Refund Policy — Cashia

Effective Date: September 10, 2025

PROCESS ELEMENT DESCRIPTION

Process Name — Cashia Customer Refund and Reversal Process

Process Owner — Head of Customer Experience, General Manager Operations. Any process changes must be approved by the process owner.

Objective — This process serves to establish a standardized, efficient, and compliant process for handling customer-initiated refund and reversal requests for Cashia's e-money services. It ensures the protection of customer funds, reduction of potential fraud loss, and adequate adherence to CBK supervisory expectations, including mandatory reversal obligations under the National Payment System Act, AML obligations, and data privacy rights under the Data Protection Act. It further ensures alignment with consumer protection principles as envisaged in global standards such as PSD2, Visa/Mastercard dispute frameworks and FATF guidance on suspicious transaction reversals. This process The objective is to provide timely resolution of customer issues while maintaining fraud prevention measures and regulatory compliance.

Scope — This process covers all refund and reversal activities for Cashia's e-money platform including: mobile money transfers, bill payments, merchant payments, airtime purchases, and cash-in/cash-out transactions. The process applies to all customer-facing channels (mobile app, USSD, customer service), all departments involved in reversal processing (Customer Experience Desk, Fraud and Risk Team, Operations), and all supporting systems (core financial system, fraud detection system, customer relationship management system).

Regulatory/ISO Standards — ISO Standards: ISO 27001:2013 (Information Security Management), ISO 9001:2015 (Quality Management Systems), ISO 20022 (Financial Services Universal Financial Industry Message Scheme). Local Regulations: Central Bank of Kenya E-Money Regulations 2013, National Payment System Act 2011, Data Protection Act 2019, Anti-Money Laundering and Combating of Terrorism Financing Laws. International Standards: Payment Card Industry Data Security Standard (PCI DSS), Financial Action Task Force (FATF) Recommendations.

ROLES & RESPONSIBILITIES

Role 1: Process Owner (Head of Customer Experience & General Manager Operations) – Responsible for ensuring the process is followed, approving process changes, monitoring overall performance, and ensuring customer satisfaction targets are met.

Role 2: Compliance Officer – Ensures compliance with internal processes, ISO and regulatory guidelines, conducts regular process audits, maintains regulatory reporting, and liaises with Central Bank of Kenya on compliance matters.

Role 3: Customer Experience Desk Agent – Acts as first point of contact for reversal requests, performs initial verification and categorization, resolves simple reversals, escalates complex cases, and maintains customer communication throughout the process.

Role 4: Fraud and Risk Analyst – Investigates complex reversal requests, conducts fraud assessments, gathers evidence for decision-making, and implements risk mitigation measures.

Role 5: Operations Manager – Oversees process execution, handles escalated cases, approves high-value reversals, and ensures operational efficiency and compliance.

Role 6: Customer – Provides accurate information for reversal requests, cooperates during investigation processes, and reports suspected fraudulent activities promptly.

PROCESS STEPS

Step 1: Customer Request Initiation
The customer initiates a refund or reversal request by contacting Cashia through one of the approved channels: dedicated customer support phone line, official customer support email, or in-app chat feature within the Cashia mobile application. During this initial contact, the customer must provide their full name, registered mobile phone number, transaction ID of the disputed transaction, detailed reason for the reversal request, and any supporting documentation such as receipts, screenshots, or error messages. The Customer Experience Desk agent logs the request and assigns a unique case reference number.

Step 2: Request Acknowledgment and Initial Verification

Within five minutes of receiving the request, the Customer Experience Desk agent acknowledges receipt of the reversal request via the customer's preferred communication channel, providing the unique case reference number for tracking purposes. The agent then logs into the recipient’s wallet using the details provided, confirms if the disputed funds are still available and if they are, blocks the funds for debit. The agent then performs initial verification by confirming the customer's identity through security questions, validating the transaction details against the core financial system records, and checking for any obvious signs of fraud or system errors. This verification process ensures that only legitimate account holders can initiate reversal requests for their own transactions. If the recipient is different from the complainer, using the official communication channels, notify the recipient that the mentioned funds have been recalled by the sender, why the funds have been frozen.

Step 3: Request Categorization
Based on the initial verification and the nature of the request, the Customer Experience Desk agent categorizes the reversal as either simple or complex.

Simple reversals include straightforward cases such as sending money to the wrong recipient (Stika), duplicate payments, or entering incorrect transaction amounts where the error is clearly evident and low-risk.

Complex reversals involve cases that require detailed investigation, such as fraud claims, disputes between parties, technical system issues, or high-value transactions that necessitate additional scrutiny and approval.

Step 4: Simple Reversal Processing
For simple reversals, the Customer Experience Desk agent

The agent verifies that the recipient has authorized the reversal of the funds.
The agent then confirms the transaction details one final time.
For reversals that include sending out money via Paybill or Bank, the CX agent sends the reversal request on email to the Operations Team clearly explaining the request and giving all the facts. The CX agent should include a copy of the reversal authorisation by the recipient on this email.
Upon receipt, the Operations Team should validate the information on the system and confirm that the funds are still available and held on the recipient’s wallet.
Upon validating the reversal approval included on the email request, the Operations team initiates a reversal for the funds. The reversal process is a maker-checker system.
For Simple Reversals, the Payments Manager or the CX Manager can approve reversals up to Kes 1M. Above Kes 1M the reversals approval should be jointly done by either the CX Manager / the Payments Manager - Jointly with the General Manager
. The agent then updates the case management system with the resolution details and notifies the customer of the successful reversal within twenty-four hours of the initial request. The funds are returned to the customer's account within the same timeframe.

Step 5: Complex Reversal Escalation

For complex reversals, the Customer Experience Desk agent escalates the case to the Fraud and Risk Team within two hours of categorization. Complex reversal requests include any other reversal request outside simple reversals as defined above. Such may include;

Reversal requests where the customer claims unknown debits on their wallets. (Debits that a customer claims they did not authorise)
System / Technical issues - Reversal for debits that may have emanated from internal system glitches.
High / significant value reversal requests that warrant more due diligence before reversing. I.e. Any reversal request whose value is above Kes 500,000
The CX team should check availability of funds on the recipient’s wallet and immediately put a freeze even as the investigations kick off.
The CX team then shares the request with the Fraud and Risk team while keeping the Operations team in copy of the email. In this email, the CX team should include the complainant’ request. Also included on this email should be a comprehensive case summary, all gathered documentation, initial verification results, and a preliminary risk assessment.
Fraud and Risk Team acknowledges receipt of the escalated case and begins the detailed investigation process, which may involve contacting other parties involved in the transaction, reviewing transaction patterns, and conducting fraud analysis.

Step 6: Detailed Investigation

The Fraud and Risk Team conducts a thorough investigation of the complex reversal request over a period not exceeding five business days. This investigation involves analyzing transaction logs, reviewing customer account history, verifying the legitimacy of all parties involved, identifying patterns of fraudulent behavior, and gathering additional evidence as needed. The team may contact merchants, other financial institutions, or law enforcement agencies if the case involves suspected criminal activity. All investigation activities are documented in the case management system with timestamps and responsible analyst identification.

Step 7: Decision Making and Approval

Upon completion of the investigation, the Fraud and Risk Team makes a recommendation to approve or decline the reversal request based on the evidence gathered.

The Fraud and Risk Team communicates this decision back to the CX team while keeping the Operations team in copy.
Upon getting an okay to proceed from the CX team, the Operations team proceeds with the reversal.
The reversal process has dual control. All reversals up to Kes 500,000 should be approved by the Operations Manager or the CX Manager. Reversals above Kes 500,000 in this category should be countersigned by the General Manager.
The decision-making process considers regulatory compliance requirements, fraud risk assessment, customer protection principles, and business impact. All decisions are documented with clear justification and supporting evidence.

Step 8: Customer Notification and Resolution

Once the reversal decision has been advised by the Fraud and Risk team and within ten business days of the initial request, the Customer Experience team updates the customer of the final decision regarding their complex reversal request., The reversal should be processed within twenty-four hours of the decision, and funds are returned to the customer's account. If declined, the customer receives a detailed explanation of the decision, including the specific reasons for denial and information about the escalation process if they wish to appeal the decision. All communications are documented and stored in the customer relationship management system.

Step 9: Case Closure and Documentation

Once the customer has been notified and any approved reversals have been processed, the case is formally closed in the system. The Customer Experience Desk agent or Fraud and Risk Analyst completes a final case summary, updates all relevant systems, and ensures that all documentation is stored correctly for audit and compliance purposes. The case closure includes verification that all regulatory reporting requirements have been met and that any lessons learned are documented for process improvement.

Step 10: Escalation Handling (if applicable)
If a customer is dissatisfied with the reversal decision, they may request escalation through a structured three-level process. Level 1 involves review by a Customer Experience Desk supervisor, Level 2 escalates to the Fraud and Risk Team Lead or Payments Lead, and Level 3 involves the Head of Operations / General Manager for final decision. Each escalation level has defined timelines and decision-making authority, ensuring that customer concerns are addressed fairly while maintaining operational efficiency and risk management standards.

INPUTS

Required Resources:

Customer relationship management (CRM) system for case tracking and documentation
Core financial system for transaction verification and processing
Fraud detection and monitoring system for risk assessment
Secure communication channels (phone, email, WhatsApp, in-app chat)
Customer identity verification tools and databases
Document management system for storing supporting evidence

Required Data:

Customer account information and transaction history
Transaction details including ID, amount, date, and parties involved
Supporting documentation from customers (receipts, screenshots, error messages)
Fraud risk indicators and transaction pattern analysis
Regulatory compliance checklists and audit trails
Historical reversal data for trend analysis and decision-making

Required Systems:

Integrated payment processing platform
Real-time transaction monitoring system
Automated fraud detection algorithms
Secure data storage and backup systems
Regulatory reporting and compliance management tools
Customer communication and notification systems

OUTPUTS

Primary Deliverables:

Resolved reversal requests with appropriate fund transfers or case closures
Comprehensive case documentation and audit trails for regulatory compliance
Customer communication records, including acknowledgments, updates, and final decisions
Fraud investigation reports and risk assessment documentation
Monthly performance reports and key performance indicator summaries
Regulatory compliance reports for Central Bank of Kenya submissions

Expected Results:

Timely resolution of customer reversal requests within defined service level agreements
Maintained customer satisfaction through transparent and efficient processing
Reduced fraud losses through effective investigation and prevention measures
Compliance with all applicable regulatory requirements and industry standards
Continuous process improvement through data analysis and performance monitoring
Enhanced customer trust and confidence in Cashia's payment services

METRICS/KPIs

KPI 1: Average Resolution Time
Measure the average time taken to resolve simple reversals (target: within 24 hours) and complex reversals (target: within 10 business days). This metric ensures adherence to service level agreements and identifies process bottlenecks.

KPI 2: First Contact Resolution Rate
Track the percentage of reversal requests resolved during the initial customer contact without requiring escalation (target: 70% for simple reversals). This indicates process efficiency and customer experience quality.

KPI 3: Customer Satisfaction Score
Monitor customer satisfaction through post-resolution surveys measuring satisfaction with process speed, communication quality, and outcome fairness (target: 85% satisfaction rate).

KPI 4: Fraud Detection Accuracy
Measure the percentage of fraudulent reversal requests accurately identified and prevented (target: 95% accuracy rate). This ensures effective fraud prevention while minimizing false positives.

KPI 5: Compliance Adherence Rate
Track compliance with regulatory requirements including timely reporting, proper documentation, and adherence to Central Bank of Kenya guidelines (target: 100% compliance).

KPI 6: Process Cost Efficiency
Monitor the cost per reversal request processed, including staff time, system resources, and operational overhead (target: continuous improvement in cost efficiency).

KPI 7: Escalation Rate
Track the percentage of cases requiring escalation beyond the initial processing level (target: less than 15% escalation rate for optimal process efficiency).

RISK MANAGEMENT

Risk 1: Fraudulent Reversal Requests
Customers or malicious actors may attempt to exploit the reversal process to obtain unauthorized refunds or reverse legitimate transactions. This risk could result in financial losses, regulatory violations, and damage to customer trust.

Mitigation: Implement multi-layer verification processes including customer identity confirmation, transaction pattern analysis, and fraud detection algorithms. Require additional documentation for high-value reversals and maintain a fraud blacklist database. Conduct regular staff training on fraud identification techniques.

Risk 2: Regulatory Non-Compliance
Failure to adhere to Central Bank of Kenya regulations, Anti-Money Laundering requirements, or international standards could result in regulatory penalties, license suspension, or legal action.

Mitigation: Establish comprehensive compliance monitoring systems, conduct regular internal audits, maintain updated regulatory knowledge through continuous training, and implement automated compliance checks within the reversal process workflow.

Risk 3: Operational Delays and Service Level Breaches
System failures, staff shortages, or process inefficiencies could lead to delays in reversal processing, resulting in customer dissatisfaction and potential regulatory violations.

Mitigation: Implement redundant systems and backup procedures, maintain adequate staffing levels with cross-trained personnel, establish clear escalation procedures, and monitor performance metrics in real-time with automated alerts for potential delays.

Risk 4: Data Security and Privacy Breaches
Unauthorized access to customer information or transaction data during the reversal process could result in privacy violations, identity theft, and regulatory penalties.

Mitigation: Implement ISO 27001 compliant information security measures including encryption, access controls, audit logging, and regular security assessments. Ensure all staff complete data protection training and maintain strict data handling procedures.

Risk 5: Reversal-induced Money Laundering. Criminals could exploit reversals to mask illicit origin of funds.

Mitigation:

AML red flag detection
enhanced due diligence
suspicious transaction blocking

Risk 6: Erroneous System Reversal / Double Debit

Mitigation:

automated reconciliation
independent transaction confirmation log
ledger mismatch alerts

Risk 7: Reversal Authorised by Compromised Credential

Mitigation:

fraud scoring
device fingerprinting
behavioural authentication
MFA step-up

CONTROLS & MONITORING

Process Monitoring Controls: The reversal process is monitored through real-time dashboards displaying key performance indicators, case volumes, and processing times. Automated alerts notify supervisors of cases approaching service level agreement deadlines or requiring immediate attention. Daily management reports provide a detailed analysis of process performance, identifying trends and potential issues.

Compliance Monitoring: The Compliance Officer conducts regular monthly audits to ensure adherence to regulatory requirements and internal policies. All reversal cases are subject to random quality assurance reviews, with findings documented and corrective actions implemented as needed. Automated compliance checks are integrated into the case management system to flag potential violations.

Fraud Monitoring: Continuous fraud monitoring is implemented through automated algorithms that analyse transaction patterns, customer behaviour, and reversal request characteristics. Suspicious cases are automatically flagged for enhanced investigation, and fraud trends are analysed monthly to update detection parameters. Regular fraud awareness training is provided to all staff involved in the reversal process.

System Controls: Access to reversal processing systems is controlled through role-based permissions, with all user activities logged and monitored. System availability is monitored 24/7 with automatic failover procedures to ensure continuous service. Regular system backups and disaster recovery testing ensure data integrity and business continuity.

COMPLIANCE REPORTING

Central Bank of Kenya Reporting: Monthly compliance reports are submitted to the Central Bank of Kenya detailing reversal volumes, processing times, fraud incidents, and adherence to regulatory requirements. These reports include statistical analysis of reversal trends, customer complaint resolution, and any regulatory violations or corrective actions taken.

Internal Reporting: Weekly operational reports are provided to senior management summarizing process performance, key performance indicators, and any significant issues or improvements. Monthly detailed reports include comprehensive analysis of customer satisfaction, fraud prevention effectiveness, and process efficiency metrics.

Audit Reporting: Quarterly internal audit reports assess compliance with ISO standards, regulatory requirements, and internal policies. Annual external audit reports provide independent verification of process effectiveness and regulatory compliance. All audit findings are tracked through to resolution with documented corrective actions.

Regulatory Notification: Immediate notification procedures are in place for reporting significant fraud incidents, system breaches, or regulatory violations to the Central Bank of Kenya within required timeframes. Incident reports include detailed analysis, impact assessment, and remediation plans.

REVIEW & UPDATES

Periodic Review Schedule: This process document undergoes comprehensive review every six months to ensure continued alignment with regulatory requirements, industry best practices, and operational needs. The review process includes analysis of performance metrics, customer feedback, regulatory changes, and technological developments that may impact the reversal process.

Update Triggers: Process updates are initiated when regulatory requirements change, significant fraud trends are identified, customer satisfaction scores decline below acceptable thresholds, or new technology implementations require process modifications. Emergency updates may be implemented immediately for critical security or compliance issues.

Review Methodology: The review process involves stakeholder consultation including Customer Experience Desk staff, Fraud and Risk Team members, Compliance Officers, and senior management. Customer feedback is analyzed through satisfaction surveys and complaint analysis. Benchmarking against industry best practices and competitor analysis ensures the process remains competitive and effective.

Approval Process: All process updates require approval from the Process Owner (Head of Customer Experience and Head of Operations) and review by the Compliance Officer to ensure regulatory compliance. Significant changes affecting risk management or customer impact require additional approval from the Chief Risk Officer.

Implementation and Communication: Approved process changes are implemented through structured change management procedures including staff training, system updates, and customer communication as appropriate. All staff involved in the reversal process receive training on changes before implementation, and updated documentation is distributed to all relevant stakeholders.