Protocol Covid feb22

GROUP DIRECTIVE PROTOCOL GOVERNING MEASURES TO PREVENT AND LIMIT SPREAD OF COVID-19 VIRUS IN WORKING ENVIRONMENTS

Code

Date issued

Status

HRO 008/22

08/02/2022

In force

HRO 016/21

13/10/2021

Revoked

HRO 013/21

02/08/2021

Revoked

Version Implementation of the External Regulation.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments Confidential Document.

1

Contents 1 2 3 4 5

Introduction and document objectives......................................................................................................................................3 Definitions ......................................................................................................................................................................................5 Crisis Committee and Covid-19 Committee ..............................................................................................................................7 Instructions for staff (head offices and branches) .....................................................................................................................8 Criteria applicable to on-premises personnel .........................................................................................................................10 5.1.

Access to premises ...........................................................................................................................................................11 5.1.1.

Staff who work on premises ....................................................................................................................................12 5.1.2.

External consultants ................................................................................................................................................12 5.1.3.

Visitors ......................................................................................................................................................................13 5.1.4.

Clients ......................................................................................................................................................................13 5.1.5.

Suppliers ...................................................................................................................................................................13 5.2.

Training activities, meetings and internal events ...........................................................................................................13 5.2.1 Training activities .....................................................................................................................................................13 5.2.2.

Meetings ..................................................................................................................................................................14 5.2.3.

Internal and external events ..................................................................................................................................14 5.3.

Work-related travel ...........................................................................................................................................................14 5.3.1.

Work-related travel to Italian companies/branches/offices of the Mediobanca Group .................................14 5.3.2.

Work-related travel to corporate clients/counterparties .....................................................................................15 5.3.3.

Work-related travel outside Italy ............................................................................................................................15 6 Equipment provided...................................................................................................................................................................16 7 Reorganization of working areas at premises ..........................................................................................................................17 7.1.

Reception..........................................................................................................................................................................17 7.2.

Work spaces – offices .......................................................................................................................................................17 7.3.

Meeting rooms ..................................................................................................................................................................17 7.4.

Shared spaces (e.g. kitchen and break areas, with and without food being consumed) ........................................17 7.5.

Eating meals......................................................................................................................................................................17 7.6.

Inside smoking areas ........................................................................................................................................................18 7.7.

Toilets .................................................................................................................................................................................18 8 Cleaning and sanitization ..........................................................................................................................................................19 9 Maintenance ..............................................................................................................................................................................20 9.1.

Air conditioning.................................................................................................................................................................20 9.2.

Ordinary maintenance work ...........................................................................................................................................20 10 Guidelines for managing persons with symptoms ...................................................................................................................21 11 Management of workers in a state of SELF-SURVEILLANCE .....................................................................................................22 12 Healthcare monitoring ...............................................................................................................................................................23 13 Monitoring to ensure protocol is applied correctly .................................................................................................................25 Annex....................................................................................................................................................................................................26

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 2

1 Introduction and document objectives This protocol is addressed to Mediobanca Group employees, and describes the measures put in place to safeguard health and safety in the working environment following the outbreak of the Covid-19 emergency.

The Directive applies to all Mediobanca Group companies, including the international branch offices of Mediobanca S.p.A1.

It is the responsibility of the foreign subsidiary and the head of the foreign branches to comply with the local legislation in force from time to time. Any specific provisions, also notwithstanding the provisions of the Group protocol, can be formalized in documents valid for the individual Subsidiary or Branch.

This document, along with the instructions available in all workplaces as displayed on posters and in leaflets, describes the rules with which staff must comply.

This Group Directive is consistent with the indications provided by the Authorities at the time of its publication and with the indications provided for by the "Shared protocol for updating measures to combat and contain the spread of the SARS-CoV-2 / COVID-19 virus in the workplace" signed on 06 April 2021, in order to contain and combat the spread of the COVID-19 virus in the workplace and is adopted by the Group to protect the health of workers and the community.

The priority is to combine and guarantee business continuity with safe and secure working conditions in terms of both environments and methods.

The instructions contained in this Protocol must be observed by all persons, employees and externals, at all Mediobanca Group premises.

The Group companies adopt this Directive in full, adapting it where necessary to take due account of any additional or stricter local restrictions (e.g. for branch offices) in force at the time.

The non-Italian Group companies Subsidiaries, as indicated above, in the implementation of the Directive may define provisions also in derogation of the Group protocol, provided that compliance with the applicable local legislation is always guaranteed. Any changes or additions to the contents of this Directive due to new measures being introduced by the government that come into force immediately and/or in the short term may be managed through specific communications to be issued by Group HR/Group Safety & Physical Security with immediate effect, which will accordingly become an integral and substantive part of this Directive.

Also attached to this Directive are specific guidelines for staff employed in the respective branch offices: “Protocol governing measures to prevent and limit the spread of the Covid-19 virus in branch offices”. With reference to this Protocol, for the branch offices in particular: It is the local branch office manager’s responsibility to forward any instructions received from their municipal authorities, if they are stricter than those provided for in this Directive, to their respective Compliance units (with missafety@mis.mediobanca.com copied in), while the Compliance unit is responsible for monitoring developments in the national and regional regulations, with the support of the Group Safety & Physical Security unit;

1 With

reference to the "Provisions on the use of green certifications in the private work place ", annex to this Protocol, the scope of application is defined within the annex itself.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 3

The measures to be implemented in order to with any stricter instructions will notified to the branch offices affected by email to be sent by the relevant HR unit/Group Safety & Physical Security containing the specific information; The above measures will be promptly incorporated into the internal regulations published by the Organization department in adoption of the Group Directive, with specific attachments, and sent to the branches and offices involved.

Failure to comply with the provisions of this Directive and its related attachments may lead to disciplinary proceedings being initiated.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 4

2 Definitions Staff (member): this term refers to any person who works for Mediobanca or the Mediobanca Group companies, regardless of the specific form of contract by which they are employed, and persons associated with the Bank or Group under the terms of other arrangements, including collaborators, interns and temporary staff.

Consultant: professionals normally working on Group company premises to provide services on an ongoing basis in order to ensure that working processes are able to continue: Social distancing: the measures instituted in order to contain the spread of an epidemic or pandemic, such as bans or restrictions on any form of social gathering.

Green Certification Covid-19 – GREEN PASS: it is a digital and printable (paper) certification, which contains a two-dimensional barcode (QR Code) and a qualified electronic seal. In Italy, it is issued only through the national platform of the Ministry of Health and was created with the aim of facilitating the free and safe movement of citizens in the European Union during the COVID-19 pandemic.

The Green Pass can be either “base” or “reinforced”.

The Base Green Pass is the green COVID-19 certification that attest: (a) vaccination with primary vaccination cycle (first two doses) or with booster / booster dose (when the "primary" expires); or (b) healing from COVID-19 occurred, with simultaneous termination of the prescribed isolation; or (c) the execution of a rapid or molecular antigen test with negative results.

The Super Green Pass is the green COVID-19 certification that attest: (a) vaccination with primary vaccination cycle (first two doses) or with booster / booster dose (when the "primary" expires); or (b) healing from COVID-19 occurred, with simultaneous termination of the prescribed isolation.

(It does not include rapid or molecular antigen testing).

From February 15, 2022, the Super Green Pass is required for all workers of at least 50 years old.

Consequently, the possibility of accessing the workplace on the basis (also) of the rapid antigen test and the molecular test (Green-pass base) remains valid only for workers under 50 years old.

Quarantine: public health measure implemented (to avoid the occurrence of further secondary cases due to transmission of SARS-CoV-2 and to avoid overloading the hospital system) for a healthy person (close contact) who has been exposed to a COVID case- 19, with the aim of monitoring symptoms and ensuring early identification of cases. Quarantine applies in case of close contact to people who: have completed the primary vaccination cycle for more than 120 days without having received the booster dose; are not vaccinated; Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 5

have not completed the primary vaccination cycle; have completed the primary vaccination cycle for less than 14 days.

Self-surveillance: measure implemented in case of close contact with a confirmed positive for COVID-19, for: people who have completed the “primary” vaccination cycle (no booster) in the previous 120 days; people who healed from COVID-19 in the previous 120 days; people who healed after completing the “primary” vaccination cycle; people who have received the booster dose of the vaccine (so-called "third dose" or "booster").

Suppliers/Visitors/Clients: all parties not classified as Staff or Consultants.

Medical Co-ordinator: doctor responsible for co-ordinating the various doctors appointed by the Group to provide healthcare monitoring services for workers in accordance with the provisions of Italian Legislative Decree 81/08.

Health and Safety Officer (HSO): Head of health and safety services appointed in accordance with Italian Legislative Decree 81/08.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 6

3 Crisis Committee and Covid-19 Committee Mediobanca S.p.A. has set up a Crisis Committee, which consists of the following members: Group General Manager Group HR and Organization Group COO Human Resources Central Management, CheBanca! S.p.A. and Compass Banca S.p.A. Group Safety, Physical Security & Facility Management Group Legal, General Counsel & Institutional Relations Group Communication & Institutional Relations Group Risk Management Compliance & Group AML Group Audit The Committee meets periodically on the initiative of the General Manager who chairs it. It analyzes, by way of non-exhaustive example, the trend of the epidemiological situation of Covid at Group level including the emerging or prospective criticalities, the regulatory evolution, the organizational, management and communication choices to be adopted, any indications emerging from the checks of the Control Functions2 with the necessary interventions to be adopted. In the event of significant operational decisions, the decision taken is recorded.

Covid-19 Committees have also been set up at each Group company, to implement the guidelines laid down by the Crisis Committee. The individual Group companies’ Covid-19 Committees consist of the following members: Group Safety, Physical Security & Facility Manager Company doctor and healthcare co-ordinator Group Head of Health and Safety Employee health and safety representative of each individual Group company Staff dispute and trade union relations office Reports and requests may be addressed to Group Safety & Physical Security at the following email address: missafety@mis.mediobanca.com. An internal Covid-19 officer is present on the premises of every Group company, who liaises with Group Safety & Physical Security in order to manage the respective measures required under the Directive.

The Committee is informed of the planned checks (see section 12 for details) and, periodically, of the results of these checks.

Immediate information is guaranteed in the event of serious violations of the Protocol.

2

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 7

4 Instructions for staff (head offices and branches) The Mediobanca Group informs all employees and all other persons entering its premises (head offices and branches), by the most suitable and effective means, of the measures that have been implemented in order to prevent infection. Information leaflets are handed out and/or posters displayed at entrances and in the most visible areas of the premises describing the measures.

The measures are as follows: anyone with a temperature (of at least 37.5°) or other flu-like symptoms must remain at home, contact their general practitioner promptly; the ban on staying in the company where dangerous conditions occur (temperature of at least 37.5 °); the ban on accessing company premises in the event of contact with subjects tested positive for the Covid-19 virus in accordance with the specific regulations in force for quarantine; the obligation to comply with the requirements for subjects who, in the event of contact with positive subjects, fall within the self-monitoring case as detailed in paragraph 11; in the cases indicated in the previous points, the person concerned is also obliged to inform the Covid-19 officer promptly (by writing to missafety@mis.mediobanca.com) and their own GP; all guidelines issued by the authorities and employer regarding access to the workplace must be complied with (in particular regarding hand-washing, social distancing, observing the hygiene regulations and maintaining proper conduct in the area of hygiene generally; the Covid-19 officer must be informed promptly and responsibly (by sending an email to missafety@mis.mediobanca.com) if any flu-like symptoms develop during the course of the working day, and social distancing practised appropriately versus the other persons present; all persons entering the premises are required to have their measure taken beforehand, using the instruments provided at the entrances, both in the head offices and in the branches; the obligation to have a valid Green Pass for access to the Company; avoid physical contact with others (e.g. no handshakes etc.), always trying to avoid touching your eyes, nose and mouth with your hands; take all precautions in the area of hygiene: wash frequently your hands with water and soap (following the directions shown in the signs on the walls in the toilets), or alternatively use hand gel/sanitizer as instructed by the company; staff who use public transport to come to work are required to comply scrupulously with the regulations issued by the local transport companies and to sanitize their hands thoroughly before they enter the building, using the sanitizers provided at the entrance; persons accessing the buildings must only use personal protection equipment (e.g. masks) provided by the company or other certified surgical or FFP2 masks; staff may not enter the premises wearing masks with valves and community masks (e.g. fabric and / or non-certified masks); Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 8

it is suggested to avoid, if not strictly necessary, business lunches with customers and suppliers.

Even breaks with colleagues must be set on compliance with the rules of social distancing provided for by current legislation and, in any case, it is suggested to limit the moments of conviviality even outside the workplace; the obligation to carry out complete air changes in the offices several times a day (e.g. by opening doors and / or windows for at least 10 minutes every hour); the prohibition of using the fixed PC and the equipment attached to the workstation (keyboard, mouse, landline phone, etc.) of other colleagues in job rotation during the same day.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 9

5 Criteria applicable to on-premises personnel To ensure that the return of staff to the Group company premises is managed adequately a rotation plan will be adopted to avoid too many people being concentrated in the individual working spaces at any time.

Working from home will continue to be encouraged in Phase Two as well, as it represents a useful and flexible tool for preventing infection. In any case, the return to work will be based on actual and proven operating requirements, which it will be the responsibility of each individual head of area to assess.

Each head of unit must define and formalize a shift plan shared with their manager, in compliance with the percentages of employment detailed below. It is also the responsibility of each manager to constantly check the proper performance of the activities in charge of their area. A limited presence in the common areas must be guaranteed at all times, especially for the units located in the open spaces.

A matrix has been prepared in the Annex (COVID scenario table) which defines, based on the area in which the workplace is located3 (differentiated between headquarters and branches), the percentage of maximum occupancy of the workstations 4, in compliance with the distancing social and with a maximum tolerance margin (for the offices) of 5% compared to the% shown in the table.

The adjustment to the new percentages (especially if lower) can be achieved within 3 days of the entry into force of the new area.

The maximum occupancy percentage is valid for single management including single offices.

Compared to the percentages defined in the COVID scenario table, any changes (increasing or decreasing) will be possible and made effective upon communication to the impacted headquarters / company with the specifications to be implemented by Group HR and Safety, Physical Security & Facility Management. This is in order to allow a correctly calibrated return based on the epidemiological trend and any additions / regulatory changes.

The maximum % allowed are always subject to preliminary verification of the guarantee of safety distances (as per the plan previously agreed with Group Safety, Physical Security & Facility Management).

Space planning is confirmed (lay-out with desks that can be used simultaneously 5 in compliance with the social security distancing) developed by Group Safety, Physical Security & Facility Management and including open-spaces and individual offices to define the resources of competence (internal and / or external) of each direction that may be present at the same time.

As part of the choice of resources to which to allow access to the office, it is expected that in this phase and until the end of the State of Emergency: to all persons who the Medical Co-ordinator, without prejudice to the data privacy regulation in force, informs the company have particular vulnerabilities or existing or previous health 3 The

reference areas are those defined by national and local legislation. For foreign branches and subsidiaries, the % is defined on the basis of local restrictions, in coordination with Group HR and Safety, in a manner consistent with the principle of variability of the percentage in presence according to the restriction levels adopted by local authorities.

4 This percentage does not include the staff of the property management services and contracted services (maintenance, cleaning, photocopy service, concierge and reception, etc.).

5 There is no multi-sharing of a desk with a fixed PC in the personnel rotation logic during the same working day.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 10

conditions, those suffering from autoimmune diseases, and women who are pregnant, is strongly recommended continue to work from home; however, remote work is strongly recommended for pregnant women. In the event that the worker cannot be assigned to work remotely, the following additional protective measures are applied: use of FFP2 mask, use of gloves, and recommendation to limit the use of public transport for home / work travel considering the progressive increase in accesses, if necessary, the operating procedures for access - staggered entries, timetables will be communicated by the competent functions; the managers will have to prefer (as far as the organization and composition of their department allows), the return to the workplace of workers who do not necessarily have to use public transport for long journeys; for workers who will necessarily have to travel by public transport, it is compulsory to strictly comply with the safety protocols of the local transport companies; in cases where persons have stayed and/or travelled abroad, they are reminded to inform themselves at all times, through consulting the respective institutional websites (embassies, consulates, www.viaggiaresicuri.it, the local prevention departments, etc.), to ensure that any obligations in force to contain the spread of Covid-19 are complied with. In cases where persons returning from other countries are required to be swab tested, they will only be allowed back to work if they test negative and once they have received clearance from the medical co-ordinator.

Readmission to work after infection with the SARS-CoV-2 / COVID-19 virus will take place in the manner prescribed by current legislation and in any case after negativization has occurred as well as possession of a valid green pass.

If in order to prevent hotspots from forming, the local health authorities in the areas most affected by the virus introduce additional specific measures, such as swab testing for all employees, in such cases the employer will ensure maximum co-operation.

5.1. Access to premises Before entering the workplace, Staff must: Have their temperature taken before entering the buildings.

If they have a temperature over 37.5°, they will not be allowed in and the Covid-19 Officer will be informed immediately (by an email to be sent to: missafety@mis.mediobanca.com). Without prejudice to the personal data privacy regulations in force, the Covid-19 Officer will temporarily isolate the person with the temperature (in a dedicated room which is not the nurse’s office), give them a protective mask (if they do not already have one), and ask them to contact their GP for guidance.

No company staff responsible for provision of first aid services must be involved in managing such cases.

Show the Green Certification6.

6

For operations, please refer to the Document "Provisions on the use of green certifications in the private work place".

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 11

5.1.1. Staff who work on premises All staff members are required to: Maintain the appropriate social distancing when entering the buildings and passing through turnstiles, to avoid crowding; Use, where provided, differentiated entrance and exit doors, respecting the signs present in order to avoid encounters with people passing in the opposite direction; Keep use of lifts to a minimum (and use them in accordance with the guidelines/instructions displayed on the posters nearby) using the staircases instead (with the exception obviously of persons with disabilities); Always wear the supplied certified surgical mask inside the workplace, except when working alone, in open spaces, or in closed environments that no one can access apart from the person who works there. For instance: Always for all workers with open space workstations (even in the case of a checkerboard layout) or offices with more than one workstation; Always during transit and stay in common areas (corridors, break areas, lifts, toilets, etc.); For workers with workstations in single offices, in the event that other people enter the room; When and where it is not possible to respect social distancing measures; More generally, in accordance with the company regulations, which are updated promptly in accordance with any changes to the law; Keep movements around the Group and office building to a minimum, using other forms of communication such as the telephone, email or video conference instead; Practise social distancing when using the photocopier/printer; Clear their desk and all other working surfaces completely at the end of the day to allow the cleaning staff to do their job thoroughly; Avoid every form of gathering or crowding.

In addition, the COVID scenario table annex defines, based on the area in which the workplace is located, rules on the possibility of carrying out training activities in presence, meetings and meetings with customers. If such activities are possible, social distancing must always be guaranteed and any defined limits on the use of meeting rooms must be respected as detailed in the attachment “Guidelines on internal meetings and use of meeting rooms” and “Guidelines for internal training courses”.

5.1.2.

External consultants

External consultants, including outsourcers, are allowed to enter the premises, if it is considered essential to the functioning of the company processes. Access to the premises by such consultants shall in any case follow all rules laid down by the company for its own staff internal including the measurement of body temperature and the display of the Green Pass. Any consultants needing to Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 12

access the premises must be included in calculation of the limit on the workforce referred to previously.7 The provisions on the measurement of body temperatures apply also to foreign Branches.

5.1.3. Visitors Entry to visitors is permitted upon acquisition, by the concierge, of the Self-declaration that the subject possesses the requisites required for access to the Bank's premises and undertakes to comply with the Company rules set out for staff including temperature measurement corporeal.

The Green Pass is expected to be exhibited. 8 Attachment "Covid self-declaration - 19".

5.1.4. Clients Customers for access to the offices undertake to comply with the Company rules set out for staff including the measurement of body temperature. The Green Pass has to be exhibited, according to applicable regulation.

5.1.5. Suppliers Suppliers are allowed to enter the premises subject to the Regulations for External Personnel being sent to them by the Safety team via certified email message. It should be noted that anyone accessing the premises by means of an unnamed entry card must obtain the self-declaration form from the reception staff before entering the building, stating they are safe to enter the Bank’s premises and that they undertake to comply with the company rules on display for its own staff including the measurement of body temperature and the display of the Green Pass as provided by the Annexes entitled “Regulations for external personnel” and “Covid-19 self-declaration form”.

5.2. Training activities, meetings and internal events All activities resume without prejudice to the adoption of specific procedures detailed below.

5.2.1 Training activities Where possible, it is always advisable to privilege remote modalities. For the types of courses for which the remote mode is not allowed, restarting in presence is allowed in the following ways: Internal sessions: always respect the indications given on the signs outside the room, in which, depending on the surface and configuration of the space, the maximum number of people who can access it is indicated, always respecting the safety distance provided; always clean / sanitize your hands before entering the room; be equipped with a surgical mask that must be worn for the entire duration of the training course in consideration of the prolonged sharing of the same environment; follow the teacher's instructions for registering attendance.

7

The percentage of employment of the workforce does not include the staff of the property management services / contracted services (e.g. maintenance workers, cleaning, mail / photocopy service, concierge/reception, etc.).

8 The details are visible in the Annex "Provisions on the use of green certifications in private work".

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 13

For more details, please refer to the Annex "Internal training guidelines".

External sessions: respect the Protocol adopted by the provider and / or the host body.

External sessions in which the individual worker participates9: the Employee who intends to participate in the training must comply with the Protocol adopted by the provider and / or the host body.

5.2.2. Meetings Where possible, it is always advisable to privilege remote modalities where necessary, the organization in presence is allowed with the following requirements: always respect the indications given on the signs outside the room, in which, depending on the surface and configuration of the space, the maximum number of people who can access it is indicated, always respecting the safety distance provided; always clean / sanitize your hands before entering the room; wear the surgical mask for the duration of the meeting in consideration of the prolonged sharing of the same environment.

For more details, please refer to the Annex "Meeting guidelines".

5.2.3. Internal and external events The organization is allowed in the situations defined in the COVID scenario table, provided that the organizer, with the collaboration of Group Safety, Physical Security & Facility Management and RSPP, defines specific detailed operational provisions according to the particularities of each individual (e.g. event catering, entertainment, etc.).

For more details, please refer to the Annex "Event management guidelines".

5.3. Work-related travel Work-related travel between Group offices must be taken only if strictly necessary for operational and commercial reasons that cannot be postponed10,and are allowed in the situations defined in the COVID scenario table, depending on the epidemiological trend Wherever possible, travel and business trips must follow the indications given in the following paragraphs.

5.3.1.

Work-related travel to Italian companies/branches/offices of the Mediobanca Group

Work-related travel to Italian companies/branches/offices of the Mediobanca Group, when permitted, must meet the following conditions:

This provision applies to individual Employees who intend to participate as part of their work in courses / initiatives organized by third parties (eg. ABI courses) not coordinated by an Organizer at company level.

10 Commercial division, Group Safety, Physical Security & Facility Management, Compliance and Group Audit.

9

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 14

All the guidance contained in the company protocol and locally applicable regulations must be complied with; The day of arrival and length of stay must be agreed in advance with the company/branch/office colleagues to which the journey is being made, to ensure that the guidance contained in the company protocol is complied with.

This is to ensure that the maximum occupancy of spaces is respected and social distancing maintained.

5.3.2. Work-related travel to corporate clients/counterparties When permitted, work-related travel corporate clients/counterparties must meet the following conditions: All rules of conduct included in the Mediobanca Group protocol and locally applicable regulations must be complied with at all times (wear a mask, social distancing, distancing in public and private means of transport etc.), and only the number of people, strictly necessary for the commercial activities must travel; Those travelling must ascertain in advance with the other party whether or not protocols have been adopted by them that must be respected, and must conduct themselves in accordance with the guidance contained in them; If the customer/counterparty asks to see the Mediobanca Group’s own protocol, a declaration is available from the company intranet which can be downloaded (those travelling are recommended to take it with them on the occasion of the trip).11 5.3.3.

Work-related travel outside Italy

When permitted, business trips outside Italy must meet the following conditions: If staff do actually need to travel outside of Italy to the Bank’s international branches and/or the non-Italian Group companies, or to international customers/counterparties, the Group’s general protocols and those adopted locally by the branches/Group companies or customers/counterparties must be observed, with the employee required to check these with the counterparty beforehand; If an employee needs to travel outside Italy, they must check the applicable regulations regarding the possibility of entering/travelling within/returning to the countries concerned under Italian legislation and the legislation of the country to which they are travelling (e.g. via the website of the Italian Ministry of Foreign Affairs, or the websites of the equivalent ministries of the countries to which they are travelling); In the event of a worsening of the epidemiological situation, prior authorization may be requested from the competent HR Office in collaboration with the Safety team, Competent Doctor and RSPP; Any consequences relating to individual restrictions caused by failure to observe and comply with any bans/restrictions on movement shall be the sole responsibility of the employee themselves.

11

Cf. Annex on “Information on work-related travel to clients or counterparties”.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 15

6 Equipment provided To ensure the maximum protection, the following measures have been adopted without prejudice to the general measures issued by the competent authorities: Hydro-alcoholic sanitizer gel dispensers suitable and to a sufficient extent have been installed for staff, guests, clients etc. in shared areas considered to be critical (such as entrances, canteens etc.). This in no way replaces the fundamental obligation for all staff to wash their hands frequently with soap and water; Periodical delivery of set of 20 surgical masks12 for all staff members; Periodic delivery of disposable gloves to branches available to staff to be used in particular in handling customer documents and cash; Provision of sanitizing products for cleaning pool cars.

As the Ministry of Health in the respective countries have specified, protective masks serve to limit the spread of the virus but must be used in conjunction with the other hygiene measures as well (in particular respiratory hygiene and hand-washing).

“Eco-boxes” have been installed in the shared areas of the various headquarters, suitably identified as such, for used masks and other waste considered to be a risk in terms of spreading the infection (e.g. paper handkerchiefs and gloves), as provided by Article 2, paragraph 1, letter d) of Italian Presidential Decree 254/03 (European Waste Code 180103). In this regard, it is recalled that waste cannot be thrown into eco-boxes other than what is appropriately indicated.

They are considered personal protective equipment (PPE), pursuant to Article 74, paragraph 1, of Legislative Decree 9 April 2008, no. 81, the "surgical masks" referred to in Article 16, paragraph 1, of the decree-law of 17 March 2020, n. 18, converted, with amendments, by law 24 April 2020, n. 27, the use of which is governed by Article 5-bis of the same decree-law.

12

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 16

7 Reorganization of working areas at premises 7.1. Reception Plexiglas dividers have been installed in the reception areas with holes to allow documents etc. to be handed over.

A separate area will be set up for the delivery of packages and mail items.

Predisposition of Termoscanner for the detection of body temperature.

Provision of mobile devices for the verification of the validity of the Green Pass (APP Verification C19).

7.2. Work spaces – offices The maximum capacity of the various working environments has been recalculated, both closedand open-space areas, to ensure that workers can be present at the same time while maintaining the requisite social distancing. This will involve a chequered arrangement with staff occupying alternate workstations.

7.3. Meeting rooms The new maximum capacities for meeting rooms will be stated with an indication of which places can be occupied in order to ensure that social distancing is maintained.

7.4. Shared spaces (e.g. kitchen and break areas, with and without food being consumed) Access to these areas will be restricted based on the size of the rooms themselves and their respective capacities, as will be made clear in the information notices to be displayed there.

When entering these areas, staff members are required to: Wash or sanitize their hands before using the buttons on the vending machines to purchase their coffee, snacks and beverages (including the water dispensers); Observe the rules set out in the information notices and follow the sign-posting on the floor; Spend as little time as possible in these areas and maintain social distancing at all times when in them.

If these measures are not respected, the company reserves the right to suspend the service by removing food from the vending machines and water from the dispensers as the case may be.

7.5. Eating meals Places available for sitting and eating meals are appropriately marked and where possible organized in a chequered arrangement, ensuring the tables remain at a distance of at least 1 metres from each other.

Tables which are set against walls (if any), as they are so thin, may only be used by one person at a time.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 17

Use of the area for eating meals follows the lunch hour rotation arrangements established by the company. Cleaning staff will intervene during the changeovers to clean and disinfect surfaces and the vending machine buttons.

Staff members are reminded of the need to observe the time set for their lunch hour to ensure that all colleagues who want or need to eat their lunch on the company premises can use the area for this purpose.

Staff members who choose to take their lunch hour off the premises must in any case comply with the same rules of conduct, or with those of the restaurant or café they go to if stricter rules are in place at them.

7.6. Inside smoking areas All inside areas previously available for smokers have been closed temporarily.

7.7. Toilets Social distancing must be maintained and personal protection equipment (e.g. face masks) must be worn when using the toilets.

The toilets have been fitted with disposable paper towels, and the soap dispensers are refilled each day.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 18

8 Cleaning and sanitization The daily cleaning activity of the Company's environments is maintained, with products and methods envisaged according to the rules imposed by the Authority, intervening in particular on the work surfaces and attached equipment (desks and telephone sets), contact points (handles, push-button panels, switches, etc.) and floors.

A cleaning service is guaranteed at the offices (morning before entering the offices or in the afternoon after office hours) according to the office. During the working day, continuous passage of the toilets and common areas are guaranteed if necessary.

More in depth cleaning is carried out on Saturdays according to the specifications provided and full sanitization is carried out on a weekly basis.

If a person who tests positive for Covid-19 has entered the premises, the spaces concerned are cleaned and sanitized in accordance with the provisions of circular no. 17644 of the Italian Ministry of Health issued on 22nd May 2020 and aired thoroughly. During the sanitization process, specific instructions may be issued to the persons who habitually occupy the spaces concerned (including ceasing work temporarily).

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 19

9 Maintenance 9.1. Air conditioning An additional plan of maintenance goes on for air conditioning systems (e.g. cleaning A/C filters etc.).

Office spaces and all areas where staff are present will also be aired thoroughly at least once a day, opening doors, windows and any other feature that will allow the air to be changed effectively.

9.2. Ordinary maintenance work The maintenance interventions inside the buildings continue according to the planned maintenance plan, adopting all the safety measures that aim to protect the health of workers and prevent any form of contagion. The persons responsible for the maintenance work must therefore: Be in possession of all requisite personal protection equipment (i.e. masks); Talk only to the officer responsible; Enter only the rooms they are required to enter to go about their work, and comply with the social distancing criteria.

Firms which perform maintenance activities are also advised in advance of the measures that the company has implemented and of notifications of any situations that could be critical for their own staff. 13

13

Cf. Annex entitled “Regulations for external personnel”.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 20

10 Guidelines for managing persons with symptoms If a person the premises develops a temperature or respiratory infection symptoms such as a cough, the Covid-19 Officer must be informed by email (at missafety@mis.mediobanca.com) and the person concerned must be isolated in accordance with the healthcare authority’s instructions.

The person with symptoms will be accompanied to the room set aside and equipped for this purpose (non-upholstered chairs, very few objects), suitably marked and kept free at all times and fitted with protective equipment such as gloves, masks, thermometers, hand gel, etc. The healthcare procedures will then be activated, for informing the person’s GP and the healthcare authorities, for which the Covid-19 Officer is responsible. Emergency telephone numbers and the contact details of the Medical Co-ordinator will also be displayed in the isolation room.

Once the person’s isolation has ended, the room will be closed and sanitized immediately.

The Company collaborates with the health authorities for the definition of any "close contacts" of a person present in the company who has been found positive for the COVID-19 swab, also with the involvement of the Competent Doctor Coordinator. This is in order to allow the authorities to apply the necessary and appropriate quarantine measures. During the investigation period, the company may ask any possible close contacts to leave the company as a precaution, according to the indications of the Health Authority. All activities will be carried out in compliance with the privacy legislation and with the adoption of confidentiality criteria by the people involved

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 21

11 Management of workers in a state of SELF-SURVEILLANCE For workers for whom the SELF-SURVEILLANCE measure is envisaged, compatibly with the job performed, the remote working method is privileged. In the only case in which the presence of the worker at his / her workplace14 is necessary, the same, for the period of application of the measure, must strictly comply with the following: obligation to wear FFP2 masks (delivered upon return); undergo body temperature measurement several times a day; maintenance of health and hygiene precautions with frequent hand sanitation and respect for spacing; ban on eating meals inside the workplace with other workers present; ban on the consumption of beverages at vending machines in the presence of other workers.

14

For retail, if unable to resort to agile work, the absence from work will be allowed through paid work permits.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 22

12 Healthcare monitoring Health surveillance must continue, respecting the hygiene measures contained in the indications of the Ministry of Health (so-called decalogue).

However, the following will continue to be performed: Statutory examinations (for new recruits and/or prior to staff changing duties); Examinations for staff returning to work following an absence of more than 60 days including for Covid-related reasons; Examinations for staff members who are pregnant; Examinations considered necessary in the event of particular limitations or restrictions being imposed for critical cases.

Health surveillance represents an additional preventive measure of a general nature: both because it can intercept possible cases and suspected symptoms of the infection, and for the information and training that the competent doctor can provide to workers to avoid the spread of the infection. Health surveillance must aim at the complete, albeit gradual, restoration of scheduled medical examinations, provided that it is allowed to operate in compliance with the hygiene measures recommended by the Ministry of Health and in accordance with the WHO, subject to evaluation by the competent doctor who takes into account the '' epidemiological trend in the reference area, in accordance with the circular of the Ministry of Health of 29 April 2020 and with the inter-ministerial circular of 4 September 2020.

The competent doctor collaborates with the employer, the RSPP and the RLS / RLST in identifying and implementing measures aimed at containing the risk of infection from the SARS-CoV-2 / COVID-19 virus.

The competent doctor, where present, carries out the exceptional health surveillance pursuant to article 83 of the decree-law of 19 May 2020, no. 34, converted, with amendments, by law 17 July 2020, n. 77, for the purposes of protecting fragile workers according to the definitions and methods set out in the joint circular of the Ministry of Health and the Ministry of Labor and Social Policies of 4 September 2020, in compliance with confidentiality.

The competent doctor, in consideration of his role in risk assessment and health surveillance, may suggest the adoption of testing / screening strategies if deemed useful for the purpose of containing the spread of the virus and the health of workers, also taking into account the 'epidemiological trend in the reference area and as established in the circular of the Ministry of Health of 8 January 2021.

The competent doctor collaborates with the Health Authority, in particular for the identification of any "close contacts" of a worker found positive for the COVID-19 swab in order to allow the Authorities to apply the necessary and appropriate quarantine measures. With regard to "close contacts", as defined by the circular of the Ministry of Health of 29 May 2020, their identification should take into account the prevention and protection measures identified and actually implemented in the company, in order to contain the risk to be SARS-CoV-2 / COVID-19.

Readmission to work after SARS-CoV-2 / COVID-19 virus infection will take place in compliance with the relevant legislation. For the progressive reintegration of workers who have already tested positive for the swab with hospitalization, the Competent Doctor will carry out the medical Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 23

examination provided for in Article 41, paragraph 2, lett. e-ter of Legislative Decree no. 81/2008 and subsequent amendments (medical examination prior to resuming work following absence for health reasons lasting more than sixty continuous days), in order to verify suitability for the job - also to assess specific risk profiles - independently the duration of the absence due to illness.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 24

13 Monitoring to ensure protocol is applied correctly In implementing the Protocol governing the measures to prevent and limit the spread of the Covid19 virus, each head of unit is responsible in practice for monitoring to ensure that the people who work for them apply the measures correctly, and in any cases where they do not, for reporting this fact immediately to missafety@mis.mediobanca.com, which is the technical office responsible for managing the issue (with the duty of collecting data on problems and gathering observations), in conjunction with the Covid-19 Committee and Crisis Committee via the Head of Group Safety, Physical Security & Facility Management).

Group Safety & Physical Security, Group Audit and Compliance have devised checks to ensure that the Protocol is applied correctly.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 25

Annex Covid-19 self-declaration; Information on work-related travel to clients or counterparties; Regulations for external personnel; Scenario Chart; Guidelines for internal training courses; Guidelines on internal meetings and use of meeting rooms; Guidelines on events management; Instructions regarding the use of green certification in the private workplace.

Group Directive Protocol governing measures to prevent and limit spread of Covid-19 virus in working environments 26