Whistleblowing Policy Template (EU Directive 2019/1937, SOX, PIDA)

Whistleblowing Policy: [Organisation name]

Group policy for raising concerns about wrongdoing (a "speak-up" policy): who may report, what can be reported, the internal and external channels, confidentiality, protection against retaliation, case-handling timelines, investigation, records and reporting. It is based on Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law (the EU Whistleblowing Directive), with sections for US securities law (Sarbanes-Oxley Act section 301 and section 806, Dodd-Frank Act section 922, which added Exchange Act section 21F) and the UK Public Interest Disclosure Act 1998. National transposition laws differ, so each country annex must be checked. The example organisation, Corvid Commerce Group plc, is fictional. Replace every [bracketed] value and every row marked Example. Obtain the laws for the normative text; check the consolidated text and local law. This is a documentation format, not legal advice.

Document control

Approvals

Revision history

Contents

• 1. Purpose and our commitment
• 2. Who can report and what can be reported
• 3. How to report: internal channels
• 4. External reporting and public disclosure
• 5. Confidentiality and anonymity
• 6. Protection against retaliation
• 7. What happens after you report: timelines
• 8. Case handling and investigation
• 9. Accounting, auditing and securities law concerns
• 10. Records, retention and data protection
• 11. Roles, training and awareness
• 12. Monitoring and reporting to the board
• 13. Country annex and jurisdiction table
• Glossary and references
• Standard and licence note

1. Purpose and our commitment

[Corvid Commerce Group] wants to hear about wrongdoing early, so that it can be stopped and corrected. This policy explains how you can raise a concern, what we will do with it and how we protect you.

We commit to:

• give you safe, confidential ways to report, in writing or orally
• acknowledge your report within seven days and give you feedback within three months
• handle every report impartially, diligently and as quickly as the facts allow
• protect you from retaliation, including when your concern turns out to be mistaken, as long as you had reasonable grounds to believe it was true when you reported
• tell you about your right to report to a competent authority

This policy does not replace normal management routes. For workplace grievances that concern only your own employment terms, use the grievance procedure in your local employee handbook, unless the matter also involves wider wrongdoing.

2. Who can report and what can be reported

2.1 Who can report

You can use this policy if you have learned about wrongdoing in a work-related context with the group. This includes, in line with Article 4 of the Directive:

• employees, including part-time, fixed-term and agency workers
• self-employed contractors and freelancers working with us
• shareholders and members of the board and management bodies, including non-executive members
• volunteers and paid or unpaid trainees
• people working under the supervision of our contractors, subcontractors and suppliers
• former workers, and job applicants who learned of the matter during recruitment

Protection also extends to people who help you report (facilitators), to colleagues or relatives connected with you who could suffer retaliation, and to legal entities you own or work for.

2.2 What can be reported

Report any concern that you reasonably believe shows wrongdoing connected with the group, whether it has happened, is happening or is likely to happen, including attempts to conceal it.

The Directive covers breaches of the EU law listed in its Article 2 and Annex. Many national laws go further, and this policy deliberately covers all serious wrongdoing so that you do not have to work out which law applies before you speak up. Whether legal protection applies to a specific report depends on national law; the group's commitment not to retaliate applies to every report made under this policy in good faith.

3. How to report: internal channels

We encourage you to report internally first where the concern can be handled effectively and you do not fear retaliation. You may always choose to report externally instead (section 4).

Each legal entity with 50 or more workers has its own designated recipient (Example: a local compliance officer in Germany and the UK) in addition to the group platform. You can choose either. Reports to the group channel about a subsidiary are shared with the subsidiary's designated recipient only where needed and only with your consent where national law requires it.

When reporting, include what happened, when and where, who was involved, how you know, and any documents or evidence. Do not investigate on your own or gather evidence unlawfully. You do not need proof; reasonable grounds are enough.

4. External reporting and public disclosure

You have the right to report directly to a competent authority, with or without reporting internally first. Authorities must also acknowledge and follow up reports and give feedback, generally within three months, or six months in duly justified cases (Directive Article 11). Contact points are listed in section 13.

Nothing in this policy, in any contract or in any confidentiality agreement prevents you from reporting possible violations of law to a regulator or law enforcement authority, including, in the United States, the Securities and Exchange Commission (SEC) under Exchange Act Rule 21F-17(a). Agreements that try to waive or limit these rights are void to that extent (Directive Article 24; UK Employment Rights Act 1996 section 43J).

Public disclosure (for example to the media) is protected under the Directive only in limited cases set out in Article 15: broadly, when an internal and external report, or an external report, did not lead to appropriate action within the deadlines, or when there is an imminent danger to the public interest or a real risk that an external report would lead to retaliation or would not be dealt with effectively. In the UK, the conditions in Employment Rights Act 1996 sections 43G and 43H apply. Take legal advice before making a public disclosure.

5. Confidentiality and anonymity

Your identity, and any information from which it could be deduced, is known only to the staff authorised to receive and follow up reports. It is not disclosed to anyone else without your explicit consent, unless disclosure is necessary and proportionate under law, for example in criminal proceedings. If disclosure is required, we will tell you first and explain why, unless doing so would jeopardise the investigation or legal proceedings.

You may report anonymously through the online platform or by post. We follow up anonymous reports with the same diligence (group policy; national law decides whether this is mandatory). Anonymous reports can be harder to investigate, so please use the platform's secure mailbox to answer questions. If your identity later becomes known, you are protected as if you had reported openly.

The identity of persons concerned (people named in a report) is also kept confidential while the matter is investigated (Directive Article 22).

6. Protection against retaliation

Retaliation against anyone who reports in line with this policy, or helps a reporter, is prohibited and is a disciplinary offence. It includes threats and attempts. Examples are dismissal, demotion, withheld promotion or training, negative appraisals, changed duties, location or hours, disciplinary action, harassment or exclusion, blacklisting, early termination of a contract with a supplier, and damage to reputation, including on social media.

If you believe you are suffering retaliation, report it through any channel in section 3. The Chief Compliance Officer reviews the treatment of reporters who ask for it for [12] months after the report (Example). Under Directive Article 21(5), in proceedings about a detriment suffered by a reporter, it is for the person who took the measure to prove that it was based on duly justified grounds; national law and courts apply this rule.

Protection does not cover people who knowingly report false information. Such reports may lead to disciplinary action and, where national law provides, penalties (Directive Article 23(2)). A report that proves mistaken but was made on reasonable grounds is protected.

7. What happens after you report: timelines

Feedback tells you what we have done or plan to do, such as opening an internal investigation, referring the matter to an authority, or closing the case for lack of evidence, and why. We may not be able to share all details, for example disciplinary outcomes for other people, because of their privacy rights.

8. Case handling and investigation

8.1 Roles

The designated case handler (Group Compliance Investigations team (Example)) receives reports, keeps in contact with the reporter, asks for more information and gives feedback. The triage panel (Chief Compliance Officer, General Counsel and Head of Internal Audit (Example)) decides how each case is handled. Anyone named in a report, or with a conflict, steps out of the case.

8.2 Triage categories

8.3 Investigation standards

Investigations are planned, proportionate and fair. The investigator documents the allegations, the evidence obtained, interviews held and conclusions, and gives the person concerned a chance to respond before conclusions are final. Evidence is preserved under a legal hold where needed. Findings and recommendations are recorded in an investigation report (see Fraud Investigation Report, compliance/fraud-investigation-report, for fraud cases). Disciplinary decisions are taken by management under the applicable employment procedure, not by the investigator.

Where facts suggest a crime or a reportable regulatory breach, the General Counsel decides on referral to authorities and on regulatory notifications, with the audit committee informed for category A cases. Lessons learned feed the Fraud Risk Assessment (compliance/fraud-risk-assessment) and control improvements.

9. Accounting, auditing and securities law concerns

For issuers with securities listed on a US national securities exchange, Exchange Act section 10A(m)(4) (added by SOX section 301) requires the audit committee to establish procedures for receiving, retaining and treating complaints about accounting, internal accounting controls and auditing matters, and for employees to submit concerns about questionable accounting or auditing matters confidentially and anonymously.

Example: Corvid Commerce Group plc has American Depositary Shares listed on the New York Stock Exchange and files Form 20-F as a foreign private issuer. The audit committee complaint procedure under Exchange Act section 10A(m)(4) and Rule 10A-3(b)(3) therefore applies by law, and employees of the group, including its consolidated subsidiaries, are protected under 18 U.S.C. 1514A (SOX section 806). Exchange Act section 21F and Rule 21F-17 also apply: no group agreement, policy or confidentiality term may stop anyone from contacting the SEC. The audit committee therefore:

• every report about accounting, internal controls, auditing or pressure on auditors is logged as category A or B and summarised to the audit committee chair within [5] working days
• the audit committee decides who investigates (Internal Audit, external forensic accountants or counsel) and receives the results
• the audit committee receives a quarterly log of all such reports, including those closed

Because US securities laws apply to Corvid, the policy also states that any person may report possible securities law violations directly to the SEC, with or without first reporting internally. Under Exchange Act section 21F, the SEC may pay awards of 10% to 30% of monetary sanctions collected in actions where sanctions exceed USD 1,000,000, and section 21F(h) protects those who report to the SEC from retaliation. Employees of SEC-reporting companies are also protected under 18 U.S.C. 1514A (added by SOX section 806).

10. Records, retention and data protection

Every report is recorded in the case management system with restricted access. Oral reports are documented, with the reporter's consent, by a recording or a complete and accurate transcript or minutes that the reporter can check, correct and sign; unrecorded calls are documented in an accurate call note offered to the reporter in the same way (Directive Article 18).

Personal data is processed in line with the GDPR and national law (Directive Article 17). Data that is clearly not relevant to handling a report is not collected or, if collected by accident, is deleted without undue delay. A privacy notice for reporters, persons concerned and witnesses is published on the platform, and the processing is recorded in the GDPR Records of Processing (compliance/gdpr-ropa). A data protection impact assessment (see compliance/dpia) is kept for the reporting platform.

Records are kept only as long as necessary and proportionate. National transposition laws may set fixed periods (for example a deletion period after case closure); the country annex prevails.

11. Roles, training and awareness

Training: all workers complete speak-up awareness at onboarding and every [two] years; managers complete a module on receiving concerns; case handlers receive investigation and data protection training before handling cases. The policy and external reporting information are published on the intranet and the public website so that suppliers, former workers and job applicants can find them.

12. Monitoring and reporting to the board

The Chief Compliance Officer reports to the audit committee every quarter with anonymised statistics and to the board annually with an assessment of the programme. Internal Audit reviews the programme periodically.

Check the example percentages: 23/23 = 100.0%, 22/23 = 95.7%, 5/23 = 21.7%, 10/23 = 43.5%, 3/23 = 13.0%. The figures agree with Audit Committee Report (finance/audit-committee-report) section 8. Where a deadline was missed, report the cause and the corrective action. Compare trends by entity and by category, and include a short summary of lessons learned and the control improvements that followed.

13. Country annex and jurisdiction table

The table is a summary as of 2026-10. Check local law for each entity and update contact details at least annually.

Example headcount check: 270 + 115 + 75 + 225 = 685 workers (FTE) in the group.

Glossary and references

References (check the consolidated texts and local law):

• Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, OJ L 305, 26.11.2019, in particular Articles 2, 4, 6, 8, 9, 10, 11, 15 to 24 and 26.
• Securities Exchange Act of 1934, section 10A(m)(4) (15 U.S.C. 78j-1(m)(4)), added by Sarbanes-Oxley Act of 2002 section 301; SEC Rule 10A-3.
• 18 U.S.C. 1514A (Sarbanes-Oxley Act section 806).
• Securities Exchange Act section 21F (15 U.S.C. 78u-6), added by Dodd-Frank Act section 922; SEC Regulation 21F, including Rule 21F-17.
• Employment Rights Act 1996, Part IVA (sections 43A to 43L), sections 47B and 103A, as inserted by the Public Interest Disclosure Act 1998; Employment Rights Act 2025 (sexual harassment as a qualifying disclosure; check the section number and commencement on legislation.gov.uk).
• FRC, UK Corporate Governance Code, Provision 6.
• ISO 37002:2021 (whistleblowing management systems), name only.
• Related templates: Fraud Investigation Report (compliance/fraud-investigation-report), Fraud Risk Assessment (compliance/fraud-risk-assessment), ISO 37001 Anti-Bribery (compliance/iso-37001-anti-bribery), Internal Audit Charter and Plan (compliance/internal-audit-charter-and-plan), Internal Audit Engagement (compliance/iia-internal-audit-engagement), GDPR Records of Processing (compliance/gdpr-ropa), DPIA (compliance/dpia), Audit Committee Report (finance/audit-committee-report).

Standard and licence note

Based on Directive (EU) 2019/1937 (EUR-Lex, reusable under Commission Decision 2011/833/EU), US federal statutes and SEC rules (public domain) and UK legislation (Open Government Licence v3.0), cited by article and section number and described in original wording; no legislative text is reproduced. ISO 37002 is named only. National transposition laws are summarised as of 2026-10 and must be checked with local counsel. The Corvid Commerce Group plc example and all figures are fictional. Check the current consolidated texts before use. This is a documentation format, not legal advice. Template licence: MIT.