Grievance Redressal & Dispute Resolution Policy

Welcome to Fin 100X.AI — India’s First Protocol-Governed AI Financial Operating System. By using our app or platform, you agree to the following terms:

Regulatory Compliance & Audit Policy (Effective Date: [●])

  1. Introduction Fin100X.AI (“we,” “our,” “us”) is India’s first protocol-governed AI Financial Operating System, committed to empowering Youth, Gen Z, Gen Alpha, and first-time earners with financial dignity, security, and freedom. Given the highly regulated nature of India’s financial ecosystem, Fin100X.AI must operate with full compliance and continuous audit-readiness across all modules. This Regulatory Compliance & Audit Policy (“Policy”) defines the framework by which Fin100X.AI ensures adherence to: RBI – Credit, digital lending, data storage & payments. SEBI – Investment advisory, mutual funds, SIPs. IRDAI – Insurance distribution & PoSP compliance. PFRDA – NPS & retirement planning. CERT-IN – Cybersecurity & incident reporting. DPDP Act, 2023 – Data protection, consent, grievance. Companies Act, 2013 – Corporate governance, reporting. Global Standards – ISO 27001, SOC 2, PCI DSS, NIST.
  2. Scope This Policy applies to: All business units, employees, directors, advisors, contractors, vendors, and partners of Fin100X.AI. All products and services, including Fin AI, Fin Advisor, Fin Literacy, Fin Score, Credit, SIP, Insurance, Retirement, Tax, and Fraud Shield. All regulatory audits, compliance filings, certifications, and reporting obligations.
  3. Objectives To establish a compliance governance structure. To ensure timely filing of regulatory returns and reports. To conduct independent internal & external audits. To maintain audit-ready records for 10+ years. To demonstrate regulatory alignment & proactive oversight.
  4. Regulatory Framework 4.1 RBI (Reserve Bank of India) RBI Act, 1934 Digital Lending Guidelines, 2022 Cybersecurity Framework, 2016 Master Directions on KYC, 2016 (updated 2023) RBI Ombudsman Scheme, 2021

4.2 SEBI (Securities & Exchange Board of India) SEBI (Investment Advisers) Regulations, 2013 SEBI (Mutual Funds) Regulations, 1996 SEBI SCORES Complaint Redressal System Cyber Resilience Guidelines, 2023

4.3 IRDAI (Insurance Regulatory & Development Authority of India) IRDAI PoSP Guidelines Insurance AML & Cybersecurity Framework IRDAI Integrated Grievance Management System (IGMS)

4.4 PFRDA (Pension Fund Regulatory & Development Authority) PFRDA (Retirement Advice) Guidelines, 2021 PFRDA Cybersecurity Standards

4.5 CERT-IN & IT Act CERT-IN Cybersecurity Directions, 2022 IT Act, 2000 & Rules

4.6 DPDP Act, 2023 Data Fiduciary obligations Grievance & consent compliance Data retention & breach notification

4.7 Companies Act, 2013 Corporate governance Audit committee oversight Whistleblower protection

  1. Compliance Governance 5.1 Compliance Committee Reports to Board of Directors. Composed of: Chief Compliance Officer (CCO), Chief Risk Officer (CRO), Data Protection Officer (DPO), and business heads.

5.2 Chief Compliance Officer (CCO) Nodal officer for RBI/SEBI/IRDAI/PFRDA filings. Ensures all compliance deadlines are met. Maintains compliance calendar.

5.3 Internal Audit Function Reports independently to Audit Committee. Conducts periodic compliance & process audits.

5.4 External Auditors Appointed for statutory audits, cyber audits, and regulatory certifications.

  1. Compliance Processes 6.1 Compliance Calendar Daily – Monitoring fraud alerts & cyber incidents. Monthly – Internal compliance reporting. Quarterly – Reports to Board & regulators. Annually – Independent audits, certifications, disclosures.

6.2 Regulatory Reporting FIU-IND – STRs & CTRs (fraud/money laundering). RBI – Digital lending & cyber incident reports. SEBI – Investor complaints, SCORES updates. IRDAI – Insurance PoSP reporting. PFRDA – NPS complaints & cyber resilience reports. CERT-IN – Incident reporting within 6 hours.

6.3 Compliance Monitoring Real-time dashboards tracking compliance KPIs. Escalation for breaches → CCO → Audit Committee → Regulator.

  1. Audit Framework 7.1 Internal Audit Covers finance, IT, operations, AI ethics. Performed quarterly. Reports submitted to Audit Committee.

7.2 External Audit Annual statutory financial audit. Annual cyber audit (ISO 27001, SOC 2). RBI/SEBI/IRDAI/PFRDA mandated audits.

7.3 AI & Algorithmic Audit Independent fairness & bias testing of AI models. Responsible AI reports submitted annually.

7.4 Regulatory Inspections Full cooperation with RBI/SEBI/IRDAI/PFRDA inspections. Pre-audit preparation with compliance packs.

  1. Risk-Based Supervision Risk assessments aligned with RBI’s Risk-Based Supervision (RBS). Risk registers updated quarterly. Mitigation plans linked to Risk Management Policy.
  2. Record Keeping Compliance records retained for 10 years. Fraud & cyber incident logs – 10 years. Data protection consents – as per DPDP Act retention schedules. Immutable audit trails maintained.
  3. Training & Awareness Annual compliance training for employees. AI engineers trained on Responsible AI standards. Vendor compliance induction before onboarding.
  4. Roles & Responsibilities Board of Directors – Overall compliance oversight. Audit Committee – Approves audits, reviews findings. Compliance Committee – Day-to-day compliance execution. Employees & Vendors – Required to follow compliance SOPs.
  5. Policy Enforcement Violations subject to disciplinary action & termination. Non-compliance may trigger regulator penalties. Material breaches reported to regulators & disclosed to users.
  6. Policy Review Reviewed annually by Compliance Committee. Approved by Board of Directors. Immediate updates if regulators issue new guidelines.

📑 Annexures Annexure A – Compliance Calendar (Sample) Frequency Regulator Report Responsible Officer Deadline Daily CERT-IN Cyber incident log CISO Within 6 hrsMonthly RBI Lending compliance CCO 7th of monthQuarterly SEBI SCORES updates CRO 15th of next qtrAnnually IRDAI PoSP review CCO 31st March

Annexure B – Audit Checklist (Extract) User consent logs (DPDP compliance) KYC/AML records (10-year retention) AI fairness & bias reports Fraud Shield incident records Vendor compliance contracts

Annexure C – Regulatory Escalation Chart

  1. Compliance Breach Detected →
  2. Escalation to CCO →
  3. Internal Audit Review →
  4. Audit Committee Report →
  5. Regulator Notification (as per law).

Annexure D – AI Governance Audit Template Model name & purpose Training dataset sources Bias/fairness test results Explainability report Monitoring plan

#12 Regulatory Compliance & Audit Policy(Aligned with RBI, SEBI, IRDAI, PFRDA, CERT-IN, DPDP Act 2023, Companies Act 2013, and global audit standards like ISO 27001 & SOC 2) This final policy is critical because it: Establishes a master compliance framework for all regulators (RBI for credit, SEBI for investments, IRDAI for insurance, PFRDA for retirement, CERT-IN for cybersecurity, DPDP Act for data). Defines internal & external audit protocols (annual, quarterly, and ad-hoc). Outlines regulatory reporting schedules (FIU-IND, Ombudsman, SEBI SCORES, IRDAI IGMS, PFRDA CGMS). Ensures Board & Audit Committee governance. Includes Annexures: Regulatory compliance calendar, audit templates, reporting dashboards.