# Whistleblowing Policy: [Organisation name] > Group policy for raising concerns about wrongdoing (a "speak-up" > policy): who may report, what can be reported, the internal and > external channels, confidentiality, protection against retaliation, > case-handling timelines, investigation, records and reporting. It is > based on Directive (EU) 2019/1937 on the protection of persons who > report breaches of Union law (the EU Whistleblowing Directive), with > sections for US securities law (Sarbanes-Oxley Act section 301 and > section 806, Dodd-Frank Act section 922, which added Exchange Act > section 21F) and the UK Public Interest Disclosure Act 1998. National > transposition laws differ, so each country annex must be checked. The > example organisation, Corvid Commerce Group plc, is fictional. Replace > every `[bracketed]` value and every row marked *Example*. Obtain the > laws for the normative text; check the consolidated text and local > law. This is a documentation format, not legal advice. ## Document control | Field | Value | |---|---| | Document ID | [POL-WB-001] *(Example)* | | Organisation | [Corvid Commerce Group plc] *(Example, fictional: listed in London, American Depositary Shares in New York, Form 20-F filer)* | | Applies to | [Corvid Commerce Group plc (parent, CC-HOLD), all subsidiaries and their workers; country annexes for Germany, UK, US and Vietnam] *(Example)* | | Version | [2.0] | | Status | [Draft / Approved / Superseded] | | Owner | [@chief-compliance-officer] | | Approvers/reviewers | [Board / audit committee], [@general-counsel], [@data-protection-officer], [works council where required] | | Last updated | YYYY-MM-DD | | Classification | [Public within the organisation; published on intranet and website] | | Review cycle | [Annually and after any change in law] | | Designated case-handling function | [Group Compliance Investigations team] *(Example)* | | Reporting platform | [Name of secure reporting platform or provider] | ### Approvals | Role | Name | Decision | Date | |---|---|---|---| | Audit committee chair | [@name] | [Approved] | YYYY-MM-DD | | General Counsel | [@name] | [Reviewed] | YYYY-MM-DD | | Data Protection Officer | [@name] | [Reviewed, privacy notice aligned] | YYYY-MM-DD | | Works council (Germany) | [Name] | [Consulted] *(Example)* | YYYY-MM-DD | ### Revision history | Version | Date | Author | Change | |---|---|---|---| | 1.0 | YYYY-MM-DD | [@author] | First group policy | | 2.0 | YYYY-MM-DD | [@author] | Country annexes updated; UK sexual harassment disclosures added; case-handling KPIs added | | 2.1 | 2026-10-25 | [@author] | *Example:* US securities law section corrected for the NYSE ADS listing and Form 20-F filing (section 10A(m)(4), Rule 10A-3, 18 U.S.C. 1514A, section 21F and Rule 21F-17 apply); UK Corporate Governance Code Provision 6 added; KPIs aligned with the audit committee report; headcount aligned with the annual budget | ## Contents - [1. Purpose and our commitment](#1-purpose-and-our-commitment) - [2. Who can report and what can be reported](#2-who-can-report-and-what-can-be-reported) - [3. How to report: internal channels](#3-how-to-report-internal-channels) - [4. External reporting and public disclosure](#4-external-reporting-and-public-disclosure) - [5. Confidentiality and anonymity](#5-confidentiality-and-anonymity) - [6. Protection against retaliation](#6-protection-against-retaliation) - [7. What happens after you report: timelines](#7-what-happens-after-you-report-timelines) - [8. Case handling and investigation](#8-case-handling-and-investigation) - [9. Accounting, auditing and securities law concerns](#9-accounting-auditing-and-securities-law-concerns) - [10. Records, retention and data protection](#10-records-retention-and-data-protection) - [11. Roles, training and awareness](#11-roles-training-and-awareness) - [12. Monitoring and reporting to the board](#12-monitoring-and-reporting-to-the-board) - [13. Country annex and jurisdiction table](#13-country-annex-and-jurisdiction-table) - [Glossary and references](#glossary-and-references) - [Standard and licence note](#standard-and-licence-note) ## 1. Purpose and our commitment [Corvid Commerce Group] wants to hear about wrongdoing early, so that it can be stopped and corrected. This policy explains how you can raise a concern, what we will do with it and how we protect you. We commit to: - give you safe, confidential ways to report, in writing or orally - acknowledge your report within seven days and give you feedback within three months - handle every report impartially, diligently and as quickly as the facts allow - protect you from retaliation, including when your concern turns out to be mistaken, as long as you had reasonable grounds to believe it was true when you reported - tell you about your right to report to a competent authority This policy does not replace normal management routes. For workplace grievances that concern only your own employment terms, use the grievance procedure in your local employee handbook, unless the matter also involves wider wrongdoing. ## 2. Who can report and what can be reported ### 2.1 Who can report You can use this policy if you have learned about wrongdoing in a work-related context with the group. This includes, in line with Article 4 of the Directive: - employees, including part-time, fixed-term and agency workers - self-employed contractors and freelancers working with us - shareholders and members of the board and management bodies, including non-executive members - volunteers and paid or unpaid trainees - people working under the supervision of our contractors, subcontractors and suppliers - former workers, and job applicants who learned of the matter during recruitment Protection also extends to people who help you report (facilitators), to colleagues or relatives connected with you who could suffer retaliation, and to legal entities you own or work for. ### 2.2 What can be reported Report any concern that you reasonably believe shows wrongdoing connected with the group, whether it has happened, is happening or is likely to happen, including attempts to conceal it. | Category | Examples *(Example)* | Legal protection basis | |---|---|---| | Financial crime and fraud | Bribery, fraud, money laundering, sanctions evasion, theft | EU Directive only for its Annex areas (financial services, anti-money laundering) and fraud affecting the EU's financial interests (Article 2(1)(b)); otherwise national law, UK PIDA and US law | | Accounting and auditing | Questionable accounting, internal control failures, pressure on auditors | SOX section 301 where it applies; group policy | | Data protection and security | Unlawful processing of personal data, security breaches concealed | EU Directive (privacy and network security areas) | | Consumer protection and product safety | Misleading pricing, unsafe products sold through the platform | EU Directive (consumer protection, product safety) | | Competition and tax | Cartel conduct, abusive tax arrangements | EU Directive (internal market, competition, corporate tax) | | Environment, health and safety | Pollution, dangerous working conditions | EU Directive (environment), UK PIDA, national law | | Harassment and discrimination | Sexual harassment, discrimination | UK PIDA from 2026-04-06 for sexual harassment (check commencement); otherwise group policy and national law | | Breaches of the Code of Conduct | Conflicts of interest, misuse of company assets | Group policy; national law may protect | The Directive covers breaches of the EU law listed in its Article 2 and Annex. Many national laws go further, and this policy deliberately covers all serious wrongdoing so that you do not have to work out which law applies before you speak up. Whether legal protection applies to a specific report depends on national law; the group's commitment not to retaliate applies to every report made under this policy in good faith. ## 3. How to report: internal channels We encourage you to report internally first where the concern can be handled effectively and you do not fear retaliation. You may always choose to report externally instead (section 4). | Channel | How | Availability *(Example)* | Languages *(Example)* | |---|---|---|---| | Online reporting platform | [URL], allows two-way anonymous communication | 24/7 | English, German, Vietnamese | | Telephone hotline | [Number per country], with or without recording, with your consent | 24/7, voicemail outside office hours | English, German, Vietnamese | | Meeting | On request, within [14] days, in person or by video | Office hours | Any, with interpreter | | Email or post | [speakup@example.com], [Postal address, marked "Confidential: Compliance"] | Any time | Any | | Your manager, HR or Legal | Any manager who receives a concern passes it to Group Compliance within one working day | Office hours | Any | Each legal entity with 50 or more workers has its own designated recipient *(Example: a local compliance officer in Germany and the UK)* in addition to the group platform. You can choose either. Reports to the group channel about a subsidiary are shared with the subsidiary's designated recipient only where needed and only with your consent where national law requires it. When reporting, include what happened, when and where, who was involved, how you know, and any documents or evidence. Do not investigate on your own or gather evidence unlawfully. You do not need proof; reasonable grounds are enough. ## 4. External reporting and public disclosure You have the right to report directly to a competent authority, with or without reporting internally first. Authorities must also acknowledge and follow up reports and give feedback, generally within three months, or six months in duly justified cases (Directive Article 11). Contact points are listed in section 13. Nothing in this policy, in any contract or in any confidentiality agreement prevents you from reporting possible violations of law to a regulator or law enforcement authority, including, in the United States, the Securities and Exchange Commission (SEC) under Exchange Act Rule 21F-17(a). Agreements that try to waive or limit these rights are void to that extent (Directive Article 24; UK Employment Rights Act 1996 section 43J). Public disclosure (for example to the media) is protected under the Directive only in limited cases set out in Article 15: broadly, when an internal and external report, or an external report, did not lead to appropriate action within the deadlines, or when there is an imminent danger to the public interest or a real risk that an external report would lead to retaliation or would not be dealt with effectively. In the UK, the conditions in Employment Rights Act 1996 sections 43G and 43H apply. Take legal advice before making a public disclosure. ## 5. Confidentiality and anonymity Your identity, and any information from which it could be deduced, is known only to the staff authorised to receive and follow up reports. It is not disclosed to anyone else without your explicit consent, unless disclosure is necessary and proportionate under law, for example in criminal proceedings. If disclosure is required, we will tell you first and explain why, unless doing so would jeopardise the investigation or legal proceedings. You may report anonymously through the online platform or by post. We follow up anonymous reports with the same diligence *(group policy; national law decides whether this is mandatory)*. Anonymous reports can be harder to investigate, so please use the platform's secure mailbox to answer questions. If your identity later becomes known, you are protected as if you had reported openly. The identity of persons concerned (people named in a report) is also kept confidential while the matter is investigated (Directive Article 22). ## 6. Protection against retaliation Retaliation against anyone who reports in line with this policy, or helps a reporter, is prohibited and is a disciplinary offence. It includes threats and attempts. Examples are dismissal, demotion, withheld promotion or training, negative appraisals, changed duties, location or hours, disciplinary action, harassment or exclusion, blacklisting, early termination of a contract with a supplier, and damage to reputation, including on social media. If you believe you are suffering retaliation, report it through any channel in section 3. The Chief Compliance Officer reviews the treatment of reporters who ask for it for [12] months after the report *(Example)*. Under Directive Article 21(5), in proceedings about a detriment suffered by a reporter, it is for the person who took the measure to prove that it was based on duly justified grounds; national law and courts apply this rule. Protection does not cover people who knowingly report false information. Such reports may lead to disciplinary action and, where national law provides, penalties (Directive Article 23(2)). A report that proves mistaken but was made on reasonable grounds is protected. | Jurisdiction | Main retaliation remedy route *(as of 2026-10, check local law)* | |---|---| | EU Member States | National transposition laws: protection measures, remedies and penalties under Directive Articles 21 and 23 | | United Kingdom | Employment tribunal claim for detriment (ERA 1996 section 47B) or automatically unfair dismissal (section 103A) | | United States (SEC registrants) | Complaint to the Department of Labor (OSHA) within 180 days under 18 U.S.C. 1514A; court action under Exchange Act section 21F(h) for those who reported to the SEC | ## 7. What happens after you report: timelines | Step | Deadline | Basis | |---|---|---| | Acknowledgement of receipt | Within 7 days of receipt | Directive Article 9(1)(b) | | Triage and assignment of case handler | Within [10] working days *(Example)* | Group procedure | | Feedback to reporter on action taken or planned and the reasons | Within a reasonable time, not more than 3 months from acknowledgement (or, if no acknowledgement was sent, 3 months from the end of the 7-day period) | Directive Article 9(1)(f) | | Further updates | At least every [two] months until closure *(Example)* | Group procedure | | Closure notice | When the case is closed | Group procedure | Feedback tells you what we have done or plan to do, such as opening an internal investigation, referring the matter to an authority, or closing the case for lack of evidence, and why. We may not be able to share all details, for example disciplinary outcomes for other people, because of their privacy rights. ```mermaid sequenceDiagram participant R as Reporter participant C as Designated case handler participant T as Triage panel participant I as Investigator participant AC as Audit committee R->>C: Report (written, oral or meeting) C-->>R: Acknowledgement within 7 days C->>T: Case summary without reporter identity T->>I: Assign, scope and conflict check T-->>AC: Accounting, audit or senior-management cases I->>C: Findings and recommendations C-->>R: Feedback within 3 months of acknowledgement C-->>R: Closure notice ``` ## 8. Case handling and investigation ### 8.1 Roles The designated case handler (Group Compliance Investigations team *(Example)*) receives reports, keeps in contact with the reporter, asks for more information and gives feedback. The triage panel (Chief Compliance Officer, General Counsel and Head of Internal Audit *(Example)*) decides how each case is handled. Anyone named in a report, or with a conflict, steps out of the case. ### 8.2 Triage categories | Category | Criteria *(Example)* | Handling | |---|---|---| | A: Critical | Senior management involvement; possible material misstatement; criminal conduct; imminent danger | Audit committee chair informed within 2 working days; external counsel or forensic team considered | | B: Serious | Fraud, bribery, data breach, safety, harassment | Investigation by Compliance or Internal Audit; legal privilege considered | | C: Policy matter | Code of Conduct breach with limited impact | Investigation or management action with Compliance oversight | | D: Out of scope | Personal grievance only, or no actionable information | Redirect to HR procedure with reporter's consent; record reason | ### 8.3 Investigation standards Investigations are planned, proportionate and fair. The investigator documents the allegations, the evidence obtained, interviews held and conclusions, and gives the person concerned a chance to respond before conclusions are final. Evidence is preserved under a legal hold where needed. Findings and recommendations are recorded in an investigation report (see Fraud Investigation Report, `compliance/fraud-investigation-report`, for fraud cases). Disciplinary decisions are taken by management under the applicable employment procedure, not by the investigator. Where facts suggest a crime or a reportable regulatory breach, the General Counsel decides on referral to authorities and on regulatory notifications, with the audit committee informed for category A cases. Lessons learned feed the Fraud Risk Assessment (`compliance/fraud-risk-assessment`) and control improvements. ## 9. Accounting, auditing and securities law concerns For issuers with securities listed on a US national securities exchange, Exchange Act section 10A(m)(4) (added by SOX section 301) requires the audit committee to establish procedures for receiving, retaining and treating complaints about accounting, internal accounting controls and auditing matters, and for employees to submit concerns about questionable accounting or auditing matters confidentially and anonymously. *Example:* Corvid Commerce Group plc has American Depositary Shares listed on the New York Stock Exchange and files Form 20-F as a foreign private issuer. The audit committee complaint procedure under Exchange Act section 10A(m)(4) and Rule 10A-3(b)(3) therefore applies by law, and employees of the group, including its consolidated subsidiaries, are protected under 18 U.S.C. 1514A (SOX section 806). Exchange Act section 21F and Rule 21F-17 also apply: no group agreement, policy or confidentiality term may stop anyone from contacting the SEC. The audit committee therefore: - every report about accounting, internal controls, auditing or pressure on auditors is logged as category A or B and summarised to the audit committee chair within [5] working days - the audit committee decides who investigates (Internal Audit, external forensic accountants or counsel) and receives the results - the audit committee receives a quarterly log of all such reports, including those closed Because US securities laws apply to Corvid, the policy also states that any person may report possible securities law violations directly to the SEC, with or without first reporting internally. Under Exchange Act section 21F, the SEC may pay awards of 10% to 30% of monetary sanctions collected in actions where sanctions exceed USD 1,000,000, and section 21F(h) protects those who report to the SEC from retaliation. Employees of SEC-reporting companies are also protected under 18 U.S.C. 1514A (added by SOX section 806). ## 10. Records, retention and data protection Every report is recorded in the case management system with restricted access. Oral reports are documented, with the reporter's consent, by a recording or a complete and accurate transcript or minutes that the reporter can check, correct and sign; unrecorded calls are documented in an accurate call note offered to the reporter in the same way (Directive Article 18). Personal data is processed in line with the GDPR and national law (Directive Article 17). Data that is clearly not relevant to handling a report is not collected or, if collected by accident, is deleted without undue delay. A privacy notice for reporters, persons concerned and witnesses is published on the platform, and the processing is recorded in the GDPR Records of Processing (`compliance/gdpr-ropa`). A data protection impact assessment (see `compliance/dpia`) is kept for the reporting platform. | Record | Retention *(Example, check national law)* | Owner | |---|---|---| | Case file, substantiated case | [3 years after closure, longer while proceedings run] | Group Compliance | | Case file, unsubstantiated case | [Shorter period set by national law or 3 years after closure] | Group Compliance | | Anonymised case statistics | Indefinite | Group Compliance | | Platform access logs | [12 months] | IT Security | Records are kept only as long as necessary and proportionate. National transposition laws may set fixed periods (for example a deletion period after case closure); the country annex prevails. ## 11. Roles, training and awareness | Role | Responsibility *(Example)* | |---|---| | Board / audit committee | Approve the policy; oversee effectiveness; receive category A and accounting cases | | Chief Compliance Officer | Own the programme; chair triage; report to the board | | Designated case handlers | Receive, acknowledge, follow up and give feedback; keep records | | Managers | Receive concerns respectfully, pass them on within one working day, never retaliate | | HR | Support protection measures; ensure decisions about reporters are reviewed | | Internal Audit | Investigate assigned cases; audit the programme periodically (see `compliance/internal-audit-charter-and-plan`) | | All workers | Speak up about wrongdoing; cooperate with investigations; respect confidentiality | Training: all workers complete speak-up awareness at onboarding and every [two] years; managers complete a module on receiving concerns; case handlers receive investigation and data protection training before handling cases. The policy and external reporting information are published on the intranet and the public website so that suppliers, former workers and job applicants can find them. ## 12. Monitoring and reporting to the board The Chief Compliance Officer reports to the audit committee every quarter with anonymised statistics and to the board annually with an assessment of the programme. Internal Audit reviews the programme periodically. | KPI ID | Measure | Target *(Example)* | 2026 actual *(Example)* | |---|---|---|---| | WB-KPI-01 | Reports received (all channels) | Trend monitored | 23 | | WB-KPI-02 | Acknowledged within 7 days | 100% | 23 of 23 (100.0%) | | WB-KPI-03 | Feedback within 3 months of acknowledgement | 100% | 22 of 23 (95.7%) | | WB-KPI-04 | Substantiated or partly substantiated | Trend monitored | 5 of 23 (21.7%) | | WB-KPI-05 | Anonymous reports | Trend monitored | 10 of 23 (43.5%) | | WB-KPI-06 | Reports on accounting, internal control or audit matters (audit committee category) | Trend monitored | 3 of 23 (13.0%), all closed with no financial reporting effect | | WB-KPI-07 | Retaliation complaints | 0 substantiated | 1 received, 0 substantiated | | WB-KPI-08 | Median days to acknowledge / to close | 7 / 60 | 2 / 38 | Check the example percentages: 23/23 = 100.0%, 22/23 = 95.7%, 5/23 = 21.7%, 10/23 = 43.5%, 3/23 = 13.0%. The figures agree with Audit Committee Report (`finance/audit-committee-report`) section 8. Where a deadline was missed, report the cause and the corrective action. Compare trends by entity and by category, and include a short summary of lessons learned and the control improvements that followed. ## 13. Country annex and jurisdiction table The table is a summary as of 2026-10. Check local law for each entity and update contact details at least annually. | Jurisdiction | Main law (name and number) | Channel duty and key local points | External authority (examples) | |---|---|---|---| | EU (minimum) | Directive (EU) 2019/1937; general transposition deadline 2021-12-17; for 50 to 249 workers, 2023-12-17 (Article 26) | Internal channel for legal entities with 50 or more workers (Article 8(3)); acknowledgement 7 days; feedback 3 months | National authorities designated by each Member State | | Germany *(Corvid Commerce GmbH, 270 workers, Example)* | Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG) | Internal reporting office required; national scope wider than EU law; check rules on anonymous reports and record deletion | Federal external reporting office; sector authorities such as the financial supervisor for financial matters | | United Kingdom *(Corvid Commerce Group plc and Corvid Commerce Ltd, 115 workers, Example)* | Public Interest Disclosure Act 1998 (Part IVA of the Employment Rights Act 1996); Employment Rights Act 2025, provision adding sexual harassment to qualifying disclosures (reported in force 2026-04-06; check commencement); UK Corporate Governance Code Provision 6 for the listed parent | No general statutory duty to operate a channel outside regulated sectors, but Provision 6 expects the listed parent to offer a confidential route, anonymous if the worker wishes, with the board reviewing the arrangements routinely (comply or explain); disclosures must be in the public interest; prescribed persons list | Prescribed persons, for example HMRC, the Health and Safety Executive and the Information Commissioner's Office | | United States *(Corvid Commerce Inc, 75 workers, Example)* | SOX sections 301 and 806; Exchange Act section 21F and Regulation 21F | Applies: Corvid Commerce Group plc is an SEC registrant (Form 20-F, NYSE ADS), so the audit committee procedure, 18 U.S.C. 1514A protection for group employees and Rule 21F-17 apply; no waiver of SEC reporting rights | SEC Office of the Whistleblower; Department of Labor (OSHA) | | Vietnam *(Corvid Commerce Vietnam LLC, 225 workers, Example)* | Check local law with counsel | No equivalent of the EU Directive assumed; apply the group policy and local labour rules | Competent state authorities under local law | *Example headcount check:* 270 + 115 + 75 + 225 = 685 workers (FTE) in the group. ## Glossary and references | Term | Meaning in this policy | |---|---| | Reporter (whistleblower) | A person who reports information on wrongdoing acquired in a work-related context | | Facilitator | A person who assists a reporter in the reporting process | | Person concerned | A person named in a report as involved in the wrongdoing | | Internal reporting | Reporting within the organisation through the channels in section 3 | | External reporting | Reporting to a competent authority | | Public disclosure | Making information available to the public, for example through the media | | Retaliation | Any act or omission that causes or may cause unjustified detriment because of a report | | Follow-up | Action taken by the recipient to assess the report and address the wrongdoing | | Feedback | Information given to the reporter on the action taken or planned and the reasons | References (check the consolidated texts and local law): - Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, OJ L 305, 26.11.2019, in particular Articles 2, 4, 6, 8, 9, 10, 11, 15 to 24 and 26. - Securities Exchange Act of 1934, section 10A(m)(4) (15 U.S.C. 78j-1(m)(4)), added by Sarbanes-Oxley Act of 2002 section 301; SEC Rule 10A-3. - 18 U.S.C. 1514A (Sarbanes-Oxley Act section 806). - Securities Exchange Act section 21F (15 U.S.C. 78u-6), added by Dodd-Frank Act section 922; SEC Regulation 21F, including Rule 21F-17. - Employment Rights Act 1996, Part IVA (sections 43A to 43L), sections 47B and 103A, as inserted by the Public Interest Disclosure Act 1998; Employment Rights Act 2025 (sexual harassment as a qualifying disclosure; check the section number and commencement on legislation.gov.uk). - FRC, UK Corporate Governance Code, Provision 6. - ISO 37002:2021 (whistleblowing management systems), name only. - Related templates: Fraud Investigation Report (`compliance/fraud-investigation-report`), Fraud Risk Assessment (`compliance/fraud-risk-assessment`), ISO 37001 Anti-Bribery (`compliance/iso-37001-anti-bribery`), Internal Audit Charter and Plan (`compliance/internal-audit-charter-and-plan`), Internal Audit Engagement (`compliance/iia-internal-audit-engagement`), GDPR Records of Processing (`compliance/gdpr-ropa`), DPIA (`compliance/dpia`), Audit Committee Report (`finance/audit-committee-report`). ## Standard and licence note Based on Directive (EU) 2019/1937 (EUR-Lex, reusable under Commission Decision 2011/833/EU), US federal statutes and SEC rules (public domain) and UK legislation (Open Government Licence v3.0), cited by article and section number and described in original wording; no legislative text is reproduced. ISO 37002 is named only. National transposition laws are summarised as of 2026-10 and must be checked with local counsel. The Corvid Commerce Group plc example and all figures are fictional. Check the current consolidated texts before use. This is a documentation format, not legal advice. Template licence: MIT.