Reporting System (Whistleblowing)

Cerved Group and all the companies of the Cerved Group adopted a Procedure and specific communication channels for receiving and managing reports (anonymously and not) of alleged irregularities.

“People of Cerved” as well as all other subjects who interact with the Cerved Group are invited to report any relevant violation for the purposes of the Procedure of which they become aware, at any stage of their relationship with Cerved Group.

Acts or facts that are the subject of violation reports could concern the following issues:

• violations of the Group’s Code of Ethics

• unlawful conduct relevant pursuant to Legislative Decree No. 231/2001 and violations of the 231

• violations of the procedures adopted by the Group Companies

• business integrity issues (e.g., unfair conduct in the handling of business activities, corruption, damaging events that involve customers, conflicts of interest) that also include all aspects related to the following cases:

• unlawful conduct, relevant pursuant to the regulations applicable to the activities carried out by the Group (e.g. Antitrust Law, Anti-Corruption Law, European Union Law …)

• conduct, acts or omissions detrimental to the public interest or the integrity of the public administration or private entity and consisting of:

• administrative, accounting, civil or criminal offences;

• offences that fall within the scope of the European Union or national acts indicated in the Annex to this Decree or national acts that constitute the implementation of European Union acts;

• acts or omissions affecting the financial interests of the Union;

• acts or omissions affecting the internal market (by way of example: competition and State aid violations);

• acts or conduct that frustrate the object or purpose of the provisions of Union acts.

• financial integrity issues (e.g., accounting violations, corporate fraud, theft, incorrect use of company resources.

Cerved guarantees the confidentiality of the identity of the reporting person and any other information from which this identity can be inferred, directly or indirectly, without the express consent of the reporting person himself.

Reported subjects are protected as regards both the confidentiality of the reports concerning them and any investigations carried out, and the protection of the same from any retaliatory and/or defamatory reports.

Retaliatory, harassing or discriminatory acts, direct or indirect, are expressly prohibited for reasons connected, directly or indirectly, to the report; this protection is guaranteed to the reporting party even when the report, even if unfounded, is based on criteria of good faith and reasonableness.

Violations of the procedure and of the provisions contained therein may be subject to sanctions.

Reports must be sent by Digital Reporting Channel (designed to ensure ease of use, anonymity, confidentiality) accessible from any PC, tablet or smartphone at this link.

The whistleblower is recommended to periodically access the Digital Reporting Channel to check for any requests relating to the forwarded report.

It is also possible to use the following internal alternative channels. They are inspired by the same principles of confidentiality and protection of anonymity according to the limits of the alternative channel used, indicated below:

• E-mail: (indicating “confidential”) only System Manager of each Group company can read

- Cerved Master Services S.p.A.: whistleblowingCMS@cerved.com.

- Cerved Rating Agency S.p.A.: whistleblowingCRA@cerved.com;

- For all other group companies: whistleblowing@cerved.com;

• mail: to the addresses of each Group company at their respective registered office (see the link Contatti on web site) to the attention of the System Manager (indicating “confidential”).

• Oral reporting:

By using unregistered telephone line at the following numbers:

Cerved Rating Agency SpA: +39 #31# 0802229115

Cerved Master Services SpA: +39 #31# 0802229120

Group company based in Greece: +39 #31# 0802229130

Group company based in Romania: +39 #31# 0802229125

For all other group companies everywhere: +39 #31# 0802229110

Telephone reporting allow you to report also in English. The service is available from monday to friday from 08.30 to 12.30 and from 14.30 to 17.30.

The telephone line allows you to speak directly with the System Manager who will proceed to formalize report of the conversation. Whistleblower will be notified by the identification number of the report to allow him to access the report. He/she can verify it and/or request corrections and finally approve it through the reserved communication channel present into the digital reporting channel.

• Meeting the System Manager: System Manager, if it’s possible and according to the whistleblower, will write the report in the presence of the reporting person. Then, the System Manager ask for confirmation of the contents and acquire, where possible, the sign of the report.

However, we invite all to use the Digital Reporting Channel, unless for technical reasons it is not possible to access it. The reasons are:

1. use of alternative channels cannot guarantee the same level of protection of whistleblowers and efficiency in the management of reports;
2. in case of an anonymous report, Digital Reporting Channel is the only way to ask for clarifications from the whistleblower maintaining his or her anonymity.

Management of the communication channels above is entrusted to the System Manager:

• Compliance & Risk Management responsible for Cerved Rating Agency SpA,

• Compliance, Risk Management & AML responsible for Cerved Master Services SpA,

• Internal Audit function for all other group companies, supported by local managers for the companies of the Cerved Group based in Greece and Romania.

Anyone who receives a report outside the envisaged channels shall promptly forward it to the competent System Manager.

The response to the report is managed by the System Manager of the individual company receiving the report according with the competent corporate functions who will be identified, for each case, depending of the content of the report itself.

System Manager ensures that the reporting management procedure is carried out in compliance with the regulations and with the procedure, also ensures that the checks relating to the reporting will be carried out in the shortest time possible and in compliance with the completeness and accuracy of the investigation activities.

An acknowledgment of receipt will be issued to the reporting party within 7 days of receiving the report.

Report will be acknowledged within 3 months from the date of the acknowledgment of receipt.

The term for data retention is set at 5 years from the conclusion of the reporting procedure, as governed by art. 14 paragraph 1 of the legislative decree lgs. 24 of 2023.