Whistleblowing Policy

The Whistleblowing Policy of Bank Pekao S.A. (hereinafter: “Whistleblowing Policy”) reflects the Bank’s involvement in promoting corporate culture that supports ethical conduct in accordance with legal regulations, as well as the Bank’s procedures and ethical standards. The purpose of this policy is to establish safe channels to report any practices that do not comply with law, unfair or unethical practices or a reasonable suspicion of their existence as well as to ensure that the problems reported will be received, analyzed, and properly handled and that the person who reported them in good faith will be protected against any retaliatory action.

Any early discovery of a violation and remedial actions taken in consequence of that violation contribute to the reduction or elimination of the Bank’s reputation risk. The culture of openness and honesty, contrary to the “culture of silence”, contributes to the growth of trust in the Bank’s transparent operation and constitutes a clear message that the Bank does not tolerate any illegal or unethical conduct.

The Whistleblowing Policy applies to:

• all persons cooperating with the Bank under an employment relationship or any other legal relationship of a similar nature, including members of the Bank’s statutory bodies – regardless of the issue to which the report pertains,
• entities/persons performing operations for the Bank, regardless of the type of agreement between the Bank and the entity/person – with regard to reporting actual or potential violations of regulations on counteracting money laundering and terrorism financing.

Where there are reasonable suspicions that a violation has been committed or where one is in possession of information about a possible occurrence of a violation, it is necessary to promptly contact the designated member of the Management Board and, in special cases (e.g. when the report concerns a member of the Management Board), the Supervisory Board. Reports may be filed verbally, by e-mail or in writing via dedicated communication channels, such as an anonymous infoline, a special e-mail or traditional mail. All reports are handled by the Bank with due diligence and are subject to the procedure set out in the Policy. The notice of violation can be submitted anonymously or not.

If the applicant reveals his identity, the data are protected. The information concerning the filed report of a violation is classified as “Confidential” and stored with the use of appropriate security measures in accordance with applicable laws and the Bank’s information classification and management principles. The Bank does not tolerate retaliation against reporting persons. The verification officer, while informing the person to whom the report pertains – in accordance with the Policy – about the report, at the same time reminds the person of the Bank’s rules on not tolerating retaliation and the obligation to apply them.

All Bank employees have the opportunity to ask the Compliance Department to:

• receive advice on implementing the organization’s responsible business principles and practices,
• raise concerns about events in the organization’s business relationships

Any employee of the Bank who has come into possession of information about the possibility of a material compliance risk is obliged to promptly communicate such information to the Compliance Department. A Bank employee who has become suspicious of the possibility of a compliance risk in the intended conduct or event should consult the Compliance Department.

With regard to negative impacts and the occurrence of compliance risks, the Bank has and applies Bank Pekao S.A.’s Compliance Policy. Responsibility for ensuring compliance is borne by the Bank’s statutory bodies, all organizational units of the Bank, as well as all Bank employees, in their areas of operation. The Management Board actively promotes a culture (hereafter referred to as compliance culture) in which every Employee of the Bank will feel responsible for the compliance of their actions with laws, internal regulations and market standards. The Management Board makes the Bank’s business units aware of the importance of this issue and supports the activities of the Compliance Department. If irregularities are found in the application of the Policy, the Management Board takes corrective or disciplinary measures.

In any case concerning the possible application of disciplinary measures referred to in separate internal regulations, the Human Resources Division is the organizational unit competent to apply such measures.

The Compliance Coordinator reports on a quarterly basis on the quality of the compliance risk management processes (self-assessment), applicable internal regulations, and actions taken to cover compliance risks in the Bank’s unit or organizational unit. Reports are sent to the Compliance Department by the tenth day of the first month of the quarter following the quarter covered by the reporting period, regardless of whether compliance risk events occurred in the quarter.