35.

provisions created for inclusive finance (JLG) loans as a percentage of our total NPA provisioning was 4.86%, as of
December 31, 2020 and including floating provisions (to the extent utilized), the consolidated provisions attributable to
inclusive finance (JLG) loans was 5.03%, as of December 31, 2020.

It is therefore, difficult to carry out a formal credit risk analyses on our customers based on financial information,
compelling us to rely on certain representations as to the accuracy and completeness of information provided. To further
verify the information provided by potential customers, we conduct searches through credit bureaus for creditworthiness
of our customers who have a credit history. However, a significant majority of our customers may not have any credit
history supported by income statements, tax returns, credit card statements, and statements of previous loan exposures or
other related documents. They may also have limited formal education, and generally are able to furnish very limited
information for us to be able to assess their creditworthiness accurately. In addition, we may not receive updated
information regarding any change in the financial condition of our customers or may receive inaccurate or incomplete
information.

It is therefore difficult to carry out a formal credit risk analyses on some of our customers based on financial information.
There can be no assurance that our risk management controls will be sufficient or that additional risk management
strategies for our customers will not be required. Failure to maintain sufficient credit assessment policies, particularly for
individual borrowers, could adversely affect our credit portfolio resulting in a higher level of NPAs, which could have a
material and adverse effect on our results of operations, financial condition and cash flows.

Our risk management measures may not be fully effective in mitigating our risks in all market environments or against
all types of risks, which may adversely affect our business and financial performance.

Our risk management functions are divided on the basis of key risks typically faced by banks i.e., credit risk, market risk
and asset liability mismatches, liquidity risk, operational risk, cyber security and information security risk. Our risk
management governance framework comprises a Risk Management Committee of our Board and management sub
committees for management of credit risk, cyber security and information security risks, market risk, asset liability
mismatch risk, liquidity risk and operational risk, IT Strategy Committee of the Board supervises the management sub-
committee which focuses on information security and cyber security risks. However, we may not be able to effectively
mitigate all our risk exposures. While we have risk management policies and procedures, our policies and procedures to
identify, assess, monitor and manage risks may not be fully effective. Some of our risk management systems are not
automated and are subject to human error. Some of our methods of assessing and managing risks are based on the use of
observed historical market behavior. As a result, these methods may not accurately predict future risk exposures which
could be significantly greater than those indicated by the historical measures. Management of operations, legal and
regulatory risks requires, among other things, policies and procedures to properly record and verify a large number of
transactions and events, and these policies and procedures may not be fully effective. As we seek to expand the scope of
our operations, we also face the risk that we may not be able to develop risk management policies and procedures that are
properly designed for new business areas or to manage the risks associated with the growth of our existing businesses
effectively. Implementation and monitoring may prove particularly challenging with respect to businesses that we plan on
developing. An inability to develop and implement effective risk management policies may materially and adversely affect
our business, financial condition, results of operations and cash flows.

Further, some of our risk management strategies may not be effective in a difficult or less liquid market environment,
where other market participants may be attempting to use the same or similar strategies to deal with the difficult market
conditions. In such circumstances, it may be difficult for us to reduce our risk positions due to the activity of such other
market participants. Other risk management methods depend upon an evaluation of information regarding markets, clients
or other matters. This information may not in all cases be accurate, complete, up-to-date or properly evaluated.

Our investment and interest rate risks are determined by our ability to properly identify, and mark-to-market changes in
the value of financial instruments caused by changes in market prices or rates. Our earnings are dependent upon the
effectiveness of our management of changes in credit quality and risk concentrations, the accuracy of our valuation models
and our critical accounting estimates and the adequacy of our allowances for loan losses. To the extent our assessments,
assumptions or estimates prove inaccurate or not predictive of actual results, we could suffer higher than anticipated losses.

We are exposed to operational risks arising from inadequacy or failure of internal processes or systems such as employee
negligence, data theft, fraud and embezzlement by customers and/ or third parties, and our actions may not be sufficient
to result in an effective internal control environment. Given our high volume of transactions and changing technology and
payments landscape, errors may be repeated or compounded before they are discovered and rectified. Our management
information systems and internal control procedures that are designed to monitor our operations and overall compliance
may not be able to identify non-compliance or suspicious transactions in a timely manner, or at all. Where internal control
weaknesses are identified, our actions may not be sufficient to fully correct such internal control weaknesses. In addition,
certain processes are carried out manually, which may increase the risk that human error, tampering, frauds or manipulation
will result in losses that may be difficult to detect. As a result, we may suffer monetary losses, which may not be covered

41
