Risk Management Policy

Orin Financial Advisory Private Limited ("OFAPL" or the "Company"), operating under the brand name DhanLY, recognizes that effective risk management is fundamental to maintaining customer trust, protecting stakeholder interests, ensuring regulatory compliance, and supporting sustainable business growth.

As a Lending Service Provider (LSP), the Company provides technology-enabled services to regulated Banks and Non-Banking Financial Companies ("Lending Partners"). While the final credit decision rests with the Lending Partner, the Company manages various operational, technological, compliance, fraud, and third-party risks arising from its business activities.

This Policy establishes the Company's framework for identifying, assessing, monitoring, mitigating, and reporting risks.

This Policy applies to:

• Board of Directors
• Senior Management
• Employees
• Consultants
• Third-party Vendors
• Collection Agencies
• Technology Partners
• Outsourced Service Providers

Every employee is responsible for identifying and reporting risks relating to their respective functions.

The objectives of this Policy are to:

• Promote a proactive risk management culture.
• Ensure regulatory compliance.
• Protect customer information.
• Minimize fraud losses.
• Maintain uninterrupted business operations.
• Protect the Company's reputation.
• Strengthen internal controls.
• Improve operational resilience.
• Support responsible growth.

The Board of Directors shall have overall responsibility for oversight of the Company's risk management framework. Senior Management shall be responsible for:

• Implementing this Policy.
• Monitoring key business risks.
• Ensuring timely escalation of significant incidents.
• Reviewing risk mitigation measures.
• Reporting material risks to the Board.

Risk management shall be integrated into the Company's day-to-day business operations.

The Company shall periodically identify risks arising from:

• Customer onboarding
• Technology systems
• Lending Partner integration
• Payment collection
• Customer servicing
• Regulatory compliance
• Third-party vendors
• Cybersecurity
• Fraud attempts
• Operational processes

Risks shall be documented and reviewed periodically.

Operational risk refers to losses arising from inadequate or failed internal processes, people, systems, or external events. Examples include:

• Process failures
• Human error
• System downtime
• Documentation deficiencies
• Service interruptions
• Vendor failures

To mitigate operational risks, the Company shall:

• Maintain documented operating procedures.
• Segregate key operational responsibilities.
• Monitor operational performance.
• Conduct periodic process reviews.
• Train employees regularly.
• Maintain appropriate internal controls.

The Company recognizes fraud prevention as a key component of responsible digital lending. Potential fraud risks include:

• Identity fraud
• Synthetic identities
• Forged documents
• Duplicate applications
• Account takeover
• Device manipulation
• Payment fraud
• Insider fraud

To mitigate fraud risk, the Company may implement:

• PAN verification
• Aadhaar-based verification (where applicable)
• DigiLocker verification
• Bank account validation
• Mobile OTP verification
• Device intelligence
• IP and geolocation monitoring
• Bank statement analysis
• Duplicate application checks
• Internal fraud monitoring

Suspicious activities shall be investigated promptly and escalated where necessary.

The Company relies extensively on technology for delivering its services. Accordingly, the Company shall implement reasonable security measures including:

• Secure system architecture
• User authentication controls
• Encryption of sensitive data
• Access management
• Periodic password controls
• Activity logging
• Vulnerability monitoring
• Timely security updates
• Backup procedures

The Company shall endeavor to continuously strengthen its cybersecurity posture in line with evolving industry practices.

Customer information is among the Company's most valuable assets. The Company shall:

• Restrict access to customer data based on business need.
• Protect sensitive information against unauthorized disclosure.
• Maintain secure storage of customer records.
• Monitor privileged access.
• Ensure secure data transmission.

Employees shall be required to maintain confidentiality of customer information during and after employment.

Compliance risk refers to the risk arising from non-compliance with applicable laws, regulations, or contractual obligations. The Company shall monitor compliance with:

• RBI Digital Lending Guidelines
• Information Technology Act
• Digital Personal Data Protection Act
• Prevention of Money Laundering Act
• Consumer protection laws
• Contractual obligations with Lending Partners
• Internal policies

Material compliance issues shall be escalated to Senior Management.

The Company collaborates with various service providers including:

• Payment Gateway Partners
• KYC Service Providers
• Bureau Partners
• Technology Vendors
• Collection Agencies
• Cloud Service Providers

Before onboarding any vendor, the Company shall consider:

• Technical capability
• Regulatory compliance
• Information security standards
• Business continuity capability
• Financial stability
• Service quality

Vendor performance shall be periodically reviewed.

The Company recognizes that poor customer experience may result in reputational and regulatory risks. Accordingly, the Company shall:

• Maintain transparent communication.
• Handle complaints promptly.
• Monitor customer grievances.
• Ensure ethical collection practices.
• Protect customer privacy.
• Prevent unauthorized disclosure of customer information.

Customer complaints shall be analyzed to identify systemic improvements.

The Company shall endeavor to maintain continuity of critical business operations during unforeseen events including:

• Technology failures
• Network outages
• Natural disasters
• Pandemic situations
• Vendor disruptions
• Cyber incidents

Business continuity measures may include:

• Data backup
• Alternate communication channels
• Cloud infrastructure
• Incident response procedures
• Vendor coordination

Employees shall promptly report any significant incident including:

• Data breach
• Fraud attempt
• System failure
• Customer information compromise
• Regulatory breach
• Operational disruption

Management shall investigate reported incidents and implement appropriate corrective actions.

Where required by law or contractual obligations, incidents shall be reported to the relevant Lending Partner and competent authorities.

Risk management is the responsibility of every employee. The Company shall periodically conduct awareness programs relating to:

• Fraud prevention
• Information security
• Data privacy
• Customer protection
• Regulatory compliance
• Ethical conduct

Employees are expected to comply with all internal policies and immediately report suspected violations.

Management shall periodically review:

• Operational incidents
• Fraud trends
• Customer complaints
• Vendor performance
• Compliance observations
• Technology risks

Appropriate mitigation measures shall be implemented wherever required.

This Policy shall be reviewed annually or earlier in the event of:

• Regulatory changes
• Business expansion
• New product launches
• Material operational changes
• Significant risk events

Amendments shall be approved by the Board of Directors or an authorized committee.

This Policy establishes the Company's overall risk management framework.

Nothing contained herein shall override applicable laws, RBI directions, contractual obligations, or Lending Partner requirements. In the event of any inconsistency, applicable law or regulatory direction shall prevail.