Risk Mitigation Plan

2. Background

Mahavir Bullion & Refinery Private Limited (MBRPL or the Company) was incorporated in 2018 with the objective of providing refining and related precious-metal services to business houses, precious-metal traders and jewellers. The Company recognises that its operations and supply chains may be exposed to commercial, operational, compliance, responsible-sourcing, financial, security, environmental, health and safety and reputational risks.

This Risk Mitigation Plan establishes the Company's structured approach for identifying, assessing, treating, monitoring, reporting and reviewing risks. The original Risk Mitigation Plan identifies CAHRA determination, KYC and due diligence, origin information, sanctions and legal/internal sourcing checks as key risk-identification controls.

3. Introduction

The Company shall maintain a documented and risk-based framework to ensure that identified risks are assessed and addressed in a timely and proportionate manner. Risk treatment shall be integrated with responsible sourcing, KYC/due diligence, human rights, security, health and safety, environmental management, procurement, operations and other relevant management systems.

This Plan shall be read with the Company's Supply Chain Policy, AML/CFT Policy, KYC/Due Diligence SOP, Human Rights Policy, Health & Safety Risk Assessment Policy, Security Risk Assessment Policy and other applicable controlled documents.

4. Objectives

• Identify material risks that may affect the Company's people, operations, supply chains, stakeholders, legal compliance, business continuity or reputation.
• Assess likelihood and potential impact using a documented risk-rating methodology.
• Define proportionate mitigation actions, responsible owners and timelines.
• Prevent or reduce adverse impacts through controls, engagement, monitoring and escalation.
• Ensure higher-risk supply-chain issues are addressed consistently with responsible-sourcing due diligence.
• Provide management and the Board with timely risk information for decision-making.
• Maintain evidence of risk assessment, mitigation, monitoring and closure for internal and RJC audit purposes.

5. Applicability

This Plan applies to all areas of MBRPL operations and relevant business relationships, including sourcing/procurement, refinery operations, customers, suppliers, aggregators, logistics, finance, security, human resources, health and safety, environmental management and responsible-sourcing activities.

6. Risk Management Process

• Risk identification
• Risk assessment and rating
• Risk treatment / mitigation planning
• Implementation of controls
• Monitoring and review
• Escalation and reporting
• Closure, acceptance or continued monitoring

The process shall be documented sufficiently to demonstrate why a risk was rated at a particular level, what treatment was selected, who owns the action, the applicable timeline and how effectiveness was evaluated.

7. Risk Identification

The Company shall identify risks through operational assessments, supplier/customer due diligence, transaction review, incident and near-miss information, audits, complaints, legal/regulatory changes, stakeholder feedback, security assessments, H&S assessments, environmental assessments and responsible-sourcing due diligence. For responsible-sourcing risks, the Company shall identify Conflict-Affected and High-Risk Areas (CAHRA) using documented resources, criteria and review frequency. The original Plan states that the Company has established a CAHRA identification procedure.

KYC and due diligence shall obtain and assess counterparty legal identity, relevant ownership/control, business information, source/origin information and other risk information proportionate to the relationship. For imports, the Company shall request origin information for each material transaction and understand direct supplier names and locations.

8. Risk Assessment and Rating

Risks shall be assessed using the Company's approved risk matrix. The assessment should consider, as applicable, likelihood, severity/impact, scope, duration, legal/regulatory exposure, human-rights implications, supply-chain implications, financial impact, operational impact and reputational impact.

9. Risk Mitigation / Treatment

The Company shall select treatment according to the nature and severity of the risk. Treatment may include avoiding the activity, reducing likelihood or impact through controls, transferring/contractually allocating risk where appropriate, accepting a controlled residual risk, engaging with a counterparty to improve performance, suspending activity, or disengaging where mitigation is unsuccessful or continued engagement would be inappropriate.

The original Plan specifies the following risk-rating responses and timelines. These controls are retained as the Company's existing framework and should be applied consistently with the Responsible Sourcing Policy and any approved KYC/Due Diligence SOP.

10. Responsible-Sourcing Risk Mitigation

• Where a responsible-sourcing red flag is identified, the Company shall document the risk, evidence, mitigation action, owner and decision.
• Mitigation may include obtaining additional KYC/origin documents, clarification from the supplier/customer, enhanced due diligence, additional transaction checks, site or document review, increased monitoring, corrective-action commitments or other proportionate measures.
• Senior Management shall be informed of material unresolved risks and shall decide whether to continue, suspend or disengage, as appropriate.
• Risk mitigation plans and their effectiveness shall be subject to ongoing monitoring and reporting to management/Board where material.

The original Responsible Sourcing Policy separately states that risk mitigation plans should be monitored, that failed mitigation may lead to suspension/discontinuation, and that changes in supply chain circumstances may require additional fact and risk assessment.

11. Risk Monitoring and Review

• Reconsider risk context, rating, treatment and responsibilities.
• Review previously identified risks and determine whether controls remain effective.
• Deactivate a risk only where documented monitoring demonstrates that likelihood and impact have become non-existent or negligible.
• Review risk treatment methodologies against the Company's Risk Management Policy and applicable regulatory requirements.
• Repeat or update assessments after significant incidents, changes in supply chain, changes in counterparties, changes in law, new information or other material changes in circumstances.

The original Plan expressly requires ongoing monitoring and review of risk context, ratings, treatment, responsibilities and previously identified risks.

12. Risk Reporting and Escalation

Material risks shall be reported to appropriate management and, where required, the Board. Management/Board oversight shall include review of risk-mitigation strategy, organisational responsibility, internal controls and the effectiveness of the risk-management framework.

• High and critical/residual risks shall be escalated promptly.
• Material unresolved responsible-sourcing risks shall be escalated to Senior Management and, where appropriate, the Board.
• Risk owners shall report progress against mitigation actions.
• Overdue actions shall be escalated to the next appropriate management level.
• Decisions to accept, suspend, restrict or terminate a material risk relationship shall be documented.

13. Risk Mitigation Register

The Company shall maintain a Risk Register / Risk Mitigation Register containing, at minimum:

• Risk ID and date identified
• Risk category and description
• Source / affected process or counterparty
• Likelihood and impact
• Initial risk rating
• Existing controls
• Mitigation / corrective actions
• Responsible owner
• Target date
• Status
• Residual risk rating
• Evidence / closure reference
• Management escalation / decision where applicable

The register shall be kept current and supported by objective evidence such as KYC/EDD files, risk assessments, incident records, audit findings, correspondence, corrective-action records and management approvals.

15. Documentation and Record Keeping

• Risk registers and risk assessments
• Risk mitigation plans and action trackers
• KYC / due-diligence and responsible-sourcing records
• Counterparty communications and mitigation evidence
• Incident, complaint and audit records relevant to risk
• Management/Board review records and decisions
• Closure and residual-risk acceptance records
• Training and awareness records where risk responsibilities require training

Records shall be retained securely in accordance with applicable law and the Company's document-retention requirements. Access shall be restricted to authorised personnel.

16. Training and Awareness

• Relevant personnel shall be trained on risk identification, escalation and mitigation responsibilities.
• Procurement, sourcing, compliance and other risk-exposed functions shall receive role-specific training.
• Training shall include responsible-sourcing red flags, KYC/EDD escalation, documentation and non-retaliation where relevant.
• Training attendance and content shall be documented.

17. Internal Review and Assurance

• The Company shall periodically review the effectiveness of the Risk Mitigation Plan and associated controls.
• Internal reviews/audits shall examine whether risks are identified, rated, treated, monitored and documented consistently.
• Findings shall have responsible owners and target dates and shall be tracked to closure.
• Material weaknesses shall be escalated to Senior Management and, where appropriate, the Board.

18. Policy Review

This Risk Mitigation Plan shall be reviewed at least annually and additionally following material changes in operations, supply chains, legal or regulatory requirements, RJC requirements, significant incidents, audit findings, material changes in risk exposure or other circumstances that could affect the effectiveness of the Plan.

19. Related Controlled Documents

• Supply Chain Policy – RJC COP 2024
• AML/CFT Policy – RJC COP 2024
• KYC / Due Diligence SOP
• Human Rights Policy – RJC COP 2024
• Health & Safety Risk Assessment Policy – RJC COP 2024
• Security Risk Assessment Policy – RJC COP 2024
• Grievance Redressal Policy – RJC COP 2024