Solfin Sustainable Finance Private Limited

Introduction

Solfin Sustainable Finance Private Limited (Formerly Known as Dhanvikas Fiscal Services Private Limited) ("the Company") is an NBFC registered with Reserve Bank of India ("RBI") in August 2018. The Company has formulated this KYC Policy based on Reserve Bank of India (Non-Banking Financial Companies – Know Your Customer) Directions, 2025 dated 28th November 2025 ("RBI Directions").

The Company aims to identify, mitigate, and manage the risk of money laundering (ML) and terrorism financing (TF) and recognises that failure to prevent or manage the risk of money laundering and terrorism financing would not only constitute a breach of regulatory requirements but would also carry significant reputation and financial risk for the Company. The Company would ensure strict compliance with the Prevention of Money-Laundering (PML) Act, 2002 ("PML Act"), and the Prevention of Money-Laundering (PML)(Maintenance of Records) Rules, 2005 ("PML Rules"), and RBI Direction as may be updated from time to time, and any subsequent amendments/ instructions issued by RBI.

The Company is an NBFC not deposit taking (ND), in Base Layer (BL) (NBFC ND BL) and, as such, is not exposed to many of the risks which a deposit taking company is exposed to.

This Policy outlines the principles and measures that the Company would need to follow for customer identification and due diligence. Customers of the Company would mainly refer to the borrowers, who avail of financing from the Company.

This Policy has been approved by the Company's Board of Directors on 29th December 2025. Any changes to this Policy would require approval of the Board. The Policy will be reviewed as and when required.

2. Objectives

The objectives of this policy are to:

1. a)prevent the Company from being used as a conduit for money laundering, terrorism financing and other unlawful activities.
2. b)enable the Company to determine the identity of customers including their beneficial ownership, source of funds, nature of business etc., which would help the Company to manage its risks prudently.
3. c)put in place appropriate controls for detection and reporting of suspicious transactions in accordance with regulatory requirements.

3. Key Elements of the KYC Policy

The Policy contains the following key elements:

1. a)Responsibility of KYC compliance
2. b)Customer Acceptance Policy
3. c)Risk Management
4. d)Customer Identification Procedure and Customer Due Diligence
5. e)Reliance on third party due diligence
6. f)On-going Due Diligence
7. g)Enhanced Due Diligence
8. h)Record Management
9. i)Confidentiality Obligations and Sharing of Information
10. j)Introduction of New Technologies
11. k)Hiring of Employees and Employee Training
12. l)Reporting Requirements to the Financial Intelligence Unit-India
13. m)Independent evaluation of the compliance function
14. n)Monitoring of Transactions and Others
15. o)KYC Updation

4. Responsibility of KYC Compliance

The Board of Directors would ensure compliance with the KYC Policy.

The Board has nominated a Designated Director/KYC Committee, who will ensure overall compliance with the obligations imposed under Chapter IV of the PML Act and PML Rules. The name, designation and address of the Designated Director/ KYC Committee would be communicated to the Financial Intelligence Unit, India (FIU-IND). It would be ensured that the Principal Officer, referred to below, would not be nominated as the Designated Director.

The Board has nominated a senior officer as the Principal Officer, who would be responsible for ensuring compliance, monitoring transactions, and sharing and reporting information to the Financial Intelligence Unit (FIU-IND), as required under the law/regulations. The name, designation and address of the Principal Officer would be communicated to FIU-IND.

5. Customer Acceptance Policy

The Company would undertake due diligence of the customer before establishing a relationship. The Company would endeavour to meet the genuine financial needs of the customers within the framework of its KYC Policy and applicable regulations.

The Company would not enter into a transaction with any customer in the following cases or where verification mentioned herein is not followed:

1. a)Where the customer has furnished an anonymous or fictitious / benami name.
2. b)Where the Company is unable to apply appropriate Customer Due Diligence (CDD) measures, i.e., the Company is unable to verify the identity and / or obtain required documents either due to non-cooperation of the customer or non-reliability of the documents / information furnished by the customer.
3. c)No transaction or account-based relationship is undertaken without following the CDD procedure.
4. d)The mandatory information to be sought for KYC purpose while opening an account and during the periodic updation, is specified.
5. e)Additional information, where such information requirement has not been specified in the internal KYC Policy of the Company, is obtained with the explicit consent of the customer.
6. f)CDD procedure shall be applied at the UCIC level. Thus, if an existing KYC compliant customer of the Company desires to open another account or avail any other product or service from the Company, there shall be no need for a fresh CDD exercise as far as identification of the customer is concerned.
7. g)CDD Procedure is not followed for all the joint account holders, while opening a joint account.
8. h)Customer is not permitted to act on behalf of another person/entity unless approved by the Board.
9. i)Identity of the customer does not match with any person or entity, whose name appears in the sanctions lists indicated in Chapter IX of this MD.
10. j)Where Permanent Account Number (PAN) is obtained, the same shall be verified from the verification facility of the issuing authority.
11. k)Where an equivalent e-document is obtained from the customer, the Company shall verify the digital signature as per the provisions of the Information Technology Act, 2000 (21 of 2000).
12. l)Where Goods and Services Tax (GST) details are available, the GST number shall be verified from the search/verification facility of the issuing authority.
13. m)Where the identity of the customer or any of its promoters or directors or partner (if the customer is a corporate entity or a firm) matches with any person or entity whose name appears in the sanction lists circulated by RBI.
14. n)Where the customer is engaged in any business/ activity that is illegal or undesirable.

Further, the Company will check whether the names of the customer or any of its promoters/directors or partners appear in the following lists:

1. a)The United Nations Consolidated Sanctions List.
2. b)UAPA List issued by MHA.

The Company would not enter into a transaction with such entities and report the matter immediately to RBI and FIU-IND.

The Company would be cautious about lending to Politically Exposed Persons (PEPs). A PEP is a senior official in the executive, legislative, administrative, military or judicial branches of a government (whether elected or not), as also a senior official of a major political party, or a senior executive of a government-owned corporation. In addition, this would include any corporation, business or other entity that has been formed by, or for the benefit of, a PEP.

When it is unable to comply with the relevant CDD measures in relation to the customer, the Company shall file an STR, if necessary.

Customer Profiles

The Company will make customer profiles keeping in view various parameters such as the customer's identity including beneficial owners, share holding pattern, constitution, social/financial status, nature of business activity, information about clients' business, their location, the need and purpose for which the funds are being borrowed, the sources of funds for the intended transactions etc. The Company will also seek information in respect of firms / associate / group / subsidiary / holding companies of the customer, their performance, market standing, commonality of management and financial integration etc.

As and when new information is received regarding a customer's financial position, dealings and market reports, the information would be incorporated in the customer profile and thereby the profiles would be always kept updated.

The customer profiles and information obtained from customers are confidential documents to be used for the KYC purpose only and would not be divulged to third parties.

6. Risk Management

The Company would adopt a risk based approach, as given below:

1. i.Customers would be categorised as low, medium and high risk category, based on the Company's assessment and risk perception.
2. ii.For carrying out the Risk categorisation exercise, the Company will consider parameters such as customer's identity, social/financial status, nature of business activity and information about the client's business and their location etc.
3. iii.The Company would also verify whether the identity of the customer matches with any person or entity, whose name appears in the sanction lists circulated by RBI.
4. iv.The due diligence to be exercised would depend on the risk categorization of the customers. Enhanced due diligence will be carried out in respect of customers falling in the Medium and High risk category.
5. v.The customer acceptance norms are subject to regulatory guidelines issued from time to time by RBI.

7. Customer Identification Procedure (CIP) and Customer Due Diligence (CDD) Procedure

Customer identification means identifying the customer and verifying his/ her identity by using reliable, independent source documents, data or information. The nature of information/documents required for identification process would also depend on the type of customer (individual, proprietary, partnership, company).

8. Reliance on Third Party Due Diligence

For the purpose of verifying the identity of customers at the time of commencement of a relationship, or while carrying out occasional transaction of an amount equal to or exceeding INR 50,000/- (Indian Rupee Fifty Thousand only), whether conducted as a single transaction or several transactions that appear to be connected, or any international money transfer operations, the Company may rely on customer due diligence done by a third party, subject to the following conditions:

1. i.Necessary information of such customers' due diligence carried out by the third party is immediately obtained by the Company.
2. ii.Records or the information of the customer due diligence carried out by the third party is obtained immediately from the third party or from the Central KYC Records Registry.
3. iii.Copies of identification data and other relevant documentation relating to the customer due diligence requirements shall be made available from the third party upon request without delay.
4. iv.The third party is regulated, supervised or monitored for, and has measures in place for compliance with customer due diligence and record-keeping requirements in line with the requirements and obligations under the PML Act.
5. v.The third party is not based in a country or jurisdiction assessed as high risk.

However, the ultimate responsibility for customer due diligence will be with the Company. The Company would ensure that decision-making functions of determining compliance with KYC norms are not outsourced.

9. On-going Due Diligence

The Company would monitor the financial position of the customer on an ongoing basis. The purpose of such monitoring would be to ensure that the borrower's transactions are consistent with the Company's knowledge about the customers' business, risk profile and the source of funds. The extent of monitoring would be aligned with the risk category of the customer.

Any unusual pattern noticed during such monitoring would trigger an early warning signal to review the borrower's loan account.

The Company would review the risk categorisation of accounts, at least once in six months for loans exceeding INR 3 Crores. Accordingly, the need for applying enhanced due diligence measures would be put in place.

10. Enhanced Due Diligence

The Company shall conduct Enhanced Due Diligence in connection with all customers that are classified as Medium and High Risk.

PEPs

The Company would carry out enhanced due diligence in the following cases in case of lending to PEPs or entities where a PEP is a beneficial owner. The Company would establish relationship with PEPs or accounts where a PEP is a beneficial owner provided that:

1. i)sufficient information including information about the source of funds, accounts of family members and close relatives is gathered on the PEP;
2. ii)the identity of the person shall have been verified before accepting the PEP as a customer;
3. iii)the decision to open a loan account for a PEP is taken at a senior level;
4. iv)all such accounts are subjected to enhanced monitoring on an on-going basis;
5. v)in the event of an existing customer or the beneficial owner of an existing loan account subsequently becoming a PEP, the same would be brought to the notice of the senior management.
6. vi)Enhanced due diligence would include measures such as close monitoring of the loan account for a re-categorisation of risk, updation of KYC documents, visit to the customer etc.

11. Record Management

The Company would adhere to applicable instructions for maintenance, preservation and reporting of customer account information, with reference to provisions of PML Act and PML Rules. The Company would:

1. i)maintain all necessary records of transactions between the Company and the customer for at least five years from the date of transaction;
2. ii)preserve the records pertaining to the identification of the customers and their addresses obtained while sanctioning the loan during the course of business relationship, for at least five years after the business relationship is ended;
3. iii)make available the identification records and transaction data to the competent authorities upon request;
4. iv)introduce a system of maintaining proper record of transactions prescribed under Rule 3 of PML Rules;
5. v)maintain all necessary information in respect of transactions prescribed under PML Rule 3 so as to permit reconstruction of individual transactions, including the following:
   1. a)the nature of the transactions;
   2. b)the amount of the transaction and the currency in which it was denominated;
   3. c)the date on which the transaction was conducted; and
   4. d)the parties to the transaction.
6. vi)evolve a system for proper maintenance and preservation of account information in a manner that allows data to be retrieved easily and quickly whenever required or when requested by the competent authorities;
7. vii)maintain records of the identity and address of their customer, and records in respect of transactions referred to in Rule 3 of the PML Rules in hard or soft format.

12. Confidentiality Obligations and Sharing of Information

The Company would maintain confidentiality regarding the customer information which arises out of the contractual relationship with the customer.

1. i)Information collected from customers for the purpose of opening of account shall be treated as confidential and details thereof shall not be divulged for the purpose of cross selling, or for any other purpose without the express permission of the customer.
2. ii)While considering the requests for data/information from Government and other agencies, the Company would satisfy itself that the information being sought is not of such a nature as will violate the provisions of the laws relating to secrecy in the financial transactions.
3. iii)However, the Company would disclose customer information in the following cases:
   1. a.Where disclosure is under compulsion of law,
   2. b.Where there is a duty to the public to disclose,
   3. c.The interest of the Company requires disclosure and
   4. d.Where the disclosure is made with the express or implied consent of the customer.
4. iv)The Company will capture the KYC information for sharing with the Central KYC Records Registry (CKYCR) in the manner mentioned in the PML Rules and RBI Directions, as required by the revised KYC templates prepared for 'Individuals' and 'Legal Entities' as the case may be.
5. v)Also, whenever the Company obtains additional or updated information from any customer as per the applicable PML Rules and RBI Directions, the Company shall within seven days or within such period as may be notified by the Central Government, furnish the updated information to CKYCR, which shall update the KYC records of the existing customer in CKYCR.

13. Introduction of New Technologies

Adequate attention would be paid by Company to any money-laundering and financing of terrorism threats that may arise from new or developing technologies. The Company would ensure that appropriate KYC procedures issued from time to time are duly applied before introducing new products/services/technologies.

14. Hiring of Employees and Employee Training

The Company would put in place adequate screening mechanism as an integral part of its personnel recruitment/hiring process. On-going employee training programme shall be conducted so that the members of staff are adequately trained with regard to this policy. The focus of the training shall be different for frontline staff, compliance staff and staff dealing with new customers. The front desk staff would be specially trained to handle issues arising from lack of customer education.

15. Reporting Requirements to Financial Intelligence Unit – India

1. i.The Company will furnish the required information as referred to in the PML Rules to the Director, Financial Intelligence Unit-India (FIU-IND).
2. ii.In case a Suspicious Transaction Report (STR) is filed, the Company would ensure that the fact of furnishing of STR is kept strictly confidential. It would be ensured that there is no tipping off to the customer at any level.
3. iii.The Company would put in place a robust management information system, which would highlight/ throw up alerts when the transactions are inconsistent with risk categorization and when there are suspicious transactions.
4. iv.Details of accounts resembling any of the individuals/entities in lists as referred under the head "Customer Acceptance Policy" or any other UN Security Council Resolutions (UNSCRs) circulated by RBI would need to be reported to FIU-IND apart from advising Ministry of Home Affairs.

16. Independent Evaluation of the Compliance Function

The Compliance Department of the Company or the Directors in its absence would evaluate and ensure adherence to the KYC policies and procedures. Concurrent /Internal Auditors would specifically check and verify the application of KYC procedures and comment on the lapses observed in this regard and a quarterly report would be submitted to the Board.

17. Monitoring of Transactions

The following types of transactions shall necessarily be monitored:

1. i.Large and complex transactions including RTGS transactions, and those with unusual patterns, inconsistent with the normal and expected activity of the customer, which have no apparent economic rationale or legitimate purpose.
2. ii.Transactions which exceed the thresholds prescribed for specific categories of accounts.
3. iii.High account turnover inconsistent with the size of the balance maintained.

18. KYC Updation/ Periodic Updation

1. i.KYC periodic updation shall be carried out at least once in every two years for high-risk customers,once in every eight years for medium risk customers and once in every ten years for low-risk customers from the date of opening of the account / last KYC updation.
2. ii.In respect of an individual customer who is categorized as low risk, the Company shall allow all transaction and ensure the updation of KYC within one year of its falling due.

Annexure 1 – Documents for Individual Borrowers

The Company would obtain the following information from an individual borrower and also in case of an individual who is a beneficial owner, authorised signatory or the power of attorney holder related to a legal entity ,as prescribed by RBI from time to time.

1. 1)In respect of individuals eligible for enrolment of Aadhaar, the Company would obtain:
   1. a.The Aadhaar Number in such form as is issued by UIDAI;
   2. b.The Permanent Account Number (PAN) or Form 60 as defined in the Income Tax Rules, 1962. Where an Aadhaar number has not been assigned to an individual, proof of application of enrolment for Aadhaar shall be obtained wherein the enrolment is not older than 6 months.

   In case PAN is not submitted, certified copy of an Officially Valid Document (OVD) containing details of identity and address and one recent photograph shall be obtained.

2. 2)In case of individuals resident in the states of Jammu and Kashmir or Assam or Meghalaya who do not submit Aadhaar or proof of enrolment for Aadhaar, the following would be obtained:
   1. a.A certified copy of an OVD containing details of identity and address
   2. b.One recent photograph
3. 3)For an individual not eligible to be enrolled for an Aadhaar number or who is not a resident, the following would be obtained:
   1. a.PAN or Form No.60 as defined in Income Tax Rules, 1962
   2. b.One recent photograph
   3. c.A certified copy of an OVD containing details of identity and address

   If the OVD submitted by a foreign national does not contain the details of address, documents issued by the Government departments of foreign jurisdictions and letter issued by the Foreign Embassy or Mission in India can be accepted as proof of address.

4. 4)In case the identity information relating to Aadhaar or PAN does not have the current address, an OVD as defined in the RBI Direction and brought out in the Policymay be submitted. In case the OVD furnished by the borrower does not contain the updated address, the following documents shall be deemed as OVDs for the limited purpose of proof of address:
   1. a.Utility bill which is not more than two months old of any service provider (electricity, telephone, post-paid mobile phone, piped gas, water bill)
   2. b.Property or Municipal Tax receipt
   3. c.Pension or family pension payment order (PPOs) issued to retired employees of Government Departments or PSUs, if they contain the address
   4. d.Letter of allotment of accommodation from employer issued by State Government or Central Government Departments, statutory or regulatory bodies, PSUs, Scheduled Commercial banks, Financial Institutions and Listed Companies and Leave and License agreements with such employees allotting official accommodation

   The borrower would be required to submit Aadhaar or OVD updated with the current address within a period of three months of submitting the above documents.

5. 5)On receipt of the Aadhaar number, the Company shall carry out an e-KYC authentication with the explicit consent of the borrower.

Annexure 2 – Documents for Sole Proprietorship Firms

Documents to be obtained in respect of a Sole Proprietorship Firm (in addition to details as applicable in Annexure 1):

1. 1.Registration certificate including Udyam Registration Certificate (URC) issued by the Government.
2. 2.Certificate/license issued under the Shop and Establishment Act.
3. 3.GST certificate (provisional/final).
4. 4.Certificate/registration document issued by Professional Tax authorities.
5. 5.IEC (Importer Exporter Code) issued to the proprietary concern by the office of DGFT/License/Certificate of practice issued in the name of the proprietary concern by any professional body incorporated under a statute.
6. 6.Complete Income Tax Return (not just the acknowledgement) in the name of the sole proprietor where the firm's income is reflected, duly authenticated/acknowledged by the Income Tax authorities.
7. 7.Utility bills such as electricity, water, and landline telephone bills.

Annexure 3 – Documents for Legal Entities

The following documents would need to be obtained in respect of legal entities: