Whistleblowing

Banca Sistema S.p.A. (the “Bank”), in line with its commitment to promoting a corporate culture based on ethical conduct and effective corporate governance, aims to foster a working environment in which employees and other eligible individuals can report, in good faith and on the basis of reasonable and substantiated information, any violations of which they become aware in the context of their work-related activities, without fear of retaliation, discrimination, or any other adverse consequences.

In compliance with applicable EU and national legislation concerning the protection of individuals who report breaches of EU law and national laws (hereinafter the "Whistleblowing Legislation"), the Bank has established and activated specific internal reporting channels and adopted its internal whistleblowing framework, governed by the "Regolamento dei Sistemi Interni di Segnalazione delle Violazioni (Whistleblowing)" (the "Whistleblowing Regulation").

The following provides the necessary information to make reports in compliance with the Whistleblowing Legislation and the Whistleblowing Regulation and to benefit from the protections afforded thereunder.

WHO CAN MAKE A WHISTLEBLOWING REPORT?

Whistleblowing reports may be submitted by individuals falling within one of the categories identified under Article 3, paragraph 3, of Legislative Decree 24/2023. Indicatively, but not exhaustively, this category includes:

  • employees;
  • self-employed workers, collaborators, consultants, and freelancers performing activities on behalf of the Bank;
  • employees of supplier and contractors;
  • shareholders, persons with administrative, management, supervisory or representative functions.

It is clarified that the reporting by employees is voluntary and free, and the Bank ensures compliance with the confidentiality requirements established by the relevant applicable legislation. Furthermore, the Bank adopts measures to encourage and protect individuals who, having become aware of unlawful or illegitimate behaviour by others in a work-related context, decide to report such conduct or violations trough the designated reporting channels.

WHAT CAN BE REPORTED?

In accordance with the Whistleblowing Legislation, any act or fact that comes to light within one’s work context can be reported if it constitutes:

  1. a breach of regulations governing banking activity;
  2. offenses under Legislative Decree 231/2001;
  3. violation of the Bank’s Organization, Management, and Control Model under Legislative Decree 231/2001;
  4. offenses under EU or domestic laws specified in the annex to Legislative Decree 24/2023;
  5. acts or omissions damaging EU financial interests or the internal market;
  6. acts or violations that nullify the purpose or intent of the provisions listed in points 4) and 5).

WHO MANAGES THE INTERNAL REPORTING CHANNELS?

The person responsible for handling whistleblowing reports received through internal channels, tasked with receiving, analysing, and managing investigations into the reported facts, and performing the necessary verifications, is the Head of Internal Audit(hereinafter also referred to as the “Head of Whistleblowing“).

Where a potential conflict of interest exists (for example, where the Head of Whistleblowing is the alleged perpetrator of the violation or otherwise has a conflict of interest that could compromise impartiality and independence of judgment), the report may be submitted to the Head of Compliance & AML. Likewise, where the Whistleblowing Officer becomes aware of a potential conflict of interest, he shall refrain from handling the report and shall promptly forward it to the Head of Compliance & AML.

Similarly, in order to ensure business continuity, in the event of the absence, impediment, or unavailability of the Whistleblowing Officer for a period exceeding seven days, the duties assigned to such role shall be temporarily carried out by the Head of Compliance & AML. In all such cases, the requirements of autonomy, independence, confidentiality, and adequate expertise prescribed by applicable law shall remain fully guaranteed, as shall compliance with confidentiality obligations relating to the identity of reporting persons, reported persons, and the content of reports.

WHAT REPORTING CHANNELS ARE AVAILABLE?

INTERNAL CHANNELS OF BANCA SISTEMA

The Bank has made available the following internal reporting channels:

  • “SecureBlowing” IT platform: the platform is provided by the Bank and allows for anonymous reporting, if appropriately substantiated and detailed, ensuring that the facts and situations are related to specific contexts. The platform guarantees confidentiality regarding the identity of the whistleblower, the individual involved or mentioned in the report, and the content of the report and its associated documentation.
  • oral report: the IT platform allows for oral reporting via a voice messaging system.
  • meeting with the Head of Whistleblowing: the whistleblower may request a meeting, and the recipient is required to fulfil this request within a reasonable time frame.

ANAC EXTERNAL REPORTING CHANNEL

As a priority, whistleblowers are encouraged to use internal channels. However, under certain conditions, they may submit an external report directly to the competent authorities.

In particular, external reports may be submitted to the Autorità Nazionale Anticorruzione (“ANAC”), in accordance with the procedures outlined on the authority’s official website (https://www.anticorruzione.it), if one of the following conditions applies at the time of the report:

  • internal reporting channel is not mandatory in the workplace, or the internal channel is not active or, even if activated, does not comply with applicable legislation;
  • the whistleblower has already made an internal report which has not been followed up on, where “follow-up” refers to the actions taken by the person entrusted with the management of the reporting channel to assess the reported facts, the outcome of the investigations, and any actions taken;
  • the whistleblower has legitimate reasons to believe that internal reporting would not be followed up on effectively or might lead to retaliation;
  • the whistleblower has legitimate reasons to believe the violation may constitute an imminent or obvious threat to public interest.

MANAGEMENT OF WHISTLEBLOWING REPORTS

The Head of Whistleblowing:

  • ensures the correct and diligent handling of the process outlined in the Whistleblowing Regulation;
  • manages the stages of a) receiving the report and the investigation process, b) conducting investigative activities, c) concluding such activities;
  • issues an acknowledgment of receipt to the whistleblower within seven days of receiving the report, and provides feedback within three months of the acknowledgment or, in the absence of acknowledgment, within three months from the expiration of the seven-day period after the report is submitted;
  • maintains communication with the whistleblower and may request additional information, if necessary;
  • provides clear information on the channel, procedures, and requirements for correctly making reports (e.g., the elements the report must contain), as well as for making external reports;
  • immediately reports to the Bank’s Corporate Bodies and the Supervisory Body as per Legislative Decree 231/2001 any relevant information from reports, in compliance with confidentiality obligations under the applicable legislation;
  • may involve other specialised function of the Bank, if necessary, to support investigative and fact finding activities;
  • prepares an annual report on the proper functioning of internal reporting systems, including aggregated information on the outcome of activities following received whistleblowing reports, which is submitted to the Board of Directors for approval, after consulting the Board of Auditors.

PROTECTION OF THE WHISTLEBLOWER AND REPORTED PERSONS

The Bank ensures specific protections for whistleblowers in accordance with the applicable legislations, guaranteeing that the whistleblower, even if it turns out to be unfounded, will not be subject to disciplinary action, except in cases of fraud or gross negligence. Protection is also extended to other individuals (besides the whistleblower) as defined in Article 3 of the aforementioned decree.

Ensuring compliance with confidentiality obligations established by the applicable legislation, the Bank:

  • guarantees that whistleblowers, even if it turns out to be unfounded, will not face any disciplinary action, except in cases of wilful misconduct or gross negligence;
  • adopts necessary measures to protect the physical integrity and moral personality of whistleblowers, ensuring they are adequately protected from any form of retaliation, penalty, discrimination, or threats;
  • adopts appropriate measures to protect the whistleblower from any retaliation or discriminatory acts, either direct or indirect, related to the report. The whistleblower has the right to report retaliation to ANAC, which will inform the National Labor Inspectorate for further action;
  • ensures the confidentiality of the whistleblower’s identity, the individual mentioned or involved in the report, and the content of the report and related documentation.

Under the applicable legislation, a whistleblower acting in bad faith may be subject to criminal charges for defamation or calumny, or civil liability for the same reasons if their report is proven to be malicious.

It is further clarified that, unless the act constitutes a crime, the whistleblower will not incur any responsibility, including civil or administrative, for acquiring information about the violation or accessing it. Additionally, no liability arises for revealing or disseminating information regarding:

  • matters covered by secrecy obligations, other than professional confidentiality (e.g., legal and medical);
  • information concerning the protection of intellectual property;
  • information regarding personal data protection;
  • information harming the reputation of the person involved.

In all cases, criminal or other responsibility (civil or administrative) will not be excluded for acts unrelated to the report or disclosure, nor for any acts not strictly necessary to reveal the violation.

Any disciplinary measures resulting from the whistleblowing process shall be imposed in accordance with the Bank's disciplinary system and the applicable collective labour agreements.

Administrative pecuniary sanctions in the cases provided for by Legislative Decree No. 24/2023 are imposed by ANAC.

DATA PROTECTION AND RECORD KEEPING

The processing of personal data related to the management of whistleblowing reports is carried out by the Bank, as Data Controller, in compliance with applicable European and national data protection laws (including EU Regulation 2016/679 and Legislative Decree 196/2003), adopting appropriate measures to protect the rights and freedoms of the individuals concerned.

Documentation related to reports is confidential. This documentation is stored securely in accordance with the Bank’s internal regulations on the classification and handling of confidential information and in compliance with applicable regulations (specifically, reports and related documentation are retained for the period necessary to process the report and, in any case, for no longer than five years).

The documentation is stored by the Head of Whistleblowing and is accessible only to authorized employees. The documentation includes at least the name, identification code, and the whistleblower’s department, the details of the person reported, statements, activities carried out, the outcome of the investigation, and the actions taken. It is further clarified that personal data that is manifestly irrelevant to the processing of a specific report will not be collected or, if collected accidentally, will be promptly deleted.

Click here to access the website

ANAC Website

ATTACHMENTS