Management of Whistleblowing Reports

Disclaimer: The reporting channels listed below cannot be used for commercial complaints or any disputes and requests related to personal interests.

Within the framework of the provisions of Legislative Decree No. 24 of March 10, 2023 issued in implementation of the EU Directive 2019/1937 of the European Parliament and of the Council of October 23, 2019 concerning the protection of persons who report breaches of Union law and laying down provisions regarding the protection of persons who report breaches of national laws (so-called "Whistleblowing Decree"), ICBC (EUROPE) S.A. Milan Branch, including its representative office in Rome (hereinafter "the Branch"), promotes an open culture, ensuring that all employees or third parties involved in a legal relationship with it are protected from possible retaliation so that they can report any wrongdoing in a safe manner, in the knowledge that their reports will be investigated in a timely and effective manner and treated respecting the principles of confidentiality.

The following violations may be reported:

• administrative, accounting, civil or criminal offenses (such as, but not limited to, embezzlement, theft, money laundering, fraud, etc.);
• violations of the Organization and Management Model provided for in Legislative Decree 231/2001;
• offenses that fall within the scope of application of European Union acts and the national provisions implementing them (by way of example, these are offenses related to the following areas: public contracts; services, products and financial markets and prevention of money laundering and financing of terrorism; product safety and compliance; transportation safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; privacy and personal data protection and security of networks and information systems);
• acts or omissions affecting the financial interests of the Union;
• acts or omissions concerning the internal market that undermine the free movement of goods, persons, services and capital;
• acts or conduct that frustrate the object or purpose of the provisions of Union acts.

Who can report

The following may make a report (hereinafter also only the "Reporting Party(ies)"):

• employees who work at the Branch, including workers in part-time, intermittent, fixed-term, temporary, contract, apprenticeship, ancillary work, and casual service jobs;
• potential candidates or candidates under selection;
• self-employed workers or the holders of a collaborative relationship with the Branch;
• freelancers and consultants;
• volunteers and trainees who serve at the Branch;
• shareholders;
• persons with functions of administration, management, control, supervision or representation, even if such functions are exercised on a de facto basis with entities in the private sector;
• any other persons not directly employed by the Branch but performing work at the Branch, such as temporary workers (temporary staff), contractors, subcontractors, employees of other service providers; and
• any other persons or entities that participate or intend to participate in the activities of the Branch.

How to report

The Reporting Person (hereinafter “Whistleblower”) can choose to disclose his/her identity or choose to remain anonymous, when making his/her report.

1.Internal Reporting

The Whistleblower may report through the following channels:

a.By postal mail addressed to Via Tommaso Grossi 2, 20121 Milano, Italia for the attention of the Whistleblowing Officer, in which the report must be enclosed in two different envelopments:

• If the reporting person chooses to disclose his/her identity: first envelope includes the identity of the Whistleblower along with a copy of valid identification document, second envelope includes the whistleblowing subject and contents, and these two envelopes must be contained within the third and final envelope to be addressed. The third and final envelope must explicitly indicate “Confidential: Reserved for the Whistleblowing Officer Only”;
• If the reporting person chooses to remain anonymous: first envelope includes the whistleblowing subject and contents, and this envelope must be contained within a second and final envelope to be addressed. The second and final envelope must explicitly indicate “Confidential: Reserved for the Whistleblowing Officer Only”; or

b.Via dedicated telephone line at +39 0200668823; or
c.At the request of the Whistleblower, by means of a statement made by the Whistleblower in a special physical meeting with the Head of the Legal and Compliance Department in charge of receiving Whistleblowing reports, set within a reasonable time.

It is requested that the following information be included in the report, where possible:

• a description of the established or alleged wrongdoing;
• details, to the extent known to the Whistleblower, of when, where and how the wrongdoing occurred;
• a list of the names of persons suspected of being involved (both internal to the Branch and external);
• the list of names of anyone who may have relevant information;
• details of how the Whistleblower learned of the suspected wrongdoing;
• possible conflicts of interest of the Whistleblower regarding the suspected wrongdoing;
• an estimate by the Whistleblower of possible harm to the Branch or other third parties;
• Any violations of internal controls, policies, procedures or other requirements;
• Any recommendations for specific actions to be taken;
• The names of persons to whom the Whistleblower has mentioned or reported the incident;
• the name and contact information of the Whistleblower (which will be held in the strictest confidence); and
• date and time of the report.

2.External Reporting

The Whistleblowing Decree provides that the Whistleblower may, in addition, opt for external reporting to the National Anticorruption Authority (ANAC) if one of the listed conditions is met:

• there is no provision within one's own work context for the mandatory activation of the internal reporting channel, i.e., this channel, even if mandatory, is not active or, even if activated, does not meet its requirements;
• the Whistleblower has already made an internal report and it has not been followed up;
• the Whistleblower has reasonable grounds to believe that, if he or she made an internal report, it would not be followed up effectively or that the report might involve a risk of retaliation;
• the Whistleblower has reasonable grounds to believe that the violation may pose an imminent or manifest danger to the public interest.

3.Public Disclosure

The Whistleblowing Decree provides that the Whistleblower may still benefit from the protection provided by the Decree even if the report is made through public disclosure, if:

• the Whistleblower has previously made an internal and external report or has directly made an external report, and no response has been given within the prescribed timeframe;

• the Whistleblower has well-founded reason to believe that the violation may constitute an imminent or obvious danger to the public interest;

• the Whistleblower has well-founded reason to believe that the external report may entail the risk of retaliation or may not be effectively followed up due to the specific circumstances of the concrete case, such as those where evidence may be concealed or destroyed or where there is well-founded fear that the recipient of the report may be colluding with or involved in the perpetrator of the violation.

How reports are handled

When reports are submitted through the internal reporting channel, the Whistleblowing Officer in charge of receiving reports will issue the Reporting Person with an acknowledgement of receipt of the report within seven days from the date of receipt and provide feedback on the outcome of the investigation to the Reporting Person within three months from the date of the acknowledgement of receipt, if the reporting person can be contacted.

The Whistleblowing Officer will also take care of maintaining communications with the Whistleblower and request, if necessary, additions about the report submitted.

By proceeding with the submission of a report, the Whistleblower declares and confirms that he/she has read and understood the Privacy Policy of ICBC (EUROPE) S.A. Milan Branch on the processing of personal data.

 Guarantees for the Whistleblower

• It is ensured that the confidentiality of the identity of the Reporting Person and any involved third party mentioned in the report is protected, preventing access thereto by non-authorized staff members. The information and all other personal data acquired are treated in compliance with the applicable Data Protection Regulation.
• Reports can also be submitted anonymously by the Reporting Person through their chosen reporting channel.
• The investigation will be conducted by or under supervision of the Whistleblowing Officer as speedily and sensitively as possible in accordance with all relevant laws and regulations. Each reported case will be assessed in the appropriate manner and that it may lead to an investigation. If the allegations are confirmed, ICBC Milan Branch will take all necessary measures to remediate the situation.
• If possible, the Reporting Person shall be informed about the action envisaged or taken as follow-up to the report and the grounds for the choice of that follow-up. The report considered as irrelevant will be closed and the Whistleblower will be informed accordingly.
• ICBC Milan Branch shall ensure that there will be no retaliation against any Whistleblower for having communicated, in good faith, the situations described above.
• Reporting Persons should have reasonable grounds to believe, in light of the circumstances and the information available to them at the time of the reporting, that the matters reported by them were true. Those who, at the time of the reporting, deliberately and knowingly reported wrong or misleading information do not enjoy protection and shall be liable to a penalty. That requirement is an essential safeguard against malicious and frivolous or abusive reports. Protection is not lost where the Reporting Person reported inaccurate information on violations by honest mistake.