sabotage, computer viruses and similar events or the loss of support services from third-parties such as internet backbone
providers. For instance, in the past, there have been concerns on inadequate cyber security measures, inadequate
implementation of controls such as disk encryptions on ATM devices, inadequate application of security testing and review
of configuration changes on a periodic basis. Our systems are also potentially vulnerable to data security breaches, whether
by employees, who may lack experience with our newer information technology systems, or others, that may expose
sensitive data to unauthorized persons. We undertake a high volume of transactions, including through internet and mobile
banking, and cannot assure you that we will be able to prevent occurrence of any disruption or successfully contain the
consequences of any failures. Data security breaches could lead to the loss of customer data, trade secrets or other
intellectual property, or could lead to the public exposure of personal information (including sensitive financial and
personal information) of our customers and employees. Although we intend to continue to implement security measures
and establish operational procedures to prevent break-ins, damage and failures, there can be no assurance that instances of
IT infringements and security breaches will not take place in the future or that our security measures will be adequate or
successful. Failed security measures could have a material adverse effect on our business, our future financial performance
and the trading price of the Equity Shares.

Further, we have entered into agreements and are dependent on technology service providers to set up the IT infrastructure.
If these service providers are unable to fulfil their contractual obligations or if we encounter any failure in the timely
implementation, performance or integration of such systems, we may experience interruptions in our operations, loss of
customers, damaged reputation and weakening of our competitive position. Also see “ — Any non-compliance with law or
unsatisfactory service by service providers engaged by us for certain services could have an adverse impact on our
business and results of operations” on page 45. In addition, our success will depend, in part, on our ability to respond to
new technological advances and emerging banking and other financial services industry standards and practices in a cost-
effective and timely basis. The development and implementation of such technology entails significant technical and
business risks. There can be no assurance that we will successfully implement new technologies or adapt our transaction
processing systems to customer requirements or improving market standards. In addition, the Supreme Court, in its
judgment of September 2018, held that private entities will be barred from using Aadhaar numbers for e-KYC
authentication purposes. Pursuant to a recent amendment in 2019, to the Aadhaar (Targeted Delivery of Financial and
Other Subsidies, Benefits and Services) Act, 2016, which was effected after the Supreme Court judgment, entities will be
able to carry out e-KYC subject to meeting certain specific conditions, including compliance with such standards of
privacy and security as may be prescribed. Further, entities are allowed to carry out e-KYC only if they are permitted to
offer authentication services under any other law, or if such authentication is for certain specified purposes, as the central
government may prescribe. In January 2020, with a view to use digital channels for customer identification process by the
registered entities, the RBI amended the Know Your Customer Direction, 2016, to inter alia, allow ‘Video-based Customer
Identification Process’ (““V-CIP”). The V-CIP is a consent-based alternate method of establishing the customer's identity
for customer onboarding. These developments are expected to severely impact banking and fintech companies, requiring
them to rely on alternate means for authentication which may not be as streamlined or cost efficient. In the event we are
unable to successfully implement these measures and/ or fail to adopt the V-CIP as efficiently as our competitors, it may
adversely affect our business and operations.

On September 14, 2020, RBI released guidelines on automation of income recognition, asset classification and
provisioning processes pursuant to which banks have been advised to put in place and upgrade their systems by June 30,
2021 to inter alia, recognize and derecognize income in case of impaired assets, configure the NPAs and NPIs in the system
without any manual intervention. Certain exceptions have been granted from system driven classification in cases which
are expected to be minimum and temporary subject to certain conditions. In such cases, the banks are required to maintain
system generated logs for all exceptions for a minimum period of three years. These measures may result in additional
cost of compliance that may adversely impact our business, results of operations and financial condition.

We are exposed to operational and credit risks which may result in NPAs. If we are unable to control the level of NPAs
in our portfolio or if we are unable to improve our provisioning coverage as a percentage of Gross NPAs, our business,
financial conditions, results of operations and cash flows could be adversely affected.

As of March 31, 2018, 2019 and 2020 and as of December 31, 2020, our Gross NPAs were 2 565.69 million, = 496.21
million, = 1,012.50 million and % 299.13 million, respectively, representing 3.54%, 1.81%, 2.79% and 0.78% of our Gross
Advances, respectively, while our Net NPAs were = 292.27 million, = 120.06 million, = 203.74 million and = 128.14
million, respectively, representing 1.86%, 0.44%, 0.57% and 0.33% of our Net Advances, respectively. Our ability to
manage the credit quality of our loans, which we measure in part through NPAs, is a key driver of our results of operations.
Our NPAs may increase in the future, due to several factors, including increased competition, adverse effects on the
business and results of operations of our borrowers, a rise in unemployment, a sharp and sustained rise in interest rate,
slow industrial and business growth, changes in customer behavior and demographic patterns, political influences and
central and state government decisions and changes in regulations. In particular, we could experience a significant increase
in our NPA levels due to deterioration in the credit quality of our customers, as our target borrower segment primarily
comprises small traders, individuals with micro-enterprises and others belonging to the unorganized sector, who are most
impacted due to the economic downturn caused by COVID-19 related measures such as closure of non-essential services.

28
