Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Version: 3

Function: Group Compliance

WHISTLEBLOWING PROCEDURE

Function:Group Compliance

Scope:All Coface entities

Author:Group Compliance Officer

Validated by:Group Compliance Director

1st implementation date:2018

Version:V3

Last update date:June 2023

Confidentiality level:

Public document

Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 1 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Version: 3

Function: Group ComplianceContents
1.

INTRODUCTION ............................................................................................................................................. 4
1.1.

Scope and objectives ......................................................................................................................... 4

1.2.

Laws and regulations......................................................................................................................... 4

1.3.

Key principles ......................................................................................................................................... 52.

WHO CAN REPORT ..................................................................................................................................... 5

3.

WHAT TO REPORT ....................................................................................................................................... 6
3.1.

Situations to report ............................................................................................................................. 6

3.2.

Information to disclose ..................................................................................................................... 64.

HOW TO REPORT ......................................................................................................................................... 6
4.1.

Selection of the appropriate channel ...................................................................................... 6

A.

Local and regional reporting channels .................................................................................. 7

B.

Online public channels ..................................................................................................................... 7C.

The Ombudsperson ............................................................................................................................ 8D.

External authorities............................................................................................................................. 8

4.2.

Anonymous report .............................................................................................................................. 8

4.3.

Collection modalities ......................................................................................................................... 9

5.

GOVERNANCE ................................................................................................................................................ 9
5.1.

Preliminary verifications .................................................................................................................. 9

5.2.

Handling and investigations ....................................................................................................... 10

A.

Escalation to the Whistleblowing Forum ........................................................................... 10

B.

Handling by the Ombudsperson .............................................................................................. 11

5.3.

Information of the whistleblower ............................................................................................. 11

5.4.

Information of the other targeted persons ........................................................................12

6.

PROTECTIONS FOR WHISTLEBLOWERS .....................................................................................12
6.1.

Confidentiality and impartiality commitments ...............................................................12

6.2.

Protection against any form of retaliation ..........................................................................13

7.

INTERNAL CONTROLS ............................................................................................................................. 14

8.

TRAINING AND COMMUNICATION ................................................................................................. 149.

RECORD RETENTION ................................................................................................................................15

10.

PROCEDURE EFFECTIVE DATE AND REVIEW ......................................................................15

APPENDIX I - GROUP RULES ADDENDUM TEMPLATE ............................................................... 16
APPENDIX II - EXTERNAL CHANNELS INFORMATION ................................................................. 17Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 2 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Version: 3

Function: Group Compliance

Versioning
VersionApproval date

Implementation
date

Changes

1.0

2018

2018

Procedure creation.

2.0

July 2019

July 2019

Procedure modifications.

3.0

June 2023

June 2023

Modifications to include:o Law n° 2022-401 of 21 March 2022, toimprove whistleblowers protection,
amending the law n°2016-1691 of 9
December 2016;o Decree n°2022-1284 of 3 October 2022,
on the procedures for collecting andprocessing whistleblower alerts andestablishing the list of external
authorities.

Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 3 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Function: Group Compliance

Version: 3

1. INTRODUCTION
As a regulated company, Compagnie Française d’Assurance pour le Commerce
Extérieur (“Coface”) is committed to operate ethically and in compliance withapplicable laws/regulations. Coface promotes probity, integrity standards to prevent
any incidents or suspected incidents and protect those who report misconduct in
the course of their activities.
Coface and its branches/subsidiaries (called hereinafter “Coface Group”) impose thatGroup's entities apply the same level of whistleblowing processes and protection.
This document was presented to the Workers’ councils and should be read in
conjunction with the other Coface codes of conduct and guidelines, including theCode of Conduct and the Anti-bribery Code.
1.1. Scope and objectives
1.1.1
The Whistleblowing Procedure relates to the reporting of suspected orpresumed incidents, by a natural person (hereinafter “the whistleblower”), in goodfaith and without direct financial compensation, about a potential or current breachof the law, to the Coface Code of Conduct and/or a threat or a prejudice to thegeneral interest1 (hereinafter “whistleblowing”).
1.1.2 Whistleblowing can concern but is not limited to fraud, corruption, money
laundering, terrorism financing, breach of international sanctions, inappropriate useof company resources, conflict of interests, insider trading, infractions to competition
and antitrust laws, infringement of personal data protection laws or inappropriate
conduct in regards to Coface legal duties towards its clients and/or employees.
1.1.3 The purpose of the Whistleblowing Procedure is for whistleblowing to beraised safely within Coface Group and to be handled adequately, so that suitablemeasures may be taken in a timely fashion. It describes the relevant principles andguidelines for reporting and handling suspected or presumed incidents.
1.2. Laws and regulations
1.2.1 French and European regulations require Coface to set up an internal
whistleblowing reporting mechanism and implement an efficient framework to
encourage whistleblowing.
1.2.2 As a principle, if local regulatory or legislative requirements conflict with orexceed the requirements set out in this procedure, any local variance or derogation
Article 6.I of the law of the 9 December 2016 amended by the law of the 21 March 2022 (calledhereinafter “amended Sapin 2 law”) accessible on:https://www.legifrance.gouv.fr/loda/id/JORFTEXT000033558528/2023-02-16/
1Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 4 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Function: Group Compliance

Version: 3

must be documented using the addendum template in Appendix I of thisprocedure, the higher standards will apply. Group Compliance is in charge to review
and approve local addendum template.
1.3. Key principles
1.3.1 The basic principles of the Whistleblowing Procedure are as follows:o Coface employees and third parties have a choice between a number ofwhistleblowing channels for reporting presumed or suspected incidents;o Coface employees and third parties acting in good faith must not, under any
circumstances, be subject to retaliations for their reporting: they must be
protected and their identities must insofar as possible remain confidential;o Suspected or presumed reported incidents must be verified in theappropriate manner and, if they are confirmed, Coface must take all necessary
steps to identify appropriate remedies;o The basic rights of any person implicated by the suspected or presumed
reported incidents must be respected, whilst ensuring that thewhistleblowing reporting process is effective.
2. WHO CAN REPORT
2.1.1 The whistleblowing reporting process described in this procedure isaccessible to all persons whose relationship with Coface falls or has fallen within aprofessional framework 2 . Therefore, it may be used by all Coface employees (incl.
Trainee, contractor, and subcontractor etc.), directors, managers, officers andexecutives in all Coface Group3 (called hereinafter “Coface employees”).
2.1.2 It may also be used by any external person who entered in any form ofprofessional relationship with Coface4 (called hereinafter “Coface third parties”). This
also includes, but is not limited to customers, intermediaries, suppliers and theiremployees, potential new joiners, former employees etc.
2.1.3 Anyone willing to report who has personal knowledge of the presumed orsuspected incident is encouraged to do so, even though the information was not
obtained in the course of their professional activities5.
2.1.4 Coface employees are encouraged to report any suspected or presumed
incidents and are also required to cooperate in any official investigation, audit orsimilar request. No Coface employee may use their position to prevent another
Coface employee from exercising their rights or complying with their obligations as

Art. 7-1 1° of the amended Sapin 2 law.
Art. 8.I.A. 1°, 2° and 3° of the amended Sapin 2 law.
4Art. 8.I.A. 4° and 5° of the amended Sapin 2 law.
5Art. 6.I and 7-1 1° of the amended Sapin 2 law.
2
3Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 5 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Function: Group Compliance

Version: 3

indicated above without facing potential disciplinary sanctions and criminal
prosecutions6.
3. WHAT TO REPORT
3.1. Situations to report
3.1.1 Coface employees and third parties have the possibility to report any
suspected or presumed incidents qualifying as a whistleblowing. This includes, but
is not limited to, any of the followings:
o Criminal or misdemeanor offences related to business (e.g. money laundering,terrorist financing, theft, fraud, bribery and corruption…);o Human resources misconducts (harassment, bullying, discrimination in theworkplace, endangerment of the health or safety of any person etc.);o Others violations of Coface's Code of Conduct or other unethical conduct(breach of client confidentiality, deliberate concealment of irregularities etc.);o Others breaches of law or regulations (e.g. data protection law infringement…).
3.1.2 The professional secrecy imposed on Coface employees and third parties is
not applicable in the context of whistleblowing. However, no whistleblowing can lift
the secrets of national defense, medical, judicial deliberations, judicial investigationor the lawyer-client privilege7.
3.2. Information to disclose
3.2.1 Suspected or presumed incidents are to be described as accurately as
possible. The information communicated must be factual and directly related to thesubject of the alert. Coface employees or third parties must specify as clearly as
possible the following elements:o The circumstances in which the reported facts were discovered;o All the information known about the reported facts;o Any documents or other legally obtained evidences to support the allegations;o The information necessary to contact them safely (when applicable).
3.2.2 Additional information or documents may be requested throughout theprocess to facilitate future investigations.
4. HOW TO REPORT
4.1. Selection of the appropriate channel
4.1.1 Coface employees or third parties have at their disposal various channels to
address their suspected or presumed incidents, depending on what they consider
6
7

Art. 13.I. of the amended Sapin 2 law.
Art. 6.II. of the amended Sapin 2 law.

Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 6 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Function: Group Compliance

Version: 3

most appropriate. Coface employees or third parties are invited to contact only thesedifferent channels, for efficiency and confidentiality guarantees.
4.1.2 It is up to the Coface employee or third party to choose the most appropriate
channel for reporting incidents. It is the responsibility of the Coface employee or
third party not to disclose any information about the alert and its consequences
outside of the reception channels below, except in the case of a legitimate interest,
in order to guarantee its confidentiality and proper handling.
4.1.3 If the Coface employee first contacts their manager, direct or indirect, thelatest must redirect them to the appropriate channel, in strict confidentiality, if thepresumed or suspected incident is likely to be qualified as a whistleblowing. As partof their professional obligations, the manager is also committed not to disclose any
information about the reporting apart from the appropriate channels defined below.
A.
i.

Local, Regional and Group Reporting channels
HR managers (for Coface employees only)

4.1.4 All Coface employees can contact their designated HR point of contact to whothey can address their suspected or presumed incidents. The HR manager may bereached verbally over the phone, in writing through email/post or physically at
Coface premises8.
ii.

Compliance Officers (for Coface employees only)

4.1.5 Such as HR managers, all Coface employees can contact their designatedCompliance point of contact as specified in the orgchart available on WeConnect9 to
who they can address their suspected or presumed incidents. The Compliance
Officer may be reached verbally over the phone, in writing through email/post or
physically at Coface premises10.
B.

Online public channels

4.1.6 Coface provides a form on its website that can be filled out by any employee
or third party to address their suspected or presumed incidents. This form isaccessible on the public website 11 at a minimum in English and French and if
specifically required in the local language in accordance with applicable laws andregulations.

Art. 10 of the decree n°2022-1284 accessible on:https://www.legifrance.gouv.fr/loda/id/JORFTEXT000046357368/2023-02-16/
9Compliance (coface.com)
10Art. 10 of the decree n°2022-1284.
11
Link to add.
8Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 7 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Function: Group Compliance

Version: 3

4.1.7 Moreover, the e-mail address whistleblowing@coface.com is also madeavailable to Coface employees and third parties on the public website to address
their concerns.
C.

The Ombudsperson

4.1.8 The Ombudsperson is a Coface employee in charge of collecting thesuspected or presumed incidents and trying to solve the various situations, with thesupport of the other Coface competent departments. In this capacity, theOmbudsperson acts with complete independence, outside his own hierarchy. The
Ombudsperson will treat the subject of the whistleblower in strict confidence, if thewhistleblower so requests12. The Ombudsperson can be contacted verbally over thephone, in writing at the following email address: ombuds@coface.com or physicallyat Coface head office.
D.

External authorities

4.1.9 Concerns can also be raised by Coface employees or third parties directly to
external authorities, such as the French Anti-corruption Agency (Agence Française
Anti-corruption) or any other external authorities depending on the subject, as
described in Appendix II.
4.2. Anonymous report
4.2.1 Coface employees and third parties can make in writing an anonymous alert
if they prefer, as Coface would rather receive them than not having any concerns bereported at all.
4.2.2 A report is qualified as anonymous when the whistleblower has expressly
refused to give their identity information (i.e by ticking the box “Yes, I would like toremain anonymous” in the form accessible on Coface public website) or when no
identity has been given (i.e when a letter/email is received with no information on
the sender).
4.2.3 However, Coface discourages this type of reporting for the following reasons:o Coface is firmly committed to protect whistleblowers under this procedure,
which is why there should be no reason to file an anonymous whistleblowing
report;o The subsequent investigations might be obstructed if the investigators
cannot make contact with the individual raising the presumed or suspected
incidents to obtain clarity or request further information;o In certain jurisdictions, Coface may be unable to investigate presumed orsuspected incidents that have been reported anonymously;

12

Tout ce que vous devez savoir sur Ombudsperson (coface.com)

Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 8 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:
2018

Function: Group Complianceo

Last update date: June 2023

Version: 3

Coface employees or third parties’ whistleblowing reported anonymously
waive whistleblowers‘ right to information if no means of contact is provided:
acknowledgement of receipt, feedback on the measures taken to manage thealert or information on the closure cannot be given 13 . In that regard,
whistleblowers are strongly encouraged to provide contact for further
exchanges (e-mail or postal address).

4.3. Collection modalities
4.3.1 For whistleblowing reported by Coface employee to an HR manager or aCompliance officer, the company undertakes to collect the information in thelanguage used by the entity in which the whistleblowing is made or in English at aminimum.
4.3.2 In the case of whistleblowing by third parties using the Online Whistleblowing
Form on Coface website or the generic mail address, Coface undertakes to collectwhistleblowing report in all languages.
4.3.3 When reported to the Ombudsperson, Coface undertakes to collect thewhistleblowing in English or French.
4.3.4 In order to ensure follow-up and accuracy, all verbal whistleblowing must betranscribed in writing by the first channel contacted. The whistleblower will have theopportunity to verify, correct and approve the transcription of the conversation14.
4.3.5 The whistleblower also has the possibility to verify and correct their alert when
done in writing.
5. GOVERNANCE
5.1. Preliminary verifications
5.1.1 The modalities summarized below are described in details in the
Whistleblowing Collection and Handling Standard Operating Procedure, to which
the person in charge of the whistleblowing collection may refer.
5.1.2 The alert and the presumed or suspected incident must be treated with theutmost confidentiality by all the persons in charge or otherwise aware of what has
been reported.
5.1.3 Each alert is assessed individually by the appropriate channel firstly contacted
to determine if it relates to irregularities covered by this procedure and if the person
who has raised the alert had the ability to do so.
13
14Art. 7-1 (4) of the amended Sapin 2 law.
Art. 6.II. 3° of the decree n°2022-1284.

Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 9 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Function: Group Compliance

Version: 3

5.1.4 If the conclusion of the preliminary verifications is positive - unless it would
lead to compromising the confidentiality of the Coface employee or third party’s
identity 15 or if they have expressly waived this right (by not providing contact
information) 16 - the Coface employee or third party who has raised the alert receives
an acknowledgement of receipt within seven (7) working days of the alert 17 . The
decision is documented in a whistleblowing register by the person in charge of thewhistleblowing collection.
5.1.5 If preliminary verifications indicate that the concern has no basis, or it is not amatter to be pursued under this Procedure, it may be closed at this stage. Such a
decision must be documented in a whistleblowing register by the person in chargeof the whistleblowing collection and the person who has raised the alert is informed
consequently. Such a notification must be sent within seven (7) working days of thealert, as it serves as an acknowledgment of receipt, and precises the closure of thecase and its rational.
5.2. Handling and investigations
5.2.1 The handling of the alert depends on the channel of collection initially chosen
by the whistleblower.
A.

Escalation to the Whistleblowing Forum

5.2.2 The whistleblower has initially contacted their HR manager, their Compliance
Officer or a publicly available channel.
5.2.3 In this case, the first channel contacted escalates the case, whether it is closed
after the preliminary verifications or not, to the Whistleblowing Forum.
5.2.4 The Whistleblowing Forum is composed of an expert team: the Group General
Secretary and both the Group Compliance and Human Resources Directors, who has
the right knowledge and objectivity to determine which specifically designatedteam/function will conduct future investigations.
5.2.5 The case is assigned to the most appropriate team/function to investigate
depending on the matter it is about.
5.2.6 The specifically designated team/function in charge will conduct aninvestigation and determine the veracity of the alleged facts, based on concrete
factual elements collected during these investigations. In that sense, the designatedteam/function will conduct interviews of Coface employees or third parties,
Art. 10.I. of the decree n°2022-1284.
Art. 7-1 (4) of amended Sapin 2 law
17Art. 10.I. of the decree n°2022-1284.
15

16Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 10 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Function: Group Compliance

Version: 3

witnesses or alleged authors and perform document reviews etc. The results andconclusions of the investigation must be formalized in a report which will betransmitted to the Whistleblowing Forum.
5.2.7 In case where the investigations conducted prove right the alleged facts
reported, the Whistleblowing Forum determines collectively all necessary measures
to correct the inappropriate practices (incl. consequence management) within areasonable timeframe.
B.

Handling by the Ombudsperson

5.2.8 When the whistleblower has initially contacted the Coface Ombudsperson,
they determine which specifically designated team/function will conduct future
investigations, in addition to those already conducted by the Ombudsperson.
5.2.9 The Ombudsperson and/or the specifically designated team/function in
charge will conduct an investigation and determine the veracity of the alleged facts,
based on concrete factual elements collected during these investigations. In thatsense, the Ombudsperson and/or the designated team/function will conduct
interviews of Coface employees or third parties, witnesses or alleged authors andperform document reviews etc. The results and conclusions of the investigationmust be formalized in a report to the Ombudsperson.
5.2.10 In case where the investigations conducted prove right the alleged facts
reported, the Ombudsperson determines – if need be – necessary remedial
measures with the concerned Directors to correct the inappropriate practices (incl.
consequence management) within a reasonable timeframe.
5.2.11 Investigations carried out by the Ombudsperson and/or by the specificallydesignated team/function as detailed above are only implemented with the prioragreement of the whistleblower and are carried out with the strictest respect for
confidentiality, in particular with regard to the identity of the whistleblower at allstages of the procedure.
5.3. Information of the whistleblower
5.3.1 The whistleblower has a right to information throughout the management of
its reporting. First, as mentioned above18, to provide comfort that Coface has received
the alert on the suspected or presumed reported incident and is addressing it, thewhistleblower receives an acknowledgement of receipt within seven (7) working
days of the alert. The acknowledgement of receipt specifies the next steps and the
expected timing to the whistleblower.

18

See paragraph 5.1.4 of the procedure.

Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 11 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Function: Group Compliance

Version: 3

5.3.2 As a second step, Coface will provide a written feedback19, insofar as legallypossible, to the whistleblower within three (3) months following theacknowledgement of receipt of the alert, or, if it happens in the meantime, at thecase closure. This feedback includes information on the measures taken to assess
the accuracy of the allegations, on the investigations’ conclusions and, if applicable,on the measures taken to remedy the whistleblowing reported, as well as thejustification for the measures taken20.
5.3.3 Finally, the whistleblower is informed in writing of the case closure wheneverit happens.
5.4. Information of the other targeted persons
5.4.1 For the purpose of this procedure, the “other targeted persons” include all
persons whose personal data are processed during the whistleblowing
investigations (e.g. the alleged author, the witnesses, etc.)21.
5.4.2 In accordance with the law22, the other targeted persons must be informed
about the allegations formalized by the whistleblower within a reasonable period oftime, which does not exceed one month, as well as on how to exercise their rights ofaccess and correction. However, such an information may be deferred 23 when it
would seriously jeopardize the needs of the investigation (e.g. if there is a risk ofdestroying evidence and provided that confidentiality on identity of thewhistleblower and details of the allegations must be protected at all times).
6. PROTECTIONS FOR WHISTLEBLOWERS24
6.1. Confidentiality and impartiality commitments
6.1.1 Coface is committed to ensure that all alerts are received, escalated,
processed and archived in an impartial and confidential manner.
6.1.2 Impartiality means that each situation will be handled without bias, incomplete objectivity and by people who have no direct or indirect link with thesituation reported to avoid conflict of interest situations.

Art. 4.III. of the decree n°2022-1284.
Art. 10-1.II. of the amended Sapin 2 law.
21
8.1 of the guidelines for the processing of personal data for the implementation of a professional alert
system published on July 18th 2019, by the French Data privacy Regulator.
22
Art. 14 of the GDPR.
23
Art. 14-5-b) of the GDPR.
24
All the protections granted by Coface are extended to the facilitators, the individuals and the entities
linked to the Coface employee or third party as part of their professional activities, as defined by thearticle 6-1 of the amended Sapin 2 law.
19

20Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 12 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Function: Group Compliance

Version: 3

6.1.3 Confidentiality is guaranteed first of all by the fact that the identity of thewhistleblowers will be treated in confidence, from the whistleblowing receiving to
the end of the data retention period. All Coface employees involved in the alert
collection and handling process are trained25 and personally committed to maintainstrict confidentiality about the content of any whistleblowing, in accordance withapplicable law.
6.1.4 Information about the whistleblower may only be disclosed with the express
consent of the whistleblower 26 - unless information are disclosed to the judicial
authorities - to authorized investigators to the extent necessary to carry out theinvestigations. Particular attention must be paid regarding the right of the persons
implicated to be given a fair hearing.
6.2. Protection against any form of retaliation
6.2.1 Any Coface employee or third party who reports an irregularity or a suspicionof irregularity, provided that this is done in good faith and in compliance with theprovisions of this procedure, must be protected against any acts of retaliation,
whether or not the facts reported are proven right. On the other hand, Coface
reserves the right to impose disciplinary sanctions for any abuse of the system,
characterized by a slanderous denunciation made in bad faith.
6.2.2 For the purpose of this procedure, "retaliations" are defined as any action or
threat of action which is unjustly detrimental to the Coface employee or third party
because of their report, including indirectly. This includes 27 , but is not limited to,termination of the business relationship (suspension, layoff, dismissal, contract
termination …), refusal of career advancement, imposed transfer or changes inprevious working conditions, disciplinary measures, disadvantageous treatment anddamage to reputation. In addition, all illegal measures, such as harassment,
discrimination, unfair treatment, etc., are also prohibited.
6.2.3 Any form of retaliation is considered to be a breach of loyalty and professional
ethics requirements of the Code of Conduct. In such a case, disciplinary sanctions
and criminal prosecutions may be faced. Where whistleblower considers that they
have been the victim of retaliations or have good reason to believe so, they areentitled to complain to the Group Human Resources or Compliance Directors.
6.2.4 In addition, in the event where disciplinary measures unrelated to thewhistleblowing are taken with time against the whistleblower, the Human
Resources Director ensures that these disciplinary measures have no link with thewhistleblowing escalated, cannot be considered as retaliation measures and are duly
motivated.
Art. 11 of the decree n°2022-1284.
Art. 9.I. of the amended Sapin 2 law.
27
Art. 10-1.II. of the amended Sapin 2 law.
25

26

Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 13 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Function: Group Compliance

Version: 3

6.2.5 In the event of a judicial proceeding from the whistleblower against retaliatory
measures, the burden of proof will be on the defending party to demonstrate thatthe concerned measures were not motivated by the reporting of presumed orsuspected incidents28.
6.2.6 In the European Union, the whistleblower is also protected by Courts from any
civil proceedings against them on the basis of the reporting29. Nor is a whistleblower
criminally liable if they remove, misappropriate or conceal documents or any othermedium containing information of which they have lawful knowledge and which
they report under the conditions mentioned in this Procedure30.
7. INTERNAL CONTROLS
Coface implements appropriate controls to ensure that the whistleblowing
mechanism is effective and efficient. Level 1 and 2 controls must be carried out on
an ongoing basis to ensure appropriate collection and handling of thewhistleblowing escalated. Periodically, the quality of the system is also reviewed byinternal audit, as a level 3 control, such controls are always operated with protectionof confidentiality as detailed hereinabove.
8. TRAINING AND COMMUNICATION
Training is a key element of ethic awareness and contributes to promote a strong
Compliance culture. In accordance with the HR Training Program and applicablelaws, regulations, all Coface employees receive a regular global mandatory training
on Coface Code of Conduct and Anti-Bribery Program, which includes thewhistleblowing mechanism. All new Coface employees receive this training within
30 days of their assignment.
Furthermore, any Coface employee in charge of the collection and the handlingwhistleblowing process must refer to the Whistleblowing Collection and HandlingStandard Operating Procedure and must be subject to specific training sessions31, inview of their position, mission or knowledge.
More generally, the whistleblowing reporting system is subject to annual
communication in Coface, in which Coface employees are reminded the current
group rules and the reporting channels. Coface managers receive communicationon the escalation system.

Art. 10-1.III. of the amended Sapin 2 law.
Art. 10-1.I. of the amended Sapin 2 law and article 21 of the Directive (EU) 2019/1937.
30
Art. 122-9 of the French Criminal Code31
Art. 11 of the decree n°2022-1284.
28
29Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 14 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Function: Group Compliance

Version: 3

Specific key performance indicators have been deployed regarding whistleblowing
and are presented five times a year to Coface's top management through the Coface
Group Risk and Compliance Committee (CRGCC) and to the Board Risk Committee.
9. RECORD RETENTION
All whistleblowing related records must be retained in accordance with local laws
and regulations that apply, in particular regarding the special requirements on
sensitive data where applicable, and must be readily retrievable. However, in thecontext of whistleblowing, all archives are anonymized as soon as the knowledge of
the Coface employee or third party identity is no longer strictly needed.
As a minimum requirement of five (5) years, the following records must be retainedin electronic or paper format:
o Records relating to documentation, information on the presumed orsuspected incidents disclosed to the appropriate channels;
o Records relating to the alerts handling and remedial measures taken by the
Whistleblowing Forum;o Records relating to trainings and communications.
Coface is responsible for the processing and protection of data collected in thecontext of whistleblowing investigations.
10. PROCEDURE EFFECTIVE DATE AND REVIEW
These Group Rules are effective as of XXX 2023. This procedure should be reviewed
and approved, at least every two years, by the Group Compliance Director and any
material amendments must be presented to Group General Secretary. These
Procedure is distributed to all concerned employees. The procedure is also madeavailable on WeConnect and Coface’s website.

APPENDIXESo APPENDIX I – Procedure addendum templateo APPENDIX II – External channels information

Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 15 | 17

Procedure

name:Whistleblowing Procedure

1st implementation date:

Last update date: June 2023

2018

Function: Group Compliance

Version: 3

APPENDIX I - GROUP RULES ADDENDUM TEMPLATE
Date of Addendum Publication:
Addendum Version Number:Country/Region
Coface Legal entities covered bythis addendum
Line of Business covered by thisaddendumContact name, position and team
Impacted Group Rules Section
Group Rules Section Ref:
Group Rules Section Title:
Variance, Derogation?
Change to the Group Rules

Reason for the change to the Group Rules
Provide title, link and details of theRegulation or Law that requires thisAddendum.
Please be specific e.g. clause,paragraph or page number, etc.
Please add any further relevant
information (if any) e.g. Legal
Advice or additional references foraudit trail and complete reference.

Type of modifications
Variance

Derogation

Definition
A variance must be drafted when local laws
and regulations are stricter than the Group
Rules.
A derogation must be drafted when local
laws and regulations are in conflict with theGroup Rules.

Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 16 | 17

Procedure

name:Whistleblowing Procedure

Function: Group Compliance

1st implementation date:

Last update date: June 2023

2018

Version: 3

APPENDIX II - EXTERNAL CHANNELS INFORMATION
Although it is always recommended to make an internal reporting, so that thesituation can be adequately handled, both Coface employees and third parties may
directly use external channels32.
In France, external ethical alerts could be addressed to different authorities
depending on the nature of the situation reported33. The external authorities include
but are not limited to:
Subject
Authority
Contact
Breaches of probity, French
Anti-corruption Faire un signalement | Agencecorruption allegations
Agency (AFA)
françaiseanticorruption(agence-francaiseanticorruption.gouv.fr)
Financialservices, French Prudential control https://acpr.banqueproducts and markets
andresolution Authority france.fr/controler/signalerPrevention of money (ACPR).
lacpr-un-manquement-oulaundering and terrorist
une-infraction
financing
Product
safetyand French General Directorate SignalConso, un service public
compliance, Consumer for Competition, Consumer pour les consommateurs
Protection
Affairs and Fraud Control(DGCCRF)
Protection of privacy French Data processing and https://www.cnil.fr/fr/lanceursand
personal
data, liberties Commission (CNIL)
dalerte-adresser-une-alerte-lasecurity of networks andcnil
information systems
Individual and collective French Labor Law Inspection Dans quels cas recourir àlabor relations, working
l'inspecteur du travail ? |conditions
Service-public.fr
Discriminations
FrenchHumanrights https://www.defenseurdesdroit
defenders.fr/fr/lanceurs-dalerte
The Coface employee or third party can also make an alert directly to the judicial
authorities34.
All guarantees associated to an external whistleblowing are specified in the decree.

Art. 8 of the decree n°2022-1284.
The list of authorities is provided in the appendix of the decree n°2022-1284 of October 3, 2022 relating
to the procedures for collecting and processing suspected or presumed incidents and setting the listof external authorities instituted by Law n° 2022-401 of March 21, 2022 aimed at improving theprotection of whistleblowers.
34
Art. 8.II of the amended Sapin 2 law.
32
33

Group Compliance – Whistleblowing Procedure – V3 – Public Document - Page 17 | 17