Whistleblowing Policy Notice (Utmost Luxembourg)

The Utmost Luxembourg S.A. Whistleblowing Policy has been reviewed in April 2020 in order to align with the obligations imposed by the EU Whistleblowing Directive 2019/1937 and the EU Directive 2018/843 (the “5th AML Directive). Both have caused some impact in terms of reporting channels and sanctions. The main points of the implementation are listed below:

1.Revamp of the reporting channels including eligible persons and types of information to be reported

Who is eligible to report a concern?

A breach is generally defined as any kind of information or activity within the Company and its affiliates that is deemed illegal, unethical, or not in compliance with any internal rules (policies, procedures, corporate governance rules) and/or external rules and laws and regulations applicable to the business of the Company and its affiliates.

Based on Article 4 of the EU Directive 2019/1937, the concept of reporting person is extended for the purpose of this policy and therefore should apply to all who acquire information on breaches in a work-related context, which includes the persons listed:

• All Staff Members;
• Persons having self-employed status;
• Shareholders and persons belonging to the administrative, management or supervisory body of an undertaking, including non-executive members, as well as volunteers and paid or unpaid trainees;
• Any persons working under the supervision and direction of contractors, subcontractors and suppliers.*

What can be reported?
Information concerning the following matters may be reported (non-exhaustive list):

• Corporate governance breaches;
• Fraud and misconduct in respect of accounting, internal accounting controls;
• Auditing matters;
• Protection of privacy and personal data, and security of network and information systems;
• Bribery and financial crime including fraud, theft, abuse of data and compliance;
• Financial services, products and markets, and prevention of money laundering and terrorist financing;
• Breaches relating to the functioning of the European internal market, as referred to in Article 26(2) TFEU (Treaty on the Functioning of the European Union), including breaches of Union competition and State aid rules, as well as breaches relating to the internal market in relation to acts which breach the rules of corporate tax or to arrangements the purpose of which is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law;
• Breaches of internal rules and laws/regulations applicable.

2. Internal reporting channel and external reporting channel via the Commissariat aux Assurances (CAA), and the setting of conditions of sanctions to be imposed

Reporting through internal channel (Integrity Line)
In order to make our internal channel complying with the above measures, it will remain available for staff members through the intranet, and it is extended to all eligible persons via our webpage link. Under these terms, all eligible persons in a work-related context with Utmost Luxembourg will have access to our internal channel and be able to report a concern anonymously.

The whistleblower can always submit the escalation directly to the Chief Compliance Officer and Head of Regulatory Compliance by writing a letter to Utmost Luxembourg S.A., 4 Rue Lou Hemmer, 1748 Findel Niederanven.

Reporting through external channel
In addition, the EU Directive 2018/843 (the “5th AML Directive”) in accordance with the EU Whistleblowing Directive 2019/1937 establishes that whistleblowing alerts may be reported independently to the Commissariat aux Assurances (CAA) for any breaches to the applicable Luxembourg laws and regulations.
As for the CAA website, instructions on how to report via hotline or proper form are described in details. on the link https://www.caa.lu/fr/whistleblowing.

In conclusion, it is recommended for all eligible reporting person to first use our internal alert procedure via Integrity Line before contacting the CAA for external report.

3. Sanctions for non-compliance with the legal protection of the reporting person

The 5th AML Directive states that whether the reporting person is exposed to threats, retaliatory or hostile action, and in particular from adverse or discriminatory employment actions, sanctions can be imposed in the form of a fine ranged between €250 and €250,000 by supervisory authorities (CAA or other competent authorities) to the Company, its Board members, its effective directors and any other person within the company responsible for the non-compliance action.

*In line with the provisions of Article 5(4), subparagraph 3, and Article 8-3(3) of Luxembourg Law of 12 November 2004 on the fight against money laundering and the financing of terrorism.