AML / KYC Compliance Policy

1. Purpose & Scope of Compliance Framework

WinToday Technologies ("WinToday", "Platform") maintains an internal compliance framework designed to combat financial crimes, identity theft, money laundering, and the financing of illicit activities. We require all active investors to undergo verifiable identity validation to maintain a trustworthy, transparent, and secure operational ecosystem.

This policy outlines the exact technical procedures, document submission stages, administrative verification reviews, and monitoring mechanisms implemented across our platform.

2. Regulatory Status & Transparency Disclaimer

Crucial Compliance & Legal Disclaimer:

• No Statutory Registration Claims: WinToday is a private technology software platform. It does NOT claim registration, licensing, or statutory accreditation with the Securities and Exchange Board of India (SEBI), the Reserve Bank of India (RBI), or the Financial Intelligence Unit - India (FIU-IND) without certified documentary evidence.
• Internal Due Diligence Only: Our KYC and AML procedures are adopted as internal risk-governance and commercial due diligence practices to protect platform participants and prevent fraud. Nothing in this policy should be construed as implying statutory regulatory authorization or government oversight.

3. When KYC Is Requested & Mandatory Gating

WinToday enforces structured onboarding gates to verify the identity of investors before funds can be withdrawn:

• Withdrawal Pre-Requisite: Full KYC onboarding is an absolute prerequisite for submitting withdrawal requests. An investor with incomplete or rejected KYC records cannot request, approve, or disburse funds from the platform.
• Mandatory Tripartite Requirement: Complete onboarding status requires three verifiable components:
  1. Valid PAN record submitted and verified.
  2. Valid Aadhaar identity authenticated via DigiLocker eKYC.
  3. Active Indian bank account verified in the investor's legal name matching identity records.

4. Identity Verification Flow & Technical Steps

The identity verification process on WinToday consists of the following technical stages:

Step 1: Permanent Account Number (PAN) Verification

The investor inputs their official 10-character alphanumeric PAN issued by the Income Tax Department of India and uploads a digital photograph/scan of their physical PAN card. The platform verifies format consistency, deduplicates against existing records to prevent multi-accounting, and records the submission timestamp.

Step 2: Consent-Based Aadhaar eKYC via DigiLocker

To verify citizen identity without collecting sensitive raw biometric data, WinToday utilizes an authorized electronic KYC integration powered by Message Central DigiLocker:

• The investor initiates the verification request in the WinToday application.
• The platform generates a secure, authenticated DigiLocker URL via Message Central eKYC APIs.
• The investor is directed to the official DigiLocker web interface to grant explicit consent and authenticate using their Aadhaar-linked mobile OTP.
• Upon successful authentication, the server receives a cryptographic verification callback. The platform records the verified status and verification reference identifier.
• Important Privacy Safeguard: WinToday never asks for, collects, stores, or handles raw 12-digit Aadhaar biometric data (fingerprints or iris scans). Full Aadhaar credentials are never logged in application traces.

Step 3: Live Selfie & Facial Match

The investor captures a live facial photograph (selfie) within the application. This selfie is matched against the photograph appearing on the uploaded PAN and DigiLocker documents to verify liveness and prevent impersonation fraud.

Step 4: Bank Account Validation

The investor registers their primary Indian bank account (Account Holder Name, Bank Name, Account Number, and IFSC Code). The account holder name must match the legal name verified on the PAN and Aadhaar identity documents. Third-party bank accounts are strictly rejected.

5. Multi-Stage Verification Status Workflow

Identity records on WinToday progress through an audited status lifecycle managed by our compliance desk:

• Pending: Initial state when the investor has submitted preliminary details or initiated a verification session that has not yet concluded.
• Under Review: The dossier has been locked for inspection by an authorized compliance administrator who verifies document legibility, name consistency, and facial match.
• Verified: All documents, PAN records, DigiLocker confirmations, and bank details have been verified and confirmed. Full platform features, including withdrawals, become available.
• Rejected: If documents are blurry, names mismatch, forged elements are detected, or the DigiLocker session fails, the dossier is marked as rejected. The administrator must document a specific reason (rejection_reason), which is communicated to the investor for rectification.

Every status transition is permanently recorded in the immutable KycStatusHistory table with the reviewer ID and timestamp.

6. Bank Account Whitelisting & Payout Rules

To prevent money laundering, tax evasion, and unauthorized diversion of capital:

• Strict Whitelisting: Payouts are made exclusively to the verified primary Indian bank account registered under the investor's verified legal identity.
• No Third-Party Accounts: Requests to withdraw funds to accounts belonging to spouses, relatives, business entities, or third parties are strictly prohibited and will be rejected.
• IFSC & Branch Validation: Bank accounts undergo automated IFSC branch verification to ensure the receiving financial institution is a recognized Indian banking entity.

7. Sensitive Data Masking & Aadhaar Protection

In accordance with Indian privacy standards and the Aadhaar Act guidelines regarding offline verification:

• Masked PAN Representation: PAN numbers are programmatically masked in user interfaces and serialized data models (e.g., ABCDE••••F).
• Masked Aadhaar Representation: Aadhaar references are masked in all standard outputs (e.g., ••••••••1234 or XXXX XXXX 9012).
• No Biometric Storage: Under no circumstances does WinToday collect or store core biometric information or raw Aadhaar numbers.
• Isolated Storage Disks: Uploaded identity documents are stored on protected private server volumes with authenticated access controls.

8. Ongoing Monitoring & Account Freezing

WinToday operations personnel monitor platform activity for indicators of financial manipulation or fraud:

• Velocity Checks: Monitoring abnormal deposit or withdrawal frequencies inconsistent with standard investor behavior.
• UTR Recycling Detection: Automated database constraints preventing the re-use of identical payment UTRs across different investments or accounts.
• Account Freezing & Suspension: The platform reserves the right to immediately freeze and block accounts (UserStatus::Blocked) found submitting forged identity documents, fabricated UTRs, or suspected illicit funds.
• Escalation Protocols: Serious suspicious transactions or identity theft attempts are escalated to senior compliance officers for formal review and potential referral to Indian law enforcement authorities.

9. Audit Logging & Document Retention

WinToday maintains comprehensive audit logs (AuditLog) capturing:

• Administrator identity verification decisions, timestamps, and entered remarks.
• Payment verification approvals and rejections with associated bank credit references.
• KYC dossiers and financial records are retained for a minimum of eight (8) years following account closure to ensure availability for commercial and tax compliance.

10. Inquiries & Compliance Contact

For inquiries regarding KYC verification status, document resubmission, or AML compliance standards, contact our compliance desk:

• AML & Compliance Officer: WinToday Technologies
• Escrow Operations Location: Koramangala, Bengaluru, Karnataka, India
• Official Compliance Email: support@wintoday.app
• Operating Hours: 09:00 to 18:00 IST (Monday through Friday)