Whistleblowing

Banca Sistema S.p.A. (the “Bank”), in line with its objective of promoting a corporate culture characterized by ethical conduct and an effective corporate governance system, intends to foster a work environment in which employees and other authorized individuals may report, in good faith and based on detailed evidence, any violations of which they have become aware in the course of their work, without fear of retaliation, discrimination, or other adverse consequences.

In implementation of EU and national legislation concerning the protection of individuals who report violations of EU law and national regulatory provisions (hereinafter the “Whistleblowing Legislation”), the Bank has established and activated specific internal reporting channels and adopted its own internal system for reporting violations, governed by the “Regulations on Internal Systems for Reporting Violations (Whistleblowing)” (hereinafter the “Whistleblowing Regulations”).

The following information is provided to enable you to file reports in compliance with the Whistleblowing Regulations and the provisions of the Whistleblowing Regulations and, consequently, to benefit from the relevant forms of protection.

WHO CAN FILE A REPORT?

Reports may be submitted by individuals who fall into one of the following categories defined in Article 3, paragraph 3, of Legislative Decree 24/2023. By way of example and without limitation, this category includes:

• in-house employees;

• self-employed individuals, contractors, consultants, and independent professionals who perform work on behalf of the Bank;

• supplier personnel;

• shareholders and individuals in senior management positions.

Notwithstanding that reporting by staff is voluntary and subject to the guarantee of compliance with the confidentiality obligations established by the relevant external regulations, the Bank adopts measures designed to encourage and protect the positive conduct of individuals who, having become aware of unlawful or improper conduct by another individual within their work environment, decide to report such acts or facts to the appropriate authorities.

WHAT CAN BE REPORTED?

In accordance with the Whistleblowing Policy, any act or incident that comes to one’s attention within one’s work environment may be reported if it constitutes:

1. violation of the regulations governing banking activities;

2. offenses under Legislative Decree 231/2001;

3. a violation of the provisions of the Bank’s Organization, Management, and Control Model;

4. offenses under European or national legislation listed in the annex to Legislative Decree 24/2023;

5. acts or omissions that harm the financial interests of the EU or the internal market;

6. acts or violations that undermine the purpose or intent of the provisions referred to in 4) and 5).

WHO IS RESPONSIBLE FOR MANAGING THE INTERNAL REPORTING CHANNELS?

The manager responsible for reports received through internal channels—tasked with receiving, analyzing, and managing the investigation of reported incidents and, therefore, conducting the appropriate —is the Head of the Bank’s Internal Audit Function (hereinafter also referred to as the “Whistleblowing Officer”).

Please note that, in the event of a potential conflict of interest (e.g., the Whistleblowing Officer is himself the alleged perpetrator of the violation or has a potential conflict of interest that could compromise the impartiality and independence of his judgment), the report may be directed to the Compliance & AML Officer. Furthermore, the Whistleblowing Officer is required—should he or she become aware of a potential conflict of interest on his or her part—to recuse himself or herself from Management of the report and to forward it to the Compliance & AML Officer.

Similarly, to ensure operational continuity, in the event that the Whistleblowing Officer is absent, unable to perform their duties, or unavailable for a period exceeding seven days, the duties assigned to that position are temporarily carried out by the Compliance & AML Officer. In this context, it is understood that, even in cases of substitution, the requirements of autonomy, independence, confidentiality, and adequate competence provided for by current regulations are guaranteed, as well as compliance with confidentiality obligations regarding the identity of the whistleblowers, the persons reported, and the content of the reports.

WHAT REPORTING CHANNELS CAN BE USED?

INTERNAL COMPANY CHANNELS

The Bank has made the following internal reporting channels available:

• “SecureBlowing” IT platform: This platform is provided by the Bank and may also be used for anonymous reports, provided they are adequately substantiated and presented in sufficient detail—that is, when they are capable of bringing facts and situations to light by relating them to specific contexts. The platform guarantees the confidentiality of the whistleblower’s identity, the identity of the person involved or otherwise mentioned in the report, as well as the content of the report and the related documentation;

• oral reporting: The IT platform allows reports to be submitted orally via the voice messaging system;

• In-person meeting with the Whistleblowing Officer: The request must be made by the whistleblower, and the recipient is required to act on the request within a reasonable timeframe.

ANAC’S EXTERNAL CHANNEL

As a matter of priority, whistleblowers are encouraged to use internal channels; however, under certain conditions, they may file an external report directly with the competent authorities. Specifically, it is possible to file an external report with the National Anti-Corruption Authority (“ANAC”), in accordance with the procedures set forth on the agency’s official website, if one of the following conditions applies at the time the report is submitted:

• the mandatory activation of the internal reporting channel is not required within the workplace, or the channel is not active, or—even if activated—it does not comply with external regulations;

• the whistleblower has already filed an internal report and no action was taken on it, where “action” refers to the steps taken by the person responsible for managing the reporting channel to assess the validity of the reported facts, the outcome of the investigation, and any measures adopted;

• the whistleblower has reasonable grounds to believe that, if they were to file an internal report, it would not be effectively addressed or that filing such a report could expose them to the risk of retaliation;

• the whistleblower has reasonable grounds to believe that the violation may pose an imminent or clear danger to the public interest.

PROCEDURES FOR MANAGEMENT OF REPORTS

The Whistleblowing Officer:

• ensures the proper and diligent conduct of the process governed by the Whistleblowing Regulations;

• manages the following stages: a) receipt of the report and preliminary review, b) conduct of the investigation, c) outcome of the investigation;

• issues the Whistleblower with an acknowledgment of receipt of the report within seven days of the date of receipt, providing a response to the report within three months of the date of the acknowledgment of receipt or, in the absence of such acknowledgment, within three months of the expiration of the seven-day period following the submission of the report;

• maintains communication with the Whistleblower and may request additional information from the Whistleblower, if necessary;

• provides clear information on the reporting channel, procedures, and requirements for submitting reports correctly (e.g., specifying the elements a report must contain), as well as on the channel, procedures, and requirements for submitting external reports;

• reports the information contained in the reports directly and without delay to the corporate bodies and the Supervisory Body pursuant to Legislative Decree 231/2001, where relevant, in compliance with the confidentiality obligations set forth in the applicable regulations;

• in compliance with the confidentiality obligations set forth in the applicable regulations, involves—where deemed necessary or useful for the purposes of preliminary investigations and the possible conduct of investigations—other specialized corporate units of the Bank;

• in compliance with the provisions of personal data protection regulations and the provisions of Legislative Decree No. 24/2023 regarding confidentiality obligations, prepares an annual report on the proper functioning of the internal reporting systems, containing aggregated information on the results of the activities carried out following the reports received, which is submitted to the Board of Directors for approval, after consulting with the Board of Statutory Auditors.

PROTECTION OF THE WHISTLEBLOWER AND THE PERSON REPORTED

The Bank provides specific guarantees and protections for whistleblowers in accordance with relevant regulatory provisions, ensuring that employees who file a report—even if the report turns out to be unfounded—are not subject to any disciplinary action, except in cases of willful misconduct and/or gross negligence. Furthermore, all protections provided for by Legislative Decree 24/2023 are extended to other parties (in addition to the whistleblower) as defined in Article 3 of the aforementioned Decree. Subject to compliance with the confidentiality obligations established by the relevant external regulations, the Bank:

• ensures that employees who file a report, even if the report proves to be unfounded, are not subject to any disciplinary action, except in cases of willful misconduct and/or gross negligence;

• takes all necessary measures to protect the physical integrity and personal dignity of staff, so that the whistleblower is adequately protected from any form of retaliation, penalization, discrimination, or threats;

• adopts adequate measures to protect the whistleblower from any acts of retaliation or discrimination, whether direct or indirect, for reasons directly or indirectly related to the report. This is without prejudice to the right of those who believe they have suffered retaliation to report such incidents to ANAC, which is then responsible for informing the National Labor Inspectorate so that it may take the measures within its jurisdiction;

• ensures the confidentiality of the whistleblower’s identity, the identity of the person involved or mentioned in the report, as well as the content of the reports and related documentation.

Pursuant to the law, a whistleblower acting in bad faith is subject to penalties if found criminally liable—even by a first-instance judgment—for defamation or slander, or in any case for the same offenses committed through a complaint filed with judicial or accounting authorities; or if civil liability arises for the same grounds in cases of willful misconduct or gross negligence.

It should also be noted that, unless the act constitutes a crime, the whistleblower shall not incur any liability—including civil or administrative liability—for obtaining information regarding violations or for accessing such information.

Furthermore, no penalty shall be imposed on anyone who discloses or disseminates information regarding violations:

• covered by a duty of confidentiality, other than attorney-client or doctor-patient confidentiality;

• relating to copyright protection;

• relating to the protection of personal data;

• that damages the reputation of the person involved.

In any case, criminal liability and other liability—including civil or administrative liability—is not excluded for conduct, acts, or omissions not related to the report, the filing of a complaint with judicial or accounting authorities, or public disclosure, or that are not strictly necessary to disclose the violation.

Finally, it should be noted that any sanctions imposed following a proceeding governed by the Whistleblowing Regulations are based on the Bank’s disciplinary system, adopted in accordance with the applicable National Collective Bargaining Agreements (CCNL). The application of administrative monetary sanctions in the cases provided for by Legislative Decree 24/2023 is also the responsibility of ANAC.

DATA PROTECTION AND DOCUMENT ARCHIVING

The processing of personal data related to the management of reports is carried out by the Bank in its capacity as Data Controller, in compliance with European and national regulations on the protection of personal data (EU Regulation 2016/679, Legislative Decree No. 196/2003), by adopting appropriate measures to protect the rights and freedoms of data subjects.

Documentation related to reports is confidential. Such documentation is archived securely and in compliance with current internal policies on the classification and handling of confidential information, as well as in accordance with applicable laws and regulations (in particular, reports and related documentation are retained for the period necessary to process the report in question and, in any case, for no longer than five years).

The documentation is archived by the Whistleblowing Officer and is accessible only to authorized employees. The documentation includes, at a minimum, the name, identification code, and department of the Whistleblower; details regarding the subject of the report; statements; actions taken; the outcome of the investigation; and measures implemented. Finally, it should be noted that personal data that is clearly not necessary for processing a specific report is not collected; if collected accidentally, it is promptly deleted.

Click here to access the platform

ANAC Portal