RANAPAY INDIA PRIVATE LIMITED

This Policy establishes the framework for identifying, reporting, containing, investigating, responding to and recovering from cyber incidents and cyber-fraud events affecting RanaPay, its customers, systems, gift-card/voucher products or relevant partners.

• Enable timely detection and escalation.
• Limit customer and business impact.
• Preserve evidence.
• Coordinate with PPI issuers, banks, payment partners and other stakeholders.
• Support appropriate reporting and legal obligations.
• Restore secure operations.
• Prevent recurrence through corrective action.

This Policy applies to cyber incidents, suspected cyber fraud, account compromise, credential theft, phishing, malware, unauthorised access, API abuse, data compromise, system disruption, fraudulent gift-card activity and other technology-enabled security events.

• Phishing/social engineering
• Credential compromise
• Account takeover
• Malware/ransomware
• Unauthorised system access
• API abuse or credential leakage
• Gift-card/voucher fraud
• Payment fraud
• Data breach or suspected leakage
• Denial-of-service/service disruption
• Insider misuse
• Third-party security incident

• Critical – material customer, financial, data or service impact
• High – significant impact or credible ongoing threat
• Medium – contained impact requiring formal investigation
• Low – limited impact handled through routine security procedures

Employees, contractors, partners and relevant stakeholders shall promptly report suspected cyber incidents through designated security or management channels. No person shall intentionally conceal a known material incident.

1. Record incident reference.
2. Record date/time detected.
3. Identify reporting source.
4. Classify preliminary type and severity.
5. Assign incident owner.
6. Start incident log.
7. Initiate appropriate response.

The response team shall determine affected systems, customers, data, transactions, partners, geographic scope, potential financial exposure and whether the incident is ongoing.

• Disable compromised credentials
• Restrict affected accounts
• Block malicious access
• Isolate affected systems where appropriate
• Suspend affected API keys
• Block suspicious transaction patterns
• Coordinate with relevant partners

Containment decisions shall consider customer impact and preservation of evidence.

• System/application logs
• Authentication records
• API logs
• Transaction records
• Device/network indicators where available
• Emails/messages
• Screenshots or documents
• Partner communications

Evidence shall be preserved in a manner that maintains integrity and limits unauthorised access.

The assigned response team shall establish the incident timeline, affected assets, attack method, root cause, customer impact, financial impact and control weaknesses using available evidence.

Where fraud is suspected, the case shall be coordinated with the Fraud Prevention & Transaction Monitoring function. Transaction and redemption records shall be reviewed and relevant accounts/products may be restricted according to approved procedures.

• Secure or restrict compromised accounts
• Block compromised voucher/code where possible
• Review suspicious transactions
• Coordinate refunds/reversals where applicable
• Provide security guidance
• Escalate material customer impact

Incidents involving a PPI issuer, bank, payment processor, merchant, technology provider or other partner shall be escalated according to contractual contacts and applicable procedures.

Where an incident triggers a legal, regulatory, contractual or law-enforcement reporting obligation, RanaPay shall coordinate the required response through authorised personnel and within applicable timelines.

External communications concerning material cyber incidents shall be controlled and issued only by authorised personnel. Public or customer communication shall avoid unnecessary disclosure of sensitive security information.

1. Remove or contain threat.
2. Validate system integrity.
3. Restore services from trusted sources where required.
4. Reset or rotate compromised credentials.
5. Monitor restored systems.
6. Confirm partner readiness.
7. Return to normal operations.

After material incidents, a post-incident review shall identify root cause, control failures, lessons learned, corrective actions, owners and target dates.

• Patch vulnerabilities
• Improve access controls
• Rotate credentials/keys
• Update fraud rules
• Improve monitoring
• Enhance customer warnings
• Review vendor controls
• Update procedures/training

• Critical/high severity incident
• Customer data exposure
• Material financial loss
• Ongoing attack
• Systemic compromise
• Significant service disruption
• Partner/regulatory notification
• Law-enforcement request

Suspicious transactions may be held, blocked, reviewed or escalated where supported by the applicable system, partner agreement and law. Decisions shall be documented.

Third-party incidents affecting RanaPay information, systems or customers shall be logged, assessed and managed through the vendor/partner escalation process.

Where an incident causes significant service disruption, the Business Continuity & Disaster Recovery Policy shall be activated as appropriate.

• Incident report
• Timeline
• Severity assessment
• Actions taken
• Evidence register
• Partner communications
• Customer impact assessment
• Regulatory/law-enforcement records where applicable
• Root-cause analysis
• Corrective action plan
• Closure approval

Incident information shall be restricted to personnel with a legitimate need to know. Sensitive evidence and investigation material shall be securely stored.

Relevant personnel shall receive incident-response and cyber-fraud awareness training. Periodic tabletop exercises or response drills may be conducted based on risk.

• Incident count by severity
• Detection and response time
• Financial impact
• Customer impact
• Root causes
• Repeat incidents
• Third-party incidents
• Corrective action ageing

Incident-response controls may be tested through audits, tabletop exercises, simulated scenarios, evidence reviews and control assessments.

Exceptions shall be documented, risk-assessed and approved by an authorised function. Mandatory legal, regulatory or contractual obligations shall not be bypassed.

This Policy shall be reviewed at least annually and whenever there is a material change in cyber threats, technology, products, partner arrangements or applicable requirements.