Merchant and Corporate Onboarding Policy

Purpose and principles

This policy governs how Kadyan Paygate India decides which businesses may use its platform and what each must provide and satisfy before any card is issued, any balance is loaded, or any bill is paid on its behalf. It is deliberately strict. A fast go-live is only worth having if the client on the other side of it has been properly verified, and our partner banks, issuers and NPCI hold us to that.

• Nothing goes live before verification is complete. There is no provisional access, no "verify later" and no exception without a documented approval by the Director.
• Risk-based, not one-size-fits-all. The depth of due diligence rises with the risk. A listed company running a gifting programme is not treated the same as a newly formed private company seeking high-value reloadable instruments.
• Every decision has two people behind it. Onboarding runs on a maker-checker basis. The person who collects and reviews documents is never the person who approves.
• The standard is the RBI's, applied by us and confirmed by the issuing partner. We collect and verify to the standard of the RBI's Master Direction on KYC, the Master Directions on Prepaid Payment Instruments, and the PML Rules, and no instrument is activated until the issuing partner has independently confirmed that its own requirements are met.

Who we onboard

We onboard businesses and institutions established in India, including private and public limited companies, limited liability partnerships, registered partnership firms, sole proprietorships with a verifiable business, registered trusts and societies, government bodies and public-sector undertakings, and educational and healthcare institutions. Foreign-owned Indian subsidiaries are eligible with enhanced due diligence on the ownership chain.

At a minimum a client must have:

• A valid Permanent Account Number in the entity's name.
• GST registration, or a documented and verified reason why registration is not required.
• An active bank account in the entity's own name from which the platform will be funded. We do not accept funding from third-party accounts.
• A verifiable place of business in India.
• Beneficial owners and authorised signatories who can be identified and verified as set out in our AML and KYC Policy.
• A business purpose for the programme that is lawful, clearly described and consistent with the entity's registered activity.

Businesses with less than twelve months of operating history are eligible but are treated as higher risk, with tighter initial limits and a review at three months.

Prohibited and restricted categories

We do not onboard, and we terminate on discovery, any business that is engaged in or facilitates:

• Gambling, betting, lotteries, fantasy contests involving stakes, or casinos, whether or not licensed in any jurisdiction.
• Dealing in virtual digital assets, crypto-asset exchange or brokerage, or unregulated foreign-exchange trading.
• Lending, deposit-taking, chit funds, nidhi activity, or payment services without the licence or registration Indian law requires.
• Multi-level marketing, pyramid or matrix schemes, or any scheme whose returns depend primarily on recruiting participants.
• Adult content and services; escort services; weapons, ammunition and explosives; narcotics and controlled substances; counterfeit or infringing goods.
• Sale of tobacco, e-cigarettes or alcohol directly to consumers through instruments on our platform, except where the issuing partner has expressly approved a compliant programme.
• Any activity involving a person or entity on a sanctions list, or any business owned or controlled by such a person.
• Shell entities with no verifiable operations, entities that cannot explain their source of funds, and entities that have been struck off, are under liquidation, or are subject to an order of a court or regulator that restricts their operations.

The following are restricted and may be onboarded only with enhanced due diligence and the Director's approval: non-banking financial companies, insurance and securities intermediaries (with proof of the relevant regulatory registration), real-estate developers and agents, precious-metal and gem dealers, travel agencies and ticketing consolidators, non-profit organisations and charities, pharmaceutical and healthcare businesses whose activity requires a licence, and any business whose ownership includes a politically exposed person.

Documentation checklist

Every application must be supported by current, legible copies of the documents below. Originals or certified copies may be required where authenticity cannot be established otherwise, and every document is independently verified — we do not rely on a copy alone.

Verification and screening

After documents are received, the following are completed before any approval:

1. Authenticity. Registration details against the MCA portal; PAN against the income-tax database; GSTIN against the GST portal including filing status; bank account by penny-drop; identity documents by the method permitted for that document (Aadhaar offline verification, DigiLocker, or partner V-CIP).
2. Screening. The entity, every director or partner, every beneficial owner and every authorised signatory is screened against UNSC and MHA sanctions lists, the lists required by our partner institutions, PEP databases, and adverse-media sources. Screening is repeated on a continuing basis after onboarding.
3. Consistency. The stated business is checked against the registered objects, the website, the GST activity codes and the financial information. Inconsistencies are resolved in writing before proceeding.
4. Site verification. A video or physical verification of the place of business is required for every high-risk client, for every client under twelve months old, and for any client where the documents raise doubt.
5. Risk categorisation. A low, medium or high category is assigned with written reasons, in line with our AML and KYC Policy. High-risk applications require enhanced due diligence, including source-of-funds evidence, and the Director's approval.
6. Partner confirmation. The verified file is shared with the issuing partner (for card programmes) and, where relevant, checked against Bharat Connect requirements (for bill payments). No instrument is activated until the partner confirms that its KYC and product requirements are satisfied.

An application is declined if any verification fails, if screening produces a confirmed match, if the business falls in a prohibited category, or if the client does not provide requested information within 30 days. We inform the applicant of the decision; where the law prevents us from giving reasons, we say so.

Programme-level rules

Cards and prepaid instruments

• Instrument types, limits and KYC levels are those permitted by the RBI's Master Directions on Prepaid Payment Instruments and confirmed by the issuing partner. Gift instruments are capped at the value the directions permit and are non-reloadable. Full-KYC instruments require completed due diligence of the individual holder before activation.
• For employee and beneficiary programmes, the client provides the list of individuals under a signed declaration that they are genuine employees or beneficiaries of the client; the issuing partner completes each individual's KYC before activation.
• Loads are accepted only from the client's verified funding account. Balances that remain unused at programme end are returned to that account, never to a third party.

Bill payments on Bharat Connect

• A client may register consumer or account numbers only for bills that belong to the client, its branches, or individuals who have authorised the client to pay on their behalf (for example employees redeeming rewards against their own bills). A declaration to this effect forms part of onboarding.
• Bulk registration of consumer numbers is reviewed for plausibility against the client's stated locations and size.
• Bharat Connect transactions are subject to the network's own rules, receipts and complaint process, in addition to the monitoring described in our AML and KYC Policy.

Contracting

No client goes live without signing a master services agreement that, at a minimum:

• Names the RBI-licensed issuing partner for any card programme and sets out that customer funds are held by that partner and not by us.
• Incorporates an acceptable-use policy prohibiting use of the platform for any prohibited category or for any purpose other than the programme approved.
• Requires the client to notify us within 15 days of any change in directors, partners, beneficial owners, registered office, business activity, or regulatory status.
• Includes a data-processing addendum setting out our respective roles under the Digital Personal Data Protection Act, 2023, where the client provides personal data of its employees or customers.
• Permits us and our partner institutions to audit compliance, to restrict or suspend services on reasonable suspicion, and to share information with partners, NPCI, regulators and law enforcement as the law requires.

Timeline

Where documents are complete and verifications clear without exception, a standard programme goes live within seven days:

High-risk files, files requiring site verification, and files where the partner requires additional information take longer, and we say so at the outset.

After onboarding

• Continuing screening of the entity, its owners and its signatories against sanctions, PEP and adverse-media sources.
• Periodic re-verification in line with the risk category — at least every two years for high risk, eight for medium and ten for low — and immediately on any trigger event: a change in ownership or control, a change in business activity, adverse media, an unexplained change in transaction pattern, a regulatory or law-enforcement enquiry, or a returned communication suggesting the registered address is no longer valid.
• Limit review at three months for new clients and annually thereafter, against actual usage.
• Suspension or termination where a client breaches this policy or the agreement, where re-verification cannot be completed, where screening produces a confirmed match, or where a partner institution or NPCI requires it. On termination, instruments are blocked, unused balances are returned to the client's verified account, and records are retained as our AML and KYC Policy requires.

Regulatory references

• Reserve Bank of India, Master Direction – Know Your Customer (KYC) Direction, 2016, as amended.
• Reserve Bank of India, Master Directions on Prepaid Payment Instruments, 2021, as amended.
• Prevention of Money-Laundering Act, 2002, and the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005, as amended.
• Unlawful Activities (Prevention) Act, 1967, and the Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005.
• NPCI Bharat BillPay procedural guidelines applicable to Agent Institutions.
• Digital Personal Data Protection Act, 2023, and rules made under it.
• Companies Act, 2013, including the provisions on significant beneficial ownership.

Where any of these instruments is amended, the amended requirement applies from its effective date whether or not this page has yet been updated.