Merchant Onboarding Policy @PayGlocal

I Introduction

This policy is created by PayGlocal Technologies Private Limited (hereinafter referred to as the "Company" or PayGlocal or "We") to clearly document guidelines & practices followed by the Company for acquiring new merchants in the course of its Payment Aggregator ("PA") and Payment Aggregator – Cross Border ("PA-CB") businesses. The Reserve Bank of India ("RBI") by means of Master Direction on Regulation of Payment Aggregator (PA) dated September 15, 2025 ("PA Guidelines") regulates PA and PA-CB in the payment ecosystem.

In accordance with the PA Guidelines PayGlocal ensures detailed evaluation of each merchant onboarded on its system with detailed coverage of all the steps. ("Merchant On-boarding Policy" or "Policy"). The intent of the Policy is to establish a comprehensive mechanism to onboard merchants on the platform.

Merchant on-boarding process includes documentation collection and verification, merchant nodal codes setup process, activation & maintenance activities.

Our assessment and evaluation processes followed have been diligently drafted primarily on the guidelines and rules framed by RBI, advice and counsel of our banking partners and renowned consultants, prevailing industry best practices and our own zeal to provide our merchants and customers a safe, trusted, reliable and a secure platform to allow exchange of payments across. These assessments, evaluations and processes are updated from time to time as per the regulatory guidelines formulated and enforced.

II Objectives

The key Policy objectives are:

• Adherence to regulatory compliance in line with RBI guidelines titled 'Master Direction on Regulation of Payment Aggregator (PA) dated September 15, 2025 and bearing reference no. RBI/DPSS/2025-26/141CO.DPSS.POLC.No.S-633/02-14-008/2025-26 and amendments issued to the same thereafter.
• Adherence to regulatory compliance in line with RBI regulation titled 'Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025' ('KYC Master Directions) and amendments issued to the same thereafter.
• Provide a clean, secure and robust process to ensure thorough assessment and evaluation of the prospective merchants of the Company.
• Provide seamless onboarding experience to the merchant
• Adequate management of financial and operational risk associated with the merchant onboarding process.
• Checks and evaluation criteria at the time of onboarding the merchant.

The policy must be read in conjunction with the Company's Know Your Customer/ Anti-Money Laundering/ Combating Financing of Terrorism Policy (KYC/AML/CFT Policy), as updated from time to time.

Financial risk

PayGlocal is exposed to financial risks in the following situations:

• Activate payment option / merchant on incorrect TDR (with reference to agreement/ addendum).
• Activate merchant / payment option on TDRs less than the buy rate / bank rate except in cases where business head approval on TDR is available.
• Activate merchant on incorrect settlement type / flag (T+1, T+2 or any other).
• Activate incorrect bank details updated on MID.
• Activate incorrect nodal codes.
• Activate a merchant without requisite approval.
• Activate merchant on incorrect back-end processor keys.

Compliance risk

Compliance Risk is endured in the following situations:

• Merchant on-boarded without agreement.
• Merchant KYC documents are missing as per the entity type of the merchant.
• Merchant KYC documents are forged or not validated from the source.
• Modification of details for live merchant without additional checks.

Other Assessments

• Verification of brand identity, business model and line of business of the Merchants
• Website Redirection – If the merchant website is redirecting to a different website for purchase or payments, we seek clarification on requirement of PG Web/App not live. If web/app is not live or throwing some error, we don't allow and inform the business team to take up with merchant further.
• Incorrect web/app URL – If the merchant has shared an incorrect URL, we do not allow and inform the business team to talk with the merchant about such rectification. These businesses are subject to further verification of business model. Additional information or documents are sought here. Business Model must be clearly defined while ascertaining LOB of the merchant. Model must accurately define the use of PG on the merchant website/application. Purpose of PG must be clearly stated in detail.
• Refund & Cancellations Policy of the merchants: Verify refund policy offered by merchant (Returns/ Refunds or replacements or no refund no exchange), applicable policy TAT (Days till policy remains active for services/products as per merchant business model), mode of refund, the time till when the merchant is going to accept the cancellations and through which all channels.
• Privacy policy of the merchants – Privacy policy should be according to the jurisdiction of India or their state in addition from where merchant is doing his business, customer/user information collection, use of information, third party disclosure, information protection, rights of users, cookies policy and notification of changes
• Commercial check – This check is needed for the enterprise level merchants. PayGlocal will validate merchant’s commercials as per the updated benchmark sheet for respective banking industry. Users need to select approve/reject/approval required for all the line as per the Commercials which are below the benchmark rates would need an approval from the respective business head of department.

V Merchant Acceptance Principles

PayGlocal will not do business with unethical, illegal entities that are deemed to pose a risk to the Company. Some merchant categories may be unacceptable to the Company based on business type, industry type, business model, or geographical location, even before proceeding with document collection.

Key Principles for Merchant Acceptance

To onboard merchants for domestic or cross-border transactions, PayGlocal will either directly onboard a merchant based in India or abroad, or may enter into a contract with an e-commerce player, aggregator, or licensed financial institution that can provide aggregation services in India or abroad. In all scenarios, the responsibility of merchant due diligence rests with PayGlocal.

• The Company shall not enter into business relationships with any merchant associated with illegal or unethical practices. A comprehensive list of such categories is provided in Annexure 1.
• The Company will not conduct business in countries or with entities that violate applicable sanctions laws or are present in the “Black List” of FATF. The Company has subscribed to global negative list databases to conduct regular screening.

Merchants are divided primarily into two groups from an assessment perspective:

• Prohibited Merchant Categories – Merchant categories that will not be acceptable.
• High Risk Merchant Categories – Merchants falling in this category will be subject to enhanced review prior to onboarding them on the platform.

VI Business Models based on Partnerships

Direct Merchant

• Merchant is selling goods and/or services to the end customer.
• Merchant signs an agreement with the Company to avail these services.
• Merchant submits relevant documents to the Company to get onboarded for the aggregation services provided by the Company.

Financial Service Licensed Partners (Banks / Other Aggregators)

The Company shall enable services to the merchants of other regulated entities in partnership with them and shall conduct due diligence in accordance with applicable regulations.

Referral Arrangements

Certain entities may refer merchants to the Company as per the agreed arrangement with the referral partner. The Company shall conduct due diligence on merchants as per applicable KYC requirements.

Cross Border Merchants

The Company shall onboard merchants who wish to avail export and import related services in accordance with relevant RBI guidelines. The business model for cross-border merchants may fall into one of the categories listed above.

Merchants located abroad shall be onboarded either directly or via a partner who can assist in collecting relevant documents for onboarding. The Company will collect all necessary documents and perform appropriate due diligence.

The Company shall strive to adhere to all applicable regulations and will conduct KYC for these business models depending on the KYC Partner Checklist (Annexure 3).

Government Entities

The Company will collect requisite documents published by the Government entity, such as MoU or basic KYC documents, to establish the authenticity of the entity.

VII Merchant Onboarding Risks and Categorisation

Merchant due diligence and other relevant checks are mentioned in the KYC/AML/CFT Policy. Merchant onboarding shall include the following checks to ensure that relevant business details are obtained from the merchant and their online presence to determine whether the merchant will be accepted, rejected, or subject to additional review.

Merchant Platform

Our platform conducts checks on the following aspects of a merchant’s online presence:

• Website (wherever applicable)
• About Us (Company Profile)
• Terms and Conditions
• Privacy Policy
• Return Policy (for goods merchants)
• Social media / online presence
• Tenure of business
• Financials (if required)

PCI/DSS Compliance

PCI/DSS compliance (wherever applicable) is collected from the merchant. This depends on the payment checkout page and which party collects the card data. If the payment checkout is enabled on the merchant’s page, they are mandatorily required to submit a PCI/DSS certificate.

Sanction Screening Checks

The Company conducts checks of legal entities and key associated personnel against applicable sanctions lists, adverse media lists, and the PEP (Politically Exposed Person) list. The Company does not onboard any merchant found in the sanctions list and makes case-by-case decisions on PEPs, who are considered high-risk merchants. As a policy, the Company avoids onboarding PEPs.

Risk Categorisation

Every merchant is classified as High, Medium, or Low risk based on parameters such as line of business, tenure of operations, and social media presence. This data is used to conduct re-KYC of merchants at a frequency of two (2), eight (8), and ten (10) years for low, medium, and high-risk merchants respectively.

Decision on Onboarding

Based on the various assessments listed above, the Onboarding and Risk team will decide whether to onboard a merchant or reject the application.

VIII Merchant Onboarding Overview

The Company shall ensure that the following KYC and due diligence checks are performed on the merchants as part of the onboarding process as per the PA Guidelines:

• The Company shall obtain the proof of business existence for the merchant as per the applicable KYC/AML regulatory requirements. (Refer to Appendix-2 below) and KYC for overseas merchants, will be as per the regulation defined in that geography.
• Important Note: KYC/AML/CFT Policy covers the detailed approach on KYC process
• The merchant onboarding team shall perform a complete KYC check of the merchant. Verification shall be done for identity of the merchant and address of the establishment as per the regulatory requirements for KYC verification.
• The Company shall undertake background and antecedent checks of the merchant to ensure that fraudulent merchant set-ups, unreliable or untrustworthy operators are not onboarded. It includes KYC document verification and risk assessment of the merchant through assessment of the website, line of business and various paid / unpaid third party platforms.
• Important Note: Risk assessment guidelines are part of the Company’s Merchant Risk & Fraud policy
• For domestic merchants, based on the merchant's line of business / business model, number of years of operations, the merchant shall be classified as low, medium or high risk and accordingly, and the periodic updation of KYC/ Re-KYC will be triggered as per the extant directions of the RBI including but without limitation the RBI KYC Master Directions.

IX Merchant Onboarding Process

The Policy covers mainly the following aspects of managing financial risk and compliance risk:

• Merchant KYC verification
• Merchant commercial update – Revenue and Cost
• Merchant payment option activation
• Merchant bank details update
• MID Creation and Activation

This Policy aims to define the following processes, which are to be executed by Merchant On-boarding team and part of PayGlocal core activity of payments processing:

Merchant KYC validation:

• Merchant supporting documents and KYC validation / verification.
• PayGlocal's terms of use to be agreed with and accepted by the Merchant

Merchant Commercial update:

• TDR & Base rate (rack rate) verification –Revenue

Merchant payment option update:

• Checking payment options are enabled as per the as per the agreed terms.

Merchant bank details update:

• Account Verification
• Preformat Code Creation (Beneficiary code with Nodal Bank)

MID Creation & Activation

• Creation & Activation of MID

Please refer to Appendix 1 of this Policy for the list of prohibited and high-risk business lists. High-Risk categories to be onboarded post joint approval from Risk and Business heads.

Settlement Obligations

Merchant settlement cycle within the system will be as following:

• Settlement cycle will be defined and agreed with the merchant.
• PayGlocal will ensure the settlement cycle is configured in PayGlocal system complies with the agreed time with the merchant in the contract.
• PayGlocal will ensure the settlement cycle is not configured to be later than (Td+1) or (Tr+1) as per the settlement cycle agreed with the merchant.
• Certain exceptions will be agreed with the merchant when the settlement can be put on hold by PayGlocal which shall include.
  • risk-based events such as excessive chargebacks, complaints, frauds, non-compliance, etc.
  • other scenarios where deferred settlement is agreed between PayGlocal & merchant explicitly in the merchant agreement.
• Merchants will be obligated to comply with regulatory & compliance requirements set down in the PA Guidelines with respect to handling customers’ card data. It will be considered a breach of agreement if the PA Guidelines on handling card data are not adhered to, and the Merchant’s transaction processing is suspended immediately until the situation is remediated.
• For cross border transactions, settlement cycle shall be mutually agreed between the merchant and PayGlocal teams and shall be documented in the agreement.

Merchant payment option update

Tp, Ts, Td and Tr are terms defined by RBI as time of payment, time of shipment, time of delivery and time of refund. PayGlocal is not in the business of shipping goods or services. Hence, PayGlocal will agree on settlement cycle with the merchants either based on Tp, Td or Tr and will adhere to the agreed timelines for settlement cycle excluding exception.

Based on the commercials provided by the business team, onboarding team checks them against the base rate (rack rate) and commercials agreed with the merchant to process further. If the rates are below the base rate (rack rate), the team rejects the cases. Such cases only get processed on approval of the business head.

• A check is in place to ensure all the payment options are enabled as per the agreed terms between PayGlocal and the merchant.

XII Delisting and Deactivation of Merchants

Delisting or de-activation of a merchant shall be considered for the reasons as per the agreed terms between the Company and the merchant. The reasons for deactivation shall include the following:

• Non-adherence to the terms and agreed terms between the merchant and the Company.
• Merchant's involvement in fraudulent transactions.
• Complaints raised against the merchant.
• Cancellation request from the merchant.
• Merchant inactive and not performing transactions for 12 (Twelve) months or more.
• Any direction or request received from any governmental authority; and
• Data security breach.

XIV Record Keeping

The records pertaining to merchant transactions/ complaints shall be maintained for a minimum period of 10 (ten) years by the respective department of the Company as per the KYC Master Directions.

PayGlocal shall maintain all necessary records of transactions between them and the customer, both domestic and international, for at least 10 (ten) years from the date of transaction and preserve the records pertaining to the identification of the merchants and their addresses obtained while opening the account and during the course of business relationship, for at least 5 (Five) years after the business relationship is ended.

PayGlocal shall make available the identification records and transaction data to the competent authorities upon request and also maintain all necessary information in respect of transactions prescribed under Rule 3 of Prevention of Money Laundering (Maintenance of Records) Rules, 2005, so as to permit reconstruction of individual transaction, including the following:

• the nature of the transactions.
• the amount of the transaction and the currency in which it was denominated.
• the date on which the transaction was conducted.
• the parties to the transaction.

Annexure 1

Prohibited Line of Business

1. Business or organisation that engages in, encourages, promotes, or celebrates unlawful violence or physical harm to persons or property
2. Business or organisation that engages in, encourages, promotes, or celebrates unlawful violence toward any group based on race, religion, disability, gender, sexual orientation, national origin, or any other immutable characteristic
3. Counterfeit or unauthorised goods
4. Drugs and narcotics
5. Get-rich-quick schemes or pyramid schemes
6. Human or animal bodies or organs
7. Intellectual property or proprietary rights infringement
8. Nazi-branded products, Nazi content, and articles
9. No-value-added websites, including websites which employ unfair, deceptive, or predatory sales practices
10. Pay-to-remove sites or defamatory publications; racist, sexist, misogynistic or otherwise abusive products and content
11. Archaeological findings and items
12. CBD and hemp products
13. Online pharmacies, prescription drugs
14. Fireworks and related products
15. Live animals
16. Pornography and other obscene materials; sites offering sexually related services
17. Substances designed to mimic illegal drugs
18. Weapons, ammunition, and related products
19. Radioactive, toxic, flammable, corrosive or other types of hazardous materials
20. Activities related to coal mining, extraction of oil and/or natural gas
21. Logging and supporting activities of mass sale of timber
22. Waste management and disposal
23. Bail bonds
24. Bankruptcy lawyers
25. Psychic or fortune-teller services
26. Pyrotechnic devices and supplies
27. Sale of Twitter followers, Facebook likes, YouTube views, and other forms of social media activity that is prohibited by the terms and conditions of the respective platform
28. Crypto currencies
29. Gambling

High-Risk Line of Business

1. Pharmaceutical – OTC
2. Chemical
3. Online Education with deferred delivery
4. Involvement of PEP in running a business
5. P2P lending platforms
6. Precious metals like gold, diamond etc.

Annexure 2

Required Onboarding Information for Customer Onboarding

The Company will obtain the following information from an individual/ freelancers while establishing an account-based relationship

1. Officially Valid Document (OVD) means the passport, the driving licence, proof of possession of Aadhaar number, the Voter's Identity Card issued by the Election Commission of India, job card issued by NREGA duly signed by an officer of the State Government, letter issued by the National Population Register containing details of name and address.
2. Permanent Account Number or the equivalent e-document or Form-60 as defined in Income-tax Rules, 1962.
3. Any other documents from the customer, or the equivalent e-documents thereof as may be required and defined.
4. In case an individual is into a business, address and document about their business validation.
5. In case the OVD or equivalent e-document, furnished by the customer does not contain updated address, the following documents will be obtained as proof of address for a period of 3 months:
   • Utility bill which is not more than three months old of any service provider (electricity, telephone, post-paid mobile phone, piped gas, water bill).
   • Property or Municipal Tax receipt.
   • Pension or family pension payment orders (PPOs) issued to retired employees by Government Departments or Public Sector Undertakings if they contain the address.
   • Letter of allotment of accommodation from employer issued by State or Central Government departments, statutory or regulatory bodies, and public sector undertakings, scheduled commercial banks, financial institutions, and listed companies.

List of sub-category documents

Annexure 3

KYC Partner Checklist

The following table outlines the KYC, Settlement, Agreement, Platform Compliance, and Liability responsibilities based on the business model.