23.

We may face cyber threats attempting to disrupt products and services and theft or leakage of sensitive
internal data or merchant or cardholder information, possibly causing disruptions in the transactions
Processed on or through our products or services, damaging our relationships with our customers and
exposing us to liability.

As part of our payment services, we electronically process and transmit cardholder information. We
interact with and offer our products and services to our customers through a range of digital channels
including our POS network and ATMs. Therefore, we are exposed to various cyber threats including (i)
phishing and trojans targeting our customers, wherein fraudsters send unsolicited mails to our customers
seeking account sensitive information or to infect customer machines to search and attempt exfiltration of
account sensitive information; (ii) hacking, wherein attackers seek to hack into our website and system
with the primary intention of causing reputational damage to us by disrupting services; and (iii) data theft
or ransomware, wherein cyber criminals may attempt to enter our network with the intention of stealing
our data or information or by encrypting some or all of our data and information with the intent to
demand a ransom for its restoration. Although we have instituted policies on network security, wireless
network access and acceptable usage to safeguard our data and have not experienced any data breaches in
the last three financial years, such risks have significantly increased in recent years, and may continue to
do so as we continue to expand our Ongo ecosystem and provide a larger suite of VAS that rely on
mobile payments and other digital-based services and applications. Cybersecurity risks have significantly
increased in recent years, in part due to the increased sophistication and activities of organized crime
affiliates, terrorist organizations, hostile foreign governments, disgruntled employees or vendors,
activists and other external parties, including those involved in corporate espionage. The encryption
software and the other technologies that we and our partners use to provide security for storage,
processing and transmission of confidential customer and other information may not be effective to
protect against data security breaches. Further, our and our customers’ data may be handled or processed
by third-party vendors, and we may not be able to control the strength and scale of their cybersecurity
measures. Additionally, the existence of cyber-attacks or security breaches at third-party vendors with
access to our data may not be disclosed to us in a timely manner.

The risk of unauthorized circumvention of our security measures has been heightened by advances in
computer capabilities and the increasing sophistication of hackers. Unauthorized access to our computer
systems, or those of our third-party service providers, and misuse of our confidential or proprietary data,
by third parties or our own employees, could result in the theft or publication of the information or the
deletion or modification of sensitive records, and could cause interruptions in our operations. In view of
the COVID-19 pandemic, work-from-home arrangements have been enabled for our employees. This has
exposed us to risks arising on account of remote work environment, data security issues, increased cyber-
attacks and availability of critical functions and IT systems. See “— The Coronavirus Disease
(COVID-19) pandemic has had and may continue to have certain adverse effects on our business,
operations, cash flows and financial condition. The continuing impacts of the Coronavirus Disease
(COVID-19) are unpredictable and could be significant, and the extent to which it or the effect of
outbreaks of any other severe communicable disease may continue to do so in the future is uncertain and
cannot be predicted.” on page 25. Further, in the absence of specific data protection laws in India, such
private information stored in our database may be vulnerable and susceptible to data breaches. See “—
External Risk Factors — Changing laws, rules and regulations and legal uncertainties across the
multiple jurisdictions we operate in may adversely affect our business, results of operations, cash flows,
financial condition and prospects.” on page 53. Any inability to prevent security breaches could damage
our relationships with our customers, cause a decrease in transactions by individual cardholders, expose
us to liability which may not be capped or limited under our agreements with our customers and which
may include claims for unauthorized purchases, and subject us to penalties. These claims also could
result in protracted and costly litigation. If unsuccessful in defending that litigation, we might be forced
to pay damages or change our business practices. In addition, although we have obtained cyber liability
insurance to cover losses arising out of certain security or privacy breaches, we cannot assure you that
any claim under such policy will be honoured fully, in part or on time, or that we have taken out
sufficient insurance to cover all material losses.

Further, additional regulations, prompted by a significant data security breach or changes in data
protection laws in India, could impose new and costly compliance obligations. Any material increase in
our costs resulting from additional regulatory burdens being imposed upon us or litigation could have an
adverse effect on our business, results of operations, cash flows and financial condition.

40
