Violation Reporting Systems - Whistleblowing

In accordance with the provisions of Legislative Decree 24/2023, starting from July 15th, 2023, the audience of possible whistleblowers will be extended. The following subjects can make a whistleblowing report:

• employees and self-employed workers who work or have worked for the Group;
• holders of a professional collaboration relationship referred to the Article 409 of the Code of Civil Procedure (for example, agency relationship) and to the Article 2 of Legislative Decree 81/15 (collaborations organized by the client);
• workers or collaborators who provide goods or services or who carry out works for third parties and perform or have performed their work for the Group;
• freelancers and consultants who work or have worked for the Group;
• volunteers and trainees (paid and unpaid);
• shareholders (natural persons);
• persons with administrative, control, supervisory or representative functions (hereinafter referred to as “representatives”).

The Whistleblowing process, which integrates the other reporting systems and processes active in the Company, makes it possible to report, with the utmost guarantee of confidentiality, violations that damage the public interest or the integrity of Intesa Sanpaolo and of the Group companies of which become aware within the working context, or on the basis of the legal-economic relationship existing with the Group, protecting the whistleblower from any possible retaliatory or discriminatory behavior.

Whistleblowing reports can be sent using the specific channels indicated below (available 24 hours a day, 7 days a week, in Italian and English version).

The report must allow the identification of the whistleblower (name and surname, relationship with the company and contact details) and must contain a detailed description of the facts and conduct considered to be in conflict with the law, also indicating, where possible, the documents, the rules that are considered to have been violated and the other findings useful for conducting the investigation of the disputed facts. Finally, the whistleblower has the obligation to declare whether she/he has a personal interest connected to the report.

The shareholder is required to provide, pursuant to art. 46 of the Single Provision on post-trading issued by the Consob and the Bank of Italy as of August 13th, 2018, the certification of the legitimacy to exercise the right, and can request it from his intermediary.

The Chief Audit Officer ensures the correct execution of the process.

All whistleblowers address the main channel with the exception of representatives (for whom a specific confidential process has been envisaged). The report can be made, using the following communication way:

Written, at the email address:

• segnalazioni.violazioni@intesasanpaolo.com

Orally, by a recorded voice messaging system (maximum recording time 3 minutes), to the following numbers:

• +39 0116799110 for reports in Italian;
• +39 0116799112 for reports in English.

Communications are managed through specific channels, segregated and independent from the ordinary ones.

The whistleblower may also request, through the two above mentioned channels, a meeting aimed at making the report. The meeting will be scheduled within a reasonable time by the Whistleblowing Team.

The personal data and information acquired by the Intesa Sanpaolo Group company to which the "Whistleblowing" report is sent will be processed by the same in its capacity as Data Controller for the related management and will be kept no later than 5 years after the ending of the procedure and has as its legal basis the fulfillment of an obligation by law.

As a priority, whistleblowers are encouraged to use internal channels and, if certain conditions are met, they can carry out an external report to the competent Authorities.

It is possible to carry out an external report, for Italy, to the National Anti-Corruption Authority (ANAC), if at least one of the following conditions occurs at the time of its submission:

• the mandatory activation of the internal reporting channel is not envisaged within the working context, i.e. this channel is not active or, even if activated, does not comply with external regulations;
• an internal report has already made and it has not been followed up, where follow-up means the action undertaken by the person entrusted with the management of the reporting channel to assess the existence of the facts reported, the outcome of the investigations and any measures taken;
• there are reasonable grounds to believe that, if she/he were to carry out an internal report, it would not be followed up effectively or that the same report could lead to the risk of retaliation;
• there are reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest.

External reports to the ANAC can be made according to the methods provided on the ANAC website.