UniCredit Bank Czech Republic and Slovakia, a.s. (hereinafter referred to as "Bank") supports and develops a corporate culture characterised by honesty and openness, in which all employees and other associates have the opportunity and the right to freely express opinion and disagreement with unacceptable conduct, without fear of recourse, and when they can be sure of a proper and fair investigation of the announcements made.

The main purpose of this policy and the principles embeded in it is to detect and prevent wrongdoing that could harm the public interest or the mission and reputation of the Bank as well as the UniCredit Group.¹

PRINCIPLES

The whistleblower may be any employee and other associate of the Bank (e.g. self-employed, member of the body, shareholder, intern, contractor's employee).

Whistleblowers who suspect that unlawful, unfair, unethical or otherwise harmful conduct has occurred or may occur have the opportunity to report their suspicions without fear of any adverse effects on whistleblowers.

Non-anonymous reports are preferred. Confidentiality about the identity of the person who initiated the complaint is guaranteed.

All reported suspicions of unacceptable behaviour will be assessed fairly, impartially, objectively and will be properly, fairly and confidentially investigated.

In the event of verified merits of a report of unacceptable behaviour, the Bank shall take appropriate measures to correct unacceptable behaviour and avoid reoccurrence.

The rights of those affected by reported suspicions will be respected and protected.

Whistleblower must be genuinely conviced that the information provided is true at the time of submission of the report. Persons knowingly making false reports will not be granted protection.

EXTENT

These principles apply to any unacceptable behaviour, which is understood to mean any action or failure by the Bank or an employee of the Bank, which could harm the public interest or the mission or reputation of the Bank as well as UniCredit Group. That is unlawful, unfair or unethical conduct in the Bank's business as well as non-compliance with all UniCredit Group rules and regulations.

RIGHTS OF WHISTLEBLOWERS

The Bank guarantees the whistleblower protection from any penalty due to report. The Bank does not tolerate threats and any form of retaliation against the whistleblower or those who cooperated to verify the merits of the complaint.

The bank guarantees the anonymity of the whistleblower unless the whistleblower has given his or her explicit consent to reveal his or her identity or the legislation so requires.

Should the whistleblower be exposed to any disadvantage stemming from the notification, the Bank will provide appropriate assistance to the whistleblower in order to eliminate any negative impact on the whistleblower.

The whistleblower is entitled to information about the outcome of the investigation.

REPORTING PROCEDURE

If an employee or other associate of the Bank has a reasonable suspicion of the occurrence of unacceptable conduct, or the occurrence of such conduct is likely in the future, and does not wish or cannot address such suspicion along the management line, the whistleblower has the option to approach the Compliance Unit manager(s) with suspicion or, if the notification relates to that person, also to the Internal Audit Service manager(s). Should the unacceptable behaviour concern the aforementioned persons, the staff member may report his suspicions directly to the members of the Board of Directors of the Bank.

In order to investigate the reported suspicions thoroughly, the report should contain in particular the following information:

• a description of perceived unacceptable behaviour with all the material facts known,
• identification of the people involved, including any witnesses,
• an indication of the department where the case occurred,
• supporting documents to support suspicions
• whether the whistleblower has discussed the matter with other persons and their identification,
• how the v became aware of the matter,
• the whistleblower 's name, surname and contact details.

Suspicions may be reported:

• via e-mail to address: whistle-blowing@unicreditgroup.cz
• via The Speak Up service:
  • web interface:
    www.speakupfeedback.eu/web/m2phex/cz - Czech Republic – access code 86136
    www.speakupfeedback.eu/web/m2phex/sk - Slovakia – access code 88288
  • phone line:
    800 900 538 – Czech Republic – access code 86136
    0800 004 529 – Slovakia – access code 88288 (when calling from a work landline it is necessary to press # twice)

The access code is the same for all users. Upon leaving the complaint, the whistleblower will receive a unique code to return to the system, establish compliance feedback, and develop solutions to the complaint.

• in writing by sending to:
  Lucien Strnad
  lucien.strnad@unicreditgroup.cz
  útvar Compliance, 15C
  UniCredit Bank Czech Republic and Slovakia, a.s.
  BB Centrum - Filadelfie
  Želetavská 1525/1
  140 92 Praha 4

• by inserting a writing into the secure "Whistleblowing" box at:
  UniCredit Bank Czech Republic and Slovakia, a.s.
  BB Centrum - Filadelfie
  Želetavská 1525/1
  140 92 Praha 4
  15D

• face-to-face interview at the above address

INVESTIGATIon of UNACCEPTABLE BEHAVIOUR

The Compliance Unit manager shall arrange his own investigation in accordance with the rules laid down. All necessary steps shall be taken in the course of the investigation to ensure a fair and unbiased investigation.

The whistleblower shall be notified of receipt of the report within 7 days, unless he requests not to be notified. Nor is he notified if it leads to the disclosure of his identity.

Investigations shall be conducted with due diligence and within a reasonable time (maximum three times 30 days) that the whistleblower is informed of, where possible, while maintaining confidentiality about the whistleblower of unacceptable behaviour as well as the persons affected by the complaint. The outcome of the investigation is a report summarising the course of the investigation and the evidence, drawing conclusions on the extent and seriousness of unacceptable behaviour and recommending appropriate measures to correct unacceptable behaviour and avoid future reoccurrence. The whistleblower shall be informed of the outcome of the investigation within the period mentioned above.

The detailed arrangements for investigating unacceptable behaviour and related aspects of whistleblowing are contained in internal regulation 3220_ER_015 – Reporting obligations to Compliance and whistleblower protection.

EXTERNAL REPORT

If, for some reason, the whistleblower does not want or cannot use the internal notification system mentioned above, it is also possible to contact:

1)     Ministry of Justice on matters relating to the bank's operations in the Czech Republic: Chci podat oznámení – veřejnost – Oznamovatel (justice.cz)

2)     Office for the protection of whistleblowers in matters relating to the bank's operations in Slovakia: Chcem oznámiť - Úrad na ochranu oznamovateľov (oznamovatelia.sk)

¹In accordance with Act No. 171/2023 Coll., on the protection of whistleblowers and with Act No. 54/2019 Z. z., on protection of whistleblowers about anti-social activities