RANAPAY INDIA PRIVATE LIMITED

This Policy establishes the governance framework for designing, approving, launching, issuing, distributing, activating, redeeming, monitoring, modifying and retiring gift cards, gift vouchers and virtual gift products offered by RanaPay through applicable authorised or regulated partners.

RanaPay shall clearly distinguish its role from the role of the PPI issuer, bank or other regulated entity. Where a product involves regulated issuance or stored-value functionality, the relevant authorised entity shall be identified and the product shall operate within the approved contractual and regulatory structure.

• Ensure every product has documented ownership and approval.
• Prevent unauthorised or misleading product issuance.
• Define product terms, limits and customer journey.
• Integrate fraud, security, KYC and customer-protection controls.
• Control changes to live products.
• Maintain complete product and issuance records.
• Ensure orderly suspension or retirement.

This Policy covers physical and virtual gift cards, gift vouchers, e-vouchers, brand-specific vouchers, digital codes and related products handled through RanaPay's approved business and partner arrangements.

• Gift Card
• Gift Voucher
• Virtual Gift Card
• Digital Voucher / E-code
• Brand-specific product
• Partner-issued product
• Other approved stored-value or prepaid-related product

The classification shall identify whether the product is regulated, non-regulated, partner-issued or otherwise subject to specific contractual requirements.

Each product shall have a designated Product Owner responsible for maintaining product documentation, coordinating approvals, monitoring performance and initiating review when material changes occur.

1. Prepare product proposal.
2. Identify issuer/partner and regulatory role.
3. Complete legal/compliance assessment.
4. Define customer journey and terms.
5. Assess fraud, security and operational risks.
6. Confirm settlement and reconciliation process.
7. Obtain required management/partner approvals.
8. Complete technical testing.
9. Approve launch.

• Product description
• Issuer/partner details where applicable
• Denomination/value
• Validity/expiry
• Activation rules
• Redemption rules
• Usage restrictions
• Refund/cancellation terms
• Customer support process
• Fraud controls
• Settlement model
• Technical/API dependencies

Gift cards/vouchers shall be issued only through approved systems and partner arrangements. Issuance controls shall prevent duplicate, unauthorised, invalid or inconsistent product creation.

• Unique product/code/reference
• Authorised issuance source
• Transaction/reference record
• Applicable value
• Activation status
• Creation timestamp
• Partner/merchant reference

Where activation is required, activation shall occur only after the applicable transaction and system checks are completed. The system shall maintain an auditable activation status.

Redemption shall be processed according to product terms and applicable partner rules. Duplicate, expired, blocked or already-redeemed instruments shall be rejected or escalated according to the defined process.

Applicable denomination, transaction, velocity or other limits shall be defined by the approved product structure, applicable partner rules and law. Limits shall not be changed without appropriate approval.

Customers shall receive clear information on value, validity, redemption, restrictions, refunds/cancellation, customer support and applicable issuer/partner information where required.

• Secure code generation
• Controlled issuance
• Velocity controls
• Duplicate detection
• Redemption monitoring
• Suspicious activity escalation
• Compromised-code handling
• Partner fraud coordination

Where KYC, age, customer eligibility or other verification requirements apply, the product journey shall incorporate the responsibility and controls defined under the KYC & Customer Due Diligence Policy and applicable partner requirements.

Product systems and APIs shall use appropriate authentication, authorisation, logging, error handling and security controls. Production issuance credentials shall be restricted to authorised systems and personnel.

• Functional testing
• Issuance testing
• Activation testing
• Redemption testing
• Refund/reversal testing
• Fraud-control testing
• API/security testing
• Settlement/reconciliation testing
• Customer communication testing

Material changes to value, validity, redemption, issuer/partner, customer eligibility, transaction limits, technical integration or commercial terms shall undergo documented impact assessment and approval before deployment.

RanaPay may suspend affected issuance or redemption activity where there is a material fraud, security, regulatory, partner or operational risk, subject to applicable contractual and legal requirements.

1. Identify issue.
2. Assess customer and business impact.
3. Contain or suspend where appropriate.
4. Notify relevant partner/management.
5. Investigate.
6. Implement remediation.
7. Approve restart.
8. Document closure.

Refund, reversal and chargeback handling shall follow the approved Refund, Cancellation & Chargeback Policy and relevant product/partner terms.

Issuance, activation, redemption, refund and settlement records shall be reconciled according to the applicable operating model. Exceptions shall be investigated and documented.

• Sales/issuance volumes
• Redemption volumes
• Failure rates
• Fraud alerts
• Refund/reversal trends
• Customer complaints
• Settlement exceptions
• Partner performance
• Security incidents

Product retirement shall include controlled suspension of new issuance, handling of outstanding customer obligations, partner communication, settlement closure, data/record retention and customer support.

Partners involved in product issuance, distribution, processing, redemption or settlement shall be managed under the PPI Issuer / Bank Partner Management Policy and Third-Party / Vendor Risk Management Policy.

• Product approval documents
• Product specifications
• Partner approvals
• Issuance records
• Activation/redemption records
• Changes and approvals
• Testing evidence
• Incidents
• Complaints
• Settlement/reconciliation records
• Retirement records

RanaPay may conduct periodic reviews of product governance, issuance controls, customer disclosures, partner arrangements, fraud controls, security, settlement and records.

Exceptions shall be documented, risk-assessed and approved by an authorised function. No exception may bypass mandatory legal, regulatory or partner requirements.

This Policy shall be reviewed at least annually and whenever there is a material change in product structure, partner model, regulatory requirements, technology or risk profile.