Fraud Risk Management Policy

• aReserve Bank of India (Digital Lending) Directions, 2025 and all subsequent amendments.
• bReserve Bank of India (Non-Banking Financial Companies - Responsible Business Conduct) Directions, 2025, updated directions and fair practices requirements applicable to NBFCs.
• cRBI directions on Key Facts Statement, Annual Percentage Rate, penal charges, grievance redressal, outsourcing, recovery agents, credit information reporting, KYC/AML, cyber security and customer protection.
• dCompanies Act, 2013, Information Technology Act, Digital Personal Data Protection framework, Contract Act, consumer protection laws and any other applicable law.

In case of inconsistency between this Policy and any binding regulatory requirement, the stricter requirement shall apply automatically. Management shall place such inconsistency before the Board or authorised committee for formal amendment at the earliest feasible meeting.

The purpose of this Policy is to establish a comprehensive, transparent, borrower-protective and regulator-ready framework for fraud risk management policy of Crestmont Capital Pvt. Ltd.. The Policy is designed for digital lending through Askrupee, website publication, internal governance, LSP/DLA control, audit review and Board oversight.

This Policy is deliberately detailed so that business, compliance, technology, recovery, customer service, legal and audit teams can operate from a common control framework and avoid informal practices that may create regulatory, conduct, data, customer protection or reputational risk.

• aAll directors, KMPs, employees and officers of the Company.
• bAll digital lending journeys, including Askrupee and any web/app/API channel.
• cAll outsourced service providers, LSPs, DLAs, collection agencies, technology vendors, call centres, API partners and processors.
• dAll borrowers, applicants, co-applicants, references and customer data subjects to the extent applicable.
• eAll loan lifecycle stages: marketing, application, KYC, underwriting, sanction, KFS, disbursement, servicing, repayment, collection, closure and complaint handling.

• aThis Policy applies to the Company, its directors, employees, officers, consultants, LSPs, DLAs, vendors and any person acting for or on behalf of the Company.
• bThe Policy is intended to ensure governance discipline, compliance ownership, transparent customer outcomes and auditable control environment.
• cAny exception shall require written justification, approval and retrospective reporting.
• dWhere this Policy refers to digital lending, it includes Askrupee and any related website, app, API, partner or customer interface.

• aThe Company shall maintain maker-checker approval, access controls, periodic review, audit logs and documented evidence.
• bOutsourcing shall not dilute regulatory responsibility.
• cAll customer-impacting processes shall be tested for fairness, disclosure and consent.
• dMaterial issues shall be reported to senior management and the Board.

• aNo employee or partner shall bypass approved SOPs.
• bNo communication shall misrepresent RBI approval.
• cNo undisclosed fee shall be charged.
• dNo borrower data shall be used beyond approved purposes.