AML Compliance

1. Purpose and scope

INDO CHATS PRIVATE LIMITED, which runs Indo Mail, is committed to preventing the use of its service for money laundering, terrorist financing, fraud and sanctions evasion. This document explains what Indo Mail does and does not do with money, who is responsible for which legal duties, and which controls we apply ourselves.

It applies to the whole Indo Mail service and all 21 apps on an account, with particular attention to the apps where money or value is involved: Wallet, the advertising apps (Ads, Ad Manager, Search Ads, Shopping Ads, Local Services Ads, Indo Chats Ads), Merchant Center, Manufacturer Center, and paid plan purchases.

2. Indo Mail does not hold or move money

The most important fact for anti-money-laundering purposes is simple. Indo Mail does not hold customer money, does not transfer money between people, and does not issue stored value. It is not a bank, a prepaid payment instrument issuer, a wallet issuer or a payment aggregator.

• Wallet only creates UPI payment-request links and QR codes in Indian rupees. When someone pays, the money moves between their bank or UPI app and the receiver's bank account through the UPI system. It never passes through an Indo Mail account. We never see UPI PINs.
• Plan purchases and advertising payments will be taken by an RBI-authorised payment aggregator when online checkout launches. Checkout is not live yet. The aggregator takes the money, and settles it to Indo Mail's bank account as payment for the services sold.
• Advertiser budgets are prepaid amounts that pay for ad clicks. They are a payment to Indo Mail for advertising, not a balance that can be withdrawn or paid to another person.

3. The legal position

In India the main law is the Prevention of Money-laundering Act, 2002 (PMLA), together with the rules made under it. The PMLA places duties on 'reporting entities' such as banks, payment system operators and certain other financial institutions. These duties include verifying customers, keeping records and reporting suspicious transactions to the Financial Intelligence Unit - India (FIU-IND).

Indo Mail is not a reporting entity under the PMLA, because it does not carry out the regulated financial activities. The payment aggregators and banks that handle payments connected with Indo Mail are reporting entities, and they carry out their own customer due diligence, transaction monitoring and reporting. Indo Mail does not take over these duties and does not carry them out in their place.

Being outside the PMLA does not make us indifferent. We apply the controls in section 4 as good practice and as part of our general duty to follow Indian law, including the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023. If the law or our business changes so that we become a reporting entity, we will register and meet all the duties before we begin the activity, and we will update this document.

4. Controls Indo Mail applies

5. Red flags we watch for

We train the people who review ads, reports and accounts to recognise signs of financial crime. We do not read your mail in the ordinary course to look for them. We act on signals from the platform, on reports, and on legal orders. Examples of red flags include:

• many new accounts created from the same device or IP address, or that share the same mobile number;
• advertisers whose ads promise guaranteed returns, unlicensed loans, 'doubling' schemes, or crypto investments that look like scams;
• ad destinations that collect bank details, UPI PINs or one-time passwords;
• Wallet links used to collect money repeatedly for goods or services that do not exist;
• payments by an advertiser that do not match the size or type of the advertiser's business, or that are made with cards or accounts belonging to other people, as reported to us by the aggregator;
• mass mailings that impersonate banks, government departments or Indo Mail itself.

6. What we do when we find something

• We review the account and the material needed to decide, nothing more.
• We may refuse an ad, disable a payment link, lower sending limits, suspend the account or end it. The steps are described in our Community Guidelines.
• We keep the records of what we found and what we did.
• Where the law requires, or where we believe an offence has been committed, we report it to the proper authority, such as the police, a cybercrime cell or CERT-In. If our payment partner needs information from us to make its own report, we help.
• We do not tell an account holder that a report has been made if the law forbids it, or if doing so would put someone at risk or help someone escape an investigation.

7. Cooperation with FIU-IND and law enforcement

We cooperate with the Financial Intelligence Unit - India, the police, the Enforcement Directorate and other competent authorities. We respond to requests that are made through lawful process: a court order, a written request from an authorised agency under the Bharatiya Nagarik Suraksha Sanhita, 2023, the Information Technology Act, 2000 or the PMLA, or an emergency request that meets the legal standard. We check each request for authority and scope, and we give only what the request legally requires. Our Law Enforcement Guidelines explain how to submit a request. Requests go to legal@indoemail.in.

We do not give any authority direct access to our systems, and we do not make bulk disclosures outside the law. We publish counts of requests in our Transparency Reports.

8. Record keeping

We keep records that help us show what controls we applied and let us answer lawful requests. These include: sign-in logs (one year); advertiser review records and abuse-related records (3 years); billing and GST invoice data (8 years); and a record of law-enforcement requests and our responses for as long as the law requires. Payment-level records, such as bank statements, remain with the aggregator and the banks involved, in line with their own legal duties. The full schedule is in our Data Retention Policy. Records are stored in India, in encrypted storage, and are accessible only to authorised staff.

9. Roles and training

The company's directors are responsible for this policy. The person who leads Trust & Safety manages day-to-day compliance and the legal contact at legal@indoemail.in advises on legal duties. New staff who handle ads, support, abuse reports or billing receive training on the red flags in section 5 and on how to escalate a concern. The training is repeated at least once a year, and when this document changes. Any staff member who suspects financial crime must report it internally straight away. Retaliation against someone who reports in good faith is not allowed.

10. Review of this policy

We review this document at least once a year, and sooner if the law changes, if checkout and payment features launch, if the payment aggregator contract is signed or changed, or if we add a feature that moves value. The review looks at the number and type of reports and requests, how our controls worked, and any new risks. We keep a record of each review and of changes made. The current version is always on indoemail.in.

This document is governed by the laws of India.

11. Contact

Report suspected fraud or financial abuse: abuse@indoemail.in. Law-enforcement and regulatory requests: legal@indoemail.in. Advertiser questions: ads@indoemail.in. Complaints: Salena, Grievance Officer, INDO CHATS PRIVATE LIMITED, grievance@indoemail.in, 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India. If you are the victim of online financial fraud in India, call the national cybercrime helpline 1930 or report at cybercrime.gov.in.