Outsourcing Risk Policy

1. Introduction & Objectives

The objective of this Policy is to adopt sound and responsive risk management practices for effective oversight, due diligence and management of risks arising from outsourcing activities.

Outsourcing relationships are governed by written contracts that clearly describe all material aspects, including rights, responsibilities, customer confidentiality, and termination procedures.

2. Scope & Permissible Outsourced Activities

Outsourcing is defined as the Company’s use of a third party (affiliated or external) to perform activities on a continuing basis that would normally be undertaken by the Company itself. Indicative outsourceable financial services include:

• Field investigation
• Call Centre Services
• Legal Services
• Information Technology Services
• Collections and Debt Recovery Services
• Human Resources Management and Recruitment Services
• Payroll Management Services
• Data processing
• Application / Software Maintenance Services

3. Activities That Shall NOT Be Outsourced

The Company shall NOT outsource its core and critical activities under any circumstances. Illustrative non-outsourceable activities include:

• Maintenance and safekeeping of critical data
• Monitoring and redressal of investor grievances
• Surveillance functions
• Management of investment portfolio
• Decision-making functions such as determination of KYC norms for loan processing/account opening and according sanction for loans
• Internal Audit (internal auditors can however be engaged on contract)
• Strategic and Compliance functions

4. Key Risks Arising Out of Outsourcing

• Strategic Risk: Where service provider conducts business inconsistent with Company goals.
• Reputation Risk: Where poor service or customer interaction harms company standing.
• Compliance Risk: Non-compliance with privacy, consumer and prudential regulations.
• Operational Risk: Arising from technology failure, fraud, error, or inadequate financial capacity.
• Legal Risk: Fines, penalties or supervisory action resulting from provider commissions or omissions.
• Exit Strategy Risk: Over-reliance preventing bringing functions back in-house speedily.
• Counterparty Risk: Inappropriate underwriting or credit assessments by third parties.
• Contractual Risk: Inability of the Company to enforce contractual rights.
• Concentration & Systemic Risk: Excessive exposure to a single service provider.
• Country Risk: Political, social or legal risks in foreign offshore jurisdictions.

5. Risk Management Committee & Governance

The discretion for outsourcing activities rests with the Risk Management Committee, responsible for evaluating risks and materiality, implementing sound outsourcing policies, communicating material risks to the Board, ensuring tested contingency plans, and conducting independent audit compliance.

No part of the outsourced activity shall be sub-contracted without prior written approval of the Risk Management Committee.

6. Appraisal & Due Diligence of Service Providers

• Service providers must not be owned or controlled by any Director, Officer or Employee of the Company or their relatives.
• Comprehensive evaluation of capability, financial soundness, past experience, market reputation, security controls, and disaster recovery preparedness.
• Service providers must conduct background due diligence on their own employees.
• Service providers must isolate Company customer information and records to prevent commingling with other clients.
• Customer access is restricted on a strict "need-to-know" basis.

7. Confidentiality, Security & Incident Reporting

Customer confidentiality is paramount. Access to customer data is limited strictly to areas required to perform outsourced functions.

Security practices of service providers are reviewed regularly. The Company immediately notifies the Reserve Bank of India in the event of any security breach or data leakage.

8. Material Outsourcing Criteria & Agreements

Materiality is assessed based on importance of activity, financial impact, reputation impact, cost proportion, and aggregate exposure.

All outsourcing contracts must include: clear service standards, Company and RBI audit and inspection rights, continuous monitoring mechanisms, termination clauses, customer data confidentiality, business continuity plans, and prior approval requirements for subcontractors.

9. Intra-Group Outsourcing & Offshore Conditions

Outsourcing within group entities is conducted on arm’s-length terms under written agreements with clear physical demarcation to prevent customer confusion.

Offshore outsourcing: All original records continue to be maintained in India; offshore entities must not impede RBI inspection visits.

10. Direct Sales Agents (DSA), Marketing & Recovery Agents

Business Correspondents, Direct Sales Agents, Direct Marketing Agents and Debt Recovery Agents are strictly governed under this Policy, the Fair Practices Code, and Board-approved collections guidelines.

Customers are given a 30-day window for preferring complaints regarding outsourced activities through the Company’s Grievance Redressal Mechanism.

This Policy is reviewed annually by the Board of Directors.