Security Risk Assessment & Management Policy

Company Name	Mahavir Bullion & Refinery Private Limited	Policy No.	MBR/SRAMP/06
Policy Title	Security Risk Assessment & Management Policy	Revision Date	01/04/2026
Effective Date	01/04/2025	Review Date	01/04/2027
Approved By	Board of Directors	Approval Date	01/04/2026
Policy Owner	Compliance Officer / Senior Management	Classification	Controlled Document
Applicable Standard	RJC COP 2024	Next Review	Annually

2. Introduction
Mahavir Bullion & Refinery Private Limited (MBRPL) recognises that refining and bullion operations involve high-value precious metals, sensitive information, controlled areas, specialised processes and movements of material. The Company therefore maintains a structured approach to identifying, assessing, treating and monitoring security risks.

RJC COP 2024 COP 13.1 requires members to assess security risks and establish measures protecting workers, visitors and relevant business partners against theft, damage or substitution of products on premises and during events, exhibitions and shipments. COP 13.2 requires security personnel to respect human rights and dignity and use force only when strictly necessary and proportionate to the threat.
3. Purpose
• Protect employees, visitors, contractors, security personnel, premises, equipment, precious metals and confidential information.
• Identify security vulnerabilities and assess likelihood and potential impact.
• Prevent and detect theft, diversion, tampering, substitution, unauthorised access and collusion.
• Maintain secure and traceable movement of precious metals from receipt through processing, storage and dispatch.
• Establish clear responsibilities for assessment, controls, incident response and corrective action.
• Provide evidence of an effective security management system for RJC COP 2024.
4. Scope
This Policy applies to all employees, security personnel, supervisors, contractors, job workers, cleaners, logistics personnel, visitors and relevant business partners, as applicable.

It covers refinery and melting areas; aqua regia and chemical-processing areas; fire assay/laboratory areas; precious-metal storage and vaults; receiving, weighing and dispatch; chemical storage; administrative/control rooms; and internal/external movement of dore, scrap, samples and bullion.
5. RJC COP 2024 Alignment

RJC Requirement	How this Policy Addresses It	Key Evidence
COP 13.1 – Security risk assessment and protection	Security risks are identified, assessed and controlled for personnel, premises, products and shipments.	Risk assessment; risk register; controls; incident records.
COP 13.2 – Security and human rights	Security personnel must respect human rights and use only necessary and proportionate force.	Security SOP; training; contracts; incident records.
COP 2 – Management systems	Responsibilities, procedures, records, monitoring, corrective action and review are established.	Approved policy; procedures; registers; management review.

Risk Category	Examples
Physical Security Risks	Break-in, intrusion, unauthorised entry, tailgating and perimeter vulnerabilities.
Asset Theft and Diversion	Theft, pilferage, substitution, concealment of gold dust/scrap, mixing/mislabeling and collusion.
Supply Chain and Transport Security	Tampered consignments, high-risk routes, transporter weaknesses and receipt/dispatch vulnerabilities.
Personnel and Insider Risks	Misuse of access, collusion, coercion and compromised security personnel.
Information and Data Security	Unauthorised access, manipulation of weighment/assay records and disclosure of sensitive dispatch/stock information.
Visitor and Contractor Risks	Unauthorised movement, inadequate identification and non-compliance with site security rules.

7. Security Risk Assessment Framework
RJC guidance states that risk assessments should identify significant impacts and risks and that controls and treatment plans should be prioritized according to significance.

1. Identify assets, people, processes, locations, activities and information requiring protection.
2. Identify threats and vulnerabilities through site inspections, incident history, employee inputs, CCTV/blind-spot review, access-point review and process observations.
3. Assess likelihood and impact, including financial, operational, safety, human-rights and reputational consequences.
4. Assess existing controls and residual vulnerability.
5. Assign a risk rating and define owner, mitigation action, target date and monitoring method.
6. Review at least annually and after significant incidents, material operational changes, new threats, major security weaknesses or audit findings.
8. Risk Rating and Treatment

Risk Level	Typical Meaning	Required Action	Monitoring
High	Significant likelihood/impact or critical vulnerability.	Immediate escalation and mitigation; consider restricting activity until controlled.	Frequent follow-up.
Medium-High	Material weakness requiring prompt action.	Management-approved corrective action with defined timeline.	Regular monitoring.
Medium	Manageable risk requiring planned controls.	Implement corrective action and monitor effectiveness.	Periodic review.
Low-Medium	Limited exposure with effective controls.	Maintain controls and improve where practical.	Routine monitoring.
Low	Low likelihood/impact with effective controls.	Maintain controls and monitor for change.	Routine checks.

Role	Responsibilities
Board / Senior Management	Approve policy; provide resources; review significant risks, incidents and corrective actions.
Security Manager	Lead security functions; coordinate assessments; supervise security personnel; review access controls; coordinate with relevant authorities.
Compliance Manager	Support risk methodology, RJC compliance, records, escalation and corrective-action monitoring.
Control Room / Security Team	Monitor CCTV/access systems; maintain logs; report suspicious activity; manage keys/passes and records.
Department Heads	Implement controls; report vulnerabilities/incidents; ensure employees follow requirements.
All Employees / Contractors	Follow access rules; protect confidential information; report suspicious or unusual activity immediately.

10. Physical Security Controls
• Perimeter and entry/exit controls appropriate to site risk.
• Controlled access to restricted/high-risk areas.
• Visitor identification, authorisation and escort/restriction as applicable.
• CCTV coverage of critical areas and restricted access to recordings.
• Periodic review of CCTV functionality, blind spots and retention.
• Security deployment and patrols based on assessed risk.
• Vault/precious-metal storage controls, authorised access, dual-control/maker-checker and entry/removal logs where applicable.
• Key, access-card, biometric and credential management with prompt withdrawal after role change/separation.
11. Internal Movement and Precious-Metal Security
• Precious-metal movement shall be authorised and traceable.
• Weighment, transfer, sample movement and dispatch shall use appropriate maker-checker controls.
• Unique batch/lot identification shall be maintained where applicable.
• High-risk movement shall be monitored through appropriate physical/CCTV controls.
• Inventory reconciliation and investigation of unexplained discrepancies shall be performed.
• Spillage, recovery and unusual-loss records shall be maintained and escalated.
12. Security During Raw-Material Receipt
• Receipt through approved entry and receiving arrangements.
• Check material against relevant delivery and transaction documentation.
• Perform and record weight/package/seal checks where applicable.
• Escalate suspicious, damaged, tampered or inconsistent consignments before normal processing.
13. Security During Refining and Processing
• Restricted access to refining, melting, assay and other high-risk areas.
• Compliance with PPE and site security requirements.
• Controlled and traceable samples/intermediate materials.
• Spillage, recovery and material-loss controls.
• No unauthorised removal of material, tools or records.
14. Finished-Goods Dispatch Security
• Use approved transporters/service providers.
• Verify vehicle, driver and dispatch documentation before release.
• Use secure/tamper-evident packaging and identification where applicable.
• Protect dispatch schedules and shipment information on a need-to-know basis.
• Use route/tracking controls where required by risk assessment or contract.
• Maintain dispatch and handover records sufficient for traceability.
15. Security Personnel and Human Rights
Security personnel shall respect human rights and dignity. Force shall only be used where strictly necessary and proportionate to the threat, consistent with RJC COP 13.2.
Security risk assessments shall consider risks to disadvantaged and vulnerable groups and the potential impact of security measures on them. RJC guidance specifically highlights protection of vulnerable groups and children in security-related interactions.

• Provide appropriate training on conduct, human rights, escalation and use-of-force requirements.
• Include expected conduct, reporting and site rules in security-provider contracts where appropriate.
• Prohibit harassment, intimidation, discrimination, retaliation and abusive conduct.
• Investigate alleged security misconduct through applicable grievance and disciplinary processes.
16. Information Security Controls
• Sensitive stock, assay, dispatch and security information shall be need-to-know.
• Use role-based access to sensitive systems.
• Manage authentication controls under IT requirements.
• Restrict CCTV/security-system data to authorised personnel.
• Unauthorised copying, disclosure or removal of sensitive information is prohibited.
17. External Parties, Contractors and Security Providers
• Inform relevant external parties of site security rules.
• Verify identity and authorisation before entry where applicable.
• Require cooperation with security checks and monitoring.
• Include security expectations in contracts/service arrangements where appropriate.
• Repeated or serious non-compliance may result in restricted access or contractual action.
18. Security Incident Reporting and Response
7. Protect people and secure affected areas/material where safe.
8. Notify the Security Manager/designated responsible person immediately.
9. Record the incident in the Security Incident Register.
10. Preserve relevant evidence and records.
11. Investigate proportionately and document findings.
12. Assign corrective/preventive actions and owners.
13. Escalate significant incidents to management and authorities where legally or operationally required.
14. Verify completion and effectiveness of corrective actions.
19. Security Training and Awareness
• Security induction for relevant employees, contractors and security personnel.
• Training on access control, visitor management, suspicious-activity reporting and precious-metal security.
• Role-specific human-rights-respecting training for security personnel.
• Refresher training at planned intervals and after significant incidents or material changes.
• Maintain training records showing topic, date, participants and trainer/organiser.
20. Security Risk Register – Minimum Requirements
The Security Risk Register shall, at minimum, capture:

Risk ID	Area/Process	Asset/People	Threat/Vulnerability	Existing Controls	Likelihood	Impact	Risk Rating	Mitigation / Action
SR-01	Vault Operations & Storage	High-value inventory (Bullion bars), Vault Staff	Internal theft or unauthorized access to the main vault.	Biometric door access, CCTV coverage, standard double-lock system.	Low	Critical	Medium	Implement strict "two-person rule" for all vault entries. Upgrade to dual-authentication biometrics.
SR-02	Logistics & Transportation	Precious metals in transit, Transport Drivers/Guards	Armed robbery, hijacking, or route interception during transit to clients.	Armoured vehicles, basic GPS tracking, armed transport personnel.	Medium	Critical	High	Institute randomized delivery routes. Install real-time engine-kill switches and live-feed cabin cameras.
SR-03	Perimeter & Site Security	Refinery infrastructure, Night-shift workers	Perimeter breach or trespassing by unauthorized individuals during non-operational hours.	24/7 manned guard house, boundary wall, basic alarm system.	Medium	High	High	Install motion-detection fencing, infrared night-vision CCTV, and panic buttons in processing areas.
SR-04	Health & Safety / Emergency	Refinery personnel, Processing equipment	Fire or chemical spill in the refining area leading to injury or forced evacuation, leaving assets unsecured.	Fire extinguishers, basic first aid kits, emergency exit signs.	Low	High	Medium	Conduct quarterly evacuation drills. Upgrade automated fire suppression system in high-heat zones.

21. Monitoring, Assurance and Management Review
• Periodic inspection of security controls and restricted areas.
• Review of access-control, visitor, key, CCTV and incident records.
• Review of incidents, near misses, discrepancies and trends.
• Verify corrective actions are completed and effective.
• Management review of significant risks and residual risk.
• Internal/independent security assessments where required.
• Use audit findings and incident lessons to strengthen controls.
22. Records and Retention
• Security risk assessments and risk registers
• CCTV/system inspection records
• Visitor and access-control logs
• Key/access-card registers
• Vault access records
• Receiving and dispatch security records
• Security incident/investigation reports
• Security training records
• Security-provider due diligence/contracts
• Corrective-action and management-review records
23. Grievance, Reporting and Non-Retaliation
Employees, contractors and other affected persons may raise security-related concerns through the Company's grievance, whistleblowing or other approved reporting channels. Retaliation against a person who raises a concern in good faith or participates in an investigation is prohibited.
24. Policy Review and Continuous Improvement
This Policy shall be reviewed at least annually and sooner following a major security incident, significant operational change, new threat, change in applicable law or RJC requirement, material audit finding, security-system change or other significant risk development.

The Company shall use incidents, near misses, risk assessments, audit findings, employee feedback and management review to improve security controls.
25. Related Controlled Documents
• AML/CFT Policy – RJC COP 2024
• Supply Chain Policy – RJC COP 2024
• Risk Mitigation Plan – RJC COP 2024
• Anti-Bribery & Anti-Corruption Policy – RJC COP 2024
• Human Rights Policy – RJC COP 2024
• Grievance Redressal Policy – RJC COP 2024
• Emergency Evacuation Plan – RJC COP 2024
• Health & Safety Risk Assessment Policy – RJC COP 2024
• Applicable security SOPs, registers and work instructions
For Mahavir Bullion & Refinery Private Limited

Prepared By	Reviewed & Approved By
Compliance Officer	Director
Rushikesh Rajendra Deshmukh	Jitendra Panditrao Deshmukh

PURPOSE

The Anti-Bribery Policy (“Policy”) emphasizes Mahavir Bullion & Refinery Private Limited’s (hereinafter referred to as “MBR/Company”) zero-tolerance approach to bribery and corruption. It establishes the principles with respect to applicable anti-bribery and anti-corruption laws. The policy provides information and guidance on how to recognise and deal with bribery and corruption issues. It guides us to act professionally, fairly and with utmost integrity in all our business dealings and relationships, wherever we operate.

POLICY STATEMENT

Bribery is the offering, promising, giving, accepting or soliciting of an advantage as an inducement for action which is illegal or a breach of trust. A bribe is an inducement or reward offered, promised or provided in order to gain any commercial, contractual, regulatory or personal advantage.

It is our policy to conduct our business in an honest and ethical manner. We take a zero-tolerance approach to bribery and corruption. We are committed to acting professionally, fairly and with integrity in all our business dealings and relationships wherever we operate and implementing and enforcing effective systems to counter bribery. We will uphold all laws relevant to countering bribery and corruption in all jurisdictions in which we operate.

SCOPE

The principles set forth in this policy are applicable to all directors, officers, employees, consultants, contractors, associates and business partners of the company. It is, therefore, the responsibility of all to follow and adhere to all elements described in the policy. In countries where there are more stringent applicable laws, regulations or industry codes, MBR requires compliance with the most restrictive requirement, and the principles set out in this policy shall be superseded in those specific countries.

ANTI-BRIBERY AND CORRUPTION STANDARDS

It is prohibited for the company or its directors, officers, employees, consultants, business partners or contractors to:

a) Give, promise to give, or offer a payment, gift or hospitality to a third party or otherwise engage in or permit a bribery offence to occur, with the expectation or hope that an advantage in business will be received, or to reward a business advantage already given.
b) Give, promise to give, or offer a payment, gift, or hospitality to a third party to "facilitate" or expedite a routine procedure.
c) Accept a payment, gift or hospitality from a third party if you know or suspect that it is offered or provided with an expectation that a business advantage will be provided by the company in return.
d) Threaten or retaliate against another employee or worker who has refused to commit a bribery offence or who has raised concerns under this Policy or the company’s whistleblower policy.
e) Engage in any activity that might lead to a breach of this Policy.

GIFTS, HOSPITALITY AND ENTERTAINMENT

a) MBR acknowledges that exchange of nominal gifts and sharing of entertainment is customary in many parts of the world during national, cultural and religious occasions.

b) The giving or receipt of gifts by Associates is not prohibited, if following requirements are met:
- No quid pro quo – There must always be a legitimate business purpose to support gifts related expenses. Customary gifts, meals, entertainment, travel or lodging may never be given or received in return for a favour/ favourable treatment or to refrain from doing something disadvantaging Company.
- It complies with all applicable Anti-bribery and Anti-corruption laws;
- It does not include cash or a cash equivalent (such as gift certificates or vouchers);
- Considering, the reason and nature of the gift, it is of an appropriate type and value and given at an appropriate time;
- It is given openly, not secretly.

c) MBR appreciate that the practice of giving business gifts varies between countries and regions and what may be normal and acceptable in one region may not be in another. The test to be applied is whether in all the circumstances the gift or hospitality is reasonable and justifiable. The intention behind the gift should always be considered.

FACILITATION PAYMENTS AND KICKBACKS

Facilitation payments are a form of bribery made for the purpose of expediting or facilitating the performance of a public official for a routine governmental action and not to obtain or retain business or any improper business advantage. Facilitation payments tend to be demanded by low-level officials to obtain a level of service that one would normally be entitled to.

MBR’s strict policy is that facilitation payments must not be paid. MBR recognizes, however, that its employees may be faced with situations where there is a risk to the personal security of an employee or his/her family and where a facilitation payment is unavoidable, in which case the following steps must be taken:
- Keep any amount to the minimum;
- Create a record concerning the payment; and
- Report it to your manager.

In order to achieve our aim of not making any facilitation payments, each business of the company will keep a record of all payments made, which must be reported to the management in order to evaluate the business risk and to develop a strategy to minimize such payments in the future.

POLITICAL CONTRIBUTIONS

MBR do not make donations, whether in cash or kind, in support of any political parties or candidates, as this can be perceived as an attempt to gain an improper business advantage.

CHARITABLE CONTRIBUTIONS

Charitable support and donations are acceptable (and indeed are encouraged), whether of in- kind services, knowledge, time, or direct financial contributions. However, employees must be careful to ensure that charitable contributions are not used as a scheme to conceal bribery. MBR only does charitable donations that are legal and ethical under local laws and practices. No donation must be offered or made without the prior approval of the Management.

RECORD-KEEPING

MBR maintains financial records and has appropriate internal controls in place, which will evidence the business reason for making payments to third parties. MBR maintains a written record of all hospitality or gifts accepted or offered, which will be subject to managerial review. All expense claims relating to hospitality, gifts, or expenses incurred to third parties are submitted in accordance with the company’s expenses policy and specifically record the reason for the expenditure. All accounts, invoices, memoranda, and other documents and records relating to dealings with third parties, such as clients, suppliers, and business contacts, should be prepared and maintained with strict accuracy and completeness. MBR ensures that no accounts are kept "off-book" to facilitate or conceal improper payments.

RAISING A CONCERN AND PROTECTION

a) All MBR associates are encouraged to raise concerns about any issue or suspicion of malpractice at the earliest possible stage. If they are unsure whether a particular act constitutes bribery or corruption, or if they have any other queries, these should be raised with the manager.

b) An associate who refuses to accept or offer a bribe, or those who raise concerns or report another's wrongdoing, are sometimes worried about possible repercussions. MBR aims to encourage openness and will support anyone who raises genuine concerns in good faith under this policy, even if they turn out to be mistaken.

c) MBR will ensure that no one will suffer any detrimental treatment as a result of refusing to take part in bribery or corruption, or because of reporting in good faith their suspicion that an actual or potential bribery or other corruption offence has taken place, or may take place in the future. Detrimental treatment includes dismissal, disciplinary action, threats or other unfavourable treatment connected with raising a concern.

TRAINING AND COMMUNICATION

Training on this policy forms part of the induction process for all new employees. All existing employees will receive regular, relevant training on how to implement and adhere to this policy. In addition, all employees will be asked to formally accept conformance to this policy on an annual basis. Our zero-tolerance approach to bribery and corruption must be communicated to all suppliers, customers, contractors and business partners at the outset of our business relationship with them and as appropriate thereafter.

MONITORING AND REVIEW

The Board of Directors shall monitor the effectiveness and review the implementation of this policy, regularly considering its suitability, adequacy and effectiveness. Any improvements identified will be made as soon as possible. Internal control systems and procedures will be subject to regular audits to provide assurance that they are effective in countering bribery and corruption. All employees are responsible for the success of this policy and should ensure they use it to disclose any suspected danger or wrongdoing. Employees are invited to comment on this policy and suggest ways in which it might be improved. Comments, suggestions and queries should be addressed to the Board of Directors. This policy does not form part of any employee's contract of employment and it may be amended at any time.