AML & KYC Policy

Instaramp Fintech Private Limited and its subsidiaries and affiliates (the “Company”, which term includes its owners, directors, investors, employees and other related parties) is a private limited company incorporated under the laws of India. A person who avails any service from the Company, or who engages in any transaction on any digital or non-digital platform that the Company provides or operates, directly or indirectly, is a “User”. A User is a “client” for the purposes of the PMLA, the PML Rules and the FIU-IND Guidelines.

This Anti-Money Laundering, Countering the Financing of Terrorism and Combating Proliferation Financing and Know Your Customer Policy (“AML Policy”) sets out the measures that the Company takes to prevent the use of its services for money laundering, terrorist financing and proliferation financing. It is the statement of policies and procedures of the Company under Chapter IV of the PMLA, the PML Rules and the FIU-IND Guidelines.

This AML Policy is also an agreement between the Company and the User. It binds the User. Every User must comply with this AML Policy at all times. Any non-compliance may result in the termination of the User’s account on the Company platform, and in the reporting of the non-compliance and the termination to the relevant statutory authorities.

Users must strictly comply with this AML Policy, which forms part of the User’s Terms of Service. Terms not defined in this AML Policy have the meanings given in the Terms of Service or, if not defined there, their general meaning.

Each User must read, review, understand and agree to this AML Policy before the User clicks the “I Accept” option to use or avail the services of the Company.

This AML Policy supersedes and replaces all prior oral or written understandings or agreements between the Company and the User with respect to this AML Policy.

All terms defined in the Terms of Service and the Privacy Policy have the same meaning, force and effect in this AML Policy.

In this AML Policy:

1. (a)
   “Applicable Law” means all laws in force in the territory of India, including the PMLA, the PML Rules, the UAPA, the WMDA, the FIU-IND Guidelines, and the guidance, red flag indicators, directions and instructions that FIU-IND issues from time to time, each as amended from time to time;
2. (b)
   “Beneficial Owner” has the meaning given in the PML Rules, and includes the natural person who ultimately owns or controls a User, or on whose behalf a transaction is conducted;
3. (c)
   “Board” means the board of directors of the Company, or a committee of the board of directors to which the board delegates the relevant function;
4. (d)
   “Designated Director” means a managing director or whole-time director of the Company, duly authorised by the Board, who is responsible for overall compliance with the obligations under Chapter IV of the PMLA and the PML Rules, as defined in Rule 2(1)(ba) of the PML Rules;
5. (e)
   “FIU-IND” means the Financial Intelligence Unit – India;
6. (f)
   “FIU-IND Guidelines” means the “AML & CFT Guidelines for Reporting Entities Providing Services Related to Virtual Digital Assets” issued by FIU-IND, updated as on 08 January 2026, available at https://fiuindia.gov.in/pdfs/downloads/VDA08012026.pdf, as amended from time to time;
7. (g)
   “Money Laundering” has the meaning given in Section 3 of the PMLA;
8. (h)
   “Non-Profit Organisation” has the meaning given in Rule 2(1)(cf) of the PML Rules;
9. (i)
   “PEP” or “Politically Exposed Person” has the meaning given in Rule 2(1)(db) of the PML Rules;
10. (j)
    “PMLA” means the Prevention of Money-Laundering Act, 2002;
11. (k)
    “PML Rules” means the Prevention of Money-laundering (Maintenance of Records) Rules, 2005;
12. (l)
    “Principal Officer” means the officer at management level whom the Company designates under Rule 2(1)(f) of the PML Rules, and who is responsible to ensure implementation of and compliance with the obligations under Chapter IV of the PMLA and the PML Rules;
13. (m)
    “Sanctions Lists” means the lists of individuals and entities designated under the resolutions of the United Nations Security Council, including the ISIL (Da’esh) & Al-Qaida Sanctions List and the 1988 Sanctions List, the individuals and organisations notified under the UAPA, the persons covered by orders under the WMDA, and any other sanctions list that the Company adopts under this AML Policy, including the OFAC SDN list;
14. (n)
    “Senior Management” means the directors, officers or other personnel of the Company whom the Company specifically designates to monitor and ensure KYC compliance and the operation of the Company’s internal audit systems;
15. (o)
    “Suspicious Transaction” means a transaction, including an attempted transaction, whether or not made in cash, which, to a person acting in good faith:

    1. (i)
       gives rise to a reasonable ground of suspicion that it may involve proceeds of an offence specified in the Schedule to the PMLA, regardless of the value involved;
    2. (ii)
       appears to be made in circumstances of unusual or unjustified complexity;
    3. (iii)
       appears to have no economic rationale or bona fide purpose; or
    4. (iv)
       gives rise to a reasonable ground of suspicion that it may involve financing of the activities relating to terrorism;

    Explanation. A transaction that involves financing of the activities relating to terrorism includes a transaction that involves funds suspected to be linked or related to, or to be used for, terrorism, terrorist acts, or a terrorist, a terrorist organisation, or those who finance or attempt to finance terrorism.

16. (p)
    “UAPA” means the Unlawful Activities (Prevention) Act, 1967;
17. (q)
    “Unhosted Wallet” means a VDA wallet that is not hosted by a VDA service provider, and whose private keys the User holds directly;
18. (r)
    “VDA” or “Virtual Digital Asset” has the meaning given in Section 2(47A) of the Income-tax Act, 1961; and
19. (s)
    “WMDA” means the Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005.

The Government of India, by Notification S.O. 1072(E) dated 07 March 2023, notified persons who carry on certain VDA activities on behalf of another person in the course of business as reporting entities under the PMLA. By Notification S.O. 4877(E) dated 09 November 2023, the Director, FIU-IND, is the regulator of such reporting entities.

The Company carries on the following notified activities through the Instaramp platform:

1. (a)
   exchange between VDAs and fiat currency, through the On-Ramp and Off-Ramp services; and
2. (b)
   transfer of VDAs to and from the External Wallets of Users, as part of such exchange.

The Company carries on the notified activities only with a valid registration with FIU-IND as a reporting entity. The Company keeps its registration details, and the details of its Designated Director, Principal Officer, principal place of business and significant beneficial ownership, current on the FINGate portal.

The Company is non-custodial. It does not hold VDAs or fiat currency for Users, and it does not host wallets for Users. Where this AML Policy refers to a wallet or an account of a User, it means the User Account, the External Wallet or the Linked Bank Account, as the context requires.

This AML Policy applies to all Users, all transactions, and all directors, officers and employees (permanent and contractual) of the Company.

Board. The Board approves this AML Policy, the client acceptance framework, the risk classification framework and the periodic KYC updation policy. The Board receives the reports of the Principal Officer, the outcome of each risk assessment and the report of each independent audit under this AML Policy.

Designated Director. The Designated Director is responsible for overall compliance with the obligations under Chapter IV of the PMLA and the PML Rules. The Designated Director will ensure that the Company:

1. (a)
   evolves an internal mechanism to maintain information as Rule 5 of the PML Rules requires, including the correct upkeep of CDD records, transaction records and other documents;
2. (b)
   evolves an internal mechanism to furnish information to FIU-IND as Rule 7 of the PML Rules requires;
3. (c)
   submits, on time and accurately, the transactions prescribed under Rule 3 of the PML Rules, the reports that FIU-IND prescribes, and the information that FIU-IND seeks under Section 12A of the PMLA;
4. (d)
   carries out the risk assessment under Rule 9(13) of the PML Rules; and
5. (e)
   has adequate resources, internal controls, processes and training, and that its officers and employees follow all procedures for record keeping, CDD, transaction monitoring and reporting.

Principal Officer. The Principal Officer is responsible to ensure compliance, to monitor transactions, and to share and report information as the PMLA and the PML Rules require. The Company will ensure that the Principal Officer:

1. (a)
   works for the Company exclusively and full-time, and has no simultaneous or concurrent engagement with any other entity in any capacity;
2. (b)
   is at management level, preferably not below the level of head of audit, compliance or risk, and has sufficient seniority and authority to act independently, without interference or improper influence;
3. (c)
   has at least three (3) years of relevant experience, is familiar with AML/CFT/CPF legal requirements, reporting obligations and enforcement mechanisms, and knows the money laundering and terrorist financing risks, trends and typologies of the VDA sector;
4. (d)
   is based in India;
5. (e)
   is not actively involved in the business or operational activities of the Company;
6. (f)
   is a permanent invitee to each high-level committee that evaluates the risks of products and services;
7. (g)
   has adequate support staff, technical resources and unhindered, timely access to all CDD information, transaction records and other relevant information; and
8. (h)
   is a different individual from the Designated Director.

The Company has appropriate internal guidelines to make information and documents available to the Principal Officer on time, so that the Principal Officer can respond promptly to requests from FIU-IND, law enforcement agencies and regulators.

Responsibilities of the Principal Officer. The Principal Officer will:

1. (a)
   furnish the information referred to in Rule 3(1) of the PML Rules to FIU-IND, based on the information available with the Company, and keep a copy for official record;
2. (b)
   furnish information on a Suspicious Transaction to FIU-IND promptly, after being satisfied that the transaction is suspicious;
3. (c)
   evolve and implement an internal mechanism to escalate potential Suspicious Transactions, with special attention to complex or unusually large transactions and unusual patterns of transactions that have no apparent economic or visible lawful purpose;
4. (d)
   examine the background and purpose of such transactions, record the findings, and make the records available to the relevant authorities when required;
5. (e)
   take the final decision on each escalated alert, record the reasons to treat a transaction as suspicious or to close an alert as not reportable, and ensure that there is no undue delay in this decision;
6. (f)
   review the alert scenarios and the monitoring approach from time to time, and carry out surprise checks on a sample basis to confirm that all unusual or potentially suspicious transactions are escalated; and
7. (g)
   report directly to the Board.

Reporting to the Board. The Principal Officer will place a review of the AML/CFT/CPF function before the Board, preferably every quarter, and in any case at least once a year. The report will include, at a minimum:

1. (a)
   an assessment of the effectiveness of the AML/CFT/CPF compliance programme of the Company;
2. (b)
   any risks or vulnerabilities identified in the programme;
3. (c)
   a summary of the Suspicious Transaction Reports and other reports submitted to FIU-IND;
4. (d)
   the instructions, red flag indicators, typologies and guidance issued by FIU-IND, and the status of their implementation; and
5. (e)
   any proposed changes to this AML Policy.

Communication to FIU-IND. The Company will promptly communicate the name, designation, address and contact details of the Designated Director and the Principal Officer to FIU-IND, as Rule 7(1) of the PML Rules requires, and will update them on the FINGate portal whenever they change.

Compliance team. The Company has a compliance team that assists the Principal Officer. The compliance team may analyse alerts and prepare documents, but the final analysis and decision remain with the Principal Officer.

The Company will:

1. (a)
   ensure that the management, all officers and all staff understand the spirit and requirements of this AML Policy and the FIU-IND Guidelines;
2. (b)
   adopt client acceptance policies and apply CDD measures in proportion to the money laundering, terrorist financing and proliferation financing risk of each User, business relationship, transaction, geographic area, product and service;
3. (c)
   have systems to identify, monitor and report on time Suspicious Transactions, threshold-based reports and typologies to FIU-IND;
4. (d)
   have an internal mechanism to furnish records and information to FIU-IND within the time and in the manner that FIU-IND requires under Section 12A of the PMLA;
5. (e)
   have a mechanism to co-operate with law enforcement agencies, including timely disclosure of the required information; and
6. (f)
   not use or avail the products or services of any third party based in a known high-risk jurisdiction.

The Company will cause an independent review of this AML Policy every year, to assess its continued effectiveness. A person who was not involved in framing this AML Policy will carry out the review.

The Company displays a clear, comprehensive and concise summary of this AML Policy on its website and in its mobile application, in a place that Users access for onboarding and login. Section 31 sets out this summary.

The Company sets out instruction manuals for its staff on onboarding, CDD, sanctions screening, record keeping, transaction monitoring and reporting, as per this AML Policy.

The Company carries out a risk assessment to identify, assess and take effective measures to mitigate its money laundering, terrorist financing and proliferation financing risks, for Users, geographic areas, products, services, transactions and delivery channels, severally and together.

The risk assessment considers, among other things, the risks of VDAs and VDA-related products and services (in particular, methods for anonymity-enhanced transactions), VDA-related business practices, the technologies and tools associated with VDA activities, Users who carry out complex or high-value transactions, and Users who transact with known high-risk jurisdictions.

Before the Company launches any new technology, product, service or business practice, it carries out a risk assessment to identify, assess and mitigate the risks that may arise.

The Company documents each risk assessment. The assessment is proportionate to the nature, size, geographical presence and complexity of the activities of the Company. The Board determines the frequency of the risk assessment based on the outcome of the previous assessment. The interval between any two assessments will not exceed one (1) year.

The Company places the outcome of each risk assessment, and the mitigation measures identified or implemented, before the Board. The Company makes them available to the relevant authorities when required.

The Company has a Board-approved client acceptance framework. Under this framework:

1. (a)
   the Company will not start any relationship or transaction with a User without the correct CDD measures;
2. (b)
   the Company will not open or keep any anonymous account, any account in a fictitious name, or any account on behalf of other persons whose identity is undisclosed or cannot be verified;
3. (c)
   any discrepancy, mismatch or failed verification of information will trigger enhanced measures under CDD;
4. (d)
   if the Company cannot verify the identity of a User, if it suspects that the information provided is false or not genuine, or if it cannot apply the correct CDD or enhanced measures, the Company will end the onboarding process and will not allow any transaction;
5. (e)
   the Company will screen every User against the Sanctions Lists, and will not accept any User whose identity matches a person or entity on a Sanctions List; and
6. (f)
   if the Company does not have the identity records of an existing User as this AML Policy requires, it will obtain them within a fixed time. If it cannot obtain them, it will close the account of the User after due notice to the User.

A User must transact on the Company platform only on the User’s own account, with the User’s own funds, and for the User’s own benefit. A User must not act on behalf of another User. The Company will determine whether a User acts on behalf of a Beneficial Owner, and will take all necessary steps to identify the Beneficial Owner.

Users who are PEPs cannot open an account on the Company platform.

If an existing User becomes a PEP at any time, the Company will apply enhanced measures under CDD. The Company may continue the relationship with the User only with the approval of Senior Management. Senior Management may decline to continue the relationship for any reason that it deems suitable, at its sole discretion.

The Company has a Board-approved framework for the risk classification of Users. Under this framework, the Company classifies each User, at a minimum, as “High Risk” or “Medium Risk”. The Company may create additional categories for Users with a higher risk perception.

The Company classifies Users on parameters such as the identity of the User, financial position, nature of business activity, information about the business and location of the User, geographical risk of the User and of the transactions, the products and services used, and the types of transactions undertaken. The framework defines objectively the parameters for each risk category, including the parameters for transaction monitoring and for enhanced measures under CDD.

The Company reviews the risk classification of every User at least once every six (6) months.

The Company keeps the risk classification of each User, and the specific reasons for it, confidential.

Due to the anonymous and instantaneous nature of VDA transactions, the Company applies a robust client due diligence (“CDD”) process. The Company applies CDD to every User, regardless of the value of the transaction:

1. (a)
   when it establishes a relationship with the User;
2. (b)
   when it does not have the identity records of an existing User;
3. (c)
   when there is a suspicion of money laundering, terrorist financing or proliferation financing, regardless of any threshold;
4. (d)
   when it doubts the veracity or adequacy of identification information or documents obtained earlier; and
5. (e)
   for the periodic updation of the profile of an existing User.

CDD includes:

1. (a)
   identification of the User through the User’s details and documents, and verification of the User’s identity from reliable and independent sources;
2. (b)
   development of a risk profile of the User, based on a holistic assessment of available and open-source information;
3. (c)
   ongoing due diligence through continuous monitoring of the User’s transactions and activities; and
4. (d)
   updation of User information periodically, or when a change in the User’s profile triggers it.

The Company collects additional identifiers that it needs for verification, authentication, monitoring and risk assessment, including the IP address with timestamp, geo-location, device ID, VDA wallet addresses and transaction hashes.

The Company obtains and verifies the Permanent Account Number (“PAN”) of every User before onboarding and before any VDA-related activity.

At the time of establishing a relationship, the Company obtains, at a minimum, the following information from an individual User:

1. (a)
   personal information: full name as it appears in the PAN, date of birth, gender, PAN details, identity document type, identity document number and nationality;
2. (b)
   contact details: address, mobile number and email ID;
3. (c)
   financial and occupation details: occupation, income range and bank account details; and
4. (d)
   other parameters: a selfie of the User with liveness detection, and the latitude and longitude of the onboarding location, with date, timestamp and IP address.

The User must submit the PAN and any one of the following identity documents, or an equivalent e-document that contains the details of identity and address:

1. (a)
   passport;
2. (b)
   driving licence;
3. (c)
   proof of possession of Aadhaar number; or
4. (d)
   voter’s identity card issued by the Election Commission of India.

Where the User submits proof of possession of an Aadhaar number, the Company verifies it only in a manner that Applicable Law permits, such as offline verification.

The Company verifies and validates the information and documents through reliable and independent sources. The Company verifies the mobile number and email ID through one-time password (OTP) validation or link verification.

The Company ensures that the person whose credentials are furnished is the same person who accesses the application and personally starts the account creation. The Company captures a live photograph of the User and uses liveness detection technology to verify the physical presence of the User at the time of onboarding.

The onboarding system captures the geo-location coordinates (latitude and longitude) of the User at the place of verification. If the address furnished does not match the geo-coordinates, the Company applies enhanced measures under CDD.

The Company verifies the Linked Bank Account of the User through a penny-drop mechanism, to confirm both the ownership and the operational status of the account.

For a User that is not a natural person, such as a sole proprietary concern, partnership firm, company, trust or Non-Profit Organisation, the Company carries out CDD of the legal person as per the procedure for individuals in this AML Policy, as applicable. In all cases, the Company obtains the PAN of the legal person and verifies it from the database of the issuing authority. The Company also obtains the information and documents that Rule 9 of the PML Rules prescribes.

Where the User is a company, it must submit to the Company:

1. (a)
   its certificate of incorporation;
2. (b)
   its memorandum and articles of association;
3. (c)
   its PAN;
4. (d)
   a resolution of its board of directors, and a power of attorney granted to its managers, officers or employees to transact on its behalf;
5. (e)
   the officially valid documents of its Beneficial Owners, and of the managers, officers or employees who hold a power of attorney to transact on its behalf;
6. (f)
   the names of the persons who hold senior management positions;
7. (g)
   the address of its registered office and principal place of business, if different; and
8. (h)
   any other documents that the Company may request.

Where the User is a partnership firm, it must submit to the Company one certified copy of each of the following:

1. (a)
   its registration certificate;
2. (b)
   its partnership deed;
3. (c)
   its PAN;
4. (d)
   the officially valid documents of its Beneficial Owners, and of the persons who hold a power of attorney to transact on its behalf;
5. (e)
   the names of all its partners;
6. (f)
   the address of its registered office and principal place of business, if different; and
7. (g)
   any other documents that the Company may request.

Where the User is a trust, it must submit to the Company one certified copy of each of the following:

1. (a)
   its registration certificate;
2. (b)
   its trust deed;
3. (c)
   its PAN;
4. (d)
   the officially valid documents of its Beneficial Owners, and of the persons who hold a power of attorney to transact on its behalf;
5. (e)
   the names of its beneficiaries, trustees, settlor, protector (if any) and author;
6. (f)
   the address of its registered office; and
7. (g)
   any other documents that the Company may request.

Where the User is a sole proprietary concern, the Company carries out CDD of the proprietor as an individual, and obtains proof of the existence of the business, such as a registration certificate or a GST registration certificate.

Where the User is any other juridical person, it must submit to the Company one certified copy of each of the following:

1. (a)
   a document that shows the name of the person authorised to act on its behalf;
2. (b)
   the officially valid documents of its Beneficial Owners, and of the person who holds a power of attorney to transact on its behalf; and
3. (c)
   any other documents that the Company may request.

The Company determines the Beneficial Owners of every User that is a legal person, and takes all reasonable steps under Rule 9(3) of the PML Rules to verify their identity.

The Company verifies that any person who claims to act on behalf of a legal person is so authorised, and verifies the identity of that person.

Where the User is a Non-Profit Organisation, the Company ensures that the User is registered on the DARPAN portal of NITI Aayog, as Rule 9 of the PML Rules requires.

A resolution or authorisation letter of a legal person must authorise transactions in VDAs.

If the Company engages a third party to carry out the User identification process, the Company will ensure that:

1. (a)
   the Company obtains the User due diligence carried out by the third party within two (2) days;
2. (b)
   adequate steps are taken to ensure that the third party makes copies of any part of the User due diligence available without delay, on request;
3. (c)
   the Company is satisfied that the third party is regulated, supervised or monitored by, and complies with the due diligence and record-keeping requirements of, the PMLA;
4. (d)
   the third party is not based in a high-risk jurisdiction;
5. (e)
   no decision-making function of the Company is outsourced to the third party;
6. (f)
   Users do not have to give any additional copies of officially valid documents to the third party;
7. (g)
   the Company itself remains ultimately responsible for User due diligence; and
8. (h)
   the Company complies with all other requirements of Applicable Law.

If Applicable Law so requires, the Company will file KYC records with the Central Registry of Securitisation Asset Reconstruction and Security Interest of India (“CERSAI”) within the time that Applicable Law prescribes, and may communicate the User’s KYC Identifier once CERSAI assigns it.

The Company will use the KYC records of a User only for the purposes of this AML Policy. The Company will not transfer such records to any third party without the prior authorisation of the User, or of the Director or other regulator appointed under the PMLA, except as Applicable Law requires. The Company treats all information collected from Users as confidential and does not use it for cross-selling. The Company keeps the information that it collects as non-intrusive as possible. Any request for information that is not mandatory is labelled as optional.

The Company applies enhanced measures under CDD based on materiality and risk. The Company starts these measures for transactions assessed as high risk, or where a red flag indicator raises a money laundering, terrorist financing or proliferation financing concern. The scope and intensity of the measures are in proportion to the risk profile of the User and to the circumstances that triggered them. They are not limited to the collection of income or turnover documents.

Enhanced measures under CDD include:

1. (a)
   examination of the financial position of the User, including the source of funds;
2. (b)
   a record of the purpose of the transactions;
3. (c)
   more frequent review of the User’s profile and transactions;
4. (d)
   collection of information from open sources; and
5. (e)
   independent verification of the information obtained from the User, including from independent and credible databases, where necessary.

The Company always applies enhanced measures under CDD to relationships and transactions:

1. (a)
   with natural and legal persons from known high-risk jurisdictions, including countries designated as tax havens and countries on the grey list or black list of the Financial Action Task Force;
2. (b)
   with PEPs, including an existing User who becomes a PEP;
3. (c)
   with Users that are Non-Profit Organisations; and
4. (d)
   that involve Unhosted Wallets, as set out in Section 18.

As Users are not face-to-face customers of the Company, the Company may also require the certification of documents, additional documents, and a first payment from the User’s own KYC-compliant bank account.

When the transactions of a User reach a total value of at least INR 50,00,000 (Indian Rupees Fifty Lakh) over the course of the User’s engagement with the Company platform, the Company will apply enhanced measures under CDD, and will ask the User for:

1. (a)
   a customer declaration form, which states that all VDAs and funds that the User uses on the Company platform come from legitimate sources, and which contains other details of the User;
2. (b)
   the bank statements of the User for the previous three (3) months;
3. (c)
   a certificate from a chartered accountant with details of the financial soundness of the User and the compliance of the User with the PMLA and the Foreign Exchange Management Act, 1999; and
4. (d)
   documents for physical verification of the identity and address of the User.

The Company may revise this threshold from time to time based on its risk assessment.

If the Company cannot apply the required enhanced measures under CDD, the Company will terminate the relationship with the User and will file a Suspicious Transaction Report with FIU-IND, as the PML Rules require.

Due to the high-risk nature of VDAs, the Company periodically updates the CDD of its existing Users, under its risk-based approach. The Company ensures that all CDD information remains accurate, up to date and relevant. The Company updates the KYC of each User at least:

1. (a)
   once every six (6) months for a User assessed as high risk; and
2. (b)
   once every year for all other Users,

measured from the date of account opening or from the date of the last KYC updation.

The Board approves the policy for periodic KYC updation. Where periodic updation is already due for a User, the Company updates the KYC of that User on priority.

During periodic updation:

1. (a)
   if there is no change in the CDD information, the Company obtains a self-declaration from the User. For a legal person, the Company also confirms that the Beneficial Owner information is accurate and up to date, and obtains a self-declaration to this effect;
2. (b)
   if there is any change in the CDD information, the Company carries out the full CDD process, including verification, as for a new User;
3. (c)
   if any CDD document has expired, the Company carries out the full CDD process as for a new User;
4. (d)
   the Company promptly updates its records with the information and documents obtained, and keeps a record of the date of updation; and
5. (e)
   any additional measure that the Company adopts, such as a live selfie or video, physical presence or more frequent updation, is set out in its CDD programme.

Where the Company observes a material change in the ownership, business or transaction behaviour of a User, it carries out verification or enhanced measures under CDD.

The User must promptly inform the Company of any change in the information or documents that the User submitted, and must submit the updated information or documents.

If a User does not complete periodic KYC updation when due, the Company may suspend the User Account until the updation is complete, and may close the account after due notice to the User.

The Company exercises ongoing due diligence, as Rule 9(12) of the PML Rules requires. It closely examines transactions on a continuous basis, to determine whether they are consistent with the Company’s knowledge of the User, the User’s financial and risk profile, and the source of funds. The intensity of monitoring is in proportion to the risk category of the User.

Ongoing due diligence includes identification of changes in the risk profile of the User, such as changes in behaviour, in the VDA products and services used, and in the volume and value of transactions. Such changes may require enhanced measures under CDD.

The Company has an internal mechanism and transaction monitoring systems that monitor transactions continuously, as per the guidance that FIU-IND issues from time to time. These systems identify the origin and destination of each VDA through blockchain analytics, and apply robust controls to detect potential money laundering, terrorist financing and proliferation financing.

The Company flags any unusual or suspicious movement of funds or activity, including fiat-to-virtual and virtual-to-fiat transactions. The Company in particular monitors:

1. (a)
   large or complex transactions, including transactions with unusual patterns that are not consistent with the normal or expected level of activity of the User, and that have no apparent economic rationale or legitimate purpose;
2. (b)
   transactions with a high turnover that is not consistent with the financial profile, declared income range or occupation of the User; and
3. (c)
   transactions that appear to be structured into smaller transactions to avoid any threshold or control.

The monitoring system includes the red flag indicators, guidance, typologies and instructions that FIU-IND issues from time to time, and any additional indicators from the Company’s own risk assessment. The compliance team and the Principal Officer review all alerts without delay. Where applicable, the Principal Officer files a Suspicious Transaction Report promptly.

The Company uses appropriate, scalable and secure systems to store transaction data, so that individual transactions can be reconstructed as Rule 4 of the PML Rules requires. These systems have role-based access control and reliable data backup and recovery mechanisms.

The Company may use transaction risk scoring models, automated systems and artificial intelligence or machine learning technologies to support effective monitoring.

When the Company sends VDAs to, or receives VDAs from, a wallet hosted by another VDA service provider, the Company obtains, holds and transmits the required originator and beneficiary information, as Rule 4 of the PML Rules and the FIU-IND Guidelines require. Before it transmits the information, the Company carries out due diligence and sanctions screening on the counterparty VDA service provider, to avoid dealing with illicit actors or sanctioned persons.

When the Company is the originating entity, it obtains, holds and transmits the following information:

1. (a)
   the PAN and the identity document number of the originator;
2. (b)
   the verified full name of the originator;
3. (c)
   the wallet address or account number of the originator used for the transaction;
4. (d)
   the physical address and date of birth of the originator, as verified in the CDD process;
5. (e)
   the name of the beneficiary, which the Company reviews for sanctions screening, transaction monitoring and suspicious transaction reporting; and
6. (f)
   the wallet address or account number of the beneficiary used for the transaction.

When the Company is the beneficiary entity, it obtains from the originating entity, and holds, the information listed in the previous Clause. The Company verifies that the name and wallet address or account number of the beneficiary match its verified User data. The Company reviews the name of the originator for sanctions screening, transaction monitoring and suspicious transaction reporting.

The Company uses an appropriate technological solution to transmit the required information immediately and securely, that is, before or at the same time as the VDA transfer. The Company does not submit the required information after the transfer. Where the deployment of such a solution is not feasible in an exceptional case, the Company may use a self-declaration mechanism, as the FIU-IND Guidelines permit.

The Company keeps a communication channel with counterparty VDA service providers for follow-up due diligence, and to request information on a transaction to determine whether it involves high-risk or prohibited activities or sanctioned persons.

The Company monitors VDA transfers to detect transfers that lack the required originator or beneficiary information, and takes risk-based action on them. The Company makes the required information available to the appropriate authorities on request, without delay.

The Company screens every User against the Sanctions Lists, at a minimum:

1. (a)
   at the time of onboarding;
2. (b)
   when the KYC details of the User change;
3. (c)
   when any Sanctions List changes; and
4. (d)
   when any VDA transaction is initiated.

The Company also screens the External Wallet address of the User and the counterparty wallet address of each VDA transaction.

The Company promptly applies the directives of the competent authorities that implement the resolutions of the United Nations Security Council on terrorism, terrorist financing and the proliferation of weapons of mass destruction and its financing, including orders under Section 51A of the UAPA and Section 12A of the WMDA, and complies with all other applicable laws and directives on economic sanctions.

The Company does not complete any VDA transfer before sanctions screening is complete and confirms that no concern arises. Until then, the Company holds the transaction pending.

If a User or a transaction matches a Sanctions List, the Company will deny the transaction, take the actions that the competent authorities direct, and report the matter to FIU-IND and the other authorities as Applicable Law requires.

Unhosted Wallets. VDA transfers to and from Unhosted Wallets pose significant risks due to anonymity, portability and speed. For such transfers, the Company collects the required originator, beneficiary and other relevant information from the User, verifies that the User owns and controls the Unhosted Wallet, monitors and assesses the information to determine the risk, and applies enhanced measures under CDD and other risk-based controls. The Company may limit, restrict or decline transactions with Unhosted Wallets based on its risk assessment.

Unregistered VDA service providers. The Company applies the same risk-based approach to transfers to and from wallets hosted by VDA service providers that are not registered with FIU-IND. The Company may limit, restrict or decline such transactions.

Anonymity-enhancing crypto tokens. The Company does not permit deposits or withdrawals of anonymity-enhancing crypto tokens, or of any VDA designed to conceal or obscure the origin, ownership or value of transactions. The Company does not facilitate dealings in such tokens.

Mixers and tumblers. The Company uses transaction monitoring and analytical tools to identify transactions that involve crypto tumblers, mixers or other anonymity-enhancing products or services. The Company does not facilitate such transactions, and applies suitable risk mitigation measures when it detects them.

ICOs and ITOs. The Company does not provide services related to Initial Coin Offerings or Initial Token Offerings.

Automated processes. The use of a smart contract or other automated process does not relieve the Company of its obligations under Chapter IV of the PMLA and the PML Rules.

Suspicious Transaction Reports. The Principal Officer will furnish information on Suspicious Transactions, including attempted Suspicious Transactions, to FIU-IND promptly, and not later than seven (7) working days after being satisfied that the transaction is suspicious, as Rules 3(1)(D), 7(2) and 8(2) of the PML Rules require.

The Company will file a Suspicious Transaction Report irrespective of the amount of the transaction or any reporting threshold, if it has reasonable grounds to believe that the transaction involves proceeds of crime or financing of terrorism.

Each report will contain complete and accurate information on User KYC, wallets, transactions, counterparties and grounds of suspicion. The Company will use every data point available to it, including KYC information, transaction information, technical information, IP addresses, device IDs and behavioural insights, to report high-quality Suspicious Transaction Reports, after due application of mind.

Other reports. The Company will furnish to FIU-IND the information on transactions prescribed under Rule 3 of the PML Rules, and a monthly report, in the form, time and manner that FIU-IND prescribes from time to time.

Information sought by FIU-IND. The Company will furnish any records or information that FIU-IND seeks under Section 12A of the PMLA, within the time and in the manner that FIU-IND requires.

The Company will submit all reports in the format that FIU-IND prescribes from time to time.

Section 12(2) and Section 12A(3) of the PMLA, read with Rule 8(6) of the PML Rules, require the Company, its directors, officers and all employees (permanent and contractual) to keep confidential the fact that records are maintained and information is furnished to FIU-IND.

This prohibition applies before, during and after the submission of a Suspicious Transaction Report. The Company will ensure that there is no tipping-off to the User or to any other person at any level.

The government, law enforcement authorities, police, investigating agencies, or tribunals and courts, within or outside the territory of India, may require or direct the Company to co-operate with and aid them.

In such cases, subject to applicable laws on data protection, the Company may disclose any information about the User that is in its possession or control, including to government or law enforcement officials, police, investigating agencies, tribunals and courts within the territory of India.

In particular, the Company may start processes and make disclosures, including in the following circumstances:

1. (a)
   information about, or in pursuance of, claims and legal process, such as summons or warrants;
2. (b)
   to protect the property, rights and safety of the Company, of a third party, or of the public in general; and
3. (c)
   to identify and stop any activity that the Company considers illegal, unethical or legally actionable.

The Company maintains all necessary information and records of transactions so as to permit the reconstruction of individual transactions, including:

1. (a)
   the nature of the transaction;
2. (b)
   the amount and type of VDA and the fiat currency, if any, involved in the transaction;
3. (c)
   the date on which the transaction was conducted;
4. (d)
   the parties to the transaction; and
5. (e)
   the other details that the Travel Rule requires.

The Company also maintains a separate record of:

1. (a)
   all transactions prescribed under Rule 3 of the PML Rules;
2. (b)
   User transactions with a value of at least INR 1,00,000 (Indian Rupees One Lakh), or its equivalent in foreign currency, and User transactions that are connected to each other, that take place within a month of each other, and that have a monthly aggregate of at least INR 1,00,000 (Indian Rupees One Lakh), or its equivalent in foreign currency; and
3. (c)
   all Suspicious Transactions, whether made or attempted, by any mode.

The Company maintains hard and soft copies of these records in the procedure and manner that Rule 5 of the PML Rules and other Applicable Law specify. The Company has a system with clearly defined procedures for the retention, maintenance and preservation of all transaction and account records, so that it can retrieve them easily and promptly when the competent authorities require them.

The Company preserves complete audit trails, including verification responses, timestamps and authentication logs, in a tamper-proof manner.

The Company retains the records specified under Section 12(1)(a) and Section 12(1)(e) of the PMLA for the period, and in the manner, that Section 12 of the PMLA and the PML Rules prescribe, read with the FIU-IND Guidelines (https://fiuindia.gov.in/pdfs/downloads/VDA08012026.pdf), each as amended from time to time. At present, the Company:

1. (a)
   maintains and preserves the records of the identity and address of Users, obtained at onboarding and during the business relationship, for at least five (5) years after the account-based relationship ends;
2. (b)
   maintains and preserves all necessary records of transactions for at least five (5) years from the date of the transaction; and
3. (c)
   retains records that relate to ongoing investigations, or to transactions that were the subject of a disclosure, until it is confirmed that the case is closed.

The Company securely preserves these records and does not destroy them during the retention period.

The Company causes an independent audit of its AML/CFT/CPF controls, systems, procedures and safeguards at least once a year. The audit focuses on compliance with this AML Policy and the related procedures and controls.

The audit report comments on the robustness of this AML Policy and the internal processes, and makes suggestions to strengthen them where necessary. The Company places the audit report before the Board and takes corrective action on any deficiency.

The Company also compiles records, and audit and compliance notes, to determine the efficacy of its internal audit systems on an ongoing basis.

The Company has an adequate screening mechanism for personnel as part of its recruitment process.

The Company has an ongoing training programme, so that its staff are adequately trained to implement AML/CFT/CPF measures. The Company customises the training for staff who handle AML/CFT/CPF matters.

A User may contact the Company’s staff with any question or concern about the measures in this AML Policy.

The User agrees and undertakes not to engage in, assist, abet or encourage, in any manner, any activity that involves money laundering, terrorist financing, proliferation financing or the financing of any illegal or unlawful activity.

The User must give true, accurate and complete information and documents, including the information that the Travel Rule requires, and must promptly inform the Company of any change in them.

The User must not use the Company platform for any transaction that involves anonymity-enhancing crypto tokens, mixers, tumblers or any sanctioned person or address.

Any notice or other communication under this AML Policy must be sent only by email. The User agrees to receive electronic or any other form of communication and notifications from the Company.

Email messages sent over the internet are not always secure. The Company is not responsible or liable if the User does not receive such communication. Once the Company sends an email, it is deemed served on the User. The Company is deemed to receive a communication from the User only when it actually reaches, and is acknowledged in, the inbox of the person to whom it is addressed. The Company is not liable or responsible for the non-receipt of communications, or for any damages that result from sending email messages over the internet.

The Company will send all communications to the User at the email address that the User gave as part of KYC. The User must inform the Company of any change in the email address or communication option.

The User must send all communications to the Company to:

This AML Policy is governed by and construed in accordance with the laws of India.

Subject to the dispute resolution provisions of the Terms of Service, the parties irrevocably submit to the exclusive jurisdiction of the courts at Bengaluru, Karnataka, India, for the resolution of any dispute that arises from or in connection with this AML Policy.

Successors. This AML Policy binds, and is for the benefit of, the parties and their respective successors and permitted assigns.

Severability. The invalidity or unenforceability of any provision of this AML Policy does not affect, impair or make unenforceable this AML Policy or any other provision in it. The other provisions remain in full force and effect. This AML Policy is divisible as to any provision that is deemed invalid or unenforceable. The rest of this AML Policy remains enforceable and binding on the parties.

Waiver. No provision of this AML Policy may be waived or changed except in a writing signed by the party against whom the waiver is to be enforced. If a party fails or omits at any time to enforce, or to require strict or timely compliance with, any provision of this AML Policy, this does not affect or impair that provision, any other provision, or the right of that party to avail the remedies that it may have for any later breach of that or any other provision.

Recitals. The recitals, schedules and annexures of this AML Policy form part of this AML Policy, and their contents are read into it. Headings are for ease of reference only. They do not affect the meaning or interpretation of this AML Policy.

Entirety. This AML Policy, and the other agreements that it contemplates, constitute the entire agreement.

Change in law. VDA service providers are reporting entities under the PMLA. The legal and regulatory framework for VDAs in India may change. If any law, or any direction of a competent authority, makes the services of the Company unlawful, this AML Policy will terminate automatically, without further notice to the User. The User understands, agrees to and accepts the risks and costs of transactions in VDAs.

Miscellaneous. All other provisions of the Terms of Service of the Company, including governing law and jurisdiction, notices, severability and assignment, are read into this AML Policy and form part of it.

The Company reviews this AML Policy at least once a year, and whenever Applicable Law or the FIU-IND Guidelines change. The Board approves each revision.

The Company will upload the revised AML Policy on the Company website, with the date of modification. The User must periodically visit the website to review this AML Policy and any changes to it.

The continued use of the services of the Company by the User is the agreement of the User to this AML Policy and to any amendments to it.

The User must not assign this AML Policy, or the responsibilities or benefits that arise from it, except with the prior written consent of the Company.

The Company publishes this summary on its website and in its mobile application, as paragraph 3.4.5 of the FIU-IND Guidelines requires.

Who we are. Instaramp Fintech Private Limited is a reporting entity under the PMLA. It provides non-custodial On-Ramp and Off-Ramp services between VDAs and INR.

Know your customer. Every User must complete KYC before any transaction. We collect your PAN, an identity document, contact details, occupation, income range, bank account details, a live selfie and your onboarding location. We verify your mobile number and email by OTP, and your bank account by penny-drop.

Your own account only. You may transact only for yourself, with your own funds. We do not accept anonymous or fictitious accounts, or politically exposed persons as new Users.

Risk-based checks. We classify every User by risk. We update KYC every six (6) months for high-risk Users and every year for other Users. We may ask for more information or documents at any time.

Screening and monitoring. We screen every User, wallet and transaction against sanctions lists, and monitor all transactions with blockchain analytics. We apply the Travel Rule to transfers with other VDA service providers.

What we do not allow. We do not allow anonymity-enhancing tokens, mixers, tumblers or sanctioned persons or addresses. We may restrict transfers with unhosted wallets or unregistered service providers.

Reporting. We report suspicious transactions and other prescribed information to FIU-IND, as the law requires. The law does not permit us to tell you about such reports.

Records. We keep identity and transaction records for at least five (5) years, as the PMLA requires.

Contact. For any question about this AML Policy, email compliance@instaramp.xyz.