Last update: Jun 8th, 2026

VIGIL MECHANISM AND WHISTLE BLOWER POLICY

1. Purpose

This Vigil Mechanism and Whistle Blower Policy (“Policy”) is framed pursuant to Section 177(9) and 177(10) of the Companies Act, 2013, read with the applicable rules, and in alignment with RBI corporate governance expectations for Non-Banking Financial Companies (“NBFCs”).

The purpose of this Policy is to:

  • encourage ethical and lawful conduct across Padmalaya Finserve Private Limited (“Padmalaya” or “the Company”);

  • provide a secure and confidential mechanism to report genuine concerns;

  • enable early detection and prevention of fraud, misconduct, regulatory non-compliance, and unethical practices – including in connection with the Company’s Personal Loan (“PL”) product and the Bridge application;

  • facilitate investigation and resolution of reported concerns; and

  • protect whistleblowers acting in good faith from retaliation, while actively discouraging malicious or knowingly false complaints.

The Committee of Executives shall oversee the vigil mechanism under this Policy. Any overseeing member having a conflict of interest in a particular matter shall recuse, and the remaining members shall deal with the matter.


2. Preface

The Company is committed to the highest standards of integrity, transparency and accountability. The Company believes that a robust whistleblowing framework is a critical component of sound corporate governance and effective risk management.

This Policy provides a formal channel for raising concerns regarding actual or suspected misconduct, fraud, unethical behaviour, or violation of law or Company policies, without fear of reprisal. This Policy does not replace other grievance redressal mechanisms (including the Company’s customer Grievance Redressal Mechanism) and does not dilute the duty of confidentiality owed by employees in the normal course of employment.


3. Objectives

  • Act as an additional internal control and compliance mechanism, alongside the Company’s Fraud Risk Management Policy.

  • Enable reporting of actual or suspected misconduct, fraud, unethical practices, or violations of the Company’s Code of Conduct (including the Code of Conduct for Collection-Recovery Agents).

  • Ensure compliance with applicable laws, RBI directions and internal policies.

  • Provide a safe and confidential mechanism for reporting concerns without fear of retaliation.

  • Safeguard the Company’s financial and reputational interests.

  • Promote a culture of accountability, transparency and ethical conduct.


4. Applicability of Policy

This Policy shall be communicated to all concerned persons at the commencement of their engagement, and shall be applicable to:

  • all Directors of the Company;

  • all employees of the Company; and

  • all other stakeholders of the Company, including LSPs and its personnel, Collection-Recovery Agents engaged under the Company’s Code of Conduct for Collection-Recovery Agents, and other vendors and service providers.


5. Definitions

  • “Act” means the Companies Act, 2013 and the rules framed thereunder.

  • “Board” means the Board of Directors of the Company.

  • “Committee” in absence of the Audit Committee this shall mean Committee of Executives overseeing the vigil mechanism.

  • “Disciplinary Action” means any action that can be taken on completion of, or during, investigation proceedings, including but not limited to a warning, imposition of a fine, suspension from official duties, or any such action as is deemed fit considering the gravity of the matter.

  • “Directors” means all directors of the Company.

  • “Employee” means every employee of the Company (whether working in India or outside).

  • “Protected Disclosure” means any written communication made in good faith that discloses or demonstrates information about unethical, illegal or improper conduct.

  • “Subject” means a person or group of persons against or in relation to whom a Protected Disclosure is made, or evidence gathered during the course of an investigation under this Policy.

  • “Whistleblower” means any Director, employee or third party who makes a Protected Disclosure under this Policy.

  • “Whistle Officer” means an officer nominated by the Company to receive and investigate disclosures under this Policy: Mr. Sachin Jivanbhai Vadodariya –Director.

  • “Good Faith” means a reasonable belief that the information disclosed is true and made without malice or personal gain.

  • “Policy” or “this Policy” means this Vigil Mechanism and Whistle Blower Policy.

Oversight of this process is assigned to the Committee of Executives. A senior-level officer from the Company’s Compliance function shall be responsible for managing access to the email address designated for whistleblowing purposes.


6. Scope of Reportable Matters 

This Policy covers, inter alia:

  • fraud, financial irregularities, accounting manipulation, or deficiencies in internal controls;

  • intentional breach of RBI directions (including the RBI Digital Lending Directions), the Companies Act, contractual obligations, or any other applicable law;

  • abuse of authority, gross negligence, or acts causing substantial risk to public health or safety, or conflict of interest;

  • bribery, corruption, theft or misappropriation of assets, or misuse of Company funds or assets;

  • insider trading, or leakage or pilferage of confidential or proprietary information (including customer data collected through the Bridge application);

  • intentional breach of data privacy, IT security, or misuse of social media impacting the Company;

  • suspected fraud of the nature described in the Company’s Fraud Risk Management Policy, including suspected fraud by LSPs, other vendors, or Collection-Recovery Agents;

  • retaliation against whistleblowers;

  • sexual harassment or any conduct violating dignity or workplace ethics (without prejudice to the Company’s POSH mechanism);

  • any breach of the Company’s Code of Conduct or other internal policies.


7. Exclusions

This Policy does not ordinarily cover:

  • personal grievances (e.g., promotion, appraisal, transfers); or

  • customer complaints regarding the PL product, which are addressed through the Company’s Grievance Redressal Mechanism.

Any such matter received under this Policy shall be redirected to the appropriate mechanism, without investigation under this Policy.


8. Guiding Principles

To ensure that this Policy is adhered to, and that concerns are acted upon seriously, the Company will:

  • ensure that the whistleblower and/or the person processing the Protected Disclosure is not victimised for doing so;

  • treat victimisation as a serious matter, including initiating disciplinary action against any person(s) responsible for victimisation;

  • maintain complete confidentiality of identity and information;

  • provide protection against retaliation;

  • apply zero tolerance for victimisation or evidence tampering;

  • provide an opportunity for the Subject to be heard; and

  • apply a presumption of innocence until the investigation is concluded.


9. Reporting Channels and Anonymous Complaints

Complaints may be made through the following channels only:

  • Email: sachin@padmalayfinserve.com or such other email ID as may be notified by the Company from time to time;

  • Written letter, addressed to: Padmalaya Finserve Private Limited, 115, Sunday Hub Shopping Center, Near Ankur Vidhyalay, Surat, Gujarat, India, 395004

Complaints should preferably contain:

  • the name and contact details of the whistleblower;

  • a description of the concern, with relevant facts; and

  • the names of persons involved, if known.

Anonymous disclosures are discouraged, as they limit the effectiveness of investigation.


10. Investigation and Timelines

  • Acknowledgement: within 10 working days.

  • Preliminary assessment: within 5 working days.

  • Detailed investigation: within 90 working days.

Serious matters involving fraud or a regulatory breach shall be escalated immediately to the CEO/senior management and the Committee of Executives, and, where the matter also qualifies as a fraud under the Company’s Fraud Risk Management Policy, shall additionally follow the governance and reporting requirements set out in that Policy. Timelines may be extended with reasons recorded in writing, particularly in complex or regulatory-sensitive matters.


11. Protection Against Retaliation

No whistleblower acting in good faith shall suffer harassment, discrimination, termination, demotion, or any other adverse consequence. Any retaliation shall attract strict disciplinary action. This protection extends to any person assisting in an investigation under this Policy.


12. Roles and Responsibilities

Whistle Officer

  • receive and acknowledge complaints;

  • conduct or oversee investigations;

  • maintain confidentiality; and

  • submit periodic reports to the Committee.

Committee of Executives

  • oversee the vigil mechanism;

  • review a quarterly summary of complaints; and

  • ensure the independence and effectiveness of the mechanism.

Senior Management

  • set the ethical tone for the Company;

  • ensure training and awareness, including for LSP and Collection-Recovery Agent personnel where practicable; and

  • implement corrective actions.


13. False or Malicious Disclosures

Knowingly false or malicious disclosures shall attract disciplinary action. However, no action shall be taken against a complaint made in good faith, even if it is ultimately unsubstantiated.


14. Record Retention

All disclosures and investigation records shall be retained for a minimum period of 7 years, or such longer period as may be required under applicable law or regulatory directions.


15. Reporting to the Board/Board-Level Committee

Material matters involving fraud, senior management, or regulatory exposure shall be reported immediately to the Committee. Where a disclosure concerns a COE member or a Director, reporting bypasses the COE and goes directly to the Board.


16. Amendment and Waiver

The Board reserves the right to amend or modify this Policy. Any waiver shall require the approval of the Committee or the Board, as applicable. This Policy shall be reviewed as and when required, and in any case at least annually.


17. Availability of this Policy

This Policy shall be made available to all Directors and employees at the commencement of their engagement, and shall be accessible through the Company’s internal HR/policy repository. The designated reporting channel(s) under Section 9 shall also be communicated to relevant third parties, including LSPs and engaged Collection-Recovery Agents, to the extent this Policy applies to them.