NEW PROVISIONS REGARDING WHISTLEBLOWING

Legislative Decree no. 24 of 10 March 2023 "Protection of people who report violations of Union law and containing provisions regarding the protection of people who report violations of national regulatory provisions" introduces new provisions on whistleblowing. The rule in question and the new ANAC guidelines (see Resolution no. 311 of 12 July 2023), provide for the possibility of making reports through IT, and/or documentary tools and/or in oral form. The procedures for managing reports, regardless of the channel used, must, in any case, guarantee the confidentiality of the identity of the reporter, the content of the reports and any related documentation attached. C.M.G. SpA has set up a specific procedure for the collection of reports in documented format, electronically (use of email) and in oral form. Regardless of the channel used, the reporting party is still required to complete a specific document format containing the useful and necessary information for a suitable investigation. The form is designed to receive reports relating to any:

• administrative, accounting, civil and criminal offences;
• significant illicit conduct pursuant to Legislative Decree 231/2001, or violations of the organization and management models provided therein;
• violations of community or national regulations relating to the following sectors: public procurement; financial services, products and markets and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental Protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and protection of personal data and security of networks and information systems;
• acts or omissions that harm the financial interests of the European Union.

The methods for managing reports are as follows:

• the report is formalized through the use of a specific reporting form which can be sent by post or email. In the case of an oral report, the person making the report will also be asked to complete the reporting form. For the purposes of complete applicability of the Decree, the form must contain the data of the reporting person. Anonymous reports will be taken into account only if adequately substantiated, but will not be subject to regulatory requirements;
• the report is received by the Evaluation Body and managed by it while maintaining the duty of confidentiality and protection of confidentiality towards the reporter as defined by the law;
• following the sending of the report in the manner indicated above, the Evaluation Body provides formal feedback to the reporter within 7 days of taking charge. Within the following 90 days the Evaluation Body undertakes to conclude the investigation with communication of the outcome to the reporting party.

C.M.G. SpA has prepared a procedure which, in more detail, defines the requirements for sending the report, its acceptance and subsequent management. Employees and interested parties are invited to review it. Before formalizing the report, the reporter is invited to read the information on the processing of personal data.