Risk Management & Internal Controls Policy

Welcome to Fin 100X.AI — India’s First Protocol-Governed AI Financial Operating System. By using our app or platform, you agree to the following terms:

  1. Introduction Fin 100X.AI (“we,” “our,” “us”) is India’s first protocol-governed AI Financial Operating System, designed to empower Youth, Gen Z, Gen Alpha, and first-time earners with financial dignity, security, and freedom. As a platform that integrates with regulated financial institutions (banks, NBFCs, AMCs, insurers, and pension providers), Fin 100X.AI is exposed to diverse risks — financial, operational, technological, compliance, reputational, and systemic. This Risk Management & Internal Controls Policy (“Policy”) sets forth our framework for identifying, assessing, mitigating, monitoring, and reporting risks in compliance with: RBI’s Risk-Based Supervision (RBS) Framework SEBI’s Risk Management Framework for Market Intermediaries IRDAI’s Enterprise Risk Management (ERM) Guidelines PFRDA’s Corporate Governance & Risk Standards CERT-IN Cyber Security Directions DPDP Act 2023 & IT Act 2000
  2. Objectives The objectives of this Policy are: To establish a comprehensive risk management framework across all Fin 100X.AI modules. To define internal controls ensuring integrity, accountability, and compliance. To align risk governance with regulatory expectations of RBI, SEBI, IRDAI, and PFRDA. To enable proactive identification of emerging risks including AI/ML bias, fraud, and cyber threats. To safeguard the interests of users, partners, regulators, and investors.
  3. Scope This Policy applies to: All Fin 100X.AI products and services (AI Financial Advisory, Credit Score & Loans, SIPs, Insurance, Retirement, Fraud Shield, etc.). All employees, advisors, contractors, vendors, and third-party service providers. All systems, processes, data, and transactions across the platform.
  4. Risk Governance Framework 4.1 Governance Structure Board of Directors – Ultimate responsibility for risk oversight. Risk Management Committee (RMC) – Board sub-committee overseeing enterprise risks. Chief Risk Officer (CRO) – Senior executive responsible for day-to-day risk management. Internal Audit Function – Independent assurance of control effectiveness. Compliance Officer – Ensures adherence to RBI/SEBI/IRDAI/PFRDA directives.

4.2 Three Lines of Defence Model

  1. First Line (Operations & Business Units) – Own and manage risks.
  2. Second Line (Risk & Compliance Teams) – Monitor and report risks.
  3. Third Line (Internal Audit) – Provide independent assurance.
  4. Risk Appetite & Tolerance Risk Appetite Statement (RAS): Fin 100X.AI will operate with low tolerance for compliance, legal, and fraud risks, moderate tolerance for operational risks, and higher tolerance for controlled innovation risks (AI/ML experiments). Risk Limits: Defined quantitatively (e.g., credit default rate ≤ 3%, fraud loss ≤ 0.5% of transactions, downtime ≤ 0.1%). Escalation: Breaches beyond risk limits must be reported to CRO and RMC within 24 hours.
  5. Risk Categories 6.1 Strategic Risk Misalignment with business objectives. Mitigation: Regular board reviews, strategy audits.

6.2 Financial Risk Credit risk, liquidity risk, market risk. Mitigation: Stress testing, scenario analysis, diversification.

6.3 Operational Risk Failures in processes, people, or systems. Mitigation: SOPs, staff training, automation, insurance coverage.

6.4 Compliance & Regulatory Risk Non-compliance with RBI, SEBI, IRDAI, PFRDA rules. Mitigation: Compliance calendar, regulatory reporting, legal review.

6.5 Cybersecurity & Technology Risk Hacking, ransomware, AI model attacks. Mitigation: CERT-IN aligned protocols, encryption, zero-trust architecture.

6.6 Fraud Risk Identity theft, transaction fraud, insider collusion. Mitigation: AI-driven fraud detection, segregation of duties, whistle-blower hotline.

6.7 Reputational Risk Negative media, user dissatisfaction. Mitigation: PR strategy, grievance redressal, transparency reports.

  1. Internal Control Framework 7.1 Control Environment Tone at the top – Ethical culture promoted by leadership. Code of Conduct & Ethics for employees and advisors.

7.2 Control Activities Segregation of Duties (SoD): No single employee controls an entire transaction flow. Dual Authorization: For fund transfers, data changes, and policy approvals. Access Controls: Role-based, MFA-enabled access to systems. Reconciliation & Exception Handling: Automated daily reconciliations with manual oversight.

7.3 Information & Communication Risk dashboards updated daily. Mandatory reporting of control breaches to CRO.

7.4 Monitoring Continuous monitoring using AI tools. Quarterly internal audit reports to Board.

  1. Cyber & IT Risk Management CERT-IN Compliance: 6-hour incident reporting. Data Protection: AES-256 at rest, TLS 1.3 in transit. Disaster Recovery (DR) & Business Continuity (BCP): RTO ≤ 2 hours, RPO ≤ 15 minutes. AI Risk Controls: Explainability checks, bias detection, ethical AI guardrails.
  2. Fraud Risk Controls Prevention: Strong KYC (CKYC, DigiLocker, Video KYC). Detection: AI-powered Fraud Shield scanning anomalies. Response: Incident Response Team (IRT) escalates within 6 hours. Reporting: RBI Ombudsman & FIU-IND as required.
  3. Regulatory Alignment RBI: Cyber Security Framework, RBS guidelines. SEBI: Risk management for intermediaries, cyber resilience. IRDAI: Enterprise Risk Management & AML standards. PFRDA: IT & Governance Risk guidelines. DPDP Act 2023: Data fiduciary duties & user rights.
  4. Roles & Responsibilities Board: Approves RAS, oversees risk strategy. RMC: Quarterly risk reviews. CRO: Implements ERM framework. Employees: Report incidents, comply with SOPs. Internal Audit: Annual independent risk audits.
  5. Training & Awareness Mandatory annual Risk & Compliance Training for employees. Specialized training for fraud detection, cyber hygiene, AI bias handling. Workshops with regulators for updates.
  6. Reporting & Escalation Daily: Risk dashboards to CRO. Monthly: Reports to Management Committee. Quarterly: RMC & Board-level reviews. Regulatory: As per RBI/SEBI/IRDAI/PFRDA schedules.
  7. Business Continuity & Crisis Management Crisis Response Plan with escalation hierarchy. Alternate DR site tested annually. Crisis drills (cyber-attack, fraud, outage) conducted quarterly.
  8. Enforcement Violations of this Policy subject to disciplinary action, including termination. Material breaches may attract regulatory penalties under RBI/SEBI/IRDAI/PFRDA.
  9. Policy Review Reviewed annually by the CRO. Updates approved by the Board. Immediate revisions if regulators issue new guidelines.

Annexures Annexure A – Risk Matrix (Sample) Risk Type Likelihood Impact Risk Rating Mitigation Strategy Credit Risk Medium High Severe Partner NBFC risk-sharingCyber Risk High High Critical CERT-IN aligned SOCFraud Risk High Medium High AI Fraud ShieldOperational Risk Medium Medium Moderate SOPs + Dual Controls

Annexure B – Incident Escalation Protocol

  1. Detect → 2. Contain → 3. Report → 4. Investigate → 5. Remediate → 6. Audit

Annexure C – Risk Appetite Statement (RAS) Example Compliance Risk: Zero tolerance. Credit Risk: Tolerated up to 3% default rate. Cyber Risk: Zero tolerance for breaches of PII.

Annexure D – Internal Audit Checklist (Extract) Access logs reviewed monthly. High-value transactions audited weekly. AI model bias tested quarterly.

#7 Risk Management & Internal Controls Policy(RBI/SEBI/IRDAI/PFRDA–aligned) This policy is critical because: Regulators expect a documented risk framework (operational, credit, market, cyber, fraud, compliance risks). It defines internal controls for fraud prevention, segregation of duties, dual approvals, and escalation paths. It codifies risk appetite statements, stress testing, and early warning systems. It ensures alignment with RBI’s Risk-Based Supervision (RBS), SEBI’s Risk Management Framework, IRDAI’s Enterprise Risk Management Guidelines, and PFRDA’s Governance Mandates. It will include Annexures like risk matrices, reporting templates, and escalation protocols.