Risk Management Policy

    PAYOTRIX is committed to identifying, assessing, mitigating, and monitoring all forms of operational, regulatory, financial, technological, and reputational risks associated with its business model. This Risk Management Policy has been formulated to provide a systematic, measurable framework that aligns with guidelines from the Reserve Bank of India (RBI), Information Technology Act, global risk frameworks such as COSO and ISO 31000, and best practices in fintech operations.

Objective of the Policy

This policy aims to safeguard PAYOTRIX, its merchants, customers, and partners by:

• Minimizing the likelihood of risk-related disruptions

• Establishing mitigation workflows

• Providing proactive defense against fraud, system abuse, and regulatory penalties

• Ensuring long-term platform sustainability and integrity

Scope of the Policy

The policy applies to all business units of PAYOTRIX, including:

• Technical infrastructure

• Merchant onboarding

• KYC/AML integrations

• Payment gateway connections

• Legal, compliance, and customer service operations

Third-party vendors working with PAYOTRIX are also bound by risk controls.

Risk Governance Structure

PAYOTRIX has constituted a Risk Management Committee that:

• Reports to executive management

• Reviews risk indicators quarterly

• Oversees the platform’s risk appetite strategy

• Handles escalations and implements mitigation protocols

This committee operates independently from daily operations.

Risk Categorization Framework

All risks are classified under:

• Operational Risk: System downtime, human error

• Compliance Risk: Non-adherence to legal norms

• Technology Risk: Cyberattacks, server failures

• Reputational Risk: Brand damage from disputes

• Third-party Risk: Vendor or aggregator-related failures
  Each type has subcategories, thresholds, and designated response workflows.

Risk Identification Process

PAYOTRIX continuously identifies risks using:

• Automated log analytics

• Internal audits and system health scans

• External threat intelligence sources

• Incident reports from customers and partners

• Alerts from payment gateway ecosystems

New risks are formally logged and assessed by the Risk Committee.

Risk Scoring and Assessment

Every identified risk is evaluated using a matrix of:

• Likelihood (Low, Medium, High)

• Impact (Minor, Moderate, Critical)
  This scoring determines the urgency of action, whether proactive or reactive.

Each score is updated dynamically as new data is received.

Merchant Risk Profiling

Each PAYOTRIX merchant is scored based on:

• Transaction frequency and volume

• Historical chargebacks or refund rates

• Business category (e.g., high-risk vs low-risk)

• Compliance status (KYC, GST, PAN validation)

High-risk merchants may face additional verification or limits.

Fraud Detection and Response System

PAYOTRIX runs a 24/7 automated risk engine to detect:

• Rapid multiple failed transactions

• IP address switching

• Unusual traffic from proxy/VPNs

• Account hijack signals

• Suspicious payment redirection attempts

High-severity alerts are routed immediately to the fraud response team.

Transaction Monitoring Tools

All redirected payment transactions are monitored for:

• Anomalous patterns

• Amount mismatches between the source and the aggregator

• Redirect loop failures

• Timestamp gaps indicating manipulation

Such flagged events are automatically logged for audit.

Whitelist and Blacklist Controls

PAYOTRIX maintains:

• IP whitelists for verified merchants

• Blacklists for known malicious agents, devices, and locations

• Blacklist sync APIs with payment partners when available
  Merchants using blacklisted infrastructure may be auto-suspended.

Technology Resilience Planning

To mitigate tech-related risks:

• PAYOTRIX employs redundancy in DNS, servers, and APIs

• Uptime targets exceed 99.95% annually

• Failover systems activate upon SLA breaches

• Disaster Recovery (DR) site is ready for activation within 3 hours

All systems undergo failover testing every quarter.

Data Security Risk Measures

Aligned with the RBI cybersecurity framework and ISO 27001, PAYOTRIX implements:

• Role-based access control

• End-to-end TLS encryption

• Firewall protection with WAF

• DDoS protection and bot filtering

• Regular source code review and pentesting

Incident logs are retained for 7+ years.

KYC/AML Risk Surveillance

PAYOTRIX audits the KYC/AML status of its partners to ensure:

• PAN, Aadhaar, and GSTIN are valid and mapped

• Merchants are not on FATF, OFAC, or UNSC watchlists

• Ongoing screening is enforced through API connections with PAs

Red flags are documented and escalated within 24 hours.

Operational Risk Handling

To address internal risks (human error, process failures), PAYOTRIX:

• Uses SOP-driven processes with multi-person verification

• Limits access to production infrastructure

• Trains all staff in compliance-sensitive operations quarterly

Internal risk events are documented and investigated formally.

Regulatory Risk Compliance

All RBI, MCA, IT Act, and FIU-IND circulars are:

• Logged in the Regulatory Tracker

• Assigned to compliance/legal officers

• Implemented with a due date
  Missed implementation escalates directly to the COO.

Business Continuity Planning (BCP)

PAYOTRIX maintains a structured Business Continuity Plan (BCP) to handle:

• Natural disasters

• Server infrastructure failures

• Political unrest or regulatory blocks

• Long-term technical disruption

The BCP includes:

• Real-time replication of critical data

• Failover DNS and cloud CDN readiness

• Manual fallback routing for redirection-based payments

Tests are conducted semi-annually to ensure preparedness.

Vendor and Partner Risk Controls

All third-party providers (e.g., hosting, payment gateways, analytics tools) undergo:

• Background checks

• Contractual obligations to meet PAYOTRIX's compliance standards

• Audit clauses allowing risk assessments

• SLA monitoring for reliability, data leakage, or downtime

Failure to meet standards may result in suspension or deactivation.

Intellectual Property and Code Leakage Prevention

PAYOTRIX protects source code, scripts, and proprietary frameworks by:

• Storing all critical assets in version-controlled repositories

• Restricting developer access by environment (dev, stage, production)

• Prohibiting downloads of production code outside whitelisted systems

• Monitoring for unusual Git pull/clone patterns

Legal action is enforced for IP violations internally or externally.

Reputational Risk Monitoring

PAYOTRIX uses:

• Brand monitoring tools

• Review and reputation tracking engines

• Legal alerts (mentions in court cases, leaks, etc.)
  …to track reputational risk.

If a reputational threat arises, the Risk Committee and PR team coordinate response protocols.

Regulatory Non-Compliance Risk

PAYOTRIX maps all critical processes against:

• RBI payment circulars

• IT Act digital platform guidelines

• GST, Income Tax, and MCA compliance
  …to avoid penalties and license issues.

Non-compliant workflows are paused and reviewed immediately upon detection.

Platform Misuse and Abuse Monitoring

PAYOTRIX tracks:

• Fake merchant onboarding

• Abuse of redirect APIs for phishing

• Use of PAYOTRIX branding in fraudulent email campaigns

Such cases are flagged and escalated to the Cybersecurity team and, when needed, CERT-IN.

Incident Response Plan (IRP)

For every severity-rated incident, PAYOTRIX uses a formal IRP that includes:

• Classification (P1 to P5 based on urgency/impact)

• Dedicated response team assignment

• Escalation to external bodies (e.g., payment partners, CERT-IN)

• Root cause analysis (RCA) documentation within 72 hours

The IRP is tested every quarter with simulations.

Identity and Access Risk Mitigation

PAYOTRIX controls user and admin access via:

• Two-factor authentication (2FA)

• Role-based access controls (RBAC)

• Auto-lockout on suspicious login behavior

• Periodic review of user access logs and anomalies

Privileged accounts are reviewed monthly.

Risk Awareness Training

All employees undergo:

• Monthly email drills (e.g., phishing simulations)

• Quarterly risk training covering RBI, fraud, and tech threats

• Immediate refreshers after an incident or regulation update

Training records are logged and tied to HR compliance reports.

Dashboard & API Risk Filters

For all platform usage, PAYOTRIX integrates risk filters such as:

• Rate limits on API calls

• Session timeout enforcement

• Verification flows for sensitive dashboard actions (e.g., editing redirect URLs, email templates)

• Audit logs for all admin changes

This protects both merchant integrity and customer experience.

Dependency Risk Management

All system dependencies (e.g., Redis, MySQL, third-party APIs) are:

• Mapped in a dependency graph

• Categorized by mission-criticality

• Reviewed quarterly for version updates and CVEs

• Monitored by heartbeat ping systems

If a critical dependency fails, alternative configurations or downgrades are enabled immediately.

Risk-Based Merchant Tiering

Merchants are placed in tiers (e.g., Standard, Monitored, Restricted) based on:

• Compliance status

• Industry vertical

• Chargeback or dispute frequency
  Each tier determines the applicable API limits, visibility settings, or real-time fraud rules.

Insurance Against Risk Events

PAYOTRIX maintains corporate insurance policies for:

• Cyber liability

• Professional indemnity

• Fraud and crime coverage

• Legal risk handling (litigation, arbitration)

All policies are renewed annually and reviewed for adequacy.

Systemic Risk Stress Testing

PAYOTRIX conducts quarterly stress simulations for:

• Sudden 10x traffic spikes

• Fake merchant flooding

• DDOS plus fraud attack combo
  These are reviewed post-test to harden the system against potential system-wide failure scenarios.

Whistleblower Risk Intake Channel

Any internal or external stakeholder can report:

• Risky practices

• Security violations

• Abuse of platform authority
  …anonymously via support@payotrix.com.

All reports are reviewed by a neutral compliance committee with whistleblower protection ensured.

Strategic Risk Controls

PAYOTRIX regularly assesses:

• Changes in fintech regulations

• Market entry of large competitors

• Revenue concentration from a few partners
  …to manage long-term strategic risks.

The executive team adjusts business goals and technology stack based on quarterly risk reviews.

Data Privacy Risk Monitoring

By the RBI, IT Act, and proposed DPDP Act norms:

• All sensitive data is encrypted in transit and at rest

• Pseudonymization is used where applicable

• Third-party access is governed strictly through NDAs and privacy contracts

• Data mapping and usage purposes are reviewed monthly

Breaches are escalated to the Data Protection Officer and regulators if necessary.

Cross-Border Risk Awareness

When PAYOTRIX interacts with international partners or merchants:

• Geo-risk scoring is applied (e.g., high-risk nations flagged by FATF)

• Cross-border data flow is monitored

• Sanctions and embargo compliance is ensured through screening APIs

Payments from banned jurisdictions are automatically blocked.

API Abuse Risk Mitigation

To prevent exploitation of public or partner-facing APIs:

• Rate limiting (based on IP/session)

• API key rotation policies

• Strict versioning to prevent unintentional backward compatibility

• 403 blacklisting for abuse attempts

Suspicious API clients are suspended automatically.

Redirection Risk Isolation

PAYOTRIX ensures that payment redirections:

• Are domain-verified before being allowed

• Include checksum or token validation

• Are single-use only to prevent phishing/abuse

• Timeout after 10 minutes if not used

This limits the risk of fake page injection or rerouting fraud.

Risk-Aware Deployment Cycles

All product and backend deployments:

• They are preceded by UAT (User Acceptance Testing) in the sandbox

• Go through regression and security checks

• They are deployed during low-traffic windows

• Include rollback options for hotfix failures

This avoids production-level service degradation and risk leakage.

Legal Risk Management

All PAYOTRIX legal exposure—due to disputes, compliance gaps, IP infringement, or merchant litigation—is:

• Assigned to the in-house legal team

• Monitored through a litigation tracker

• Reported quarterly to executive risk oversight

• Covered by indemnity clauses in partner contracts

All legal notices are tracked from receipt to resolution.

Communication Risk Minimization

To prevent miscommunication that leads to:

• Merchant panic

• Regulatory alerts

• Reputational fallout
  …all external communication is:

• Reviewed by Legal & Compliance

• Checked for tone, accuracy, and disclaimers

• Backed by logs or documentation if required

No risky customer-facing statement is released without approval.

Currency and FX Risk Prevention

PAYOTRIX does not directly handle currency conversion. However, it ensures:

• That partners (e.g., Stripe, PayPal) use RBI-authorized FX facilities

• Rates are transparent to the end customer before redirection

• No hidden forex markup is added from PAYOTRIX’s end

All foreign payment redirections are monitored for conversion compliance.

Continuous Risk Monitoring Dashboard

A centralized internal dashboard shows:

• Active risk alerts by category

• Escalated incident response tickets

• Pending compliance deadlines

• High-risk merchants or IPs flagged by heuristics

This allows real-time intervention by compliance and technical teams.

Incident Closure & RCA Documentation

Each critical incident (e.g., fraud, downtime, data loss) must go through:

• A closure form

• Root cause analysis report

• Lessons learned meeting

• Documentation is stored with a timestamp and the owner

Closed incidents are audited quarterly to prevent recurrence.

Internal Audit of Risk Functions

All major components of the risk management process are:

• Internally audited twice per year

• Randomly spot-checked by legal/compliance officers

• Reviewed in conjunction with cyber and infrastructure teams

• Updated with RBI circular alignment reports

Audit failures lead to immediate policy action.

Alignment with International Risk Standards

PAYOTRIX maps its risk framework with global guidelines such as:

• ISO 31000: Risk Management

• NIST Cybersecurity Framework

• COSO ERM Framework
  This supports international merchant confidence and investor due diligence.

Enforcement of Risk Breach Penalties

Any employee or partner found to:

• Neglecting defined risk procedures

• Deliberately bypass safeguards

• Conceal incidents or misuse of admin privileges
  …is subject to:

• Immediate suspension

• Escalation to law enforcement (if applicable)

• Full cooperation with the forensic audit

A zero-tolerance stance is strictly followed.

Reporting to Senior Management & Board

The Risk Management Committee submits:

• Monthly summaries to the CEO

• Quarterly updates to the Board or Advisory Council

• Immediate reports in case of regulatory or cybersecurity escalations

This ensures top-down visibility and accountability of risk controls.

🔄 Amendment Clause

PAYOTRIX reserves the right to modify this Risk Management Policy at any time, without prior notice. Users, merchants, and stakeholders are expected to review this page regularly. Continued use of the platform indicates agreement with the latest published version.