4.2 Relevant risks in the area of corruption

Mediobanca and the Group companies take part in meetings and initiatives of the respective category associations, including those on the fight against corruption.

Mediobanca has also adopted the following policies:

Policy for managing conflicts of interest, in order to identify and prevent or manage situations in which the Bank could, in the performance of its business, damage the interests of a customer by acting in its own interests or the interests of another customer. Employees’ personal conflicts are also detected; hence staff members are required to report any such situations in a timely manner, to allow specific measures to be adopted if necessary.

Directive on external personal interests, which requires staff members to obtain authorization from senior management before acquiring personal financial interests or accepting positions in companies external to the Group.

The companies included in the scope of the Statement, which provide banking and investment services have adopted internal regulations on conflicts of interest, which include measures to manage personal conflicts.

4.2 Relevant risks in the area of corruption

[GRI 102-15], [GRI 205-1], [GRI 205-3]

To complete the internal regulations adopted to tackle corruption and comply with the relevant external regulations, the Group Legal Entities which operate in the banking and financial sectors perform an annual assessment of the risk of non-compliance with the regulations, which includes those instituted in order to tackle corruption, active and passive, as well as those governing corporate liability of entities for crimes covered by Italian Legislative Decree 231/01.

This risk assessment activity takes the following factors into consideration: the risk of potential breach (taking into account the probability of occurrence in the absence of measures, the seriousness of the sanctions for such breaches, and the potential impact in reputational terms); the existing mitigation measures in place; and the degree of compliance noted in the existing conduct. Following the assessment process, the residual risk of non-compliance can be identified, based on which a decision as to whether or not to institute controls or mitigation measures can be taken.

The Group Audit Unit performs audits of the various Group Legal Entities which also include checks on the risk of corruption, including: correct application of the accounting procedures and transfers of funds to suppliers, transparency in relations with the public administration, compliance with powers of representation delegated to staff and with the internal regulations on expense refund claims. Also part of the audit activities are checks which impact on the risk of corruption indirectly, such as those on transactions on financial markets and the nature of counterparties.

The audits performed by the control functions revealed no instances of corruption.

MATERIAL ISSUES

Ethics and integrity in business

Ethics and integrity in business

Ethics and integrity in business

Ethics and integrity in business

RISKS IDENTIFIED BY MEDIOBANCA

Lack and/or ineffectiveness of reporting systems for breaches of Group policies and/or practices (e.g. whistle-blowing)

Conflicts of interest: non-compliance with the legal provisions or self-imposed regulations in the area of conflicts of interest

Inadequate and/or insufficient Group staff training and awareness initiatives on bribery and corruption, and compliance in general, and possible adverse impacts in terms of breaches of regulations, ethical principles and self-imposed codes

Internal fraud/misconduct committed by Group staff

MITIGATION ACTIVITIES

Group Whistle-Blowing Policy

Implementation of a system for reporting breaches of the regulations

Monitoring reports by compliance teams

Reporting to corporate bodies on any reports received

Group Policy for Managing Conflicts of Interest, which defines roles and responsibilities for preventing and managing conflicts

Adoption of measures for managing conflicts of interest in relation to business activities, including of a personal nature

Checks on execution of activities most exposed to the risk of conflicts of interest

Annual compliance risk assessment activity

Co-operation between local compliance teams and Group HR in defining an appropriate training programme and monitoring its usage

Regular training activities on issues pertaining to Italian Legislative Decree 231/01, including tackling corruption, at all corporate levels

Regular reports from local Compliance teams to parent company on any issues in the training area

Reporting to supervisory body on training activities carried out in relation to Italian Legislative Decree 231/01 activities

Organizational Model pursuant to Italian Legislative Decree 231/01, Code of Ethics, Code of Conduct, Company Disciplinary Code

Second- and third-level control units and HR in internal reporting processes

Policies and procedures in the internal fraud management area and in managing any unlawful activities

Regular staff training activities on issues relating to Italian Legislative Decree 231/01 and/or bribery and tests on compliance with Code of Conduct

Monitoring operations and regular checks and audit activity

Regular assessment of internal fraud risks as part of operational risk management activities

MATERIAL ISSUES

Ethics and integrity in business

Ethics and integrity in business

Ethics and integrity in business

RISKS IDENTIFIED BY MEDIOBANCA

Non-compliance with the regulations on bribery and corruption, money-laundering and terrorist financing

Risks of misinterpretation of tax regulations, with possible adverse impacts on earnings (e.g. administrative sanctions and claim) and reputational impacts

Breach of principles of proper conduct, honesty and transparency in relations with the regulators with which the Group interacts (e.g. national banks, European Central Bank, Consob, IVASS, AGCOM etc.)

MITIGATION ACTIVITIES

Organizational model involving company management and local compliance teams to tackle bribery, money-laundering and terrorist financing, where applicable

Adoption by all Group legal entities of internal regulations to tackle bribery, moneylaundering and terrorist financing

Regular training on bribery and corruption/ money-laundering at all company levels

Checks on most significant activities with reference to bribery and corruption/moneylaundering

Annual assessments of risk of non-compliance with regulations, including those on receiving and giving bribes, money laundering and terrorist financing

Group Tax Unit, guaranteeing full and correct management of tax issues and monitoring changes in the regulations on an ongoing basis

Existence of Group tax strategy

Training activities, with the objective of raising awareness and control levels with regard to tax risk in relation to business

Working closely with competent authorities in providing the necessary information to enable checks to ascertain that tax obligations have been met correctly

Compliance with guidance to ensure appropriate funds transfer pricing for intraGroup deals and to allocate income generated in the various countries in which the Group operates

Implementation of Tax Control Framework pursuant to Italian Legislative Decree 128/15(in progress)

Adoption of suitable measures to ensure proper conduct, honesty, and transparency in relations with the authorities

Organizational Model pursuant to Italian Legislative Decree 231/01, Code of Conduct and Directive on relations with the Public Administration