KYC and Anti-Money Laundering Policy

Effective date and last updated: 6 October 2026 · Applies to: NxtBanking (a product of Laraware Private Limited), its websites, APIs, dashboards and partner platforms.

1. Commitment

Laraware Private Limited is committed to preventing money laundering, terror financing, fraud and other financial crime through its Services. This policy sets out the know-your-customer (KYC) and anti-money laundering (AML) standards that we apply to merchants, distributors, business customers and partners, and that we expect them to apply to their own customers. It is aligned with the Prevention of Money Laundering Act, 2002 and the PML Rules, RBI Master Directions on KYC and payment systems, NPCI requirements and FIU-IND guidelines, as they apply to our role.

NxtBanking is a software and API infrastructure provider. Where a service involves a regulated activity (for example BBPS bill payments, AEPS cash withdrawal, money transfer or prepaid recharge), that activity is carried out by the licensed or authorised entity concerned (such as a Bharat Bill Payment Operating Unit, a sponsor bank, a Payment Aggregator or a payment system operator) under its own licence and rules. NxtBanking does not hold customer funds as a bank, does not issue payment instruments and does not claim any licence or authorisation that it has not been granted.

2. Scope

The policy applies to every merchant, retailer, distributor, white-label partner, API customer, employee and vendor involved in the delivery of our Services.

3. Customer due diligence

Before activating a user, we perform checks that are proportionate to the risk:

• Identity: Name, photograph, PAN and an officially valid document (such as Aadhaar with consent, passport, voter ID, driving licence) for individuals. For firms and companies: registration documents, GSTIN where applicable, PAN of the entity, directors or partners and beneficial owners.
• Address and place of business: Address proof and verification of the business location.
• Bank account: Verification of the settlement account through penny-drop or equivalent, in the name of the user.
• Screening: Screening against UN, OFAC and Indian sanctions lists and lists of debarred persons, and adverse-media checks.
• Purpose and expected activity: Understanding the nature of the business and expected volumes.
• Video or in-person verification for higher-risk users, where needed.

We do not onboard anonymous or fictitious persons, shell entities or users who refuse to provide information.

4. Risk-based approach

Users are classified as low, medium or high risk, based on factors such as business type, location, volumes, mode of transactions, adverse information and politically exposed person (PEP) status. High-risk users are subject to enhanced due diligence, lower limits, closer monitoring and senior approval. KYC is reviewed periodically (at least every 2 years for high-risk and 8 to 10 years for low-risk users) and on any trigger event.

5. Transaction monitoring

We monitor transactions on an ongoing basis using rules and analytics for patterns such as:

• Structuring or splitting of transactions to avoid limits.
• Unusual volumes or velocity compared with the user's profile.
• Round-amount, circular or back-to-back transactions.
• Many customers or accounts linked to one device or location.
• Transactions in a high-risk geography or with a sanctioned party.
• Repeated failed attempts, biometric mismatch and cash-out patterns.

Alerts are reviewed by the compliance team. We may hold, reject, reverse or freeze transactions, and ask for information and documents.

6. Reporting

Our Principal Officer reports suspicious transactions and other prescribed reports to the Financial Intelligence Unit - India (FIU-IND) and to our partner banks and regulators as the law and our partners require. We do not tell the person concerned about the filing of a suspicious transaction report (no "tipping off"). Staff and users who report in good faith are protected.

7. Record keeping

We keep KYC, transaction and monitoring records for at least 5 years after the end of the relationship or the transaction, whichever is later, or longer where the law or an investigation requires. Records are kept in a form that allows reconstruction of transactions.

8. Obligations of merchants and partners

Merchants and partners using our Services must:

• Provide true and complete information, and update us promptly of changes.
• Perform and record the customer checks that applicable rules require of them, including verification of the customer's identity for relevant services.
• Not accept or process funds from unknown or unverified sources, or carry out transactions for third parties not permitted under their agreement.
• Not structure, split or disguise transactions, or allow others to use their account (no "rent-a-wallet" or account-lending).
• Cooperate with enquiries, audits and requests for records, and report suspicious activity to us immediately.

9. Sanctions and prohibited users

We do not provide Services to persons or entities on sanctions lists, to those engaged in prohibited activities (such as unlicensed gambling, narcotics, illegal arms or terror financing), or to residents of jurisdictions where doing so is prohibited by law.

10. Governance

• The Board of Directors approves this policy and receives periodic reports.
• A Principal Officer is responsible for AML compliance and reporting.
• Staff receive AML and fraud awareness training at induction and at least annually.
• The policy and controls are reviewed at least once a year and independently tested.

11. Privacy

Personal data collected for KYC is used only for compliance and risk purposes, as set out in the Privacy Policy. We handle Aadhaar-based KYC strictly under the Aadhaar Act, with consent.

12. Reporting concerns

If you suspect money laundering or fraud involving our Services, write to legalteam@laraware.com or call 0731-4621515. Reports can be made confidentially.

Contact us