Know Your Seller

Simfex Digital Pvt. Ltd. | Stylesavvys Marketplace

Policy owner: Compliance and Risk |

Version: 1.4 | Issue date: July 30, 2026 |Status: Final

This policy sets the checks required before a seller may list, accept orders, or receive settlements through Stylesavvys. It also defines ongoing reviews and escalation when identity, transaction, product, or fraud risks arise. The business team must not bypass a compliance hold to meet a sales target.

1 Purpose and application

This policy applies to every seller, manufacturer, distributor, wholesaler, service provider and other merchant using Stylesavvys, including existing sellers at renewal, related entities and sellers introduced by agents. It covers B2C, B2B and wholesale activity, and any linked virtual account or payment collection arrangement. A seller account is a business relationship; a buyer purchase does not make the buyer a seller.

Stylesavvys operates as a marketplace. Its internal KYS and AML controls support fraud prevention and the due diligence required by its bank and payment partners. Legal duties assigned to a “reporting entity” under the PMLA or to an RBI regulated entity remain with that entity unless law independently designates Simfex as one. Compliance shall confirm applicability before making any statutory filing or representing a review as regulated KYC.

2 Governance and separation of duties

Role	Responsibility
Seller acquisition	Collect application and explain requirements; cannot approve own case.
KYS analyst	Verify documents, registries, ownership, address, bank and screening; record evidence.
Compliance lead	Resolve hits, set risk rating, approve high risk cases, investigate alerts and restrictions.
Finance	Independently validate beneficiary bank account and settlement controls.
Operations	Verify product, fulfilment and delivery capacity; monitor complaints and returns.
Approver	Approve or reject activation after maker and checker signoff; document exceptions.

The person who uploads or edits seller information may not perform final approval. System permissions must enforce this wherever feasible. Exceptions need documented Compliance and senior management approval, a time limit and compensating controls; identity, bank ownership and sanctions checks cannot be waived.

3 Digital verification through Setu and Perfios Hub

Stylesavvys integrates Setu and Perfios Hub APIs into its seller onboarding workflow for KYC and KYB, document and registry verification, bank validation, and available AML, sanctions, PEP and adverse-information checks. The configured API inventory, approved provider, endpoint, version, data fields, consent basis and fallback for each check shall be maintained by Technology and Compliance. A provider capability is not deemed an active control until its production configuration and response mapping are tested and recorded.

The website captures seller-provided information and the relevant notice or consent, then sends only required fields through authenticated server-side calls. API responses are linked to the application ID and stored with provider, check type, request or correlation ID, timestamp, input reference, outcome, match score or reason code where supplied, and reviewer disposition. Credentials are held in a secrets manager; calls and webhooks use transport encryption, access controls, retry limits and signature or origin validation where available. Do not log full identity numbers or sensitive payloads in general application logs.

Check	System decision and human review
PAN, GSTIN, CIN or business registry	A verified active record and matching legal name may pass automatically under approved matching rules. Inactive, missing or inconsistent records go to a KYS analyst.
Identity and documents	Validate authenticity and extracted details against the application. Low confidence, tampering signal, expiry or mismatch requires human review and additional evidence.
Bank account	Require validated account status and beneficiary name match before payout. A mismatch or unavailable result holds settlement pending independent validation.
AML, sanctions, PEP and adverse information	A clear configured result proceeds to risk assessment. Possible matches go to Compliance for documented false-positive resolution; confirmed prohibited matches block activation.

An API timeout, outage, incomplete response, stale cache or unconfigured check is never treated as a pass. Retry safely using an idempotent reference; if unavailable, hold the relevant activation or payout until the check is restored or Compliance approves an independently evidenced alternative. Do not override a confirmed prohibition. Technology monitors API failures and reconciles all submitted requests to final outcomes daily.

Provider output supplies evidence, while Stylesavvys owns the seller decision and ongoing monitoring. Compliance reviews changes in provider scope, data sources, screening coverage and contractual terms at least annually and after material incidents. A second provider result may resolve a technical failure but does not erase an unresolved adverse result.

4 Onboarding sequence and activation gates

Create a unique application ID and capture legal name, trade name, entity form, PAN, GSTIN or exemption basis, registered and operating addresses, contacts, product categories, expected order value and volume, shipping origin, payment and settlement model, website or storefront, and source of introduction.
Obtain entity documents, authorised signatory proof, ownership and control declaration, bank evidence, licences applicable to products, and signed marketplace agreement. Collect only data necessary for these purposes.
Verify against independent sources; document source, date, result, reviewer and any mismatch. Screen entity, owners, controllers, directors and signatories. Conduct an operations and product review.
Assign risk rating and obtain checker approval. Activate only after the agreement is executed, settlement account is verified, payment partner requirements are fulfilled and all critical flags are cleared.
Issue a unique seller ID and link every listing, order, invoice, shipment, refund and payout to that ID. Do not recycle seller IDs or allow another business to transact under one seller account.

5 Minimum documentary Requirements

Seller form	Required evidence
Sole proprietor	PAN and identity of proprietor; GSTIN or documented exemption; business address; business bank proof; applicable trade and product licences.
Partnership or LLP	PAN; deed or LLP incorporation and partner details; GSTIN or exemption; authority to sign; partner or controlling person IDs; business address and bank proof.
Company	PAN; incorporation/CIN and current master data; constitutional documents where needed; director and authorised signatory details; board resolution or authority; GSTIN or exemption; address and bank proof.
Trust or other entity	Formation deed or registration; PAN; trustees or controllers; authority, tax registration or exemption, address and bank proof; Compliance approval.
Every seller	Signed agreement; beneficial ownership declaration; expected activity and source of goods; supplier or brand authorisations where applicable; refund and fulfilment contact.

Aadhaar must not be demanded as the sole identity method. If voluntarily provided, use an authorised verification route and mask or redact unnecessary Aadhaar digits; do not retain biometrics. PAN, GSTIN, CIN and licences must be checked for status and consistency, not merely collected as images.

6 Identity, ownership and authority verification

Compare the legal name, PAN, GST profile, registration record, business address and bank beneficiary. Resolve transliterations, trade names and minor spelling differences with evidence. Verify the authorised person by a board resolution, power of attorney, deed or owner confirmation. Contact the business using an independently checked number or domain for higher risk applications

Obtain an ownership chart to natural persons and declare persons who ultimately own or control the seller, including control through voting rights, agreements, nominees or management. Record all direct and indirect holders at or above 10% as an internal review trigger, and any other person exercising effective control. This 10% trigger is a Stylesavvys control and must not be presented as a universally applicable statutory threshold. For opaque structures, obtain additional layers and ultimate controllers; unresolved ownership prevents activation.

Verify principal business location through registry information, address proof and, when risk warrants, a live video or physical visit with time and location evidence. Capture a photo only with a clear purpose and notice. A visit is mandatory for high risk or suspicious locations when remote evidence cannot establish genuine operations.

7 Bank and settlement controls

Settlement must go only to a verified account in the seller legal name or an approved documented exception supported by the bank/payment partner. Verify account number, IFSC, beneficiary name and account status using bank letter, cancelled cheque and/or a reliable account validation service. A screenshot alone is insufficient. No payouts to employee, agent, director, unrelated third party or overseas account without legal and partner review.

Changes to bank account, ownership, contact credentials or signatory require reauthentication, independent callback to the previously verified contact, fresh documentary validation, maker checker approval and a cooling period set by Compliance. Hold pending settlements while an unauthorised change or mismatch is investigated. A virtual account must map to one approved seller and be traceable through collection, order, settlement and reversal.

A screenshot of a computer

AI-generated content may be incorrect.

8 Screening and risk rating

Before approval and periodically thereafter, screen the seller, beneficial owners, directors and signatories against applicable sanctions and prohibited-party lists and credible adverse media; review PEP exposure as a risk factor. Record matching logic and distinguish false positives from confirmed matches. A potential sanctions match must be held immediately and escalated; no seller is informed of confidential investigations beyond what law and partner instructions allow.

Risk level	Indicators and required treatment
Low	Transparent domestic ownership, consistent registries, ordinary goods, modest expected volume; standard approval and annual review.
Medium	New business, high ticket sales, complex fulfilment, recent registration, moderate complaints or inconsistent but resolved data; enhanced transaction limits and review every six months.
High	Opaque ownership, PEP or adverse media, cross border element, unusual third party funding, repeated bank changes, high fraud categories, cyber complaint, unexplained spikes or weak supplier provenance; Compliance and senior approval, enhanced due diligence, tighter limits and quarterly review.
Prohibited	Confirmed sanctions restriction, forged documents, unverifiable ultimate owner, illegal goods, deliberate misrepresentation or refusal to provide mandatory evidence; reject or suspend and escalate as appropriate.

Risk scoring uses identity and ownership (25%), product and supply chain (20%), transaction and settlement pattern (25%), geography and counterparties (15%), and adverse information or complaints (15%). Compliance may override a numeric score upward with written reasons. No score can clear a mandatory prohibition.

9 Enhanced due diligence

For high risk sellers, obtain additional incorporation and tax evidence, ultimate ownership documents, supplier contracts and invoices, stock and warehouse evidence, product authenticity and licences, sample order trail, expected monthly turnover, source of goods and business funds, and explanation of complex structures. Consider a live interview or site visit, initial transaction caps, delayed payout within contractual and legal limits, and a 30 to 90 day monitored probation. Compliance documents the rationale and approval before activation.

10 Product and marketplace checks

Operations verifies that offered goods or services are lawful, accurately described and consistent with licences, brand permissions, supplier provenance and tax classification. Restricted categories need category owner and legal approval. Test order or sample invoice checks may be used. Seller invoices must identify the actual seller and match order and settlement records. Seller agreements require truthful listings, lawful fulfilment, delivery proof, complaint cooperation, refund handling and notice of ownership or bank changes.

11 Monitoring and red flags

Monitor orders, collection accounts, shipment and delivery proof, refunds, chargebacks, returns, payout destinations, complaints, cyber notices and abrupt activity changes. Alerts include: transaction splitting; repeated round amounts; many buyers with the same device or IP; unrelated payer names; rapid high value turnover without shipment; repeated cancelled orders followed by payout; refund to a different source; circular buyer seller activity; unusual geographic clustering; sudden category change; repeated lien or law enforcement notices; or a seller seeking settlement before delivery.

Analysts review flagged transactions and record the facts, seller explanation, documents, decision and approver. Compliance may pause listing, collection, payout or account access proportionately while investigating. Preserve evidence and follow bank, payment partner and lawful authority instructions. Do not promise a release of a lien or hold that only a bank or authority can authorise.

12 Escalation and reporting

Any employee who suspects fraud, money laundering, terrorist financing, sanctions exposure or forged KYC must notify Compliance immediately through the case system. Compliance assigns a case number, preserves evidence, assesses whether to restrict activity, and informs the bank/payment partner and law enforcement where required or appropriate. If Simfex is legally a reporting entity for a relevant activity, its designated Principal Officer shall assess and submit reports to FIU IND within applicable deadlines; otherwise it shall support the reporting entity and comply with lawful requests. Staff must not tip off a subject where prohibited.

Requests from police, cyber cells, banks and payment partners go to a designated legal or compliance mailbox. Authenticate the request, log acknowledgment number, dates, transaction identifiers, amount, layer or account, response deadline, documents shared and closure evidence. Share the minimum necessary data through approved channels.

13 Periodic review and changes

Review low risk annually, medium risk every six months and high risk quarterly, or sooner on a trigger. Refresh registration status, GSTIN, bank details, ownership, signatory, sanctions results, licences and business activity. A material change to ownership, control, legal name, product line, address, bank or payment flow requires reapproval before continuing the affected activity. Dormant sellers inactive for 12 months require fresh core checks before reactivation.

14 Records, security and privacy

Maintain the application, copies or verification references, consent and notices, registry results, ownership chart, risk score, approval trail, contracts, transaction ledger, invoices, shipment and refund evidence, alerts, decisions, correspondence and access logs in a controlled repository. Set a retention schedule approved by Legal based on applicable law, partner contracts, limitation needs and any litigation hold; do not impose a statutory retention period on Simfex without confirming its legal status. Delete or anonymise personal data when no longer required, subject to lawful retention.

Restrict access by role, encrypt stored and transmitted records, use MFA, log downloads and changes, review access quarterly, and prohibit collection through personal messaging accounts. Give sellers an appropriate privacy notice stating purposes, recipients, retention and contact for requests. Use processors under written security and confidentiality terms, with incident escalation to the privacy lead.

15 Training, audit and breaches

Acquisition, operations, finance and compliance staff receive induction and annual refresher training on document fraud, beneficial ownership, sanctions, suspicious activity, data handling and escalation. Compliance samples approved files monthly, reports missing evidence and overrides to management, and tracks corrective actions. Material control failures trigger account review and root cause analysis. This policy is reviewed at least annually and after a material law, partner requirement or business model change.

Appendix A Decision checklist

Entity type and registration independently verified; PAN and GST status or exemption recorded.
Authorised signatory and ultimate natural-person owners or controllers identified.
Address, product licences, supplier provenance and fulfilment capacity checked.
Sanctions, PEP and adverse information screening resolved and recorded.
Bank beneficiary independently verified; no unexplained third party settlement.
Risk score and EDD completed; maker, checker and approver recorded.
Agreement signed, partner requirements met, limits set and unique seller ID activated.

Appendix B References and implementation note

Primary reference sources reviewed on 20 April 2026: RBI Master Direction on KYC FAQ (9 June 2025); FIU IND Prevention of Money Laundering Act and Maintenance of Records Rules; GST portal Search Taxpayer guidance; Ministry of Electronics and Information Technology Digital Personal Data Protection Act and Rules. This draft should be checked by Indian counsel and the acquiring bank/payment partner before formal adoption, especially reporting-entity status, retention periods, data protection commencement and partner merchant KYC requirements.

Reference URLs:

Fast shipping

Authentic products

100% Secure payment

24/7 Support center

Your cart is empty!