Regulatory Compliance & Audit Policy

Welcome to Fin 100X.AI — India’s First Protocol-Governed AI Financial Operating System. By using our app or platform, you agree to the following terms:

<hr><ol><li>Introduction <a target="_blank" rel="noopener noreferrer" href="https://fin100x.ai">Fin 100X.AI</a> (“we,” “our,” “us”) is India’s first protocol-governed AI Financial Operating System, committed to empowering Youth, Gen Z, Gen Alpha, and first-time earners with financial dignity, security, and freedom. Given the highly regulated nature of India’s financial ecosystem, <a target="_blank" rel="noopener noreferrer" href="https://fin100x.ai">Fin 100X.AI</a> must operate with full compliance and continuous audit-readiness across all modules. This Regulatory Compliance & Audit Policy (“Policy”) defines the framework by which Fin 100X.AI ensures adherence to: RBI – Credit, digital lending, data storage & payments. SEBI – Investment advisory, mutual funds, SIPs. IRDAI – Insurance distribution & PoSP compliance. PFRDA – NPS & retirement planning. CERT-IN – Cybersecurity & incident reporting. DPDP Act, 2023 – Data protection, consent, grievance. Companies Act, 2013 – Corporate governance, reporting. Global Standards – ISO 27001, SOC 2, PCI DSS, NIST.</li><li>Scope This Policy applies to: All business units, employees, directors, advisors, contractors, vendors, and partners of <a target="_blank" rel="noopener noreferrer" href="https://fin100x.ai">Fin 100X.AI</a>. All products and services, including Fin AI, Fin Advisor, Fin Literacy, Fin Score, Credit, SIP, Insurance, Retirement, Tax, and Fraud Shield. All regulatory audits, compliance filings, certifications, and reporting obligations.</li><li>Objectives To establish a compliance governance structure. To ensure timely filing of regulatory returns and reports. To conduct independent internal & external audits. To maintain audit-ready records for 10+ years. To demonstrate regulatory alignment & proactive oversight.</li><li>Regulatory Framework 4.1 RBI (Reserve Bank of India) RBI Act, 1934 Digital Lending Guidelines, 2022 Cybersecurity Framework, 2016 Master Directions on KYC, 2016 (updated 2023) RBI Ombudsman Scheme, 2021</li></ol>4.2 SEBI (Securities & Exchange Board of India) SEBI (Investment Advisers) Regulations, 2013 SEBI (Mutual Funds) Regulations, 1996 SEBI SCORES Complaint Redressal System Cyber Resilience Guidelines, 20234.3 IRDAI (Insurance Regulatory & Development Authority of India) IRDAI PoSP Guidelines Insurance AML & Cybersecurity Framework IRDAI Integrated Grievance Management System (IGMS)4.4 PFRDA (Pension Fund Regulatory & Development Authority) PFRDA (Retirement Advice) Guidelines, 2021 PFRDA Cybersecurity Standards4.5 CERT-IN & IT Act CERT-IN Cybersecurity Directions, 2022 IT Act, 2000 & Rules4.6 DPDP Act, 2023 Data Fiduciary obligations Grievance & consent compliance Data retention & breach notification4.7 Companies Act, 2013 Corporate governance Audit committee oversight Whistleblower protection<ol start="5"><li>Compliance Governance 5.1 Compliance Committee Reports to Board of Directors. Composed of: Chief Compliance Officer (CCO), Chief Risk Officer (CRO), Data Protection Officer (DPO), and business heads.</li></ol>5.2 Chief Compliance Officer (CCO) Nodal officer for RBI/SEBI/IRDAI/PFRDA filings. Ensures all compliance deadlines are met. Maintains compliance calendar.5.3 Internal Audit Function Reports independently to Audit Committee. Conducts periodic compliance & process audits.5.4 External Auditors Appointed for statutory audits, cyber audits, and regulatory certifications.<ol start="6"><li>Compliance Processes 6.1 Compliance Calendar Daily – Monitoring fraud alerts & cyber incidents. Monthly – Internal compliance reporting. Quarterly – Reports to Board & regulators. Annually – Independent audits, certifications, disclosures.</li></ol>6.2 Regulatory Reporting FIU-IND – STRs & CTRs (fraud/money laundering). RBI – Digital lending & cyber incident reports. SEBI – Investor complaints, SCORES updates. IRDAI – Insurance PoSP reporting. PFRDA – NPS complaints & cyber resilience reports. CERT-IN – Incident reporting within 6 hours.6.3 Compliance Monitoring Real-time dashboards tracking compliance KPIs. Escalation for breaches → CCO → Audit Committee → Regulator.<ol start="7"><li>Audit Framework 7.1 Internal Audit Covers finance, IT, operations, AI ethics. Performed quarterly. Reports submitted to Audit Committee.</li></ol>7.2 External Audit Annual statutory financial audit. Annual cyber audit (ISO 27001, SOC 2). RBI/SEBI/IRDAI/PFRDA mandated audits.7.3 AI & Algorithmic Audit Independent fairness & bias testing of AI models. Responsible AI reports submitted annually.7.4 Regulatory Inspections Full cooperation with RBI/SEBI/IRDAI/PFRDA inspections. Pre-audit preparation with compliance packs.<ol start="8"><li>Risk-Based Supervision Risk assessments aligned with RBI’s Risk-Based Supervision (RBS). Risk registers updated quarterly. Mitigation plans linked to Risk Management Policy.</li><li>Record Keeping Compliance records retained for 10 years. Fraud & cyber incident logs – 10 years. Data protection consents – as per DPDP Act retention schedules. Immutable audit trails maintained.</li><li>Training & Awareness Annual compliance training for employees. AI engineers trained on Responsible AI standards. Vendor compliance induction before onboarding.</li><li>Roles & Responsibilities Board of Directors – Overall compliance oversight. Audit Committee – Approves audits, reviews findings. Compliance Committee – Day-to-day compliance execution. Employees & Vendors – Required to follow compliance SOPs.</li><li>Policy Enforcement Violations subject to disciplinary action & termination. Non-compliance may trigger regulator penalties. Material breaches reported to regulators & disclosed to users.</li><li>Policy Review Reviewed annually by Compliance Committee. Approved by Board of Directors. Immediate updates if regulators issue new guidelines.</li></ol>Annexures Annexure A – Compliance Calendar (Sample) Frequency Regulator Report Responsible Officer Deadline Daily CERT-IN Cyber incident log CISO Within 6 hrsMonthly RBI Lending compliance CCO 7th of monthQuarterly SEBI SCORES updates CRO 15th of next qtrAnnually IRDAI PoSP review CCO 31st MarchAnnexure B – Audit Checklist (Extract) User consent logs (DPDP compliance) KYC/AML records (10-year retention) AI fairness & bias reports Fraud Shield incident records Vendor compliance contractsAnnexure C – Regulatory Escalation Chart<ol><li>Compliance Breach Detected →</li><li>Escalation to CCO →</li><li>Internal Audit Review →</li><li>Audit Committee Report →</li><li>Regulator Notification (as per law).</li></ol>Annexure D – AI Governance Audit Template Model name & purpose Training dataset sources Bias/fairness test results Explainability report Monitoring plan<hr>#12 Regulatory Compliance & Audit Policy(Aligned with RBI, SEBI, IRDAI, PFRDA, CERT-IN, DPDP Act 2023, Companies Act 2013, and global audit standards like ISO 27001 & SOC 2) This final policy is critical because it: Establishes a master compliance framework for all regulators (RBI for credit, SEBI for investments, IRDAI for insurance, PFRDA for retirement, CERT-IN for cybersecurity, DPDP Act for data). Defines internal & external audit protocols (annual, quarterly, and ad-hoc). Outlines regulatory reporting schedules (FIU-IND, Ombudsman, SEBI SCORES, IRDAI IGMS, PFRDA CGMS). Ensures Board & Audit Committee governance. Includes Annexures: Regulatory compliance calendar, audit templates, reporting dashboards.