Risk Management Policy

INTRODUCTION

Non-Banking Financial Companies (NBFCs) are an integral part of the Indian financial system and support access to credit for underserved sections of society. Their services include vehicle, MSME, home, microfinance and other retail financing. NBFCs must therefore establish a Board-approved framework for managing risks arising from their business.

Anusuiya Capital Pvt Ltd (“ACPL” or “the Company”) is registered with the Reserve Bank of India (RBI) and is classified as a Base Layer NBFC (NBFC-BL) under the RBI Scale Based Regulatory Framework. In accordance with the RBI Master Direction - Non-Banking Financial Company – Non-Systemically Important Non-Deposit taking Company (Reserve Bank) Directions, 2016, dated 1 September 2016, as amended from time to time, the Board of Directors has adopted this Risk Management Policy (“Policy”).

Risk management is a key part of the Company’s corporate governance principles. The Company uses an integrated risk management process to inform business decisions and address risks including credit, market, liquidity, operational, compliance, reputation, cyber-security and other business risks. This Policy is intended to help the Company manage uncertainty and changes in its internal and external environment, limit adverse impacts and identify opportunities.

Company details: Anusuiya Capital Pvt Ltd
CIN: U65929UP2019PTC120690
Registered address: Kh No. 614, Elora Complex, Hanuman Chauraha, Khandari, Karmyogi Enclave, Agra, Uttar Pradesh, India, 282005
Email: suraj@anusuiyacapital.com

OBJECTIVES AND PURPOSE OF RISK MANAGEMENT

Risk management supports informed business decisions and a balanced risk-reward approach. The Company follows a disciplined process to support sustainable growth and financial stability, and to proactively identify, evaluate, resolve and mitigate risks associated with its business.

The Policy establishes a structured approach to risk-related decisions and aims to:

• Identify, assess, quantify, mitigate and monitor material risks, including risks to which the Company may be exposed in the future.
• Establish a framework for the Company’s risk management process and support its implementation.
• Promote compliance with applicable regulations and sound governance practices.
• Support business growth while maintaining financial stability.

RISK MANAGEMENT FRAMEWORK

Risk can arise from an activity or from the omission of an activity. The Company applies a systematic approach across organizational levels to manage risks associated with its objectives, operations, revenues and regulatory responsibilities. The framework is built around three elements:

MISSION, STRATEGY AND RISK APPETITE

The Company’s objective is to achieve its financial goals by improving its understanding of potential investments and allocating finances to maximise risk-adjusted returns and protect its financial position. It seeks to support clients’ growth and liquidity objectives, while focusing on long-term returns and applying its financial, strategic and operational experience.

The Company sets its risk appetite and guidelines with regard to the following areas:

RISK GOVERNANCE

Risk Management Committee

The Company constitutes a Risk Management Committee in accordance with applicable regulatory requirements. The Committee oversees the identification, control and mitigation of risks associated with the Company’s business and functioning. It establishes procedures for integrated risk management and evaluates the overall risks faced by the Company, including liquidity risk, reporting to the Board as appropriate.

Role of the Board

The Board is responsible for framing, implementing and monitoring the Company’s risk management plan. In particular, it will:

• Define the Risk Management Committee’s roles and responsibilities and delegate monitoring or review functions as appropriate.
• Ensure appropriate risk management systems are in place and that the framework is robust.
• Consider risk when making major decisions that affect the Company’s risk profile and monitor strategic risks.
• Ensure suitable processes, controls and accountability for delegated risk responsibilities.
• Integrate risk management into Board reporting and annual reporting, and convene Board committees where needed.

CREDIT RISK

Credit risk is the risk of loss when a borrower does not meet contractual repayment obligations. It includes both the loss of expected interest income and the loss of principal resulting from loan defaults. The Company uses statistical analysis based on internal assumptions as part of its credit risk process.

Risk mitigation

• Credit bureau checks: Customer credit checks are conducted through an automated system-to-system integration with a credit bureau. Parameters specified in the loan policy are used to assess creditworthiness and over-borrowing risk; they are reviewed periodically in light of applicable RBI regulations, directions and internal norms.
• Customer verification: Loan applications are processed after verification of the customer’s address and submitted documents. A Company official meets the customer at their residence before loan approval to confirm the details provided.

OPERATIONAL RISK

Operational risk is the possibility of loss resulting from inadequate or failed internal processes, people or systems, or from external events. It may arise from process or compliance lapses, lost or misplaced documents, collusion or fraud, application outages, high transaction volumes, skills gaps or the sudden departure of key personnel.

Risk mitigation

• Process compliance and training: Follow documented procedures throughout the customer relationship, identify process deviations and train employees to prevent violations.
• Document storage and retrieval: Maintain records of physical loan documents in a secure facility, retain scanned copies for retrieval and audit purposes, and use software to process system-generated records.
• Non-compliance reporting: Encourage employees to report policy or process violations without fear. Categorise reports by nature and severity, including financial or non-financial impact and procedural or disciplinary concerns.
• Internal audits: Review functions and internal controls against applicable RBI directions, credit policies and KYC requirements. Report deviations for timely correction and present significant audit observations and follow-up actions to management.
• Reporting structure: Maintain an appropriate allocation of borrowers per staff member and an organisational structure that monitors financial and non-financial parameters.

LIQUIDITY RISK

Liquidity risk is the possibility that the Company cannot meet current cash obligations in a timely and cost-efficient manner. It may arise from asset-liability maturity mismatches, difficulty funding asset growth, unexpected changes in funding sources, concentrated sources of funds or excessive leverage. The Company follows its Asset Liability Management Policy when managing liquidity risk.

Risk mitigation

• Prepare short-term liquidity forecasts, identify gaps and take corrective action.
• Regularly review lender exposure and sources of external funding to avoid concentration.
• Plan business and repayment obligations, including obligations associated with long-tenor non-convertible debentures (NCDs).
• Maintain an appropriate level of liquidity to meet obligations and allow time for corrective action and funding arrangements.
• Target adequate leverage and capital adequacy to protect against adverse market conditions and allow time to arrange equity infusion when needed.
• Centralise fund management and loan disbursement through bank channels, monitor daily cash collections and maintain a daily minimum reserve.

PORTFOLIO CONCENTRATION RISK

Portfolio concentration risk arises from excessive credit exposure to a particular business segment, industry, geography or location. In microfinance, this may primarily relate to geographic concentration.

Risk mitigation

• Diversify lending exposure across states to reduce risks associated with a particular location.
• Follow district-wise allocation of the loan portfolio without religious or community barriers.
• Use the Company’s Asset Liability Management Policy for detailed portfolio concentration measures.

COMPLIANCE RISK

Compliance risk arises when the Company does not meet regulatory or statutory requirements, including RBI regulations, the Income Tax Act, the Companies Act and lender covenants. Non-compliance can lead to regulatory or statutory action, penalties and reputational harm.

Risk mitigation

The Company monitors its compliance systems, reviews shortfalls and takes corrective measures. The compliance function supports this process by:

• Conducting periodic audits and assessments to identify compliance gaps.
• Supporting consistent compliance with regulatory requirements and internal policies.
• Providing guidance and training to improve compliance awareness.
• Reporting compliance risks and recommending mitigation to senior management and the Board.
• Working with other departments to implement corrective actions and strengthen controls.

REPUTATION RISK

Reputation risk is the risk to earnings and capital resulting from an adverse perception of the Company by customers, counterparties, shareholders, investors or regulators. Unethical practices, regulatory actions, customer dissatisfaction or complaints and negative publicity may affect the Company’s reputation and brand.

Risk mitigation

• Train and instruct employees to follow the Company’s Fair Practices Code.
• Maintain a defined grievance redressal mechanism and communicate it to customers.
• Use customer outreach, including tele-calling, to monitor service quality and adherence to Company policies and processes.
• Manage delinquency without coercive recovery practices and consider loan restructuring where necessary.

INTEREST RATE RISK

Interest rate risk is the risk of financial loss resulting from changes in market or regulatory interest rates. It may arise when the cost of funds increases faster than the Company can or is willing to adjust lending rates.

Risk mitigation

• Maintain a financial model of the investment and loan portfolio to assess sensitivity to interest rate increases or decreases and their effect on short- and long-term profitability.
• Use asset and liability management functions to manage borrowed funds and the investment portfolio cost-effectively.

FRAUD RISK

Fraud risk requires a proactive approach to prevention, detection and response. The Company’s fraud risk management framework includes:

• Prevention: KYC and Anti-Money Laundering (AML) procedures, internal controls to prevent unauthorised access and transactions, and background verification of employees, agents and third-party vendors.
• Detection: Monitoring for unusual transaction patterns, regular internal audits and forensic analysis, and a whistleblowing channel for suspicious activity.
• Response and investigation: Investigating reported incidents, reporting significant fraud cases to regulatory authorities as applicable, and taking appropriate legal and recovery measures.
• Ongoing awareness: Training employees on fraud awareness and ethical conduct, reviewing controls for emerging risks and using technology to support monitoring and reporting.

GOVERNANCE AND EXTERNAL BUSINESS RISKS

Governance risk

Governance risk may arise from an inadequate governance structure, management succession challenges or difficulty recruiting managers who balance social and commercial objectives. The Board communicates performance expectations, lines of accountability and strategic direction, and oversees effective governance and decision-making mechanisms.

External business environment risk

External risks may arise from competition, disasters, customer satisfaction and other changes in the business environment. Although these risks may be outside the Company’s direct control, the Company periodically reviews its assumptions and prepares for potential impacts.

• Use scenario planning and forecasting for events such as economic downturns, new competitors or changing customer behaviour.
• Diversify revenue streams, markets, products or customer segments where appropriate.
• Conduct ongoing market research to understand trends and customer preferences.
• Consider financial hedging to mitigate currency, interest rate or commodity risks where relevant.

TRANSACTION AND HUMAN RESOURCE RISKS

Transaction risk

Transaction risk arises during day-to-day processing and may increase with high volumes of small transactions. Errors or fraud may occur where transactions are not cross-checked effectively, data in loan management and accounting systems is inconsistent, or loan tracking, disbursement and repayment information is inadequate.

The Company uses standardised procedures and internal controls, regular MIS reporting and monitoring, timely rectification and reduced manual data entry. MIS information includes loan disbursements, payments received, outstanding balances and overdue accounts to support monitoring and decisions.

Human resource risk

Human resource risks include employee turnover, replacement and training needs, critical skills shortages, succession planning, regulatory capability and gaps between current staff capabilities and business objectives.

• Assign employees to appropriate roles and use suitable recruitment processes.
• Maintain appraisal and compensation review systems that consider job responsibilities, peer comparison and individual performance.
• Support employee welfare, engagement, cross-training and communication with supervisors.
• Define job profiles and conduct employee police and residence verification.
• Provide employee training and follow staff welfare, 360-degree appraisal and yearly increment processes.

BORROWER RISK ASSESSMENT

Borrowers may present different levels of risk depending on their background, references, net worth and ability to repay principal and interest. The Company’s Principal Officer applies customer due diligence on a risk-sensitive basis and reviews it annually.

Enhanced customer due diligence is applied to higher-risk customers; simplified due diligence may be applied to lower-risk categories where appropriate. The type and amount of information and documentation collected varies according to the borrower’s risk category. The Principal Officer identifies, assesses and takes effective measures in response to the risks identified.

PRINCIPAL OFFICER AND POLICY REVIEW

The Company designates a senior employee as Principal Officer, located at the Registered, Head or Corporate Office. The Principal Officer is responsible for this Policy, monitors its implementation and reports conflicts to management.

The effectiveness of the risk management system is analysed through audit reviews. Findings are used to identify shortfalls and determine suitable improvements. The Policy is renewed or modified based on audit findings, subject to approval by the Board of Directors.

CYBER SECURITY RISK

The Company uses computers, laptops, other devices, the internet and computer networks that may be exposed to cybercrime, cyber-attacks, cyberterrorism, malware and unauthorised access to systems or networks. The Board has adopted a Cyber Security Policy and directed the IT department to manage cyber-security risks and fulfil its responsibilities.

Common cyber threats

• Malware: Malicious software, including viruses, trojans, spyware, ransomware, adware and botnets, that may damage systems, collect data or perform unauthorised activity.
• SQL injection: Attacks that exploit vulnerabilities in data-driven applications to access or steal information from databases.
• Phishing: Deceptive messages that impersonate a legitimate organisation to obtain sensitive information.
• Man-in-the-middle attacks: Interception of communications, particularly over unsecured networks, to obtain data.
• Denial-of-service attacks: Attempts to overwhelm systems or networks and prevent legitimate requests from being fulfilled.
• Other threats: Financial trojans such as Dridex, romance scams, malware such as Emotet, and endpoint threats caused by unsafe user actions.

Cyber-security risk mitigation

• Keep software and operating systems updated with the latest security patches.
• Use and update anti-virus and other security software.
• Use strong passwords that are difficult to guess.
• Do not open attachments or click links from unknown senders or unfamiliar websites.
• Avoid unsecured public Wi-Fi networks that may expose communications to interception.

Cyber-security risk management process

The Company’s cyber-security risk management approach uses security policies and processes to prevent, detect and remediate threats. It involves the following stages:

• Risk identification: Review the Company’s environment to identify current or potential risks to business operations.
• Risk assessment: Assess the likelihood and potential impact of identified risks, identify relevant IT assets and consider how threats may affect business objectives.
• Risk control: Define methods, procedures, technologies and other controls to mitigate risks.
• Controls review: Ongoing evaluation of control effectiveness and adjustment or addition of controls as needed.

BOARD REVIEW

The Board of Directors oversees implementation of the risk management system at its meetings and reviews the system annually.