Integrity in corporate conduct

The Intesa Sanpaolo Group recognises that compliance with internal and external regulations and codes of conduct holds significant importance, including from a strategic viewpoint, and that the observance of rules and fairness in business (combating active and passive corruption, combating money laundering, compliance with tax regulations, protection of free competition, privacy protection and compliance with the rules governing labor relations) are essential elements in the conduct of banking, which by its very nature is based on trust and transparency and promotes the creation of a competitive economic environment and the protection of customer rights.

It also recognizes that the awareness and diffusion of the culture of ethics and human rights among the Group's people, its business partners and stakeholders can result into concrete contribution to the development of the territory and the community.

It has therefore adopted an internal regulatory framework based on the Code of Ethics, the Internal Code of Conduct for the Group and for the Group's Italian companies and the Organisation, Management and Control Model adopted pursuant to Legislative Decree 231/2001.

UN SDG SUPPORTED

The Code of Ethics is the self-regulatory document adopted by all the Group's entities and is an integral part of the Sustainability management model; explains the values ​​and principles that regulate relations with stakeholders, recalling, for some areas of particular relevance (e.g. human rights, employment protection, environmental protection, fight against corruption), rules and principles consistent with the best international standards.

It provides that corporate objectives be pursued with honesty, fairness and responsibility, in full and substantial compliance with the rules, professional ethics and the spirit of signed agreements. To this end, the Group recognizes the strategic importance of the activities aimed at ensuring compliance with internal and external regulations and codes of conduct.

The document was updated in 2023 to keep in step with the evolution of the internal and external context and regulations.

Compliance with the principles and values ​​of the Code of Ethics is strengthened by specific training and communication initiatives aimed both at Group's people and externally and is also monitored through audit activities which also consider aspects and implications of social and environmental responsibility.

The extent of reports of alleged non-compliance with the Code is substantially in line with the findings of previous years. Within the category of reports from customers, the most impactful category concerns operational issues often connected to difficulties in understanding dialogue with foreign customers (34) and difficulties in accessing branches or online services by people with disabilities (25), while no instances were received in relation to the Principles on Diversity, Equity & Inclusion regarding the inclusion of people with disabilities. None of the reports sent by people in the Group are attributable to the Rules for Combating Sexual Harassment, for which, starting from November 2023, a dedicated channel has been established, managed by the Diversity, Equity & Inclusion structure.

Since 2016, a system has been in place for staff to report acts or behaviors that may constitute violations of the regulations relating to banking activity, as well as internal company policies and/or procedures, or conduct that gives rise to conflicts of interest (whistleblowing). The system is active 24 hours a day through specific channels available on the Group website and intranet portal. It was updated in July 2023, following the entry into force of Legislative Decree 24/2023, strengthening the guarantee of appropriate protection for the whistleblower from any retaliatory or discriminatory conduct resulting from his report.

Legislative Decree 231/01 provides a regime of administrative liability of companies for some specifically identified crimes or offenses committed in their interest or to their advantage. Intesa Sanpaolo has long had an Organisational, Management and Control Model which defines the control and behavioral principles to be adopted to reduce the risk of committing the crimes or offenses envisaged by the Decree, including corruption and environmental crimes.

The Model was updated in 2023 to take into account recent regulatory developments and in particular Legislative Decree 24/2023 which:

- in implementation of Directive (EU) 2019/1937, has organically regulated internal reporting systems (so-called whistleblowing);

- modified Legislative Decree 231/2001, referring to the provisions of the aforementioned decree regarding internal reporting channels, the prohibition of retaliation and the disciplinary system. Activities to update the Model by the Group's Italian companies are underway.

In this regard, a mandatory distance training course has been updated and is being released, planned for the three-year period 2022-2024.