RANAPAY INDIA PRIVATE LIMITED

This Policy establishes the framework for identification, due diligence, onboarding, contracting, monitoring, review and exit of third parties and vendors whose services may affect RanaPay's customers, transactions, information, technology, compliance or business continuity.

• Identify third-party risks before engagement.
• Apply risk-based due diligence.
• Define contractual controls and responsibilities.
• Protect customer and company information.
• Monitor vendor performance and security.
• Manage incidents and material changes.
• Ensure orderly termination and data return/deletion.

This Policy applies to PPI issuers, banks, payment processors, gift-card/voucher issuers, merchants, technology providers, cloud providers, API providers, consultants, service providers, outsourcing partners and other material third parties.

• Regulatory/compliance risk
• Financial risk
• Information-security risk
• Data/privacy risk
• Fraud risk
• Operational risk
• Business continuity risk
• Reputational risk
• Concentration/dependency risk
• Legal/contractual risk

• Critical / High – material customer, financial, regulatory, data or operational dependency
• Medium – meaningful operational or information access
• Low – limited access and limited business impact

Risk classification shall consider service criticality, data access, transaction impact, regulatory role, substitutability and dependency.

• Legal entity and ownership information
• Applicable licences/authorisations where relevant
• Business and service profile
• Financial/operational capability
• Security controls
• Data protection practices
• Business continuity arrangements
• Relevant compliance history where legally and reasonably assessable
• References or experience where appropriate

Where a third party performs a regulated activity or provides regulated infrastructure, RanaPay shall verify the relevant authorisation/licence or other basis for providing the service, to the extent applicable and reasonably verifiable.

• Security policy
• Access control
• Encryption
• Vulnerability management
• Incident response
• Backup/recovery
• Logging/monitoring
• Security testing where appropriate

Where a vendor processes personal or confidential information, RanaPay shall assess purpose, data access, security controls, retention, sub-processing and incident notification arrangements as appropriate.

Vendors involved in transactions, settlement, gift-card issuance/redemption or customer funds-related processes shall be assessed for fraud, reconciliation, financial-control and settlement risks appropriate to the service.

1. Business owner submits requirement.
2. Risk classification is assigned.
3. Due diligence is completed.
4. Material gaps are documented.
5. Compliance/security/legal review is completed where applicable.
6. Commercial and contractual approval is obtained.
7. Vendor is onboarded through approved process.

• Scope of services
• Roles and responsibilities
• Service levels
• Security obligations
• Data protection/confidentiality
• Incident notification
• Audit/assessment rights where appropriate
• Subcontracting controls
• Business continuity
• Termination and data return/deletion
• Regulatory cooperation where applicable

Critical or material vendors shall have documented service expectations, escalation contacts and appropriate service-level arrangements.

Vendor access shall be limited to the minimum necessary, approved, monitored and revoked when no longer required.

Vendor APIs and integrations shall follow approved security, authentication, credential management, logging and change-management requirements.

Material subcontracting shall be disclosed or controlled as required by contract. Vendors shall remain responsible for subcontractors to the extent provided in contractual arrangements.

• Service performance
• Security incidents
• Compliance changes
• Material ownership changes
• Financial/operational concerns
• Customer complaints
• Audit findings
• Repeated SLA failures

High-risk or critical vendors shall be reviewed more frequently and in greater depth than low-risk vendors, based on documented risk assessment.

Changes in ownership, service scope, technology, processing location, subcontractors, security posture or regulatory status shall be assessed for impact and may trigger re-due diligence.

Vendor security, fraud, privacy or operational incidents affecting RanaPay or its customers shall be escalated promptly through the relevant incident-management process.

Critical vendors shall have appropriate continuity and recovery arrangements, or RanaPay shall maintain compensating controls appropriate to the dependency risk.

RanaPay shall identify material dependency on a single vendor, partner or technology provider and consider alternatives, contingency arrangements or exit plans where proportionate.

Material vendor issues that may affect customers, transactions, gift-card availability, settlement, privacy or service continuity shall be escalated and managed promptly.

Where appropriate, RanaPay may request assurance reports, certifications, questionnaires, audit evidence, testing results or other reasonable evidence of control effectiveness.

• SLA performance
• Availability
• Transaction accuracy
• Support responsiveness
• Security events
• Complaint trends
• Reconciliation exceptions
• Corrective-action status

Material control gaps shall have documented corrective actions, owners and target dates. Unresolved high-risk issues may require management escalation or risk acceptance.

RanaPay may restrict or suspend vendor access or activity where there is a material security, fraud, compliance, operational or contractual risk, subject to applicable agreements and business procedures.

1. Confirm termination decision.
2. Restrict/revoke access.
3. Complete pending transactions and settlements.
4. Return or securely delete information as required.
5. Recover company assets.
6. Document outstanding liabilities/issues.
7. Complete final risk review.

• Due diligence records
• Approval records
• Contracts
• Security assessments
• SLA reports
• Incident records
• Review results
• Corrective actions
• Termination/exit records

Vendor information and due-diligence materials shall be handled according to applicable confidentiality and information-security requirements.

Exceptions shall be documented, risk-assessed and approved by an authorised function. Mandatory legal, regulatory or contractual requirements shall not be overridden.

This Policy shall be reviewed at least annually and whenever there is a material change in vendor risk, business model, partner arrangements, technology or applicable requirements.