Consultation Paper on the Proposed IFSCA Good Delivery Guidelines 2025

Consultation Paper on the Proposed IFSCA Good Delivery Guidelines 2025 A. Objective 1. The objective of this Consultation Paper is to permit gold refined by any Indian or global refinery, by adhering to best practices and audited by leading audit specialists on responsible sourcing, to be delivered on the India International Bullion Exchange (IIBX). B. Statement of Object and Reasons 2. India, being one of the largest gold importers and consumers, is poised to enhance its role in the global precious metals market through the establishment of the International Bullion Exchange at GIFT IFSC. This initiative originated from the NITI Aayog's 2018 report on transforming India's gold market and was announced in the 2020 Union Budget. 3. The IFSCA formalized regulations for the Bullion Exchange in December 2020, leading to the creation of the India International Bullion Exchange (IIBX) by a consortium of five major Market Infrastructure Institutions (MIIs) in India and the GIFT IFSC. IIBX was formally launched by the Hon'ble Prime Minister on July 29, 2022. The Hon'ble Prime Minister stated the following: “India is a very big market in the field of gold and silver today. But should that be the only identity of India? The identity of India should also be that of a market maker. IIBX is an important step in this direction. IIBX will also provide opportunities to trade in gold directly through the exchange. As the gold trading market becomes organized, the demand for gold in India will also impact and determine the gold prices.” 4. The idea behind IIBX is to create a vibrant marketplace and to develop a transparent Exchange model to determine the price of various metals and commodities within the country, including precious metal such as gold, silver etc, thus making India a price setter rather than a price taker in the global market. Page 1 of 57C. Background 5. Gold ore, extracted from the Earth's crust, is typically mixed with various impurities, including less desirable alloyed metals such as copper, silver, platinum, and palladium. Even trace amounts of these metals can affect the properties and value of gold. Consequently, gold ore must undergo a refining process to enhance its economic value and protect it against oxidation when exposed to certain chemicals. Refined gold is then used to create final products, including bars, coins, and various forms of jewellery. Traditional jewellery manufacturing methods involve casting in either an open or closed system or the intricate handcrafting of strips or rods. During these processes, 24 karat gold is typically alloyed to produce lower carat (e.g., 22K, 18K, 14K, 10K, and 9K) by incorporating small quantities of other metals, such as silver, copper, and zinc, to achieve deoxidization and grain refinement. Additionally, gold from freshly mined doré, scrap, or recycled sources (such as old jewellery, manufacturing scrap, and end-of-life industrial scrap) may also be used as input for the refining process. The refining of gold ore usually involves separating gold from other metals, most commonly through methods like aqua regia and gold electrolysis. 6. It is important to note that, as a mined commodity, gold is vulnerable to environmental risks. Due to its unique characteristics and its status as a quasi- currency and safe haven asset, gold is also exposed to social, environmental, and governance (ESG) risks. The concept of responsible sourcing of gold, silver, and other precious metals has therefore gained significant importance, ensuring that the supply chain adheres to ethical, sustainable, and socially responsible standards. Responsible sourcing involves actions to prevent and address issues such as child and forced labor, human rights violations, environmental degradation, and lack of support for local communities. It also entails comprehensive management of the entire supply chain, from metal extraction to the production of finished products, often incorporating practices such as fair trade, traceability, and transparency. 7. The OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas provides detailed recommendations for businesses to respect human rights and prevent contributing to conflicts through their mineral sourcing decisions. This global guidance applies to all mineral supply chains. Numerous industry associations, mineral assessment bodies, and export hubs have already developed their own Responsible Sourcing Guidelines, Norms, and Regulations, often aligning with or resembling the OECD Due Diligence Guidance. These measures aim to ensure responsible and ethical practices in the sourcing, processing, and trading of precious metals. Only those refineries that comply with both technical and responsible sourcing standards are permitted to be Page 2 of 57listed on the Good Delivery Lists of various industry standards (such as LBMA, UAE Good Delivery, etc.). 8. This trend has led to certain market players establishing standards for precious metals based on the globally recognized best practices. Allowing gold refined by any Indian or global refinery, by adhering to best practices and audited by leading audit specialists on responsible sourcing, to be delivered on the India International Bullion Exchange (IIBX) will enhance the reputation of the precious metals industry in India. This move could also shift business activities towards the Indian markets, particularly the IIBX. D. Expected Impact 9. The proposed IFSCA Good Delivery Guidelines aims to provide a comprehensive set of guidelines for the growth and development of the bullion market ecosystem in IFSC. It is also expected to promote refining in India and abroad as per the responsible sourcing guidelines and deliver the refined bullion on IIBX and promote ease of doing business for the market players. 10. It is expected to ensure that the bullion market ecosystem in IFSC is developed as envisaged by the Hon’ble Prime Minister and grow in an orderly and efficient manner. The aim is to bring out a comprehensive and detailed set of guidelines for a more transparent ecosystem in IFSC. E. Public Comments 11. In view of the above, a draft guideline is placed on the website of the IFSCA at https://ifsca.gov.in/PublicConsultation. The General public, market participants and other stakeholders are requested to forward their comments / suggestions through e-mail to Shri Ramakrishnan Padmanabhan, General Manager, IFSCA at ramakrishnan.pad@ifsca.gov.in, Shri Jasmeet Singh, Manager, IFSCA at singh.jasmeet@ifsca.gov.in and Shri Chandan Satyarth, Assistant Manager, IFSCA at chandan.satyarth@ifsca.gov.in and latest by December 31, 2025 with subject line “Comments on Draft IFSCA Good Delivery Guidelines 2025”. F. Format for Providing Comments / Suggestions 12. The comments may kindly be submitted in the following format (MS Word or MS Excel format only): Name and Details of the Person / Entity Organization name (If applicable), Contact details- Phone and Email address Page 3 of 57Page No Clause No. Sub- Clause C omments/ Detailed Global best practices of the Suggestions/ Rationale across foreign Draft Feedback jurisdictions, if any. Guidelines Page 4 of 57International Financial Services Centres Authority Good Delivery Guidelines, 2025 CHAPTER I PRELIMINARY Short title and commencement 1) These Guidelines may be called the International Financial Services Centres Authority Good Delivery Guidelines, 2025. 2) They shall come into force on the date of their publication in the Official Gazette. Terms referred in the Guidelines 3) In these guidelines, unless the context otherwise requires, the terms defined herein shall bear the meanings as assigned to them below, and their cognate expressions shall be construed accordingly- (a) “Act” means the International Financial Services Centres Authority Act, 2019 (50 of 2019 (b) “Accredited Refiner” shall mean any refinery engaged in the business of refining precious metals, and which is classified as a Designated Non-Financial Business or Profession (DNFBP) under the Prevention of Money Laundering Act, 2002 and the rules framed thereunder. The Reviewing Organisation (RO) shall certify such refineries as Accredited Refiners, upon being satisfied that the applicant refinery has, inter alia, undergone the prescribed due diligence process, demonstrated adherence to the principles of responsible sourcing and supply chain integrity, and complied with the applicable Anti-Money Laundering and Countering the Financing of Terrorism (AML-CFT) guidelines. The Accredited Refiner shall implement the guidelines as prescribed by the Authority and the implementation shall be overseen by the RO. (c) “Aggregator” refers to and individual or an entity that engages in the aggregation or initial treatment of gold, such as smelting, or casting; collects scrap or unfinished gold products, including but not limited to bars, doré, ingots, or other shapes, that may have inconsistent dimensions or purity levels; and prepares gold for subsequent refining or other value-added operations. (d) “Alluvial Gold” refers to newly extracted gold obtained from sand and gravel deposits, typically found in or near streambeds. This form of gold generally appears as very small yet visible particles, commonly known as "dust," and occasionally as larger pieces termed "nuggets." Alluvial gold is naturally concentrated, easily transportable, and can be readily melted and/or semi-refined into small ingots with a typical purity ranging from 85% to 95%. Despite its concentrated state, all forms of alluvial gold Page 5 of 57require further refining before being suitable for use in bullion or jewellery. Such refining processes can ordinarily be performed directly without the necessity for additional intermediate concentration or processing steps. (e) “Artisanal and Small-scale Mining (ASM)” means formal or informal gold mining operations with predominantly simplified forms of exploration, extraction, processing, and transportation. ASM is normally low capital intensive and uses high labour- intensive technology. “ASM” can include men and women working on an individual basis as well as those working in family groups, in partnership, or as members of cooperatives or other types of legal associations and enterprises involving hundreds or even thousands of miners. (f) “Anti-Money Laundering and Counter Financing of Terrorism (AML/CFT)”, shall have the same meanings as defined in the International Financial Services Centres Authority (Anti-Money Laundering, Counter-Terrorist Financing, and Know Your Customer) Guidelines, 2022, and the Prevention of Money Laundering Act and PLMA Rules, 2005. (g) “Authority” or “IFSCA” means the International Financial Services Centres Authority established under sub-section (1) of section 4 of International Financial Services Centres Authority Act, 2019 (50 of 2019). (h) “Beneficial Owner” means the identification of the ‘Beneficial Owner’ of the Client/Customer/Counterparty as per the International Financial Services Centres Authority (Anti Money Laundering, Counter-Terrorist Financing and Know Your Customer) Guidelines, 2022 . (i) “BIS” means Bureau of Indian Standards established under sub-section (3) of Section 1 of The Bureau Of Indian Standards Act, 2016. (j) “Bullion”, “Bullion Depository Receipt (BDR)” and “Bullion Exchange” shall have the meaning assigned to it under the International Financial Services Centres Authority (Bullion Market) Regulations 2025. (k) “Bullion Market” includes the bullion exchanges, Over the Counter Markets, bullion clearing corporations, bullion depositories, vaults, bullion contracts dealt therein, and any other persons or entities involved therein. (l) “Bullion Bank” means a bank (including retail, commercial and investment banks) licensed or registered or authorised to operate in bullion operations with the competent authorities in the respective jurisdictions or a financial institution that conducts financial transactions in refined gold/silver or unallocated gold/silver. (m) “Bullion Spot Delivery Contract” shall mean a contract which provides for- Page 6 of 57(i) actual delivery of bullion and the payment of a price therefore either on the same day as the date of the contract or on the next day, the actual period for the delivery of the bullion or the remittance money therefore being excluded from the computation of the period aforesaid if the parties to the contract do not reside in the same town or locality; (ii) transfer of the bullion by the depositary from the account of a beneficial owner to the account of another beneficial owner when such bullion is dealt with by a depositary licensed by the Authority for this purpose. (n) “Chain of Custody” means the documented record of the sequence of entities that maintain custody of gold as it progresses through the Supply Chain. (o) “Compliance Officer” or “CO” means a person, designated by the Accredited refiner, responsible for compliance of these guidelines. (p) “Conflict-Affected and High-Risk Areas (CAHRA)” refers to regions identified by the presence of armed conflict, widespread violence, including violence perpetrated by criminal networks, or other significant threats of serious and widespread harm to individuals. Armed conflict may manifest in various forms, including but not limited to, international or non-international conflicts, which may involve multiple states, wars of liberation, insurgencies, or civil wars. High-risk areas are those where there is a heightened risk of conflict or of widespread or serious human rights abuses, as outlined in Annex II of the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and/or High-Risk Areas. Such areas are typically characterized by political instability or repression, institutional weakness, insecurity, collapse of civil infrastructure, widespread violence, and violations of national or international law. (q) “Client/Customer/Counterparty Due Diligence (CDD)” and “Know Your Client (KYC)” shall have the same meaning as provided under Section 11A of the PMLA read with Rule 9 of the PML Rules as may be , and it is incumbent upon every entity engaged in precious metals refining to follow certain client identification procedures in respect of buyers and sellers of precious metals and precious stones and monitoring transactions of a suspicious nature for the purpose of reporting it to the appropriate authority. (r) “Domestic Tariff Area” or “DTA” means the whole of India (including the territorial waters and continental shelf) but does not include the areas of the Special Economic Zones and the "International Financial Services Centre". (s) “Empanelled Auditor” means the auditor empanelled by the RO for undertaking the Third-Party Audit. Page 7 of 57(t) “Enhanced Due Diligence” or “EDD” refers to the implementation of heightened Client /Customer / Counterparty Due Diligence (CDD) measures aimed at obtaining a deeper understanding of potential risk elements identified within the Supply Chain. These measures shall be in accordance with the Enhanced Due Diligence requirements as prescribed under the International Financial Services Centres Authority (Anti-Money Laundering, Counter-Terrorist Financing, and Know Your Customer) Guidelines, 2022 . (u) “Financial Intelligence Unit – India (FIU-India)” refers to a national agency, set by the Government of India, which is inter-alia responsible for receiving, processing, analysing and disseminating information relating to suspect financial transactions. (v) “Gold Ore” refers to rock or gravel that contains a commercially viable concentration of gold, even if this concentration is minimal by weight, such as 1 gram of gold per tonne of ore. Despite the small concentration, gold ore can be economically recovered in medium to large-scale industrial mining operations. Due to its bulk and weight, gold ore is typically processed near the mine site and is not ordinarily transported over long distances for further processing. (w) “Gold Concentrate” is an intermediate material produced from the initial processing of gold ore to increase its gold concentration. However, it still requires additional intermediate processing to produce doré. (x) “Gold Doré” is a bar composed of a newly mined gold alloy, typically resulting from the extensive processing and smelting of ores at medium and large-scale mines. This form of gold with a purity less than 95%. Consequently, gold doré must be transported to a refinery for further refinement into commercial-grade bullion, without requiring additional intermediate processing steps. (y) “Good Delivery” refers to the quality and technical standards of manufacturing of bullion as may be prescribed and notified by the Bureau of Indian Standards (BIS). Such bullion manufactured shall follow the guidelines prescribed herein and shall be eligible for delivery on the Exchanges in IFSC or in the over-the-counter (OTC) market. (z) “Grandfathered Stocks” refers to gold investment products, including ingots, bars, coins, and grain in sealed containers, that are stored in India at bullion bank vaults, central bank vaults, exchanges, or refineries, with a verifiable date upto 3 months from the date of issuances of these guidelines. Such stocks are exempt from the requirement to determine their origin. This category also encompasses stocks held by the aforementioned entities on behalf of the third-parties. Page 8 of 57Verifiable Date for this purpose shall refer to a date that can be authenticated through the inspection of physical date stamps on the products and/or through inventory lists. (aa) “Human Rights” shall have the same meaning as defined under Section 2 of the Protection of Human Rights Act, 1993. As per the Protection of Human Rights Act, 1993, "human rights" means the rights relating to life, liberty, equality and dignity of the individual guaranteed under the Constitution or embodied in the International Covenants and enforceable by courts in India. "International Covenants" means the International Covenant on Civil and Political Rights and the International Covenant on Economic, Social and Cultural Rights adopted by the General Assembly of the United Nations on the 16th of December 1966 as amended from time to time. (bb) "International Financial Services Centre" means an International Financial Services Centre set up, before or after the commencement of the International Financial Services Centres Authority Act, 2019, under section 18 of the Special Economic Zones Act, 2005 (cc) “ISAE 3000” mean the International Standard on Assurance Engagements ISAE 3000 Assurance Engagements. (dd) "Medium and Large-Scale Mining (LSM)" refers to gold mining operations that do not fall within the category of artisanal or small-scale mining. (ee) “Mixed Gold” refers to gold that comprises multiple sources, such as a combination of mined gold and recyclable gold. Due diligence must be performed on the sources of mixed gold in accordance with the guidelines set forth in these guidelines. (ff) "Money Laundering" shall have the meaning ascribed to it under the International Financial Services Centres Authority (Anti-Money Laundering, Counter-Terrorist Financing, and Know Your Customer) Guidelines, 2022 . (gg) “OECD” means The Organisation for Economic Co-operation and Development. (hh) “OECD Guidance” means The OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas. (ii) “Payment Service Provider” or “PSP” means a company authorised by the Authority, to provide one or more of the Payment Services under the IFSCA (Payment Services) Regulations, 2024; (jj) "PEP" refers to a Politically Exposed Person, as defined under the International Financial Services Centres Authority (Anti-Money Laundering, Counter-Terrorist Financing, and Know Your Customer) Guidelines, 2022. Page 9 of 57(kk) “PMLA” means the Prevention of Money-laundering Act, 2002 (ll) “PML Rules” means Prevention of Money laundering (Maintenance of Records) Rules, 2005 (mm) “Risks" shall mean the potential adverse effects arising from the operations or business activities of a Refiner, whether directly attributable to the Refiner's own conduct or indirectly through its commercial relationships with third parties, including but not limited to suppliers and other participants within the supply chain. Such adverse effects may encompass: (i) external impacts, including but not limited to harm or detriment caused to individuals, communities, or the environment; and/or (ii) internal impacts, including reputational harm, regulatory sanctions, or exposure to civil or criminal liability. For the avoidance of doubt, internal and external impacts are not mutually exclusive and may be causally or consequentially linked, whereby an external harm may give rise to corresponding reputational or legal consequences for the Refiner. (nn) “Risk Based Operational Excellence Framework” or “RBOE Framework” refers to the establishment of processes and the requisite documentation to be adopted by Accredited Refiners as prescribed in these guidelines. (oo) “Risk-Focused Regulatory Compliance Framework” or “RFRC Framework” refers to a structured and systematic approach to be adopted by Accredited Refiners as prescribed in these guidelines. (pp) "Recycler" refers to any individual or entity engaged in the collection, consolidation, and/or processing of recyclable gold, prior to its refinement for the commencement of a new life cycle. (qq) “Recyclable Gold” refers to gold that has undergone prior refining, including gold sourced from end-users, post-consumer items, investment gold, gold-bearing products, and scrap or waste metals and materials generated during refining and product manufacturing, which is subsequently returned to a refiner or other downstream processing entity for the purpose of re-entering the Supply Chain. (rr) "Refining" refers to the process of purifying gold using aqua regia, electrolytic process, or any other techniques or processes as prescribed by the BIS and NABL or any other nodal agency as designated by the Government of India or the Authority, in order to meet commercial Bullion Market standards by removing impurities and Page 10 of 57other substances from doré, alluvial gold, recyclable or scrap gold, or any other gold- bearing feedstock. (ss) “Reviewing Organisation” or “RO” means the Self-Regulatory Organisation recognized by the Authority for the purpose of these guidelines. (tt) “STR” shall refer to the Suspicious Transaction Report as defined in International Financial Services Centres Authority (Anti Money Laundering, Counter-Terrorist Financing and Know Your Customer) Guidelines, 2022. The same shall be applicable to the Client/Customer/Counterparty Due Diligence. (uu) “Supplier” shall refer to any individual or organisation who is considered to be a participant in the Supply Chain for the supply of gold and/or gold-bearing materials. (vv) "Supply Chain" shall refer to the system encompassing all activities, organizations, entities, technologies, information, resources, and services involved in the movement of gold and/or gold-bearing materials from its source. (ww) "Supply Chain Due Diligence" shall refer to the obligations of entities to undertake appropriate measures to identify, assess, and mitigate actual and potential risks within the Supply Chain. (xx) “Third-Party Audit” means the audit conducted by an independent auditor empanelled by the RO to review the Supply Chain Due Diligence of the refiner as prescribed in these guidelines. The Third-Party audit shall assess compliance with responsible sourcing, risk management, and AML-CFT obligations per prescribed protocols and formats prescribed by the RO. (yy) “Upstream Supply Chain” means the gold Supply Chain of gold and/or gold- bearing materials from its source such as mines, aggregators, scrap from jewellery or industrial sources to Refiners. CHAPTER II APPLICABILITY OF GUIDELINES 4) These Guidelines shall apply to all Accredited Refiners certified by the RO, whether established and/or operating i. within India, ii. including all commercial Special Economic Zones and Page 11 of 57iii. the International Financial Services Centres established by the Government of India iv. located overseas seeking to be certified as an Accredited Refiner. These Guidelines shall also extend to the members of their board of directors, management, and employees. Furthermore, these guidelines shall apply to all natural and legal persons engaged in the activity of procurement from any source for the purpose of Refining. 5) The provisions of these guidelines shall, inter alia, apply to any entity with whom the Accredited Refiner has engaged or may engage in transactions, forming part of the Supply Chain. CHAPTER III CONDUCT OF BUSINESS BASED ON PRINCIPLES OF RESPONSIBLE SOURCING AND SUPPLY CHAIN INTEGRITY 6) The guidelines and principles pertain to gold for the purpose of “Good Delivery”. Obligations of Accredited Refiners: Responsible Sourcing and Compliance Framework 7) Accredited Refiners shall ensure the following for the purpose of ethical, legal, and sustainable sourcing of bullion: (a) Regulatory Compliance and Risk Management Frameworks Every Accredited Refiner shall establish, implement, and maintain: (i) A Risk-Focused Regulatory Compliance Framework (RFRC Framework), comprising internal policies, procedures, and controls to ensure adherence to applicable laws, regulations, and responsible sourcing standards as specified by the Authority. (ii) A Risk-Based Operational Excellence Framework (RBOE Framework) to identify, assess, and monitor operational and supply chain risks, especially concerning gold sourced from Conflict-Affected and High-Risk Areas (CAHRAs) or regions with adverse human rights or governance conditions. (iii) A tailored Risk Control and Mitigation Strategy, integrated into the enterprise compliance framework and periodically reviewed to align with international best practices. (b) Due Diligence Requirements Page 12 of 57Accredited Refiners shall conduct Client/Customer/Counterparty Due Diligence (CDD): Identity and beneficial ownership verification prior to business relationships, aligned with IFSCA AML-CFT-KYC Guidelines, 2022 as . (c) Enhanced Due Diligence (EDD) Where sourcing involves CAHRAs or high-risk regions, EDD shall include: (i) Identity and credential verification; (ii) Origin and custody chain tracing; (iii) Risk assessments (legal, reputational, ethical); and (iv) Mitigation measures to prevent association with conflict financing, human rights violations, or financial crimes. (d) Risk Assessment and Mitigation (i) Robust, evidence-based, and proportionate Risk Assessments, considering factors such as geographical origin, supplier conduct, and transaction nature, including on-the-ground validations for CAHRAs. (ii) Implementation of appropriate Risk Mitigation Measures, including internal controls commensurate with business scale and nature. (e) Regulatory Registration Requirements (i) Accredited Refiners operating in India shall register with FIU-India as per AML- CFT obligations under the Prevention of Money Laundering Act, 2002. (ii) All Accredited refiners whether located in India or overseas must comply with AML-CFT requirements of the International Financial Services Centres Authority (Anti Money Laundering, Counter-Terrorist Financing and Know Your Customer) Guidelines, 2022. (f) Ongoing Monitoring Due diligence is an ongoing obligation and Accredited Refiners shall continuously monitor changes in risk profiles and adapt their compliance measures accordingly. (g) Certification, Reporting, and Independent Audit Page 13 of 57I. Accredited Refiners shall submit an Annual Compliance Statement attested by an authorised signatory to the RO disclosing: (i) Implementation status of RFRC and RBOE Frameworks (ii) Key audit/assessment findings (iii) Material risk events or non-compliance; and (iv) Remedial actions taken. II. In order for the RO to certify the Accredited Refiner as compliant with these guidelines, an independent Third-Party Audit is mandatory. (h) Compliance Officer (CO) – Accredited refiner shall designate a person as CO. (i) Continuous Review and Guidance The RO may issue further instructions regarding: (i) Scope and periodicity of reporting and audit; (ii) Additional disclosure formats; or (iii) Supplementary compliance obligations. 8) It is essential to ensure that Accredited Refiners adhere to the 5-Step Framework established under the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas. Compliance with this framework is mandatory for maintaining responsible and ethical practices in the supply chain. Framework for Due Diligence 9) Accredited refiners shall ensure the following with respect to due diligence: Step 1: Establishing An Effective RFRC Framework through Policy and Systems A. Policy Adoption and Commitment Accredited Refiners are required to undertake the following: (a) Establishment of a Gold Supply Chain Policy Page 14 of 57Each Accredited Refiner shall establish and implement a robust, documented Gold Supply Chain Policy, that comprehensively addresses the potential risks associated with sourcing of gold from Conflict-Affected and High-Risk Areas (CAHRAs). The policy shall reflect the Accredited Refiner’s commitment to responsible sourcing and effective supply chain due diligence, and shall include the following components: (i) Gold Supply Chain Policy Commitment: The policy shall articulate the Accredited Refiner’s principles and expectations concerning the extraction, transport, handling, trading, processing, smelting, refining, alloying, and export of gold. These principles shall serve as a common reference point for evaluating the conduct of the Accredited Refiner and its suppliers within the Gold Supply Chain. (ii) Risk-Based Procedures: The policy shall incorporate structured procedures for identifying, assessing, and managing risks across the Gold Supply Chain, with specific emphasis on sourcing from high-risk jurisdictions and non-transparent supply chains. (iii) Internal Management Support: The Accredited Refiner shall establish an internal governance structure that supports the execution of the policy, including designation of responsible officials, adequate resourcing, and mechanisms for oversight and accountability. (iv) Supply Chain Controls and Transparency: The Accredited Refiner shall maintain effective systems to ensure traceability and chain of custody across the gold supply chain. These systems shall facilitate the identification of upstream actors and allow for verification of origin, transit routes, and transaction legitimacy. (v) Supplier Engagement and Compliance: The policy shall be incorporated into contracts or agreements with suppliers. The Accredited Refiner shall engage with suppliers to encourage conformance with responsible sourcing practices and provide support for improving due diligence performance where necessary. (vi) Grievance Mechanism: A formal mechanism shall be instituted to allow internal and external stakeholders to raise concerns or provide information relating to risks within the gold supply chain. This mechanism shall function as an early-warning and risk-awareness tool to support prompt and effective risk mitigation. (b) Where the Accredited Refiner has a branch or subsidiary in a country or jurisdiction: (i) For which the FATF has called for countermeasures; or It is known to have inadequate AML/CFT measures, as identified by the Accredited Refiner for itself or other foreign regulatory authorities in the Page 15 of 57jurisdiction of business of the Accredited Refiner, the Accredited Refiner shall ensure that its group policy on KYC-AML-CFT standards is strictly observed by the management of that branch or subsidiary. B. Gold Supply Chain Risk Assessment framework To ensure effective implementation countermeasures to mitigate risks and maintenance of the Gold Supply Chain thorough risk assessment programme, Accredited Refiners are required to establish a robust internal governance framework. This framework, must include, inter-alia, the following key components: (a) Management Oversight: The Board of Directors or the equivalent managerial personnel shall be required to actively oversee the thorough assessment program, demonstrating a strong commitment to ethical sourcing. This includes acquiring necessary expertise, ensuring effective communication, assessing program performance, and allocating adequate resources. (b) Compliance Officer (CO): The CO shall be appointed to manage the thorough assessment process. The responsibilities of the CO shall include, inter-alia, monitoring, policy improvement, training, and regulatory engagement. (i) Personnel Qualifications: Rigorous due diligence assessments, encompassing, inter alia, certifications in social responsibility, responsible sourcing, Supply Chain Management, as well as exhaustive background checks, shall be a requisite for the appointment of the CO and other procurement personnel. Additionally, it is incumbent upon the CO to conduct regular and systematic reviews of the procurement activities executed by the relevant department, division, or section within the Accredited Refiner’s organization. (c) Comprehensive Training: A comprehensive mandatory training program shall be established and overseen by the CO, targeting all personnel involved in the Gold Supply Chain. This program will encompass both general due diligence principles and specific role-based responsibilities. Accredited Refiners shall institute mandatory annual training programs for all relevant personnel engaged in procurement, risk, compliance, or logistics functions. These programs shall include identification of red flag indicators, OECD due diligence steps, and risk escalation procedures. Training sessions shall be conducted on a regular basis and subjected to periodic evaluation to ensure their effectiveness. Step 2: Identify and evaluate risks within the Supply Chain through a Risk Based Operational Excellence (RBOE) Framework A. To ensure transparency, traceability, and the necessary controls across the Gold Supply Chain, Accredited Refiners shall be mandated to implement RBOE Page 16 of 57Framework that ensures compliance to the principles of RFRC Framework. Accredited Refiners are further obligated to conduct comprehensive assessments of their Gold Supply Chain to identify and evaluate potential risks. This assessment process shall be continuous, with particular emphasis on new business relationships. The identified risks shall dictate the scope and intensity of subsequent assessment efforts. B. The RBOE Framework of the Accredited Refiner shall encompass the documentation of Gold Supply Chain, the execution of comprehensive due diligence of counterparties, and the maintenance of detailed records. Accredited Refiners shall systematically identify and assess potential risks, through a risk-based approach. C. The following minimum processes, among others, must be adhered to in order to ensure operational excellence and to establish a robust Supply Chain: I. Undertaking Client/Customer/Counterparty Due Diligence: In fulfilling the obligations of identification of the client/customer/counterparty, the Accredited Refiner shall undertake the following measures: (a) Identifying the client/customer/counterparty and verifying the client/customer/counterparty’s identity using reliable, independent source documents, data, or information. (b) Identifying the beneficial owner of the client/customer/counterparty and taking reasonable measures to verify the identity of the beneficial owner in such a manner that the Accredited Refiner is assured of the beneficial owner's identity. For legal entities and arrangements, the client/customer/counterparty due diligence shall include the Accredited Refiner taking reasonable steps to understand the nature of the client/customer/counterparty’s business, its ownership, and control structure. (c) Understanding and, as appropriate, obtaining information on the purpose and intended nature of the business relationship. (d) Conducting ongoing due diligence on the business relationship and scrutinizing transactions throughout the course of the business relationship to ensure that the transactions being conducted align with the Accredited Refiner’s understanding of the client/customer/counterparty, the client/customer/counterparty’s business, and its risk profile, including, where necessary, the source of funds. II. Identification of Client/Customer/Counterparty (a) If a client/customer/counterparty is a natural person, the Accredited Refiner shall obtain at least the following information: Page 17 of 57(i) Full name, including any aliases. (ii) Unique Identification Number (such as an Identity card number, passport number, etc.). (iii) Date of birth. (iv) Nationality. (v) Legal domicile. (vi) Current residential address (excluding a post office box address). (vii) Contact details such as personal, office, or work telephone numbers. (b) If a client/customer/counterparty is a legal entity or legal arrangement, the Accredited Refiner shall obtain at least the following information: (i) The full name and any trading name. (ii) Unique identification Number (e.g., Tax identification number, incorporation number, or business registration number). (iii) Registered or business address, and if different, its principal place of business. (iv) Date of establishment, incorporation, or registration. (v) Place of incorporation or registration. (c) Further, where the client/customer/counterparty is a legal entity or legal arrangement, the Accredited Refiner shall also identify the legal form, constitution, and powers that regulate and bind the legal entity or legal arrangement. The Accredited Refiner shall also identify and screen the related or connected parties of such a client/customer/counterparty and remain informed of any changes to these connected parties. For the identification of connected parties, the Accredited Refiner shall obtain at least the following information for each related or connected party: (i) Full name, including any aliases; and (ii) Unique Identification Number (such as an Identity card number, passport number, etc). III. Verification of Identity of client/customer/ counterparty (a) The Accredited Refiner shall verify the identity of the client/customer/ counterparty using reliable, independent source data, documents, or information. Where the client/customer/ counterparty is a legal entity or legal arrangement, the Accredited Refiner shall verify the legal form, proof of existence, constitution, and powers that regulate and bind the client/customer/ counterparty using reliable, independent source data, documents, or information. (b) When relying on documents, the Accredited Refiner should be aware that the most reliable documents for verifying the client/customer/counterparty’s identity Page 18 of 57are those that are most difficult to obtain illegally or to counterfeit. These may include government-issued identity cards, current valid passports, reports from independent company registries, published or audited annual reports, and other reliable sources of information. The rigor of the verification process should align with the counterparty’s risk profile. (c) In verifying the identity of a client/customer/ counterparty, the Accredited Refiner may obtain the following documents: (i) In the case of Natural Persons: (aa) Any of the Officially Valid Documents (OVD) as prescribed under the International Financial Services Centres Authority (Anti-Money Laundering, Counter-Terrorist Financing, and Know Your Customer) Guidelines, 2022 or as per the AML-CFT requirements of the relevant FATF-compliant jurisdiction, that contains the client/customer/ counterparty's photograph, name, unique identification number, date of birth, and nationality; and (bb) Residential address based on OVD or a recent utility bill, bank statement, or other documents specified under the definition of OVD. (cc) For foreign nationals, the national identity card and voter identification card, regardless of the name by which they are called, issued by the government of a foreign jurisdiction or its authorized agencies, and containing the foreign national's photograph, name, date of birth, and address, shall be considered as an Officially Valid Document (OVD) for identification purposes. However, if the OVD presented by a foreign national does not include address details, documents issued and attested or apostilled by the government departments of foreign jurisdictions along with a letter issued by the Indian Embassy or Indian Consulate or Mission in India confirming the veracity of the attested/apostilled documents providing the proof of residence of the foreign national, shall be accepted as proof of address. In the case of a foreign national, a utility bill or bank statement, even if recent, shall not be accepted as proof of address. (ii) In the case of Legal Entities or Legal Arrangements: (aa) Name, legal form, proof of existence, and constitution: Verification can be obtained from a certificate of incorporation, certificate of good standing, partnership deed/agreement, trust deed, constitutional document, certificate of registration, or any other document from a reliable independent source; and (bb) Powers that regulate and bind the legal entity or legal arrangement: This can be ascertained from the constitutional documents, as well as the names of the relevant persons holding a Senior Management position in the legal entity or legal arrangement, and board resolutions or similar Page 19 of 57documents authorizing the opening of an account and appointment of its authorized signatories. IV. Beneficial Ownership Accredited Refiners are required to identify and verify the beneficial owners of client/customer/ counterparty as a supplier. (a) Where the client/customer/ counterparty is a company, the beneficial owner is the natural person(s), who, whether acting alone or together, or through one or more juridical persons, has/have a controlling ownership interest or who exercise control through other means. Explanation- For the purpose of this sub-clause- “Controlling ownership interest” means ownership of or entitlement to more than ten per cent of the shares or capital or profits of the company; “Control” shall include the right to appoint majority of the directors or to control the management or policy decisions including by virtue of their shareholding or management rights or shareholders agreements or voting agreements. (b) Where the client/customer/ counterparty is a partnership firm, the beneficial owner is the natural person(s), who, whether acting alone or together, or through one or more juridical person, has/have ownership of/entitlement to more than ten per cent of capital or profits of the partnership. (c) Where the client/customer/ counterparty is an unincorporated association or body of individuals, the beneficial owner is the natural person(s), who, whether acting alone or together, or through one or more juridical person, has/have ownership of or entitlement to more than fifteen per cent. of the property or capital or profits of the unincorporated association or body of individuals. Explanation: The term ‘body of individuals’ includes societies. Where no natural person is identified under (a) to (c) above, the beneficial owner is the relevant natural person who holds the position of senior managing official. (d) Where the client/customer/counterparty is a trust, the identification of beneficial owner(s) shall include identification of the author of the trust, the trustee, the beneficiaries with ten per cent. or more interest in the trust and any other natural person exercising ultimate effective control over the trust through a chain of control or ownership. Page 20 of 57Explanation: - For the purpose of determination of beneficial owner, any amendment made under sub-rule 3 of rule 9 of PML Rules, shall be applicable in addition to the requirements under these guidelines. (e) Whether the client/customer/ counterparty or the persons exercising the controlling ownership interest is a PEP. In cases where the client/customer/ counterparty or the person exercising control are PEPs, the Accredited Refiner shall: (i) implement appropriate internal risk management systems, policies and procedures to determine if a customer or any natural person appointed to act on behalf of the client/customer/ counterparty, or any beneficial owner of the customer is a politically exposed person (PEP). V. Environmental Assessments (a) Regardless of the source of the gold, it may be a recommended practice to undertake a comprehensive Environmental Impact Assessments (EIAs), with all relevant documentation properly maintained, to ensure that mining, refining, or smelting activities do not result in significant environmental degradation or involve the use of harmful substances and chemicals that could endanger public safety. (b) The Accredited Refiner is further obligated to comply with industry-wide commitments under relevant international agreements, conventions, or codes governing the management of specific harmful chemicals and substances. The Accredited Refiner shall not engage in any activities that would violate the principles or obligations established under such agreements, including but not limited to: (i) Minamata Convention 1 (ii) International Cyanide Management Code (Cyanide Code)2 1 Minamata Convention- India is a party to the Minamata Convention on Mercury and ratified the convention on 18.06.2018. The Annex A of the Convention provides the list of Mercury added products to be phased out for manufacture, import and export by 2020 along with exclusion list and measures to be taken for use of Dental Amalgam. Annex B of the Convention provides the list of manufacturing processes in which mercury compounds are used for their phase out by timelines listed therein and processes for which measures to be taken by parties to restrict the use of mercury or mercury compounds, India has registered exemptions for phasing out mercury added products listed in Part 1 of Annex A by five years (till 2025) from the existing phase-out date of 2020. India has also registered the exemptions for phasing out the manufacturing process for production of Acetaldehyde in which mercury or mercury compounds are used as a catalyst at Part 1 of Annex, by five years (till 2023) from the existing phase-out date of 2018. 2 Cyanide Code- This is a voluntary certification program that aims to improve cyanide management and reduce environmental impacts in the gold mining industry. The program is open to companies that produce, transport, or use cyanide in the mining industry, including manufacturers, transporters, and mining companies. The Cyanide Code was developed in 2005 by the International Cyanide Management Institute (ICMI), a non-profit corporation, under the guidance of the United Nations Environmental Program (UNEP). Page 21 of 57(iii) Convention on Bio-Diversity Protection3 VI. Supply Chain Mapping and Risk mapping (a) Supply Chain Mapping is a critical process for ensuring responsible sourcing of gold. It involves tracing the origins of gold, from its source to its final product, providing transparency and accountability throughout the Supply Chain. The guidelines below cover Supply Chain Mapping for different types of gold sources, including Medium and Large-Scale Mines (LSM), Artisanal and Small Mines (ASM), Aggregation, Recycled Material, and Mixed Gold. Each category has distinct considerations and requirements that must be addressed to ensure compliance with international standards such as the OECD Due Diligence Guidance for Responsible Supply Chains. (b) In managing the supply chain and risk mapping for different types of gold sources, it is imperative to establish a robust framework that addresses the unique challenges and risks associated with each category. The set of guidelines herein outlines the critical steps required for the identification, assessment, and mitigation of risks pertaining to Medium and Large-Scale Mines, Artisanal and Small-Scale Mines (ASMs), Aggregators, Recycled Materials, and Mixed Gold. (c) Detailed information about the Gold Supply Chain, including the origin of gold, intermediaries, and transportation routes, are required to be documented. Inter alia, the following risk factors must be duly considered in relation to supply chain mapping and risk assessment mapping: (i) Geographical Risk Factors (aa) Origin of gold (mined, recycled, grandfathered stocks) (bb) Regulatory environment of supplier locations (cc) Levels of conflict, human rights abuses, corruption, and criminal activity (dd) Proximity to CAHRAs (ee) Enforcement of relevant laws and regulations (ff) Payment mechanisms (formal channels vs. cash) (gg) United Nations Sanctions and embargoes 3 India, recognizing the critical importance of conservation and sustainable use of biological diversity, and in accordance with its sovereign commitment to global environmental governance, became a Contracting Party to the Convention on Biological Diversity (CBD), having signed the Convention at the United Nations Conference on Environment and Development (UNCED) held in Rio de Janeiro in June 1992, and ratified the same on 18 February 1994, in accordance with Article 34 of the Convention. The Convention, being a legally binding multilateral treaty, imposes on India continuing obligations to implement its provisions through domestic legal, administrative, and policy measures, and to cooperate with other Contracting Parties in achieving the objectives of biodiversity conservation, sustainable use, and equitable benefit-sharing. Page 22 of 57(ii) Transaction Risk Factors (aa) Transaction inconsistencies (amounts, volumes, pricing) (bb)Excessive cash payments undertaken by the client/customer/counterparty (cc) Transaction structuring (dd) Potential adverse impacts and severity (ee) Geographic discrepancies in the Gold Supply Chain (iii) Delivery Channel Risk Factors (aa) Unusual delivery methods (third-party involvement) (bb) Transportation security practices (cc) Reliability and thorough assessment of third-party transportation providers VII. Sourcing in Supply Chain of Gold The sections below provide a detail of the necessary procedures and best practices to ensure compliance with international standards, enhance transparency, and uphold ethical sourcing throughout the various sources of the Supply Chain for gold: MEDIUM AND LARGE-SCALE MINES (a) Identifying the Source: (i) Mine Identification: Document the exact location of the mine, through the Global Navigation Satellite System coordinates or its equivalent, and the mining company’s details, including registration, licenses, and ownership structures. (ii) Production Capacity: Accredited Refiner shall assess the production capacity of the country in which the LSM operation is situated, as well as the production capacity of the LSM itself, including historical output data and the specific type of gold ore being extracted. The Accredited Refiner is obligated to ensure that if the total supply of gold from the country of origin to the country of consumption for refining exceeds the average production of the country over the preceding three years, appropriate red flags are raised. Additionally, the Accredited Refiner is further obligated to ensure that if the total supply from the LSM operation into the country of consumption exceeds the average production of the mine over the preceding three years, appropriate red flags are also raised. It is mandatory that the SC-CO conducts an on-site visit and Page 23 of 57performs comprehensive due diligence of the supply chain on a regular basis including prior to onboarding the mine as a counterparty. In such instances, a comprehensive review must be conducted with respect to the country, the mine, the aggregator, the supplier, or the counterparty providing the source of gold from the relevant mine or country. (iii) Conflict-Affected and High-Risk Areas (CAHRAs): Determine if the mine or the transit country is in/through a CAHRA. If so, implement the following enhanced due diligence measures: (aa) Security Risk Mitigation Engage with national authorities and civil society to ensure: 1. Security forces operate under clear rules of engagement 2. Payments to public/private security are legal, documented, and proportionate 3. Apply the Voluntary Principles on Security and Human Rights 4. Avoid or minimize reliance on security forces with known records of abuse (bb) Human Rights Risk Mitigation 1. Establish company grievance mechanisms 2. Train workforce and security personnel on human rights protocols 3. Suspend contracts or activities with actors credibly implicated in serious abuses (cc) Mitigation of Support to Armed Groups - Disengage from suppliers or transporters who: 1. Finance or materially support armed groups 2. Fail to demonstrate improvement within a 6-month corrective action window (dd) Anti-Bribery and Anti-Fraud Measures 1. Prohibit all forms of bribery or inducement 2. Require declaration and documentation of all government-related payments 3. Cross-verify invoices, permits, and logistics records to detect inconsistencies (ee) Anti-Money Laundering Controls 1. Develop transactional red flags to monitor for suspicious payments 2. Require beneficial ownership disclosures from all suppliers/intermediaries 3. Route all payments through formal banking channels (ff) Origin and Documentation Verification Page 24 of 571. Conduct geochemical testing or material fingerprinting if origin is unclear 2. Audit mine-level documentation (licenses, production volumes, export permits) 3. Implement chain-of-custody systems for traceability 4. Percentage of security payments disclosed to authorities 5. Number of reported human rights violations before and after mitigation 6. Extent of supplier or transporter disengagement due to red flag risks 7. Implementation status of grievance mechanisms and training programs 8. Reduction in cash-based transactions 9. Documentation compliance (permits, tax receipts, trade papers) (b) Assessing the Supply Chain: (i) Chain of Custody Documentation: Maintain comprehensive records from the extraction site to the refinery, including transport documents, customs declarations, and third-party certifications. (ii) Third-Party Audits: Engage third-party auditors to regularly assess compliance with environmental, labour, and safety standards. Reports from these audits should be integrated into the supply chain documentation. (c) Risk Assessment and Mitigation: Conflict-Affected and High-Risk Areas (CAHRAs): Determine if the mine or the transit country is in/through a CAHRA. If so, implement the following enhanced due diligence measures: (i) Security Risk Mitigation – Engage with national authorities and civil society to ensure: (aa) Security forces operate under clear rules of engagement (bb) Payments to public/private security are legal, documented, and proportionate (cc) Apply the Voluntary Principles on Security and Human Rights (dd) Avoid or minimize reliance on security forces with known records of abuse (ii) Human Rights Risk Mitigation (aa) Establish company grievance mechanisms (bb) Train workforce and security personnel on human rights protocols (cc) Suspend contracts or activities with actors credibly implicated in serious abuses Page 25 of 57(iii) Mitigation of Support to Armed Groups - Disengage from suppliers or transporters who: (aa) Finance or materially support armed groups (bb) Fail to demonstrate improvement within a 6-month corrective action window (iv) Anti-Bribery and Anti-Fraud Measures (aa) Prohibit all forms of bribery or inducement (bb) Require declaration and documentation of all government-related payments (cc) Cross-verify invoices, permits, and logistics records to detect inconsistencies (v) Anti-Money Laundering Controls (aa) Develop transactional red flags to monitor for suspicious payments (bb) Require beneficial ownership disclosures from all suppliers/intermediaries (cc) Route all payments through formal banking channels (vi) Origin and Documentation Verification (aa) Conduct geochemical testing or material fingerprinting if origin is unclear (bb) Audit mine-level documentation (licenses, production volumes, export permits) (cc) Implement chain-of-custody systems for traceability (dd) Percentage of security payments disclosed to authorities (ee) Number of reported human rights violations before and after mitigation (ff) Extent of supplier or transporter disengagement due to red flag risks (gg) Implementation status of grievance mechanisms and training programs (hh) Reduction in cash-based transactions (ii) Documentation compliance (permits, tax receipts, trade papers) ARTISANAL AND SMALL-SCALE MINES (ASMs) (a) Identifying the Source (i) Mine Registration: It must be ensured that artisanal mines are registered with authorities (local or provincial or state). Obtain any available documentation on the mine’s ownership and operation. (ii) Production Capacity: Accredited Refiner shall assess the production capacity of the country in which the Artisanal and Small-Scale Mining (ASM) operation is situated, as well as the production capacity of the ASM itself, including historical output data and the specific type of gold ore being extracted. The Page 26 of 57Accredited Refiner is obligated to ensure that if the total supply from the country of origin to the country of consumption for refining exceeds the average production of the country over the preceding three years, appropriate red flags are raised. Additionally, the Accredited Refiner is further obligated to ensure that if the total supply from the Artisanal and Small-Scale Mining (ASM) operation into the country of consumption exceeds the average production of the mine over the preceding three years, appropriate red flags are also raised. In such instances, a comprehensive review must be conducted with respect to the country, the mine, the aggregator, the supplier, or the client/customer/counterparty providing the source of gold from the relevant mine or country. It is mandatory that the CO conducts an on-site visit and performs comprehensive due diligence of the supply chain on a regular basis including prior to onboarding the mine as a counterparty. Furthermore, the Accredited Refiner, through the CO, shall verify and investigate that the mine complies with the Accredited Refiner’s policy and other applicable due diligence requirements prior to onboarding the mine as a Supplier. This includes ensuring that the mine is legally registered, or cooperative-based, or government-recognized, or a central bank-supported initiative. Such due diligence shall be conducted in conjunction with other required measures, including but not limited to Client/Customer/Counterparty Due Diligence (CDD), Know Your Client/Customer/Counterparty (KYC), and Enhanced Due Diligence (EDD), as applicable. (iii) Conflict-Affected and High-Risk Areas (CAHRAs): Determine if the mine or the transit country is in/through a CAHRA. If so, implement the following enhanced due diligence measures: (aa) Security Risk Mitigation Engage with national authorities and civil society to ensure: 1. Security forces operate under clear rules of engagement 2. Payments to public/private security are legal, documented, and proportionate 3. Apply the Voluntary Principles on Security and Human Rights 4. Avoid or minimize reliance on security forces with known records of abuse (bb) Human Rights Risk Mitigation 1. Establish company grievance mechanisms 2. Train workforce and security personnel on human rights protocols 3. Suspend contracts or activities with actors credibly implicated in serious abuses Page 27 of 57(cc) Mitigation of Support to Armed Groups - Disengage from suppliers or transporters who: 1. Finance or materially support armed groups 2. Fail to demonstrate improvement within a 6-month corrective action window (dd) Anti-Bribery and Anti-Fraud Measures 1. Prohibit all forms of bribery or inducement 2. Require declaration and documentation of all government-related payments 3. Cross-verify invoices, permits, and logistics records to detect inconsistencies (ee) Anti-Money Laundering Controls 1. Develop transactional red flags to monitor for suspicious payments 2. Require beneficial ownership disclosures from all suppliers/intermediaries 3. Route all payments through formal banking channels (ff) Origin and Documentation Verification 1. Conduct geochemical testing or material fingerprinting if origin is unclear 2. Audit mine-level documentation (licenses, production volumes, export permits) 3. Implement chain-of-custody systems for traceability 4. Percentage of security payments disclosed to authorities 5. Number of reported human rights violations before and after mitigation 6. Extent of supplier or transporter disengagement due to red flag risks 7. Implementation status of grievance mechanisms and training programs 8. Reduction in cash-based transactions 9. Documentation compliance (permits, tax receipts, trade papers) (iv) Mapping the Community Impact: Document the socio-economic impact of the mine on local communities, including, Human Rights issues such as labour conditions, child labour risks, and local governance structures. (b) Assessing the Supply Chain: (i) Aggregation Points: In case of aggregation from ASM, identify and document all points where gold from ASMs is aggregated by Aggregators which may include the transmit routes through CAHRAs, before being sold to intermediaries or refiners. Maintain records of all transactions at these points. Supply chain complexity is also to be assessed as to the number of Aggregators or intermediaries in the supply chain. Page 28 of 57(ii) Due Diligence on Aggregators: Perform due diligence on Aggregators who may be intermediaries and buyers who purchase gold from ASMs, ensuring they comply with international standards for ethical sourcing. Ensure that documentation with regards to the Chain of Custody and the documentation of the supply chain integrity is maintained for gold sourced from Aggregators. (c) Risk Assessment and Mitigation (i) Child Labour and Human Rights: Implement strict monitoring to ensure no child labour is involved. Engage local Non-Government Organisations or community leaders to support ongoing monitoring and provide training. (ii) Financial Transparency: Ensure that payments to miners (directly or indirectly by Aggregators), are transparent, through only banking channels and that the Aggregators and other intermediaries are not engaging in practices that could lead to financial exploitation. (iii) In case the aggregations are either within a CAHRA or has transited through a CAHRA the following risk mitigations are to be undertaken: (aa) Security Risk Mitigation Engage with national authorities and civil society to ensure: 1. Security forces operate under clear rules of engagement 2. Payments to public/private security are legal, documented, and proportionate 3. Apply the Voluntary Principles on Security and Human Rights 4. Avoid or minimize reliance on security forces with known records of abuse (bb) Human Rights Risk Mitigation 1. Establish company grievance mechanisms 2. Train workforce and security personnel on human rights protocols 3. Suspend contracts or activities with actors credibly implicated in serious abuses (cc) Mitigation of Support to Armed Groups Disengage from suppliers or transporters who: 1. Finance or materially support armed groups 2. Fail to demonstrate improvement within a 6-month corrective action window (dd) Anti-Bribery and Anti-Fraud Measures 1. Prohibit all forms of bribery or inducement 2. Require declaration and documentation of all government-related payments Page 29 of 573. Cross-verify invoices, permits, and logistics records to detect inconsistencies (ee) Anti-Money Laundering Controls 1. Develop transactional red flags to monitor for suspicious payments 2. Require beneficial ownership disclosures from all suppliers/intermediaries 3. Route all payments through formal banking channels (ff) Origin and Documentation Verification 1. Conduct geochemical testing or material fingerprinting if origin is unclear 2. Audit the aggregations documentation (procurement licenses, export permits, mining sources etc.) 3. Implement chain-of-custody systems for traceability 4. Percentage of security payments disclosed to authorities 5. Number of reported human rights violations before and after mitigation 6. Extent of supplier or transporter disengagement due to red flag risks 7. Reduction in cash-based transactions 8. Documentation compliance (permits, tax receipts, trade papers) RECYCLABLE MATERIAL (a) Identifying the Source: (i) In case of “Grandfathered Stocks” - In case the material is from “Grandfathered Stocks”, the requirement to determine their origin may be exempted depending on the jurisdiction or applicability of the term “Grandfathered Stock”. (ii) In case from other recyclable sources– (aa) Source Documentation: Collect documentation on the origin of recyclable gold, whether from jewellery, electronics, or industrial scrap. Ensure the legality and ethical sourcing of the original material. (bb) Supplier Verification: Verify the suppliers’ processes for collecting and processing recycled gold. (b) Assessing the Supply Chain: (i) Traceability Records: Maintain detailed records of the recycled gold from the point of collection through refining, including documentation from all intermediaries. (ii) Audits and Certifications: Engage in regular audits of suppliers’ operations, ensuring compliance with environmental and Human Rights regulations for e.g. labour regulations. Page 30 of 57(c) Risk Assessment and Mitigation: (i) Recycled Gold from high-risk areas: Implement rigorous checks to ensure recycled gold, including gold from conflict-affected and high-risk areas (CAHRAs) is subject to EDD. This may involve working with third-party certifiers to verify the sources and the Chain of Custody. (ii) Environmental Assessment Impact: It is recommended that recycling processes undertaken by the Accredited Refiners do not result in significant environmental harm, particularly regarding waste management and emissions. MIXED GOLD (COMBINATION OF MINED AND RECYCLED GOLD) (a) Identifying the Source: (i) Source Segregation: Maintain clear records of the origins of both mined and recycled gold, ensuring that it is traceable back to its source. (ii) Documentation Integrity: Ensure that documentation with regards to the Chain of Custody and the documentation of the supply chain integrity is maintained for both mined and recycled components is accurate, comprehensive, and verifiable. (b) Assessing the Supply Chain: (i) Blending Records: Document the blending process, including the proportions of mined and recycled gold. Ensure transparency in the blending process, with records available for audit. (ii) Supply Chain Certification: Consider obtaining Supply Chain certification from recognized bodies that specialize in mixed-material tracking and verification. (c) Risk Assessment and Mitigation: (i) Risk Assessment: Perform risk assessments for both mined and recycled components, addressing any potential risks with sourcing from high risk areas, adverse environmental impact and adverse Human Rights issues such as labour conditions. (ii) Transparency and Reporting: Ensure that all stakeholders are informed of the mixed nature of the gold, including disclosures in all relevant documentation and reports. Page 31 of 57VIII. Record keeping: (a) Accredited Refiner shall be required to maintain comprehensive, accurate and legible digital records, for a period of minimum 8 years, which shall cover all aspects related to the collection, documentation, and verification of information associated with client/counterparty/customer due diligence, identity verification, Beneficial Ownership, Supply Chain mapping, and risk assessments. (b) Such records shall include, but are not limited to, adverse media or sanctions findings, documentations verifying the identity of counterparties, the legal status and structure of entities, beneficial ownership details, and all relevant supply chain information from the source to the final product. (c) These records shall be preserved in a manner that ensures their integrity, availability for audit or review, and compliance with applicable legal and regulatory requirements. (d) The record-keeping system must also support ongoing monitoring and periodic review processes to ensure continuous alignment with international standards and guidelines, including those set forth by the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas (CAHRAs). IX. Supply Chain Controls (a) Payments undertaken through Wire Transfers and its Verification: (i) Transactions with Suppliers after the necessary CDD and KYC are to be conducted only through official banking channels and Payment Service Providers (PSP) registered with IFSCA. Cash transactions are not permitted. (ii) Accredited Refiner shall monitor payment messages through wire transfers to and from high-risk countries or jurisdictions, which may include, but not limited to the CAHRAs, as well as any transactions with high-risk countries or jurisdictions, and suspend or reject payment messages or transactions with sanctioned parties or countries or jurisdictions as per the guidance issued by the competent authorities (for e.g., FIU-India, Ministry of Home Affairs etc.). (iii) Where during background checks, undertaken by the Accredited Refiner during Client/Customer/Counterparty Due Diligence confirm that the Counterparty is a terrorist or a terrorist entity, the Accredited Refiner shall block, reject or freeze assets, if any, of these terrorists or terrorist entities immediately. Page 32 of 57(iv) Where there are positive hits arising from screening/background checks of the Client/Customer/Counterparty, they should be escalated to the CO. The decision to approve or reject the onboarding of the Client/Customer/Counterparty and the transactions related to the receipt or release of the payments through wire transfers should be made at a Senior Management level and be documented. (v) Accredited Refiner shall not omit, delete or alter information undertaken during the continuous and ongoing screening/background checks of the client/customer/counterparty and any information which may not be limited to transactions, messages or emails or any form of communication, for the purpose of avoiding detection of that information during the Audit Review process. (b) Security Measures (i) The Accredited Refiner shall ensure that it documents and controls all the incoming material and is subjected to inspection by the personnel handling the material supervised by the CO, to verify the identity of the gold supplying counterparty, as well as to confirm the type, weight, and quality of the gold- bearing material. Furthermore, the Accredited Refiner and its personnel shall ensure the completeness and accuracy of the documentation provided by the gold, supplying counterparty. (ii) Such inspection shall also encompass the verification of the physical security measures employed by the gold supplying counterparty, ensuring that shipments have not been tampered with, unsealed, or opened. Physical security measures, such as sealed containers and segregation of shipments, are to be implemented to prevent tampering and loss of materials or evidence or information. (c) Cooperation with Enforcement Authorities Accredited Refiners are required to cooperate fully with regulatory and law enforcement agencies, providing access to relevant information which may include, but not limited to, filing of Suspicious Transaction Reports to FIU- India and supporting investigations when summoned by the enforcement authorities. (d) Supplier Engagement (i) Supplier Commitment: Accredited Refiners shall enhance their engagement with suppliers by incorporating a supply chain policy into contracts and/or agreements. Accredited Refiners shall only engage with those suppliers who Page 33 of 57are willing to adopt the principles of responsible sourcing practices aligned with the Guidelines. (ii) Capacity Building: Accredited Refiners shall support suppliers, wherever possible, in enhancing their thorough assessment capabilities to strengthen the overall Gold Supply Chain. Accredited Refiners may also provide assistance, wherever feasible, to suppliers in capacity-building efforts aimed at improving their due diligence performance. (e) Red Flag Indicators Accredited Refiners are required to establish and maintain a comprehensive list of red flag indicators pertaining to potential risks within their procurement and supply chain networks. These red flag indicators shall be categorized, reviewed, and updated regularly to reflect the evolving risk landscape. By systematically evaluating these indicators, Accredited Refiners can prioritize due diligence, mitigate exposure to adverse impacts, and ensure compliance with responsible sourcing principles in line with OECD Guidance. (i) Location-Based Red Flags (aa) Conflict Zones: The gold originates from or transits through Conflict- Affected and High-Risk Areas (CAHRAs), including regions identified in United Nations sanctions or embargo lists. (bb) Illegitimate Origin Claims: The country-of-origin lacks known gold reserves or has negligible production, creating suspicion of misrepresentation. (cc) Transit Anomalies: Gold transits through countries known to serve as conduits for smuggled CAHRA gold. (dd) Suspect Recycling Hubs: Recycled gold is refined in jurisdictions suspected of laundering gold originating from conflict regions. (ee) AML Deficiencies: The country of origin or transit is characterized by weak anti-money laundering frameworks, high corruption indices, or reliance on informal financial systems. (ii) Supplier-Based Red Flags (aa) High-Risk Jurisdictions: Supplier operates in or is linked to sanctioned, high- risk, or opaque jurisdictions. (bb) Adverse History: Supplier has a known history of sourcing from or being complicit in transactions involving CAHRAs or sanctioned actors. (cc) Opaque Ownership: Supplier refuses to disclose or provides incomplete details on beneficial ownership, directors, or affiliates. (dd) Compliance Failures: Lack of documented policies on responsible sourcing, ethics, AML/CFT, or due diligence. Page 34 of 57(ee) Involvement of PEPs: Supplier is linked to Politically Exposed Persons (PEPs) or entities under political patronage. (ff) Bribery & Fraud Indicators: Supplier has a pattern of misrepresenting the origin, falsifying documents, or offering unofficial inducements during transactions. (iii) ASM-Related Red Flags (aa) Source Type & Legitimacy: Supplier is associated with ASM sites not legally registered, recognized, or supported by the state or central bank. (bb) Operational Risks: ASM sources do not comply with recognized environmental, health and safety, or social standards. (cc) Lack of Traceability: Gold from ASM operations lacks verifiable documentation, chain of custody, or traceability. (dd) Security Force Presence: Presence of public or private security forces at ASM sites without formal agreements or oversight mechanisms. (iv) Human Rights and Security-Based Red Flags Serious Abuses: Evidence or allegations of: (aa) Torture, cruel or inhumane treatment (bb) Forced or compulsory labour (cc) Worst forms of child labour (dd) Widespread sexual violence (ee) War crimes or gross violations of international humanitarian law (ff) Security Force Involvement: Gold sourced from areas where security forces (state or private) are implicated in illegal taxation, extortion, or control of mine sites or transportation. (gg) Direct/Indirect Support to Armed Groups: The supplier is known to have provided logistical, financial, or material support to non-state armed groups or militias. (v) Financial Integrity & Governance Red Flags (aa) Money Laundering Risks: Transactions involving round-tripping, unusually large or fragmented payments, third-party intermediaries, or unexplained changes in payment arrangements. (bb) Tax Evasion & Royalties: Supplier fails to declare or underreports taxes, fees, or royalties paid to governments in extraction or export. (cc) Lack of Disclosure: Refusal to share payment records, trade licenses, export documentation, or customs declarations. (vi) Any other circumstances related Red Flags Page 35 of 57In case any anomalies or unusual circumstances are identified through the information collected in Step 1 which may give rise to a reasonable suspicion that the gold may contribute to conflict or serious abuses associated with the extraction, transport or trade of gold. X. Enhanced Due Diligence (EDD) for High-Risk Supply Chains (a) When significant potential risks or red flags are identified within a Gold Supply Chain, Accredited Refiners are required to conduct Enhanced Due Diligence (EDD) to mitigate potential adverse impacts. This involves a more in-depth examination of the supplier and its operations. If a Gold Supply Chain is assessed and identified as low risk, ongoing monitoring within the existing RBOE Framework is sufficient. (b) EDD Components: (i) On-site Assessments: Physical inspections of supplier facilities are essential for the verification of provided information and for obtaining a direct understanding of the supplier’s operations. Such assessments may be conducted independently by the Accredited Refiner or as part of collaborative efforts within industry initiatives. (ii) Documentation and Reviews From Other Sources: A comprehensive examination of relevant documentation, financial records, and publicly available information is necessary to identify potential red flags and evaluate the supplier’s compliance with applicable standards. (iii) Transaction Sampling: A review of a representative sample of transactions is required to detect any patterns, inconsistencies, or irregularities that may indicate underlying risks or non-compliance. (c) EDD Focus Areas, inter-alia, shall include: (i) Supplier Verification: Detailed verification of the supplier's legal status, ownership structure, and beneficial ownership. (ii) Financial Information: Review of financial statements, payment terms, and transaction history. (iii) Supply Chain Mapping: Identify the origin of the gold, transportation routes, and key intermediaries involved in the supply chain including the mapping of the flow of gold from mine to market. Page 36 of 57(iv) Operational Practices: Evaluation of mining techniques, labour conditions, and environmental impacts. (v) Risk Assessment: Evaluate the supplier’s management of social, environmental, and financial risks. (vi) Risk Mitigation Measures: Evaluation of the supplier's risk management practices. (vii) Document Review: Review relevant documentation, including permits, licenses, contracts, financial statements, and other pertinent records. (viii) Third-Party Verification and Audits: Utilise independent third-party audits or Audit Reviews, certifications, or industry reports to corroborate the information provided. (ix) Compliance Records: Verification of adherence to laws, regulations, and industry standards. Step 3: Implementation of Risk Control and Management Strategy as response to the Identified Risks: A. The Accredited Refiner shall implement a comprehensive risk control and management plan, which shall be subject to ongoing review and updates to ensure alignment with evolving business conditions, operational modifications, supply chain dynamics, and applicable regulatory changes. (a) Risk Management Strategy Based on the potential risks identified in Step 2: Identify and Evaluate Risks Within the Supply Chain through the RBOE Framework, Accredited Refiners are required to take appropriate steps in the following manner: (i) Onboarding suppliers or continue the relationship: For suppliers determined to effectively manage identified risks and maintain the integrity of the supply chain, the Accredited Refiners may onboard or continue existing relationships with suppliers or client/customer/counterparty, while implementing additional measures to strengthen supplier assessments. Should any deviations be identified in the performance of the supplier, the counterparty, the beneficial owner, or the person(s) with controlling ownership from the principles established in the RBOE Framework during these assessments, performance improvement shall be closely monitored using both quantitative and qualitative metrics. The assessment plan must be submitted by the CO to be approved by the board of the Accredited Refiner. Suppliers are expected to make significant improvements within six months. In the event of a failure to achieve Page 37 of 57satisfactory progress, the Accredited Refiner shall ensure the suspension or termination of the relationship with the supplier or counterparty. (ii) Case for Suspension: If the EDD of the supplier, counterparty, beneficial owner, or person(s) with controlling ownership reveals suspicions of illegal activities, including but not limited to money laundering, terrorist financing, human rights violations, environmental damage, or support for non-state armed groups, the Accredited Refiner is obligated to suspend all business dealings with the supplier or counterparty until sufficient risk mitigation measures are implemented. Accredited Refiners located in India shall report the incident by filing a Suspicious Transaction Reports (STR) with the Financial Intelligence Unit (FIU-India). Accredited Refiners situated, registered, or located in other jurisdictions must file the STR with the relevant authority in their respective FATF-compliant jurisdiction responsible for ensuring compliance with Anti- Money Laundering (AML) standards and Combating the Financing of Terrorism (CFT) regulations applicable to Dealers in Precious Metals and Precious Stones. (iii) Termination of Relationship with Supplier: In instances where the supplier, counterparty, beneficial owner, or person(s) with controlling ownership is confirmed to be involved in money laundering, terrorist financing, human rights abuses, or support for armed conflicts are confirmed, the Accredited Refiner, whether located in India or overseas, is required to immediately terminate the supplier relationship. Furthermore, the Accredited Refiner must report the incident to the relevant authorities in their respective jurisdictions responsible for enforcing compliance with Anti-Money Laundering (AML) standards and Combating the Financing of Terrorism (CFT) regulations, specifically applicable to Dealers in Precious Metals and Precious Stones. (b) Supply Chain Risk Mitigation Plan Accredited Refiners who are in the phase of "Onboarding suppliers or continue the relationship" or in the phase of handing the "Case for Suspension", are required to formulate a comprehensive Risk Mitigation Plan that shall include, inter-alia, the following measures: (i) Regular Reporting: The Risk Mitigation Plan must mandate the regular reporting of identified potential risks by the CO to the board. These reports should be documented, with clearly defined intervals for submission, ensuring that senior management remains fully informed of ongoing and emerging risks. These reports shall highlight high-risk counterparties and their associated risk management strategies. (ii) Enhanced Supplier Engagement: The Risk Mitigation Plan shall include enhanced engagement with suppliers, particularly through the implementation of Chain of Custody and traceability measures. Accredited Refiners must ensure that suppliers maintain comprehensive records and provide transparency throughout the supply Page 38 of 57chain, allowing for continuous monitoring and verification of compliance with established standards. (iii) Strengthened Physical Security Protocols: The Risk Mitigation Plan must include reinforced physical security measures designed to safeguard assets and shipments. These protocols shall address potential threats and ensure compliance with due diligence requirements while maintaining the integrity of the supply chain, particularly in cases of Conflict-Affected and High-Risk Areas (CAHRAs). Additionally, the protocols must ensure that shipments are protected against theft, tampering, or any other forms of compromise. (iv) Physical Segregation and Secure Handling: For shipments identified as high-risk due to its source emerging from CAHRAs or related to CAHRAs in any manner, the mitigation plan shall ensure physical segregation and secure handling procedures. This may involve dedicated storage areas, restricted access controls, and specialized handling protocols and documentations to prevent, contamination, loss, or unauthorized access to the material, data and documents. (v) Formal Agreements for Information Sharing: Accredited Refiner must establish formal agreements with suppliers or clients/customer/counterparties which specifically obligates them to share timely and accurate information regarding their operations, including any changes in ownership, management, or operational practices that could impact risk exposure. These agreements should also stipulate the consequences of failing to provide such information. (vi) Temporary Suspension for Non-Compliance: In cases where a supplier fails to comply with established risk control measures, the Risk Mitigation Plan shall require the temporary suspension of business activities with the non-compliant supplier for a minimum of three months. This suspension period allows for corrective actions to be taken and serves as a deterrent against future non-compliance. (vii) Continuous Evaluation of Risk Mitigation Efforts: The Risk Mitigation Plan must include provisions for the ongoing evaluation of risk mitigation efforts. This evaluation should assess the effectiveness of existing controls and determine whether additional thorough assessment or risk mitigation measures are necessary. The plan should also outline procedures for escalating issues to senior management when significant risks are identified. The Supply Chain risk management is an ongoing process. Accredited Refiners are required to regularly assess the effectiveness of implemented risk mitigation measures and determine the need for repeated thorough assessments. Changes in the Gold Supply Chain environment or onboarding of new suppliers shall necessitate review of Step 2: Identify and Evaluate Risks Within the Supply Chain through a RBOE Framework and additional thorough assessment efforts. Page 39 of 57Step 4: Third-Party Audit of Accredited Refiner A. The Accredited Refiner shall be obligated to undergo Third-Party Audits. This requirement is instituted to ensure the maintenance of integrity, reputation, and standards for any transaction. B. These audits are designed to assess the Accredited Refiner’s compliance with applicable Guidelines and evaluate the effectiveness of their Supply Chain Due Diligence framework, including their adherence to responsible sourcing principles and mitigation of risks associated with procurement from Conflict-Affected and High-Risk Areas (CAHRAs). It shall be noted that the Guidelines serve as foundational principles and provide the scope and criteria for the audits; however, they do not constitute a formal audit standard. C. Audit Plan The empanelled Third-Party auditors shall develop a comprehensive audit plan that includes, but is not limited to, the following components: (a) Scope of Audit The scope of audit shall encompass an extensive evaluation of the Accredited Refiner's Supply Chain Due Diligence framework, including, but not limited to: (i) Supply Chain Policy and Procedures: Review of the policies and procedures that govern the Accredited Refiner’s due diligence practices, ensuring they align with international standards such as the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals. (ii) Implementation of Policies and Procedures: Assessment of how these policies and procedures are integrated into the Refiner’s operational processes and systems, and the effectiveness of their application in everyday operations. (iii) Comprehensive Supply Chain Risk Assessment and Mitigation Strategies: Examination of the Refiner's approach to identifying, assessing, and mitigating supply chain risks, including potential risks associated with sourcing from CAHRAs and other high-risk areas. (iv) Effectiveness of Engagement with Suppliers: Evaluation of the Refiner's engagement with suppliers, including communication of due diligence requirements, monitoring of supplier compliance, and mechanisms for addressing non-compliance. (v) Chain of Custody Mechanisms and Traceability Systems: Verification of the Refiner’s systems for maintaining the integrity and traceability of materials throughout the supply chain, ensuring a clear chain of custody from origin to final product. (b) Audit Review for Compliance and Supply Chain Due Diligence Evaluation Page 40 of 57Audit Review by the empanelled Auditor shall evaluate the Accredited Refiner's conformity with these Guidelines, assessing whether the Supply Chain Due Diligence framework meets all prescribed regulatory requirements, including those related to interactions with supply chain participants, compliance with AML-CFT guidelines, and adherence to responsible sourcing principles. (c) Principles of Audit (i) Independence: The auditing organization and its personnel must maintain independence from the Accredited Refiner, including all its subsidiaries, licensees, contractors, and suppliers. The auditor shall disclose any current or previous business, financial, or consultancy relationships with the Accredited Refiner or related entities that could potentially impair their objectivity or independence. The RO shall retain the right to review and approve the selection of the auditor to ensure compliance with these independence requirements. (ii) Competence: Auditors must possess the requisite qualifications, knowledge, and experience necessary to conduct the audit in accordance with recognized auditing standards. This includes a thorough understanding of Supply Chain Due Diligence principles, procedures, and international guidelines, such as those set forth by the OECD, as well as specific expertise in gold procurement practices and the relevant geographical contexts in which the Accredited Refiner operates. (iii) Accountability: The RO shall maintain a publicly accessible registry of accredited auditors on its website, providing transparency and ensuring that only qualified auditors are engaged for these assessments. (d) Activities to be undertaken while conducting the Audit (i) Audit Preparation: The auditor shall develop a detailed audit plan outlining the audit’s objectives, scope, methodology, questionnaire and criteria. The audit plan must be communicated clearly to the Accredited Refiner to ensure alignment and understanding of the audit process. (ii) On-site Investigation: The audit shall include comprehensive on-site assessments at the Accredited Refiner’s facilities and relevant operational sites. This shall involve conducting interviews with key personnel responsible for supply chain management, reviewing relevant documents, and physically verifying operations and facilities. The on-site investigation must cover all relevant locations and include a representative sample of suppliers to ensure a holistic evaluation. (iii) Document Review: A meticulous review of relevant documentation shall be conducted, including the Accredited Refiner’s Supply Chain Due Diligence policies, procedures, risk assessments, supplier contracts, and traceability records. Page 41 of 57Document selection shall be based on a risk-based approach, focusing on high-risk areas and significant aspects of the supply chain. (iv) Audit Findings and Recommendations: Upon completion of the audit, the auditor shall prepare a detailed report outlining the findings, conclusions, and any recommendations for improvement. The report shall be structured in accordance with the Guidelines, providing a clear, concise, and comprehensive assessment of the Accredited Refiner’s compliance and areas for enhancement. The guidance set forth for the auditors in ANNEXURE A shall be construed as Audit Review guidelines, and the Auditor retains the discretion to extend beyond the provisions prescribed therein, as necessary, to ensure full compliance with the RFRC and RBOE by the Accredited Refiner. (e) Audit Implementation The auditors are required to conduct audits in strict accordance with the established audit plan, adhering to the specified scope, criteria, principles, and procedures. Effective collaboration with relevant stakeholders, including suppliers, management, and employees, is essential for the successful implementation of the audit. Accredited Refiner shall ensure the facilitation of audits and maintain the independence of the Auditor, refraining from any actions or influence that may compromise or be deemed detrimental to the integrity, reputation, and sanctity of entities established within the IFSC. Only auditors empanelled with the RO shall be engaged, ensuring adherence to established standards and maintaining the integrity of the audit process. Step 5: Annual Reporting on the RFRC and RBOE A. Auditors may apply materiality principles and sampling methodologies where appropriate, provided such application aligns with risk-based principles and ensures the integrity of conclusions. Refer to the Audit Review framework (Annexure A) for procedures. B. Reporting Obligations (a) Audits of Accredited Refiners shall be undertaken by accredited Third-Party Auditors in accordance with the frequency and assurance level requirements specified in Annexure A, including annual Limited Assurance and triennial Reasonable Assurance engagements in line with ISAE 3000 or SSAE 3000. (b) Prospective Accredited Refiners seeking to be notified as ‘Accredited Refiners’ are required to ensure the submission of the annual independent Third-Party Auditor as per the guidance enclosed as Annexure-A. However, the guidance provided for Auditors in shall be interpreted as guidelines, and the Auditor shall retain the Page 42 of 57discretion to exceed the provisions outlined therein, as necessary, to ensure the Accredited Refiner's full compliance with the RFRC and RBOE. (c) The Accredited Refiners manufacturing India Refined Gold may be audited by the Auditors based on guidelines and the checklist issued by the RO. The auditors are required to submit their reports to the RO to fulfil regulatory compliance obligations. C. Comprehensive Report to the Management (a) The Accredited Refiner shall disclose its compliance against each of the five OECD- aligned steps (Policy, Risk Assessment, Mitigation, Monitoring, Reporting), in the format prescribed by the auditor as per Annexure A. (b) The Third-Party Auditor must ensure the preparation of the Report as part of the reporting timelines (as prescribed in Annexure A), based on the Audit Review. This report must include the requirements outlined in the: (i) Step 1: Establishing An Effective Risk-Focused Regulatory Compliance Framework (RFRC) through Policy and Systems (ii) Step 2: Identify And Evaluate Risks Within the Supply Chain through a Risk Based Operational Excellence (RBOE) Framework (iii) Step 3: Implementation Of Risk Control and Management Strategy as Response to The Identified Risks (c) The Report must provide an overview of the Accredited Refiner’s assessment practices and their effectiveness in mitigating potential risks within the Gold Supply Chain. (d) The Report shall be prepared in accordance with the guidelines outlined in Annexure A, which may include additional reporting requirements and specifications. The annual reports submitted by Accredited Refiners must comprehensively address all critical requirements to enhance transparency and uphold the integrity of the Gold Supply Chain, thereby ensuring compliance with the highest standards of responsible sourcing and regulatory adherence. Page 43 of 57Annexure -A Audit Review by Third-Party Auditors under the International Financial Services Centres Authority Good Delivery Guidelines 1. The Audit Review outlines the criteria by which Accredited Refiners shall be evaluated on their compliance with the Conduct of Business based on the Principles of Responsible Sourcing and Supply Chain Integrity as stipulated in the International Financial Services Centres Authority Good Delivery Guidelines (herein referred to as the Guidelines). This framework is applicable to Auditors engaged in conducting Third-Party Audits of Accredited Refiners. The Audit Review template shall function as a mechanism to facilitate the notification of a refiner as an 'Accredited Refiner' by the RO. 2. For a refiner to be notified as an 'Accredited Refiner,' the prospective entity must adhere to the 5-Step Framework established under the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas, as prescribed in the International Financial Services Centres Authority Good Delivery Guidelines. This Audit Review framework prescribes the procedures for assessment that must be followed by both Accredited Refiners and Third-Party Independent Auditors to obtain such notification. Auditor Empanelment 3. The RO shall consider applications for empanelment from renowned auditing organizations, whether domestic or international which is engaged in auditing and certification services. Such organizations must be duly empanelled with the RO. Process of Auditor Empanelment 4. Eligibility criteria for auditors applying for empanelment are as under: (a) The applicant entity must be duly registered with the Institute of Chartered Accountants of India (ICAI) in India or Institute of Company Secretaries of India or The Institute of Cost Accountants of India or any other similar institutions overseas. Page 44 of 57(b) The applicant entity, neither the firm/organisation nor its promoters, partners, or key management personnel (KMP) should be listed on any defaulter, barred, or caution list published by public bodies, including but not limited to the Reserve Bank of India (RBI), Export Credit Guarantee Corporation of India (ECGC), Securities and Exchange Board of India (SEBI), or Credit Information Companies (CIC) or any other public bodies or regulatory authorities in India or overseas. The applicant entity is required to submit a self-attested affidavit affirming compliance with this condition. (c) The applicant entity should have the experience of conducting audit for a minimum period of 2 years. (d) The applicant entity must be equipped with the necessary systems and procedures to ensure that they meet the high standards set by ISAE 3000 and be capable of assuring integrity, governance and confidentiality. (e) The applicant entity must have adequate number of qualified personnel at all the time. (f) The applicant entity shall possess and be able to demonstrate the necessary capabilities, competencies, and proficiencies with respect to the following: i. Maintaining independence from any entities for which it conducts audits; ii. Implementing robust quality control procedures, including effective follow-up mechanisms; iii. Establishing effective systems for managing complaints and appeals; iv. Ensuring the integrity and confidentiality of all audits conducted; v. Ensuring the integrity and confidentiality of its employees, staff members, subcontractors, agents, assignees, or any other persons engaged in activities related to any audit; and vi. Providing, storing, and managing verifiable documentation that details the track record of the Supply Chain due diligence systems and procedures under audit. (g) The applicant entity must possess and be able to clearly demonstrate in-depth knowledge of International Financial Services Centres Authority (Anti Money Laundering (AML), Counter-Terrorist Financing (CFT) and Know Your Customer) Guidelines, 2022 and AML CFT Guidelines for dealers in Precious Metals and Precious Stones issued by the Directorate General of Audit (Indirect Taxes & Customs) dated January 25, 2023 or any other regulation / notification / guidance or Page 45 of 57circulars issued by the Authority or the Government of India or any other competent authority. (h) The applicant entity must have the know-how of the supply Chain due diligence systems and procedures applicable to the gold and precious metals industries, including the audit of functions such as transportation, transformation, chemical refining, inventory management, and trading. (i) Assessment by RO: Upon receipt of complete application, an internal committee of RO shall review the request for empanelment along with the supporting documents as prescribed by RO. (j) The RO reserves the right to seek clarifications or request additional information from the applicant entity as deemed necessary. (k) Upon completion of the evaluation and clarification process, the empanelment of the applicant entity as a Third-Party Auditor shall be subject to approval by the internal committee of the RO. (l) The Letter of Empanelment shall be issued to the Third-Party Auditor by the competent authority within the RO, serving as formal confirmation of their empanelment. The auditor is required to provide copies of this Letter of Empanelment to the 'Accredited Refiners' upon request and prominently display it at their place of business. 5. The empanelment details of all the Third-Party Auditors shall be published on the RO website. It shall be the responsibility of the Accredited Refiners to verify the empanelment status by consulting the RO website and to confirm the authenticity of the Letter of Empanelment issued by the RO to the empanelled Third-Party Auditor prior to engaging the auditor for conducting Third-Party Audits of the 'Accredited Refiner.' Audit Plan 6. Before commencing any audit, the empanelled auditor must develop a comprehensive audit plan in agreement with the Accredited Refiner under review. This plan shall explicitly define the audit's scope, the timeline for its completion, and the associated costs. Page 46 of 57I. Objectives of the Audit Plan A. For each audit plan, the empanelled auditor and the Accredited Refiner shall ensure that the following objectives are included: (a) An assessment and conclusion by the empanelled auditor regarding the extent to which the Accredited Refiner has established robust supply chain management systems in accordance with the Guidelines, and the OECD Due Diligence Guidance on Responsible Sourcing and Supply Chain Integrity. (b) An evaluation by the empanelled auditor of how effectively the Accredited Refiner identifies and assesses risks within its supply chain in compliance with Step 2 (Identify And Evaluate Risks Within the Supply Chain through a Risk Based Operational Excellence (RBOE) Framework) of the Guidelines, and the OECD (c) An assessment and conclusion by the empanelled auditor of the adequacy of the Accredited Refiner's reporting on the measures implemented for responsible supply chain due diligence, in accordance with all steps outlined in the Guidelines. II. Compliance Assessment A. The empanelled auditor shall assess and include in its audit report the extent to which the Accredited Refiner complies with the Guidelines, including: (a) The implementation of a policy in accordance with Step 1of the Framework for Due Diligence of the Guidelines. (b) Clear definition, establishment, and implementation of responsibilities and escalation channels as required by the Guidelines. (c) Appropriate criteria for supply chain due diligence, including systems and processes for identifying red flags as per Step 2 of the Framework for Due Diligence of the Guidelines. (d) Implementation and application of KYC processes in accordance with Step 1 of the Framework for Due Diligence of the Guidelines and the existence of a suitably qualified and competent compliance function. Page 47 of 57(e) Adequacy and existence of internal documentation and records of supply chain due diligence covering inventory and transactions. (f) Tracking and tracing for all inventory and transactions per Step 1 of the Framework for Due Diligence of the Guidelines. (g) Addressing supplier relationships in accordance with Step 1 of the Framework for Due Diligence of the Guidelines. (h) Maintaining confidentiality relating to whistleblowing and the reporting of suspicious activities while avoiding compromising any related investigations. (i) Consistent application of security requirements as mandated by Step 1 of the Framework for Due Diligence of the Guidelines. (j) Training of relevant staff of the Accredited Refiner in accordance with its supply chain policies and procedures, including: (i) Providing different training programs based on the levels of risk associated with different suppliers or staff functions. (ii) Receiving and addressing feedback from attendees. (iii) Assessing the effectiveness and adequacy of training program content. III. Risk Assessment A. The auditor shall evaluate and include in its audit report the extent to which the Accredited Refiner can identify and adequately assess risks within the supply chain in accordance with Step 2 of the Framework for Due Diligence of the Guidelines: (a) Consistent application of the policy as mandated by Step 1 of the Framework for Due Diligence of the Guidelines. (b) The Accredited Refiner’s assessment of supply chain risks, including processing, distribution, transportation, cross-border trading, and an evaluation of every actor in the supply chain. IV. Risk Assessment Tools and Methodologies A. The empanelled auditor shall assess and include in its audit report the extent to which the Accredited Refiner has established and applies adequate risk assessment tools and Page 48 of 57methodologies (e.g., screening systems for international sanctions lists) across its business divisions, including: (a) Evidence that all relevant risk factors (geographical, counterparty, transactional, and product) are considered for risk assessments, and that findings are adequate (e.g., the ability to detect falsification of evidence or proper implementation of track and trace principles). (b) Evidence that risk assessment findings enable the Accredited Refiner to detect, evaluate, and address red flags in accordance with Step 2 of the Framework for Due Diligence of the Guidelines. (c) Evidence of enhanced due diligence where red flags or potential red flags are detected, using methods outlined in the Guidelines. (d) Evidence that all findings are accurately documented and reported to all relevant parties in a timely manner. V. Risk Mitigation The empanelled auditor shall assess and include in its audit report the extent to which the Accredited Refiner has developed and implemented a risk mitigation plan in accordance with Step 3 of the Framework for Due Diligence of the Guidelines, including evidence of the adequacy and effectiveness of risk level classification and related control mechanisms. VI. Risk Control Practices The empanelled auditor shall evaluate and report on the effectiveness of the Accredited Refiner’s risk control practices, as outlined in its risk control plan, including the implementation of adequate measurable steps, monitoring and audit performance, and reporting to senior management. VII. Annual Reporting A. The empanelled auditor shall assess and include in its audit report the extent to which the Accredited Refiner is reporting annually on the measures implemented for responsible supply chain due diligence (including the methodology and results of any Page 49 of 57risk assessment and steps taken to manage risks) in accordance with Steps 4 and 5 of the Framework for Due Diligence of the Guidelines, including: (a) Assessment of the completeness, adequacy, and accuracy of the content of such reporting. (b) Assessment and evidence of the level of accessibility of such reporting for the Accredited Refiner’s regulators, existing and potential counterparties. VIII. Application of Materiality The empanelled auditor shall apply materiality in the development and execution of the audit plan, considering the nature, scale, and impact of the Accredited Refiner's business. IX. Sampling The empanelled auditor shall, when warranted by the circumstances, carry out sampling of information sources by selecting a sampling method, determining an appropriate sample size, conducting the sampling, and documenting the results. X. Auditor's Responsibilities, Resources, and Procedures A. Responsibilities The responsibilities of an empanelled auditor for each audit shall include: (a) Ensuring the audit plan is clearly established based on the objectives set out in the Guidelines. (b) Applying materiality in developing and executing the audit plan, considering the nature, scale, and impact of the Accredited Refiner's business. (c) Ensuring that it acquire a comprehensive understanding of the business, organizational structure, and supply chain of the Accredited Refiner. (d) Clearly defining the responsibilities and procedures of the auditor’s assessment team throughout the audit. (e) Ensuring the Accredited Refiner provides sufficient resources for conducting a comprehensive audit. Page 50 of 57(f) Conducting the audit in accordance with this audit framework and maintaining records. (g) Applying an adequate level of sampling where applicable. (h) Ensuring audit reports facilitate monitoring, auditing, and implementing a corrective action plan by the Accredited Refiner. (i) Informing the RO of any breach or non-compliance with the audit framework. B. Resources An empanelled auditor’s resources for each audit shall include: (a) Sufficient financial resources to develop, implement, manage, and improve the audit plan. (b) Sufficient operational resources to conduct a comprehensive audit. (c) Sufficient knowledge and competency of the auditor’s assessment team to perform the audit in accordance with this audit framework. (d) Appropriate audit techniques, methodologies, frameworks, and related systems. C. Procedures An empanelled auditor’s procedures for each audit shall include: (a) Planning and scheduling the audit plan. (b) Ensuring the competence of the auditor’s assessment team. (c) Assigning appropriate roles and responsibilities to the team members. (d) Monitoring the performance and effectiveness of the audit plan to meet its objectives. (i) Conducting any required follow-up actions. (ii) Recording the findings of the audit and carrying out cross-validation of evidence. (iii) Reporting the findings of the audit to the Accredited Refiner in a clear and comprehensible manner. XI. Implementation of the Audit Plan In carrying out each audit plan, the empanelled auditor shall: (a) Ensure the audit is conducted in accordance with the audit plan and its objectives. (b) Communicate initial findings to relevant parties for comments to be incorporated into the final audit report. Page 51 of 57(c) Coordinate the audit with all relevant persons and activities. (d) Continuously evaluate the adequacy of the audit plan and the assessment team. (e) Follow up with relevant persons on all outstanding matters or required actions. XII. Recording Audit Findings The empanelled auditor’s records of each audit shall include: (a) All documents related to the engagement of the empanelled auditor by the Accredited Refiner. (b) Interim and final versions of the audit plan. (c) Documents and correspondence regarding findings of non-compliance. (d) Documents and correspondence regarding corrective actions. (e) Documents and correspondence regarding follow-up actions. (f) Interim and final versions of the audit report. (g) Maintenance of all records for a minimum of eight years from the conclusion of each audit. XIII. Ongoing Monitoring and Assessment The empanelled auditor shall continuously monitor the implementation of the audit plan for each audit to confirm: (a) All audit objectives are met. (b) Required modifications to the audit plan are identified and implemented timely for compliance. XIV. Pre-Audit Activities The pre-audit activities shall include agreements on costs, identification of audit locations, establishment of timelines, and verification of relevant documentation and due diligence requirements. XV. On-Site Audit Activities Page 52 of 57The empanelled auditor shall conduct an opening meeting to present the audit plan and confirm key details with the Accredited Refiner’s relevant departments. All evidence obtained should be objective, relevant, and conclusive. XVI. Assessment of Compliance with the Guidelines The empanelled auditor shall assess compliance with the Guidelines and assign a rating to the Accredited Refiner based on findings. XVII. Closing Meeting A closing meeting shall be conducted to present audit conclusions and recommend improvements, if necessary. XVIII. Reporting of Audit Plan Findings Audit reports shall be provided to both RO and the Accredited Refiner within 90 calendar days from the end of the audit period. XIX. Comprehensive Management Report The comprehensive management report shall detail the audit findings, the Accredited Refiner’s compliance rating, and any corrective action plans required. XX. Accredited Refiners’ Compliance Report (a) The Accredited Refiner's Compliance Report shall be prepared by the Accredited Refiner in a format specified by the Empanelled Auditor to align with the Comprehensive Management Report, providing an overview of the detailed findings therein. (b) The Compliance Report shall include the Accredited Refiner's disclosure of its overall rating against the five steps identified in Steps 1 to 5 of the Framework for Due Diligence , along with individual ratings for each step of the Guidelines. Page 53 of 57XXI. Auditor’s Assurance Report (a) The Auditor's Assurance Report shall be prepared by the Empanelled Auditor based on the Accredited Refiner's Compliance Report and shall serve as a confirmation of the findings contained within the Accredited Refiner’s Compliance Report. (b) The RO shall utilize the Empanelled Auditor’s final overall rating, as provided in the Comprehensive Management Report, as a basis for determining the types of annual audits required. (c) The Auditor may issue an Assurance Report on either a 'Reasonable Assurance' or 'Limited Assurance' standard in accordance with the ISAE 3000 standard. (d) The initial audit of any Accredited Refiner must be conducted on a 'Limited Assurance' within the first 2 years and ‘Reasonable Assurance’ basis within the first 5 years of being accredited with the RO and the audit shall be undertaken in accordance with the ISAE 3000. XXII. Subsequent Audits A. Subsequent audits, following the initial audits based on the ‘Limited Assurance’ and 'Reasonable Assurance' standard, must be conducted with the same periodicity (within 2 years ‘Limited Assurance’ & within 5 years ‘Reasonable Assurance’ and through an empanelled auditor. (a) The RO may require the Accredited Refiner to instruct the Empanelled Auditor to conduct any audit on a 'Reasonable Assurance' basis in accordance with the ISAE 3000. The Auditor and the Accredited Refiner shall amend the terms and conditions of the Auditor’s engagement accordingly. XXIII. Mandatory Follow-Up Audit (a) If an audit results in a rating of 'Not compliant with International Financial Services Centres Authority Good Delivery Guidelines - High Risk Deviations,' the Auditor must conduct a Follow-Up Audit based on the 'Reasonable Assurance’ in accordance with the ISAE 3000 within 180 days of issuing the applicable Accredited Refiner's Audit Reports. Page 54 of 57(b) In the event a Follow-Up Audit is required, the Accredited Refiner must confirm with the RO that it has engaged a Empanelled Auditor, and that the Auditor has commenced the Follow-Up Audit within the applicable 90-day period. (c) The scope of any Follow-Up Audit shall focus on the Accredited Refiner's corrective action plan, as provided by the Empanelled Auditor who conducted the previous audit and shall include details of the implementation of the corrective actions to address the rating. (d) Upon completion of a Follow-Up Audit, the Accredited Refiner shall issue a consolidated compliance report that includes the corrective actions undertaken to address high or medium-risk deviations and discloses the individual ratings for compliance with each of the steps outlined in the Framework for Due Diligence of the Guidelines, following the implementation of the corrective action plan. (e) Upon completion of a Follow-Up Audit, the Empanelled Auditor shall issue an independent Auditor’s Assurance Report on the Accredited Refiner's consolidated compliance report and provide copies of both reports, along with the associated corrective action plan, to the RO within 30 days of concluding the Follow-Up Audit. (f) If an Accredited Refiner is required to conduct a Follow-Up Audit, the next annual audit period shall commence from the date of conclusion of the Follow-Up Audit. The Empanelled Auditor must conduct the next audit following a Follow-Up Audit on a 'Reasonable Assurance' standard in accordance with the ISAE 3000. XXIV. Breach of Audit Framework During any audit, any of the following circumstances shall constitute a zero-tolerance breach of the Audit Framework: (a) The Empanelled Auditor is not granted adequate access to any of the Accredited Refiner's locations subject to the audit; (b) The Accredited Refiner engages in unethical practices to influence the audit's outcome; (c) Any misrepresentation or falsification of documentation is carried out by the Accredited Refiner and/or any Supply Chain participant, with the knowledge and acceptance of the Accredited Refiner; Page 55 of 57(d) The Accredited Refiner continues to engage with suppliers, despite due diligence confirming the supplier's direct or indirect involvement in conflict gold, severe human rights abuses, money laundering, or terrorism financing. (e) Upon the occurrence or reasonable suspicion of any of the events set forth in (a) to (d), the Auditor must immediately and confidentially report the matter to the RO, accompanied by the necessary supporting evidence. (f) Upon receipt of such a report, the RO, at its sole discretion, shall determine the validity of the Empanelled Auditor’s claims or suspicions and decide whether to take appropriate action accordingly. XXV. Comprehensive Management Report (a) An Accredited Refiner is required to provide a limited assurance report on an annual basis and a reasonable assurance report every three (3) years from any of the empanelled auditors, with a copy of the report to the Authority stating that that the Accredited Refiner is in compliance with the International Financial Services Centres Authority Good Delivery Guidelines, in accordance with the standards for Assurance Engagements set forth in the ISAE 3000. (b) The Report shall encompass all activities performed by the auditor as stipulated under the International Financial Services Centres Authority Good Delivery Guidelines. Creation of an Audit Guidance Training of the personnel in the Third-Party Auditors 7. The Empanelled Auditor shall ensure that its personnel (for e.g. the audit managers), are well trained, for conducting the Third-Party Audits. The training session shall cover the processes as prescribed under the Risk-Focused Regulatory Compliance Framework (RFRC) and Risk Based Operational Excellence Framework of the Guidelines. The Empanelled Third-Party auditors may also refer to any training/guidance/certifications/study material available and recognised globally that shall be the basis for creating an Audit Guidance Training of the Audit personnel. Training may be online or in person training. Page 56 of 578. The Empanelled Third-Party Auditor shall be required to maintain detailed records of all training activities, including but not limited to attendance records and feedback forms, and shall make such records available to the RO upon request at any time. Suspension, withdrawal or cancellation of empanelment: 9. The empanelment of the of auditing organization may be suspended, withdrawn or cancelled if: (a) Quality of the third-Party audits is compromised (b) Auditing organization ceases to comply with the empanelment criteria (c) Professional misconduct (d) The conduct by the empanelled auditors constitutes a breach of the following fundamental principles of an effective audit: (i) Integrity: Violates the core principle of professionalism. (ii) Fairness: Fails to uphold the duty to report truthfully and accurately. (iii) Due Professional Care: Neglects the application of diligence and sound judgment in assessments. (iv) Confidentiality: Compromises the security and protection of sensitive information. (v) Independence: Undermines the impartiality of the assessment and objectivity of conclusions. (vi) Evidence-Based Approach: Contradicts the rational methodology for achieving reliable and reproducible conclusions in a systematic assessment process. (vii) Risk-Based Approach: Disregards the audit approach that considers risks and opportunities effectively. Page 57 of 57