Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1697632660687.pdf (Australia)
Co11n1onwealth Bank �SB SOVEREIGN Comnonwealth Life ./ V4.0 / March 2017 Commonwealth Bank of Australia Policy Group Whistleblower Group Security Services Financial and Advisory COMMONWEAL TH BANK OF AUSTRALIA GROUP WHISTLEBLOWER POLICY DOCUMENT CONTROL Revision History Version Author Issue Date Changes 1.2 2.0 December 201 O Reviewed against Group Risk Appetite Statement October 2010 V2.0 October 2012 Reviewed against Group Risk Appetite Statement V3.0 2012 October 2.1 April 2013 3.0 June 2014 Renamed Policy Reporting Behaviour to Group Whistleblower from Group Fraud and Unethical Policy Protection Policy Minor content the Policy/ change changes Name Program to reflect updated post Policy review; includes and responsibilities independent to roles updates 3.1 4.0 November 2015 Annual review February 2017 Policy updated the to reflect issued Principles in ABA Guiding 2016.
December Renamed Policy from Group Policy Whistleblower Protection Policy.

to Group Whistleblower Approval Authority Version Date Approval Body or Person 3.0 June 2014 EGM Group Security 3.1 December 2015 EGM Group Security and Advisory 4.0 March 2017 Executive Committee and CBA Board of Directors Page 2 of 16 COMMONWEAL TH BANK OF AUSTRALIA GROUP WHISTLEBLOWER POLICY 1.
CONTEXT 1.1 The Commonwealth Bank Group (the Group) is committed 'reportable and an organisational culture work environment constitutes conduct' foster a sound ethical culture anyone who has knowledge reportable conduct to report in section 6 of this policy, as defined throughout of, or reasonable the matter through at their earliest that does not tolerate an ethical to maintaining any act which In order to by section 4 of this policy.
the organisation, suspicions the Group encourages of, any incident of the appropriate channels, as set out opportunity.

1.2 · An effective illegal, necessary governance.
corrupt whistleblower protection program is an important element in detecting or other undesirable in achieving within of ethical the Group, and as such, is a behaviour a culture conduct element and strong corporate 1.3 An effective whistleblower program can result in: with relevant laws; of problems in a business; compliance management; • more effective • more effective • identification • improved • reduction • improved • the protection • demonstration business of business morale within risks; the Group; practices; of the interests that the Group is taking of customers; and its governance obligations seriously.
1.4 Often those making disclosures of this nature are concerned with the confidentiality of the disclosure, repercussions arising that those making a disclosure the manner in which the disclosures from making such a disclosure.

are dealt with, and potential This policy seeks to ensure can trust that: (a)the matter will be dealt with honestly, confidentially; and professionally and, where appropriate, (b)they will not be subject to retaliation, as a result of making a disclosure.
1.5 For the purpose of this policy, an Eligible Person is defined as a: • • • • director, manager, their employee), contractor, broker, auditor; or former employee, secondee; employee, licensee (or its authorised representative or consultant, supplier, service provider (or their employee); of the Group.
1.6 For the purpose of this policy, a whistleblower is defined as an Eligible Person, who: (a)makes, attempts to make or wishes to make a report of reportable conduct; and the protections determines (b)requests Group otherwise of making a report).

considered and protected Under the provisions of certain as whistleblowers.
for whistleblowers is a whistleblower set out in this policy and should be protected as a result legislation, may be other parties (or who the Page 3 of 16 COMMONWEAL TH BANK OF AUSTRALIA GROUP WHISTLEBLOWER POLICY 2.
PURPOSE AND OBJECTIVE 2.1 The purpose of this policy is to: • encourage constitutes and support reportable conduct; the reporting of reportable conduct and define what • identify • explain • explain who is deemed to be a whistleblower; how the identity how a whistleblower of a whistleblower will be supported of making a disclosure retaliation as a result will be protected; and protected from any conduct; of reportable and how reports • explain the whistleblower reporting process are assessed and investigated; • explain conduct the roles of specific and the protection appointments and support surrounding for the investigation and of whistleblowers; of this Policy governance the requirements and process.
of reportable • detail assurance of this policy by providing 2.2 The objective conduct The Group is committed a culture and fostering conduct the Group can continually senior management believe could be reportable encourage improve is to encourage and support the reporting of reportable to the whistleblower that it is safe for them to do so.

to identifying of speaking and responding to disclosures of reportable risk so and business up about problems the way it conducts its business.
The Board and all Eligible under this policy.

Persons to report conduct that they 2.3 This policy should be read in conjunction "Our Commitments".

discretion.

This policy It does not form part of any employee's with the Group's may be subject and procedures, policies to change from time to of contract including time at the Group's employment or any industrial instrument that may apply.

3.

SCOPE 3.1 This policy applies to all businesses the Group has a controlling businesses.
interest the Group, including within and is applicable to all Eligible where of those subsidiaries Persons 3.2 This policy must be implemented in accordance jurisdiction.

Where in this policy, contained inconsistency local jurisdictional requirements those requirements with this policy.
will apply to the extent of any with the laws of the relevant than those are more stringent 3.3 Entities whose whistleblower and Advisory, reporting management are to adhere to the principles matters on whistleblower through and are to as agreed with Group Security is not conducted of this policy and reporting Group Security periodic provide and Advisory.

4.
REPORTABLE CONDUCT 4.1 For the purpose of this policy, reportable conduct is defined as any conduct which is: • Dishonest • Fraudulent • Corrupt • Illegal • In breach of legislation Page 4 of 16 COMMONWEAL TH BANK OF AUSTRALIA GROUP WHISTLEBLOWER POLICY breach of internal policy • In serious • Unethical • Improper • Bullying • Unsafe work practices • Any other conduct or be otherwise including and harassment which may cause financial or non-financial loss to the Group detrimental to the interests unsound practices.
environmentally of the Group and its customers, 4.2 Additional qualify specific for protection are detailed in sections 9 and 10 below.

instances where the disclosure of information by a person will 5.

THE WHISTLEBLOWER 5.1 A whistleblower may or may not wish to remain anonymous.

this will be respected.


Such a whistleblower Where a whistleblower is to be wishes to remain anonymous, informed and it may prevent the whistleblower that, by their nature, anonymous the whistleblower reports from accessing are more difficult additional to investigate, may be entitled under legislation as detailed protection in section to which 9 below.

5.2 A whistleblower conduct, will be protected disclosure.
This includes, who, the Group determines, from retaliation, but is not limited as a direct to: has made a disclosure of reportable result of having made the • termination of employment; • disciplinary action • performance management; • harassment or bullying; • discrimination; • any other conduct or including warnings; that constitutes retaliation.

5.3 However, nothing Person in relation contractual duties concerns).
impacts in this policy to matters arising with the Group (for example, the Group's in the ordinary to deal with an Eligible ability course of their relationship and or misconduct separate performance 5.4 The Group will not be able to provide who is an external the same level of protection third party or former employee, at the time the and support for a whistleblower disclosure is made.

5.5 The Group will appoint an appropriately Protection is protected legislation.
qualified Officer (WPO) who will seek to ensure that the and supported Once a disclosure will be provided with of reportable the WPO's details of this policy and any has been made, the and will have access to the the context conduct Whistleblower whistleblower relevant whistleblower WPO at any time.

and suitable person to be a within to retaliate against or victimise 5.6 It is not acceptable so) as a result tolerated retaliated potential by the Group under any circumstances.
against termination a whistleblower of employment.

will be liable (or threaten a whistleblower conduct.
This will not be who is found to have including Any employee to disciplinary action, to do of their making a disclosure of reportable 5.7 If a whistleblower considers themselves making a disclosure, they may request "at significant that positive risk" of retaliation of action be taken in relation to their as a result Page 5 of 16 COMMONWEAL TH BANK OF AUSTRALIA GROUP WHISTLEBLOWER POLICY but is not limited to, a request to be allowed to Such action could include, protection.
take leave or to be relocated must advise the WPO if they wish specific liaise Wherever with an explanation their ability identified.

such requests as to the reason(s) with appropriate possible, protection management to provide for the duration actions staff to determine of the investigation.

to be considered the feasibility will be met or the whistleblower and the WPO will of the request.

will be provided The WPO may be limited consent to be in it is not possible.
if the whistleblower does not The whistleblower 6.

THE WHISTLEBLOWER PROCESS 6.1 Disclosures of reportable conduct known to the person making the disclosure.

the alleged grounds to suspect conduct has occurred.
must be based on information that is directly That person must have reasonable 6.2 Eligible Persons with information in relation to any reportable conduct have the option of reporting the issue via: • A senior • The Group's SpeakUP program: leader, at or above General Manager level within the Group; o 1800 773 258 (a 24-hour o Reverse o Email to speakup@speakupho dedicated on +61 2 8295 2944 tline.com.au charge from overseas hotline for reporting suspicions); 6.3 SpeakUP is a 24/7 dedicated service for people to raise issues impacting at work, or the Group, including their wellbeing SpeakUP can choose to do so in confidence, available of the protections an external vendor on behalf of the Group.
reportable anonymously, The Speak UP service under this policy.

conduct.

and/or avail themselves is managed by their role, Those contacting 6.4 On receipt of a disclosure, the person receiving it must ask the whistleblower whether or Group Legal), he or she consents persons appropriate Services Investigation properly this policy.

there may be limitations ability whistleblower Security disclosed Group Security followed.

to Group Security and Advisory.

to protect to the disclosure (e.g.


within and/or their identity being shared with Group Security and Advisory, Group People to a Whistleblower the WPO and, if appropriate, Officer (WIO).

This can enable the disclosure d and supported to be protecte to be investigated as contemplated by and the whistleblower The whistleblower should be informed that if such consent further is not given, and on the Group's on investigating the disclosure them (for example, if the WPO cannot be contacted).
If the does consent, the disclosure If the whistleblower and Advisory to Group about the disclosure being should be reported immediately has concerns because the issues relate in paragraph outlined to a person in 6.16 are to be and Advisory, the provisions of reportable conduct and Advisory, 6.5 All disclosures by Group Security procedures Advisory on the contents relating staff responsible of this policy.
made via SpeakUP will normally be managed in accordance with its standard operating to whistleblowing matters.

All SpeakUP and Group Security disclosures are to be trained and assessing for receiving and 6.6 Once a disclosure further as to whether The WIO will be responsible disclosure and for keeping has been received by Group Security investigation is appropriate, and Advisory the matter will be referred of the reported and assessed to a WIO.
for investigating the substance apprised the whistleblower of the investigation's progress.

Page 6 of 16 COMMONWEAL TH BANK OF AUSTRALIA GROUP WHISTLEBLOWER POLICY will be informed of the WIO's appointment and the WIO will the whistleblower to acknowledge receipt of the disclosure and to establish a The whistleblower contact process, progress including of dealing expected timeframes, with the disclosure.

for reporting to the whistleblower on the 6.


7 If the whistleblower is not an employee, the Group is limited against retaliation) (including inform the whistleblower applicable.

in relation by the WIO.

The WIO will also request to any information provided that can be provided that the terms of this policy to the whistleblower.
in the protections The WIO will will apply to the extent that the whistleblower to him or her in relation maintain to any report provided confidentiality 6.8 The whistleblower will be contacted by the WPO, as soon as practicable after the matter has been referred communication to a WIO, to discuss if required.

process, their welfare and to discuss a 6.9 If it is determined that there is insufficient information or evidence investigation, No further action will be taken.
the whistleblower will be informed at the earliest to warrant further opportunity.

possible 6.1 O Where a formal investigation bias, and conducted of the business without independent the person who has made the disclosure, reportable is initiated, by the WIO unit in respect conduct.

this will be a fair and independent or their delegate.
Investigations process, will be have been made, of which allegations or any person who is the subject of the whom allegations 6.11 A person against substance whistleblower whistleblower has right to respond or the content not given consent to any allegation.

of any allegation, have been made will be informed of the except to the extent that doing so may identify of the disclosure (in circumstances where the The person will also have the for that to occur).
the 6.12 The WIO may engage external investigators to assist of reportable disclosure WIO may not disclose whistleblower where appropriate.

investigator unless the whistleblower or their identity to an external conduct, has consented to this.

in an investigation into a For the avoidance of doubt, the disclosed by the any information 6.13 At the end of an investigation, allegations raised.

verifiable evidence.


outcome of the investigation communicated the investigator will be made on the balance will be informed , where appropriate.
Findings The whistleblower are: will make factual findings on any of probabilities based on by the WIO of the final The potential outcomes to be • Substantiated • Disproven and no further has been taken; or will be taken unless further and appropriate action action evidence to the contrary becomes available; or • Unable to be substantiate d and no further action will be taken unless further evidence becomes available.
6.14 Where investigations substantiate matter will be dealt with in accordance procedures, which may result employment.

an allegation arising with established from the disclosure, administrative the or disciplinary in disciplinary action, including termination of 6.15 Any matters of a criminal nature will be reported to the Police and, if appropriate, other appropriate regulatory authoriti es.
Page 7 of 16 COMMONWEAL TH BANK OF AUSTRALIA GROUP WHISTLEBLOWER POLICY 6.16 If a person who makes a disclosure with this policy, with in accordance making the disclosure Advisory, appeal to the Misconduct WPO.

the matter can be escalated or if the disclosure that their disclosure considers they have been subject to retaliation affects someone in Group Security to the WPO.

The whistleblower has not been dealt as a result and can also of Governance Committee, by the if the matter is not resolved 7.
CONFIDENTIALITY & IMMUNITY 7.1 The Group is committed to protecting and fespecting whistleblowers who disclose reportable conduct in accordance with this policy.

7.2 The Group is committed to protecting the anonymity whistleblower important compelled proceedings.

to note however, by law to disclose where that person has specifically that in certain circumstances, requested the whistleblower's identity, the Group may be for example in legal or confidentiality that protection.
It is of a 7.3 Disclosures to SpeakUP may be made anonymously or confidentially by phone or email.

7.4 Nothing in this policy should information standard.

issues or providing regulation or prudential may communicate disclosure.
with regulators be interpreted to a regulator as restricting in accordance The Group acknowledges at any time in relation from raising a whistleblower with any relevant law, that the whistleblower matter of the to the subject 7.5 Should the whistleblower elect to remain anonymous when making the disclosure via SpeakUP, whistleblower should contact have any concerns they will be provided with a unique reference number.
regarding information the disclosure, In the event that the they wishes to provide further SpeakUP and quote the reference about their protection, they should contact the WPO.

number.
Should the whistleblower 7.6 All information received in relation or that could lead to the identification from a whistleblower conduct, securely and in the strictest confidence and must not be disclosed unless: is to be held of the whistleblower, to a disclosure of reportable • the whistleblower such a disclosure; • the Group is compelled • the Group deems it appropriate legislation has consented or (see Appendix by law to do so; or specific to make a disclosure to a regulator under 1 for details).
(preferably in writing) to the disclosure prior to Any breach of confidentiality will be subject whistleblower's employee is found to have disclosed disciplinary identity, action.
to a separate the information, or a investigation they may be liable and, if an to of the information provided by a whistleblower, 7.7 In circumstances where the WPO or WIO has genuine or safety well-being and reasonable concern or any member of the of the whistleblower the whistleblower's disclosure, they may provide the person with about the immediate team investigating of the Group's details medical, counselling Employee or support Assistance services on their behalf.
Program and may engage appropriate Page 8 of 16