types, products (including gift cards and vouchers), transaction values and frequency, delivery channels, geographies, merchants, agents, partners, and methods of payment. Controls should be proportionate to the risk identified and to Prosper's role in the transaction.

Where appropriate and lawful for Prosper's role, due diligence may include verifying identity and business details using reliable documents or independent sources; identifying beneficial owners and authorised representatives of business customers; understanding the purpose and expected nature of the relationship; checking relevant sanctions or restricted-party information where required; and documenting approvals. The exact KYC method and documents must follow applicable law and the relevant bank/issuer/partner agreement. Prosper must not represent that it performs regulated KYC on behalf of an issuer unless the relevant agreement and legal framework expressly permit it.

Staff must promptly escalate suspected suspicious activity to the designated internal compliance contact and, where relevant, to the responsible bank, authorised PPI issuer, payment partner, or merchant under the agreed procedure. Transactions may be held, declined, or restricted only where authorised by law, contract, and operational procedure. Any obligation to file reports with FIU-IND or another authority must be assessed against Prosper's actual legal status and activities. Where Prosper is legally required to report, it must follow the prescribed reporting route, format, confidentiality rules, and deadlines. Staff must not make an unsupported assurance that a report has been filed, nor disclose a report or investigation to the customer.

Prosper should retain customer due-diligence records, transaction records, alerts, investigations, decisions, training records, and relevant business correspondence for the periods required by applicable law and its contracts with regulated partners. Retention periods can differ by record type and product; the applicable legal requirement must be confirmed rather than assuming a single period applies to every record. Records must be accurate, retrievable, access-controlled, and securely disposed of when retention is no longer required. Information must be shared only with authorised persons or entities and where there is a lawful basis.

Relevant employees and agents should receive role-appropriate induction and periodic refresher training on AML/CFT risks, red flags, escalation procedures, confidentiality, customer data protection, and the requirements applicable to their work. Training completion should be recorded.

Prosper should periodically review whether its controls are operating as intended, document material gaps, assign corrective actions, and track their completion. The review frequency and independent testing, if any, should be proportionate to the company's risk profile, partner requirements, and applicable law.

Failure by staff or agents to follow approved AML/CFT procedures may result in internal disciplinary action or termination of a business relationship, subject to applicable law and contract. Potential legal or regulatory breaches must be escalated to senior management and legal/compliance advisers without delay.