COMBATING FINANCING OF TERRORISM (CFT) POLICY

ZESTFLOW INDIA PRIVATE LIMITED (CIN-U62099DC2026PTC468956)

Registered Address - Office No. 201, Plot No 4, 2nd Floor, LSC Gujranwala Colony North West Delhi Delhi India 110009

1. Purpose and Policy Statement

ZESTFLOW INDIA PRIVATE LIMITED ("ZESTFLOW" or "the Company") is committed to ensuring that its platform, products, services, technology infrastructure and business relationships are not knowingly used, directly or indirectly, for financing terrorism, supporting prohibited organisations or facilitating any activity prohibited under applicable law.

The Company adopts this Combating Financing of Terrorism ("CFT") Policy as an integral part of its Anti-Money Laundering ("AML") and financial crime compliance framework.

The Company maintains zero tolerance towards terrorist financing and shall take appropriate measures to identify, assess, prevent and mitigate related risks in accordance with applicable laws and contractual obligations.

2. Scope and Relationship with AML Policy

This Policy applies to the Board of Directors, officers, employees, consultants, authorised representatives and, where relevant, merchants, channel partners, vendors and service providers associated with the Company.

This Policy shall be read together with the Company's AML Policy. The provisions of the AML Policy relating to governance, customer and merchant due diligence, beneficial ownership, enhanced due diligence, transaction monitoring, record retention, employee training, confidentiality and compliance review shall also apply to CFT matters, wherever relevant.

The extent of the Company's CFT obligations shall depend upon its business activities, regulatory status and arrangements with banks, financial institutions, payment service providers and other regulated entities.

3. Regulatory Framework

This Policy shall be interpreted in accordance with, to the extent applicable:

• the Prevention of Money Laundering Act, 2002 ("PMLA");
• the Prevention of Money Laundering (Maintenance of Records) Rules, 2005;
• the Unlawful Activities (Prevention) Act, 1967 ("UAPA");
• applicable notifications, directions and advisories issued by the Government of India and competent authorities;
• applicable sanctions and designated-person lists notified under Indian law;
• applicable United Nations Security Council ("UNSC") sanctions measures; and
• any amendment, modification or replacement thereof.

Where any provision of this Policy conflicts with applicable law, the applicable law shall prevail.

4. Terrorist Financing Risk Assessment

The Company shall adopt a risk-based approach to identify, assess and mitigate risks associated with terrorist financing and, where relevant, proliferation financing.

The assessment may consider:

• customer or merchant profile;
• nature of business and ownership structure;
• products and services used;
• transaction behaviour and payment patterns;
• geographical exposure;
• delivery and onboarding channels;
• source and destination of funds, where relevant;
• sanctions or adverse compliance indicators; and
• any other relevant risk factor.

Higher-risk relationships shall be subject to enhanced scrutiny and appropriate risk mitigation measures.

5. Sanctions and Designated Person Screening

The Company shall undertake appropriate screening, where applicable, to identify whether customers, merchants or other relevant parties are associated with designated individuals, entities or organisations subject to applicable sanctions or restrictions.

Screening may be conducted against:

• applicable lists notified by the Government of India;
• applicable lists and measures under the UAPA;
• relevant UNSC sanctions lists; and
• other legally applicable sanctions or watchlists.

Where a potential match is identified, onboarding or the relevant activity may be suspended or subjected to further review until appropriate verification is completed.

Where a confirmed match or serious sanctions concern is identified, the Company shall take appropriate action in accordance with applicable law and, where relevant, in coordination with the concerned regulated partner institution or competent authority.

6. High-risk Relationships and Jurisdictions

The Company shall exercise enhanced caution in relation to customers, merchants or transactions presenting elevated terrorist financing risks, including exposure to jurisdictions identified by competent authorities as presenting significant AML/CFT or proliferation-financing concerns.

Depending upon the level of risk, the Company may undertake:

• enhanced due diligence;
• additional verification of identity, ownership or source of funds;
• senior management approval;
• enhanced transaction monitoring; and
• more frequent review of the business relationship.

The Company may decline, restrict, suspend or terminate a relationship where identified risks cannot be adequately mitigated, subject to applicable law and contractual obligations.

7. Transaction Monitoring and CFT Red Flags

The Company shall maintain appropriate measures to identify unusual activities that may indicate terrorist financing.

Relevant indicators may include:

• transactions lacking an apparent lawful or economic purpose;
• unexplained movement of funds through multiple or unrelated accounts;
• payments involving unrelated third parties;
• transactions inconsistent with the declared business profile;
• unusual transaction frequency, value or velocity;
• transactions connected with designated persons or higher-risk jurisdictions;
• use of opaque or unnecessarily complex ownership structures;
• repeated attempts to avoid KYC or screening requirements;
• unexplained changes in settlement or bank account details; and
• any other activity giving rise to a reasonable CFT concern.

The presence of a red flag shall not automatically establish terrorist financing but shall require appropriate review based on the facts and circumstances.

8. Internal Escalation, Action and Reporting

Any employee or authorised person who identifies a suspected terrorist financing activity, sanctions concern or relevant red flag shall promptly report the matter to the designated compliance officer or function.

The designated officer shall review the available information, seek additional clarification where necessary and determine the appropriate course of action.

Where the Company is directly required by law to report any matter to FIU-IND or another competent authority, such reporting shall be undertaken in accordance with applicable law.

Where reporting or regulatory obligations are undertaken by a regulated partner institution, the Company shall promptly escalate relevant information to such institution in accordance with applicable law and contractual arrangements.

Any restriction, blocking, freezing or other action in relation to funds or transactions shall be undertaken only where authorised or required under applicable law or in coordination with the relevant regulated partner institution or competent authority.

9. Confidentiality, Records and Training

All reviews, investigations, screening results and reports relating to suspected terrorist financing or sanctions concerns shall be treated as confidential.

No employee or authorised person shall disclose to a customer, merchant or unauthorised third party that:

• a review or investigation is underway;
• a report has been or may be submitted to a competent authority; or
• the person or transaction has been identified for enhanced scrutiny,

except where disclosure is required by law.

The Company shall maintain relevant CFT records for the period required under applicable law and contractual obligations.

Employees performing relevant functions shall receive appropriate AML/CFT awareness and training based on their roles and responsibilities.

10. Violations and Corrective Action

Failure to comply with this Policy may result in appropriate disciplinary or corrective action, including warning, retraining, restriction of access, suspension or termination of employment, engagement or business relationship, and reporting to competent authorities where required by law.

The nature of the action shall depend upon the seriousness of the violation and applicable legal requirements.

11. Policy Review, Approval and Effective Date

This Policy shall be reviewed periodically and, where appropriate, upon:

• changes in applicable laws or regulatory requirements;
• material changes in the Company's business model;
• introduction of new products or services;
• emergence of significant terrorist financing or sanctions risks; or
• findings arising from compliance reviews or audits.

This CFT Policy has been approved by the Board of Directors of ZESTFLOW INDIA PRIVATE LIMITED and shall come into effect from the date of its approval.

The Board may amend or replace this Policy from time to time.

CERTIFICATION

All Directors, officers, employees and authorised representatives of ZESTFLOW INDIA PRIVATE LIMITED shall comply with this Policy to the extent applicable to their respective roles and responsibilities.

For ZESTFLOW INDIA PRIVATE LIMITED Approved by the Board of Directors on: __________________ Effective Date: __________________