H I TA C H I

R A I L2 0 24

A N N U A L

C O M P L I A N C E

R E P O R T

2024 AnnualCompliance Report
Activating Integrity

H I TAC H I R A I L . C O M

1H I TA C H I

2 0 24R A I L

Contents

EXECUTIVE SUMMARY................................................. 3

Compliance DD Reviews –Volume and Disposition Outcomes....................................16

GOVERNANCE............................................................. 4

Future Focus........................................................................16

Architecture..........................................................................4

EXPORT & TRADE COMPLIANCE (ETC).......................17

Oversight, Autonomy, and Organisation/Resources...........4

Future Focus........................................................................17

POLICIES & PROCEDURES............................................ 5
Future Focus..........................................................................6

ANTI-BRIBERY & ANTI-CORRUPTION.......................... 7
Volume and Trends for Manual Business
Courtesies and Donations & Sponsorship Requests..............7
Business Courtesies Digitalisation, Volume and Trends.........8Business Courtesies Spend Trends.........................................9

Authoriser:

Bruce Campbell
Group General Counsel
Publication date and classification:

25 June 2024
Hitachi Rail – Public

R E P O R T

DUE DILIGENCE & BUSINESSPARTNER MANAGEMENT.......................................... 15

Future Focus..........................................................................4

Jaclyn JewellGroup Chief Compliance Officer

C O M P L I A N C E

A MESSAGE FROMTHE CHIEF COMPLIANCE OFFICER.............................. 2

Reporting..............................................................................4

Author:A N N U A L

Business Courtesies Country Trends....................................10

PRIVACY & PERSONAL DATA PROTECTION.............. 18
Future Focus........................................................................18

COMPLIANCE OPERATIONS & ENGAGEMENT(TRAINING, COMMUNICATIONS).............................19
Compliance Operations......................................................19
Engagement....................................................................... 20
Training...............................................................................21
Communications.................................................................21
Future Focus........................................................................21

Future Focus........................................................................10‘NEST’ INTEGRATION................................................. 22

WHISTLEBLOWING & SPEAK-UP.................................11

Future Focus....................................................................... 23

Volume, Anonymity and Speak-Up Channels Trends.......... 11
Speak Up Channel Trends...................................................12Countries and Reported Issues Trends.................................13
Outcomes and Corrective Actions....................................... 14
Future Focus........................................................................ 141

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

A MESSAGE FROM THE CHIEF COMPLIANCE OFFICER

I am pleased to present the inaugural
Annual Compliance Report, Activating
Integrity, for Hitachi Rail.
Its release builds upon the foundational work
undertaken since mid-2022 to improveand strengthen Hitachi Rail’s Compliance
Programme by critically reviewing its
design, governance, strategy, structure, andresourcing. It reflects the sustained efforts toinvest in, nurture, and enhance our cultureof compliance and ethical conduct acrossall levels of our organisation. The value
proposition is clear; evidence confirms that astrong programme and culture of ethics andcompliance positively correlates to betterbusiness performance.

This Report highlights the positive evolution
and collective journey of our Programme,
showcasing key achievements, progress, andimprovements during the reporting period:
primarily those from the past fiscal year
(1 April 2023 — 30 March 2024), and some
additionally in effect at the time of finalisationof this Report.1
The Report is organised according to thematic
Programme areas – be it our inward-facing
compliance policies, procedures and controls,
or our outward-facing orientation in termsof ensuring we only do business with ethicalpartners.2 It also provides a forward-looking
assessment for future focus areas.

At Hitachi Rail, each of us has a role to playin “owning” compliance — making ethicaldecisions and conducting ourselves withintegrity and accountability — I invite you toreflect on the content of this Report and yourrole in contributing to our collective success as
Hitachi Rail.
As Hitachi Rail continues to navigate anever-changing operating and regulatoryenvironment, the Compliance Programmemust remain agile in responding to it. The
call to action is that each of us continues todemonstrate integrity in all we do, every day.
Our work is never done.

Jaclyn JewellGroup Chief Compliance Officer

1

This Report was finalised in May 2024, and may reference some activities covering April-May 2024.
Business partners are defined as an external companies, entities, organisations, or individuals with whom Hitachi Rail has, or may consider having, a business transaction or relationship.

22

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

EXECUTIVE SUMMARY

During the reporting period, theCompliance Programme delivered oncontinuous improvement.
Key achievements include:
Governance — formalised the architecture,
infrastructure, and effectiveness of theProgramme with the issuance in July 2023 of
the Compliance Programme Manual in ourinternal Global Business Management System.
This provides the framework to prevent, detect,and respond to compliance risks.
Policies and Procedures — issued some 16
compliance policies and procedures between
August 2023 and May 2024, standardising
ethical conduct requirements for all – setting
the same rules for our employees regardlessof location or line of business, and activatingcompliance controls.

Anti-Bribery and Anti-Corruption —articulated requirements in our Policy,
including prohibiting bribes, undue influence,
facilitation payments and political donations;launched pre-approval controls for businesscourtesies, donations and sponsorships; andset expectations for business partner screening.

Whistleblowing and Speak-Up — assumed
direct case management of our matters in
NAVEX in February 2023; issued our Policy inAugust 2023; oversaw a 77% year‑on‑year
increase in volume; a downward trend inanonymous reporting indicating increased
employee trust; and launched awareness andtraining campaigns.

Privacy and Personal Data Protection— completed implementation of the global
STS governance model for all European
jurisdictions, in particular, extending the modelto Spain and France; launched a global
training package with a 70% completion
rate; and processed ~40 data subject
access requests.

Due Diligence and Business Partner
Management — launched the compliancerisk protocol to screen new suppliers in the
Procurement platform, Jaggaer; the protocol
screens for compliance and reputation;
sanctions; corruption, and human rights
risks; we screened 639 medium- to high-risk
suppliers since February 2023.

Compliance Operations & Engagement(training, communications) — digitalised
our business courtesies form in March 2024;
progressed a risk assessment framework;
ensured all employee-facing materials aretranslated and accessible for all; launched
our COSMO Ethics & Compliance Pages;delivered annual Code training for our
employees; and offered instructor-led training
for specific topics to high-risk functions
and teams.

Export and Trade Compliance — submitted
Italian regulator reports in July and December
2023; converted two legacy paper export
licences to digital ones and secured six new
licences; registered our Australian entity forafter-market reverse logistics export licences;
and are reviewing other projects for the same.

‘Nest’ Integration — prepared for Day 1
readiness and collaborated with Ground
Transportation Systems (GTS) colleagues for
the Code, Whistleblowing & Speak-Up, andpolicies and procedures adoption to ensurebusiness continuity and a successful foundation
for integration.
3

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

GOVERNANCE
Hitachi Rail maintains a culture of integrity
and values its reputation for the highest
standards of sincerity, accountability, andlawful, ethical conduct. The Hitachi Rail
Compliance Programme develops andmaintains this culture by implementing
measures to prevent, detect and respond tocompliance risks and misconduct.
The Compliance Programme Manual wasformally documented in July 2023 in ourinternal Global Business Management System,
and consists of three pillars:This infrastructure provides for governanceand oversight as well as the necessary
framework and tools to manage, measure,and improve the Compliance Programme
to identify and mitigate potential risks to theCompany. Our Compliance Programme isbenchmarked periodically against industry
and global best practices and aligns to HitachiGroup compliance standards, including
the U.S. Department of Justice’s (DOJ)
requirements3 for an effective ethics andcompliance programme.

Architecture:
Architecture
How the Programme is structured;f Training and communications;

Implementationf Confidential reporting structure andinvestigations process;How the Programme is deployed; andEffectivenessHow the Programme works in practice.

3

f Compliance policies and procedures;f Business partner due diligenceand management;
f Risk assessment; andOversight, Autonomy,
and Organisation/Resources:
According to DOJ guidance, the Compliancefunction must be adequately resourced andhave a measure of autonomy to effectively
implement its Programme. The Hitachi RailGroup Chief Compliance Officer (CCO) leads
the Programme and team, reports to the Group
General Counsel, and is empowered to report
directly to the Audit Risk and Compliance
Committee (ARCC), which exercises oversight.
The CCO is supported by nine complianceprofessionals (direct or dotted reporting lines)4.
The team operates as a matrix organisation,with individual compliance managers
responsible for a specific country/region
and area of the compliance programme. The
compliance organisation is extremely lean fora workforce of ~14,000 employees; givena general assumption of a 1:1,000 ratioof compliance personnel to employees foradequate compliance coverage.

f Merger and acquisition related activities.

Evaluation of Corporate Compliance Programs, U.S. Department of Justice Criminal Division, March 2023, www.justice.gov/criminal-fraud/compliance.
Recent hiring includes: 1xSeptember 2022 (US, ABAC & Americas), 1xDecember 2022 (India, Operations & APAC), 1xJanuary 2023 (Italy, Whistleblowing & Investigations), and 1xJuly 2023 (UK, Export & Trade Compliance).

4

Reporting:From January 2023 to date, the CCO has
provided six confidential Compliance briefings
to the ARCC, and quarterly updates to HitachiRail’s CEO since assumption of his duties in April
2023. Additionally, multiple ad-hoc briefings
or communications were provided to the
Hitachi Rail Senior Leadership Team, local legal
entity Boards of Directors, Statutory Auditors,
Management teams and functional leaders.

Future Focus:
The Compliance function will look to buildon the achievements to date, with a view to
explore appropriate timing for a Compliance
Programme self‑assessment using establishedprogramme assessment protocols and theself-verification attestation pending from
Hitachi Corporate Compliance Office.
Furthermore, the Compliance function will
explore opportunities to identify potential
key performance indicators (KPIs) for
the Programme and look to standardise
reporting formats to drive efficiency.

4

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

POLICIES & PROCEDURES

Aligned to our Code of Ethics andBusiness Conduct, our internal
compliance policies and procedures
define ethical conduct requirementsfor our workforce, or others that
represent, or conduct, business onbehalf of Hitachi Rail.
During August 2023 and May 2024,
following authorisation protocols, theCompliance function issued 16 new policies
and procedures. Harmonising to HitachiGroup requirements, these policies andprocedures have standardised ethicalconduct requirements — setting the same
rules for all our employees regardless oflocation or line of business. These policies andprocedures replaced multiple and disparate
instances that had operated concurrently
within Hitachi Rail, and with differing
requirements, at the time.

The consistency in approach andstandardisation contributes towards
organisational fairness and sets equal
expectations for all.
Our policies and procedures commit toensuring Hitachi Rail’s compliance with alllaws and regulations in effect wherever we
do business. The requirements articulated inpolicies and procedures issued during August2023 and May 2024 are summarised,alphabetically, below:

Anti-Bribery & Anti-Corruption — werefuse to pay or accept bribes. We act withintegrity when engaging with public officials
and the private sector. We do not pay fictitious
or ambiguous expenses. We prohibit ‘grease’
payments and do not make political donations.
We know and screen business partners..

Business Courtesies — we do notgive or accept business courtesies(gifts, travel, entertainment) to influencebusiness decisions and ensurecompliance controls for pre-approvals.
Donations and Sponsorships — wereview donations and sponsorships
to avoid the perception of bribery or
corruption, we only give to or sponsor
eligible and legitimate recipients,
and we ensure any donations orsponsorships are aligned to Hitachi’s
strategy and values

Anti-Money Laundering — we only conductbusiness with reputable customers, involved in
genuine business activities and whose funds
come from legitimate sources. We implement
controls to prevent, detect and respond tomoney-laundering risks.
Books & Records — we present honest
and accurate financial and business records
that reflect the economic and commercial
substance of our business activities, consistent
with Company accounting and financial
management rules and policies.
Conflicts of Interest — we avoid conflicts ofinterest, or the perception thereof, and always
make decisions based on what is objectively
best for the Company, rather than ourselves.
We disclose, record, and manage conflictsof interest.
Fair Competition — we compete fairly in themarketplace and do not share information
inappropriately or enter agreements to divide
or allocate markets or customers, fix prices,manipulate bidding, or abuse or exploit ourmarket position for unfair advantage. We
disclose and record contact with competitors
and industry group engagement.
5

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

POLICIES & PROCEDURES
Fraud Prevention — we prevent and detectfraud by maintaining a secure and transparent
business with appropriate controls andsegregation of duties.
Modern Slavery — we are committed tomaintaining a culture of integrity and openness
in all our business dealings and relationships.
We take reasonable measures to minimizerisks of modern slavery and forced labourin our business, operations, and value andsupply chains.
Privacy and Personal Data Protection we respect individual’s privacy rights. We
responsibly handle personal data entrusted
to us. We provide a high level of protectionof personal data and use, store, and protect
data in compliance with relevant laws
and regulations.
Intellectual Property (IP) Protection —We rigorously protect the IP that we create,acquire, and use and we respect the IP rights
of others. We apply the same high standardsof protection to any third-party IP in ourcustody. We acquire or transfer technicalinformation responsibly.

Future Focus:
Data Protection Impact
Assessments — we collect, handle,
and protect personal data responsibly.
Personal Data Breach IncidentManagement — we protect personal
data we process and take precautions
to protect it from unauthorised accessand disclosure.
Data Subject Access Requests — werespect individuals’ rights regarding
their personal data.

Respectful Workplace — we provide a
respectful, safe, dignified, and supportive
environment for our workforce. We embraceour diversity and promote trust and fairness.
We do not tolerate workplace-related
discrimination and harassment.
Whistleblowing & Speak-Up — wepromote a speak-up culture whereby anyone
can report, in good faith, actual or suspectedviolations or breaches of laws, regulations, ourCode of Ethics and Business Conduct, or ourpolicies. We do not tolerate retaliation.

An immediate focus in the year ahead will
be employee sensitisation and engagementon the latest policies and procedures issued
to ensure they understand the requirements
and their obligations, including where they
may need to submit disclosures or otherforms for compliance control reviews, e.g.
conflicts of interest, contact with competitors,
and procedures related to the acquisition oftechnical information.
During the year ahead, the Compliancefunction will complete its review, andformally issue, or re-issue, refreshed policies
and associated procedures for:
Compliance Due Diligence — we act
with integrity and expect the same of thosewith whom we do business. We screen ourbusiness partners and customers to ensure
they operate to the highest standards ofintegrity and quality.

Export and Trade Compliance — wecomply with national and international
export control regulations that control the
cross-border transfer of our products andservices, as well as any economic sanctions
and customs laws and regulations.
All issued policies and procedures,
associated forms, workflows and resources
to support them are available to our
workforce on the Ethics & Compliance
Pages on our COSMO intranet. All policies
and procedures have been translated
into core languages of our workforce(Japanese, Italian, French, Spanish, andGerman) to ensure accessibility for all
who work for Hitachi Rail, or who will doso in the near future, following closing of
the transaction to acquire Thales Ground
Transportation Systems.

6

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

ANTI-BRIBERY & ANTI-CORRUPTION

The Anti-Bribery & Anti-Corruption(ABAC) Policy was issued in August
2023, supplemented by two associatedProcedures on Business Courtesies andDonations & Sponsorships (D&S).
The ABAC Policy reaffirms the Company’scommitment to preventing bribery andcorruption, including grease payments,
undue influence, and political donations.
The associated Procedures define andstandardise pre-approval controls for businesscourtesies, donations, and sponsorships. These
Procedures are designed to ensure compliancewith ABAC laws by providing transparency
around Hitachi Rail gift and entertainment
practices and providing our workforce insighton their own practices.

Donation and sponsorship recipients arescreened by the Compliance function to ensurethat they are legitimate and reputable, have noties to public or government officials, Hitachi
Rail business partners, and pose no othercompliance risks. They are also reviewed by
the External Communications and Marketing
function to make sure contributions andrecipients are aligned to our values, mission,and brand. These standardised pre-approval
controls ensure compliance with ABAC
laws by providing documented, auditable
records for all Hitachi Rail business courtesies,
sponsorships, and donations.

Volume and Trends for Manual Business
Courtesies and Donations & Sponsorship Requests:
Volume — Manual Requests(August 23 - March 24)

D&S(Form), 31

Courtesies

Courtesies(Western, Form), 108(HRJ, Sharex), 38

The Compliance function processed 177
manual requests for business courtesies,
and donations and sponsorships since theProcedures became effective in August 2023.
Until mid-March 2024, business courtesies
pre-approval requests were submitted andreviewed using a manual form and email
protocols. Of the 146 business courtesies
requests submitted, only five were rejected.
Donations and sponsorship requests are
submitted and reviewed using a manual formand email protocols. Of the 31 donations
and sponsorship requests submitted, twowere rejected.
This indicates that our employees generally
demonstrate a legitimate business justification
for business courtesies and proposed
donations or sponsorships. They haveunderstood feedback on rejected requests ifthey were not reasonable, proportionate, orappropriate in nature and value.
7

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

ANTI-BRIBERY & ANTI-CORRUPTION
BUSINESS COURTESIES DIGITALISATION, VOLUME AND TRENDS:
Business Courtesis Requests — Digital Form
(Mid-March — Mid-May 24)
45

Entertainment — Given
25

Entertainment — Accepted
5

Travel or Lodging — Given
3

Gifts — Accepted1

Gifts — Given
Travel or Lodging — Accepted0

The Business Courtesies Digital Form andApproval Workflow (Digital Form) launched
mid-March 2024.5 This process improved
traceability and employee engagement withthe business courtesies approval process andhas given the Compliance function the ability
to use data analytics to provide insight into
Company gift and entertainment practices.
Some 79 business courtesies requests havebeen submitted using the Digital Form since its
launch in mid-March 2024 to mid-May 2024,of which only 17 requests exceeded the
US$100 per person threshold which requires
Compliance function review and approval,
5

indicating that employee entertainment
practices are reasonable and appropriate.
Most business courtesies approved
were entertainment given by Hitachi Railemployees to others (45 instances), followed
by entertainment accepted by Hitachi Railemployees (25 instances). To date, there havebeen five requests for travel or lodging given
to third parties, largely related to contractual
requirements and obligations to customers.
These requests require an additional level ofapproval by the Regional General Counsel.
None of the submitted requests that are now
closed were rejected.

The Digital Form was developed and deployed in the Hitachi IT tenant linked to our O365 environment. Given the numerous
accounting systems across the business, it is not automatically linked to expense reporting systems; employees can append their Digital
Form when submitting expense reports to evidence compliance, regardless of which system their business unit or location may use.

8

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

ANTI-BRIBERY & ANTI-CORRUPTION
Business Courtesies Spend Trends:
The spend data related to business courtesies
as reported is based on data over a~2-month period following digitalisation in
mid-March 2024, and based on limited,
initial engagement with the Digital Formand approval workflows. The Form wasdeveloped in the Hitachi IT tenant linked to
our O365 environment. Given the numerous
accounting systems across the business, it is
not automatically linked to expense reportingor finance systems. Employees can append
their Digital Form when submitting expense
reports to evidence compliance with theapprovals process for instances wherebusiness courtesies are given to external
parties. The data should not be considered ascomplete empirical financial data, but rather
based on Digital Form user inputs and initial
engagement with the new process. There is
likely under-use of the Digital Form andassociated workflow approvals
at present; actuals for spend on businesscourtesies given or accepted is thus likely muchhigher than captured here. This will be an area
for continuous improvement.

Entertainment — Given(Mid-March — Mid-May 24)
50,700Total (USD)
Average/Person (USD)

95

Travel or Lodging — Given(Mid-March — Mid-May 24)
7,045

Total (USD)
Average/Person (USD)

318

Entertainment — Accepted(Mid-March — Mid-May 24)
8,498

Total (USD)
Average/Person (USD)

191

During mid-March to mid-May 2024, the tracked spend via
the new Digital Form on entertainment given by Hitachi
Rail employees to others was ~USD50,700, with an averageof ~USD$95 per person. This spend includes the cost ofentertainment where Hitachi Rail employees would pay forthemselves and the external recipients that they were hosting.

During the same period, the tracked spend via the new Digital
Form on travel or lodging given to external recipients was~USD7,045, with an average of ~USD$328 per person. The
requests were per agreements with customers and related to factory
acceptance tests (San Ying Project, Taiwan) or other contractual
requirements for meals during testing (Italian customers).

In terms of value, as tracked via the new Digital Form, ofentertainment accepted by Hitachi Rail employees during thesame period, the total was ~USD$8,498 with an average perperson value of ~USD$191. Hitachi Rail employees are accepting
reasonable entertainment (meals, sports events) linked to businessnetworking and relationship building imperatives.

9H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

ANTI-BRIBERY & ANTI-CORRUPTION
Business Courtesies Country Trends:
Business Courtesis Exchanged - Digital Form
(Mid-March - Mid-May 24)
4Rest of the World

8
15

Australia
14

Italy

6

3

India

11

UK

Accepted

8

7

China

3

Given

The highest volume of business courtesies
exchanged was in Australia, Italy, China,
India, and the UK.6

Across the 25 instances where entertainment was
accepted, the top three locations were 11 in theUK, seven in China, and three in India.

Across the 45 instances where entertainment
was given, the top three locations were 15 inAustralia, 12 in Italy, and eight in China.

The current volume of business courtesies
requests appears to be reasonable for acompany of our size when compared toother companies that publicly post theirCompliance reports.

6

Following the launch of the Business Courtesies
Procedure in August 2023, the Complianceteam facilitated some 19 targeted,
instructor‑led training or engagement
sessions, focusing on functions and teams that
present compliance control risks (e.g. Sales
and Procurement teams) and partner functions
such as Finance, that need to check andvalidate the required pre-approvals before
approving expense report payments. Leadersand employees who attended the sessions
were engaged and felt comfortable asking
questions and responding to test case scenarios
to help build understanding. Following thelaunch of the Business Courtesies Digital Formin mid-March 2024, multiple ‘Quick Guides’
were issued to help guide requesters on
required approvals, and managers on how to
critically review business courtesies requests
as the first line of defence. Both the training
pack and quick guides are readily available toemployees on the Ethics & Compliance Pages
on COSMO.

The Digital Form was launched in all Hitachi Rail locations, except Japan. For Hitachi Rail Japan, business courtesies expenses for giving scenarios are reviewed and approved in the Sharex expense report system.

Future Focus:
During the year ahead, the Compliancefunction will continue to promote awarenessof the Business Courtesies Digital Form, which
has been well received by employees who
have used it to date. Uptake and compliancewith the new digital Form and approval
workflows is likely under-utilised andcontinued engagement and promotion of the
new process will be an ongoing focus area
for the Compliance team. The team will also
explore options to design and implement a
Donations & Sponsorships Digital Form, tosimilarly improve traceability and employee
engagement with the associated review andapproval processes.
While members of the Compliance teamwill continue to offer on-demand instructorled training sessions on business courtesies,
it will look to explore options to transpose
the training content into ‘micro e-learning’
assets that can be deployed via ourLearning Management Systems (LMSs) andallow employees to refresh or top-up theirknowledge on these important anti-bribery
and anti-corruption controls as needed.

10

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

WHISTLEBLOWING & SPEAK-UP

Hitachi Rail promotes a speak-up
culture whereby anyone can report, ingood faith, actual or suspected violationsor breaches of laws, regulations, ourCode of Ethics and Business Conduct,or our policies and has a zero-tolerance
policy for retaliation of any kind againstconcern reporters or “whistleblowers”.
Various speak-up channels are identified
to report a concern, including Managers,
members of the Human Resources and Legal& Compliance teams, Supervisory Bodies,and the Hitachi Global Compliance Hotline.
In February 2023, the Compliance teamassumed direct case management of ourbusiness unit’s whistleblowing matters in the
dedicated NAVEX tool and, in August 2023,
the Hitachi Rail Whistleblowing & Speak-Up
Policy was issued.

Thereafter, appropriate communication
and awareness campaigns were launched(COSMO, Yammer/Viva Engage, dedicatedemails, and posters) to duly inform all of
our workforce about how they can reportconcerns. Additionally, dedicated andbespoke instructor-led training sessions for
all Operational HR teams on expectations
as speak-up channels were conducted
between October 2023 and January 2024.

Volume, Anonymity and Speak-Up Channels Trends:
Y-o-Y Volume
FY21/22

13

FY 22

43
76

FY23

FY22 Anonymity

72%

28%

Yes

No

49%

51%

Yes

No

FY23 Anonymity

In fiscal year 2023, Compliancemanaged 76 concerns, representing
a 77% year‑on‑year increase involume compared to fiscal year 2022
(43 reported concerns). When comparing
to data reported over 2020-2021, thisrepresents a 485% increase in volume(from 13 reported concerns to 76).

Anonymous reporting decreased 23
percentage points compared to fiscal
year 2022, demonstrating increased trust in
the programme and process. Vitality rate
(reported concerns per ’00 employees)
increased year-on-year, from 0.3 to 0.5. A
healthy vitality rate indicates a healthy andopen culture. This upward trend in vitality rate isa positive development, although the businesshas some way to go to reach a global, medianrate of 1.4 for global multinational companies.

11

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

WHISTLEBLOWING & SPEAK-UP
Speak Up Channel Trends:
YoY Speak Up Channels
Management

Internal Audit

0
1
0
1
4

Other

2
7

Legal & Compliance

HR

14
1

Hotline

FY22

17
31
41

FY23

During the reporting period, the majority ofconcerns were reported through the Hotline(54%), maintaining the same trend highlighted
in fiscal year 2022 (72% of concerns reported
through the Hotline).

However, in fiscal year 2023 trust in the
Human Resources (22% of concerns
reported against 2% in fiscal year 2022) andLegal & Compliance teams (18% of concerns
reported against 16% in fiscal year 2022)
as Speak-Up channels increased indicating
improvements in employee trust in approaching
and reporting via these channels.
12

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

WHISTLEBLOWING & SPEAK-UP
Countries and Reported Issues Trends:
Concerns were reported across all regions.
The countries with the highest number ofreported concerns were the UK (26%) andJapan (21%), followed by Spain (13%).
Reporting in Italy and the US may be lagging
compared to employee population size inthese countries.

Concerns by Country

Primary Issues Reported(FY23)(FY23)
7

Australia

7

Panama

1
2
10

Spain

20

UK
USA

The fourth highest issue reported was fraud(5%), which includes a wide range of
sub‑issues including, for example, non-financial
related misrepresentation of information.

16

Japan
KSA

6

COI

Italy

In terms of primary issues reported,harassment and discrimination-related
concerns account for 46% of volume (35 of
76 concerns), followed by other labourrelated issues at 9%, and conflicts of interest
at 8% of volume.

7

Labour Related
5

India

35

Harassment Discrimination

2

France

6

Fraud

4

Corporate Policy

4

Legal/Contractual Issues

3

Inquiry3

HSE

3Disclosure of Confidential Information

3

Data Privacy

3

Fair Competition

2

Misuse/Theft of Company Property

1

Human Rights

1

Bribery, Corruption

1

13

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

WHISTLEBLOWING & SPEAK-UP
Outcomes and Corrective Actions:
Case Outcomes & Findings

Corrective Actions(FY23)(FY23)

The 18 instances of discipline during thereporting period include:f Five terminations;18

Discipline Applied
10

Training & Communications
Policy Creation or Revision2

Control Creation or Revision

3

Not Substantiated
Other

f One suspension;
13

N/A — No Deficiencies

Substantiated/Partially Substantiatedf One resignation accepted in lieu
of discipline;

4

N/A — Insufficient Data

Ongoing Monitoring

1

Additional Action Taken

2

55%

32%

f One salary decrease;f One change in reporting line (oneaction, but cross-correlated across fourconcerns reported);f One disciplinary proceeding resulted in arecommendation for no further action; and13%

A healthy range of confirmations wasmaintained (55%), including substantiated or
partially substantiated cases. Some 13% ofreported concerns were inquiries or matters not
related to Compliance concerns, which were
duly answered or dispositioned and handed
over to the relevant function within the businessfor resolution.

f Four written or verbal warnings;

The business implemented a rangeof corrective actions, including 18 instanceswhere some form of discipline was appliedin response to substantiated violations or
misconduct. Multiple instances of training andcommunications to reinforced expectations
were also delivered to employees.

f One disciplinary proceeding was open
and active at the time of report finalisation.
Disciplinary actions were for confirmed
instances of misconduct related to harassing or
discriminatory behaviour, false representations,conflicts of interest, abuse of a company
benefit, data privacy, and violations of faircompetition practices.

Future Focus:
Hitachi Rail employees are engaging with theWhistleblowing & Speak-up Programme, withmany reporting concerns related to workplace
relations and behaviours. While not allconcerns are substantiated, the fact the Hitachi
Rail employees are reporting concerns of thisnature suggests that reinforcing a respectful
and fair workplace, and continuing to model
appropriate behaviour and engagement
styles, should continue to be a focus area
across the organisation.
During the year ahead, the Compliancefunction will continue to create targeted andfrequent employee communications andawareness initiatives on the Whistleblowing &Speak-Up Programme. Moreover, the teamwill look to define a structured data retention
process in NAVEX to remain compliant with
GDPR and any country‑specific privacy
requirements. Building on the successful
increase in reporting via HR speak-up
channels, further targeted, instructor-led
training to other non-hotline speak-up
channels is anticipated for the coming year.

14

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

DUE DILIGENCE & BUSINESS PARTNER MANAGEMENT

Hitachi Rail conducts due diligenceon third parties to avoid establishing
relationships with entities who engage inillegal or unethical activities.
In February 2023, the Procurement function
implemented a due diligence and onboarding
process for all new suppliers via the Jaggaer
tool, which includes a compliance due

diligence review. The Compliance teamworked with Procurement colleagues todevelop a risk assessment protocol whereby
new suppliers are screened for:

Compliance and reputational risk events (e.g. negative news, regulatory enforcement
including fines or other penalties, and legal actions including litigations);
Export trade sanctions and blacklisting;Corruption risk (including corruption perception scores, financial secrecy, and corporate tax
haven indices); andHuman rights risk (including Ecovadis industry and country risks, and worker’s rights indices).

All suppliers that have medium- or high-risk
findings in any of these four screening areas
are escalated to the Compliance function forreview and recommended disposition.
Based on the level of risk identified, theCompliance function may perform additional
database screening and desktop reviews ofpublic records or court findings to determine

whether the supplier onboarding process
is continued or stopped. If continued, theCompliance function may recommend
implementing specified remediation measures
to mitigate the identified risk. In rare cases, theCompliance function may escalate the supplierfor enhanced compliance due diligence before
making a final recommendation.

15

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

DUE DILIGENCE & BUSINESS PARTNER MANAGEMENT
Compliance DD Reviews – Volume and Disposition Outcomes:
Future Focus:
Compliance DD Reviews - Volume

Compliance DD Reviews - Dispositions(Feburary 23 - March 24)(Feburary 23 - March 24)
175

EMEA

140

EMEA

APAC

114

APAC

108

Americas
UK

24

There have been 639 suppliers escalated forCompliance review, scoring a medium or highrisk in one of the four compliance screening
areas articulated above.
Suppliers are reviewed by the ComplianceManager in the country or region where thelegal entity engaging the supplier is located,rather than the supplier’s location. The bulk of
the suppliers escalated are in Italy, where mostof the Company’s suppliers are onboarded.
There is a significant number of suppliers
escalated in the APAC and EMEA regions,due to the presence of high-risk countries inthese regions.

10
51

58

68

5
22

86

Americas

Japan

22

130

UK

78

Japan

171

Italy

Italy

10

24

Of those escalated for Compliance due
diligence review, only seven suppliers
received a ‘do not proceed’ recommendationfrom the Compliance function. Remediation
measures, such as strong contract language
or confirmation of product sourcing, wererecommended for 95 suppliers. The remaining
537 suppliers evaluated were cleared toproceed with the onboarding process.

ProceedRemediate

Do Not Proceed

The Compliance function partneredwith Procurement to launch Hitachi’s
Expectations of Business Partners(“Expectations”) in May 2024. Hitachi,Ltd. released the Expectations to business
units for implementation in March 2024.
The Expectations document will replace
our Supplier Code of Conduct, and a Railspecific Addendum has been added toensure coverage for any industry-specificrisk areas or regulatory requirements thatneed to be accommodated. The transition to
the Expectations will ensure a ‘One Hitachi’approach for suppliers regardless, of whichbusiness unit they transact with.

The Compliance function is preparing a
global Compliance Due Diligence Policy
and associated Procedures to standardiseand document compliance due diligence
for all types of third parties, including
customers, agents, suppliers, joint venture
partners, and donation and sponsorship
recipients. The Compliance function is also
working with Procurement to review the
supplier onboarding risk assessment, due
diligence questionnaire, and compliancereview protocol to streamline the process
and ensure that Compliance due diligence
reviews are conducted on those suppliers
who present actual, rather than theoretical,
compliance risks to Hitachi Rail.

16

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

EXPORT & TRADE COMPLIANCE (ETC)
Hitachi Rail is committed to complying withregulations regarding the export, import,
re-export or re-transfer of products (tangible
or intangible), technologies, information, andservices (hereinafter “goods”) classified as“dual-use”. Hitachi Rail shares the concernsof the international community on the
proliferation of weapons of mass destruction.
We do not deal in military products, andHitachi Rail is committed to complying withall applicable export and trade compliancelaws and regulations. We conduct export
and trade compliance-related due diligenceagainst any possible illicit transactions andensure that no products are provided, andno trade is carried out in any country or any
entity in violation of laws or regulations.
During the reporting period, the Compliancefunction validated that all STS hardware
manufactured at Hitachi Rail factories
was classified against the relevant
420 “configuration item” codes that areconsidered dual-use due to encryption.
Our dual-use hardware requires export
licences. Hitachi Rail holds 11 active export
licences: two EU General Export Authorisation(EUGEA) licences, and nine EU Individual

Future Focus:

Individual Export Licences(FY23-25)
3

Peru
2

TurkeyAbu Dhabi

1

Taiwan1

Panama1

Export Authorisation Issuance
Export Authorisation Extension

2

Export Authorisation licences, of which six‘individual’ export licences were issued by
Italian regulators in fiscal year 2022, while
the business secured three new ones in fiscal
year 2023. Hitachi Rail additionally had an
extension (modification) granted on one
individual licence. We maintained our active
EUGEA licences issued by Italian regulatorsand converted two of them from legacy paper
to digital licences during the reporting period.
We complied with reporting requirements andsubmitted bi-annual reports to the Italian
regulators in July and December 2023.
During the reporting period, Hitachi Railbecame aware of the re-export of dual-use
hardware from Australia to Italy for aftermarket repair without the locally required

1

Modification

licence. No fines or non-monetary sanctions
are anticipated for Hitachi Rail, and while
not required, Hitachi Rail will submit a
voluntary self-disclosure (VSD) in keepingwith good business practice and to remain ingood standing with the relevant authorities.
For completeness, Hitachi Rail is reviewing
all re‑export activities of controlled items
for after-market repair from global projectsites to maintain full compliance. Hitachi Railalso supported an Italian supplier for a VSD
to US regulators as an interested party. In
January 2024, we secured and started usinga UK general licence for imports of iron/steel; this was needed given the current UK
government’s sanctions package related to
Russian-origin iron/steel.

In the year ahead, the Compliancefunction will continue to review relevant
legal requirements with a view specificallyto map intangible technology transfers(e.g. software) for compliance and to
identify any associated risk exposure.
We will also focus attention on how
the business can ensure appropriate
segregation of Engineering tools that have
dual-use items included therein. An area
requiring more focus from the businessis customs compliance. The Compliancefunction will look to undertake a review ofexisting operational expertise for customs
compliance within the business so that
insufficiencies can be mapped, and actions
to mitigate the gaps defined. Furthermore,
focus will be maintained on securing thepipeline of anticipated licences in thecurrent fiscal year.

17

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

PRIVACY & PERSONAL DATA PROTECTION

Hitachi Rail takes great care in ensuring
compliance with all relevant privacy
and personal data protection laws
and regulations in effect wherever we
do business. We proactively manage
personal data lawfully and ethically, incompliance with current local privacy
laws and best international practices.
In August 2023, we issued our global Privacy
Policy and associated Procedures for Data
Protection Impact Assessments, Personal Data
Breach Incident Management, and Data
Subject Access Request. These align to HitachiGroup Privacy Principles, while allowing
for operational governance models basedon jurisdiction-specific requirements acrossHitachi Rail.

7

During fiscal year 2023, the Compliancefunction completed implementation of the
global STS governance model in all
European jurisdictions, in particular we
extended the model to Spain and France,
ensuring full compliance for our operations
and employees in these countries. Moreover,
the Compliance function assisted in updatingwhere required, language and new wording
across data protection agreements in Italy.

Hitachi Rail Japan employees received training directly related to Japanese legal requirements.

We processed some ~40 data subject
access requests (DSARs) in the UK during thereporting period and actioned multiple dataprotection impact assessments (DPIAs) for IT,
HR, or other initiatives and projects where
they were required, and in keeping with goodbusiness practices to protect personal data.
In January 2024, to coincide with International
Data Privacy Day, we launched our
first global privacy and personal dataprotection training package across allentities that are subject to GDPR, or similar
requirements.7 The training package wasoffered to all employees in Hitachi Rail
Limited (UK) and all those employed bya Hitachi Rail STS legal entity, globally.
The package included focused modules toensure all employees have the same baseline
understanding of requirements and obligations.
A global completion rate of 70% wasachieved, with positive feedback received.
In April 2024, the Compliance function, under‘Governance,’ updated the COSMO Privacy
and Personal Data Protection Page toensure consistent and adequate employee
access related to their privacy notices andoperational materials. There have been some
384 site visits to the Page.

Future Focus:
In the year ahead, the Compliancefunction will focus on developing a plan tocontinue and extend implementation or arefresh of governance models to non-EU
jurisdiction following review where more
local specificity is needed in response tolegislation, e.g. Australia, India, Canada,
and China. We will also explore possibilities
to integrate and simplify across differing
governance models where appropriate
and feasible. We will further ensure all
intragroup data transfer agreements remaincurrent, and EU ‘standard contract clauses’
or any legal adequacy requirements
are met.

18

H I TA C H I

R A I L2 0 24

A N N U A L

C O M P L I A N C E

R E P O R T

COMPLIANCE OPERATIONS & ENGAGEMENT (TRAINING, COMMUNICATIONS)
Compliance Operations:
During the reporting period, a key focus
for compliance operations was to start our
Programme’s digitalisation journey. In
March 2024, the Compliance function
launched its first digitalised approval form
and workflow for business courtesies. The
Digital Form was a first for Hitachi Rail, andthe Compliance team is proud to have been a
trailblazer in this regard.
During the reporting period, the Compliancefunction also progressed a compliance risk
assessment framework that we hope tolaunch later this fiscal year. While enterpriserisk management seeks to identify andprioritize external and internal risks which canhave a significant impact on the business (e.g.
recession, credit/forex risk, project execution
risk, natural disasters, major supply chain
disruptions); compliance risk is the threat posed
to our Company’s financial, organisational, or
reputational standing resulting from violationsof law, regulations, codes of conduct, or
standards of practice.

A compliance risk assessment shouldseek to identify and assess the risk andimpact of legal or regulatory sanctions,financial loss, or damage to reputation
resulting from failures to comply withlegal or other requirements (e.g. bribery
and corruption, privacy breaches, humanrights violations, employee misconduct,significant conflicts of interests).
Regulators expect frequent compliance risk
assessments, and refining and deploying
the compliance risk assessment frameworkfor Hitachi Rail is a near-term priority for theCompliance function.

19

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

COMPLIANCE OPERATIONS & ENGAGEMENT (TRAINING, COMMUNICATIONS)Engagement:
In supporting our employee-facing focus,
the Compliance function facilitated andensured all our internal Compliance Policies
and Procedures have been translated
into the core languages of our workforce,
including Japanese, Italian, French, Spanish,
and German (in anticipation of integrationof Ground Transportation Systems into
Hitachi Rail).
Importantly, to ensure all compliance‑relatedmaterials are accessible for all; in addition
to translations, the Compliance function
developed and launched its dedicated
COSMO Ethics & Compliance Pages(E&C Pages).

The E&C Pages serve as a resource for
employees to all compliance related materials
and has numerous sub-pages:f Code of Ethics and Business Conduct —access to the Code in 22 languages;f Compliance Policies and Procedures— access to all issued Policies, Procedures
and associated forms in all core languages
used by our workforce (English, Japanese,
Italian, French, Spanish and German);

Employees have engaged with the E&C Pages with approximately 2,000 site visits since they
were launched in January 2024, with the Policies & Procedures sub-page being the mostaccessed and visited across all languages.
E&C Sub-Page Visits

E&C Home Page Visits(January - Mid-May 24)

19
Code of Ethics

266
59

f Whistleblowing & Speak-Up —easy, clickable links to the Hotline andother available speak-up channels andguidance on how to report;
f Compliance Resources — repository
for useful content on Compliance topics
including promotional materials, quick
guides, and training or briefing packs;
f Your Compliance Team — easy andquick reference so employees know whoto reach out to with any questions.

100
46

484

Policies & Procedures

374
470
16
98

WB & Speak-up

80
131
10

Japanese

ItalianFrenchEnglish

81

599

481

749

Compliance Resources

28
35
33
30

Compliance Team

125
95
147

2 0

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T

COMPLIANCE OPERATIONS & ENGAGEMENT (TRAINING, COMMUNICATIONS)
Training:

Communications:

FY23 Code Training Region Completion Rates

Compliance Communications by Topic
100%

Japan

95%

APAC

94%

Americas
79%

Italy
UK
EMEA

76%
72%

Privacy3

General or Other

5

In fiscal year 2023, the Compliance function
conducted some 19 engagement sessions
for targeted, instructor-led training (either
in-person or via Teams) to reinforce the newBusiness Courtesies Procedure with employees
and teams that pose compliance control risks,such as Sales and Procurement.

Briefing

18%

Training48%

Others2%

19

Business Courtesies

26

Global or Local Compliance Update
20

Policies & Procedures

Whistleblowing & Speak-up

The Compliance function partnered with
the Learning and Development team tolaunch the annual Code training in
October 2023 as part of Hitachi’s Ethics
Month. While the completion target for the
training is 100%, Hitachi Rail achieved
86% overall completion.

Communication 32%

10Ethics & Compliance Month 2023

Code of Ethics & Business Conduct

Type of Engagement

1
12

The Compliance function also strategically deployedcommunications, trainings, quick guides,
and briefings to raise awareness on complianceand ethics topics throughout the reporting period,
including among others, our new policies
and procedures, promotion of the new global
whistleblower Hotline, targeted communications
to drive Code training completions, reminders
around the holidays on appropriate gift-giving tobusiness partners, and the annual Corporate Ethical
Culture and Compliance Perceptions Assessment
Surveys; leveraging and using the Hitachi Rail
Global Community on Yammer/Viva Engage
for high‑visibility engagement with all employees,
regardless of location.

Future Focus:
During the year ahead, the Compliancefunction will look to continue its digitalisation
journey and to drive employee engagementwith compliance topics and content. An
area of development is also to strengthen
the bench of internal ‘micro-learnings’
available to our workforce for e-learning,
for which investment will be needed.

21

H I TA C H I

R A I L2 0 24

A N N U A L

C O M P L I A N C E

R E P O R T‘NEST’ INTEGRATION

The acquisition of the Ground
Transportation Systems business (GTS)
from Thales Group (Project Nest) was set
to close on 31 May 2024. The Compliancefunction has worked with counterparts
in GTS to prepare for aspects of the
Hitachi Rail Compliance Programme to
go into effect for the GTS workforce on
Day 1 after close.

GTS will adopt the Hitachi Group Code of
Ethics and Business Conduct (the Code) on
Day 1 and receive targeted ‘communicate
and comply’ messaging. The Code will beavailable to the GTS workforce on Day 1
through their intranet site, and materials
promoting the Code have been provided to
GTS in advance for display across worksites
on Day 1.
Our online Code training package is set tolaunch to the GTS workforce on Day 1, withexpectations for a 100% completion rateby the end of September 2024. Instructorled training packs and videos will be used todeliver Code training to employees who do
not have computer access.

In addition to the Code, the Whistleblowing &Speak-Up Programme, including the Hotline,
will be launched in GTS on Day 1. Powers ofAttorney have been executed by GTS entities
to Hitachi, Ltd. to enable use of the Hotline,
managed by NAVEX. We have provided
necessary Hotline promotional materials to
GTS counterparts, which will also be available
on their intranet for their employees. Targeted
Day 1 communications on how to reportconcerns will be used. We anticipate there
may be an increase in concern reporting upon
integration, which is common after merger andacquisition activity.

2 2

H I TA C H I

2 0 24R A I LA N N U A L

C O M P L I A N C E

R E P O R T‘NEST’ INTEGRATIONThe Compliance function worked with GTS counterparts to reach agreement on our policies andprocedures that will apply to GTS on Day 1. The following will apply to GTS on Day 1:
Anti-Bribery and Anti-Corruption Policy

Business Courtesies Procedure(using the Manual Form for GTS, Digital for
Hitachi Rail’s current workforce)
Donations & Sponsorships Procedure(using the Manual Form for all)Whistleblowing & Speak-Up Policy
Books & Records Policy
Anti-Money Laundering Policy
Privacy Policy

Data Protection Impact Assessment Procedure
Personal Data Breach IncidentManagement Procedure
Data Subject Access Request Procedure

Fraud Prevention Policy
Modern Slavery Policy
Respectful Workplace Policy
Conflict of Interest Policy

GTS will maintain its own Export & Trade
Compliance (ETC) Programme due to theinherent complexity and interdependencies
in export and trade control. ETC Programmes
involve not only Compliance, but also
Procurement, Sales, Logistics, and Supply
Chain. In addition, there are IT systeminterdependencies that will need to beharmonized during integration. GTS has been
approved to hire a central resource for ETC
oversight for GTS after closing.
Our Privacy Policy and associated Procedures
will apply to GTS on Day 1. However,as Privacy and Personal Data Protection
operations and governance are complex,
being legal entity and jurisdiction specific,
GTS will maintain its own operational andgovernance programme through integration.
GTS will action and directly maintain theirown records of processing, data impact
assessments, data subject access requests,
privacy notices, any notifications to relevant
authorities, as needed. In March 2024,
GTS hired a central resource to manage
their programme.

Hitachi Rail and GTS Labour Relations
colleagues have ensured all European Works
Councils have undergone the ‘inform andconsent’ process using materials preparedby the Hitachi Rail Compliance function as it
relates to the Code, Whistleblowing & SpeakUp, and Compliance Policies and Procedures.

Future Focus:
In the immediate future, the Compliancefunction will focus on ensuring compliant
business continuity after the transaction
closes. We will partner with GTS colleagues
and counterparts to facilitate adoption of
our Hitachi Rail values, mission, and cultureof ethics and compliance.

Fair Competition Policy

2 3

H I TA C H I

R A I L2 0 24

A N N U A L

C O M P L I A N C E

R E P O R T

24