Interac Corp.

E n t e r p r i s e Ve n d o r M a n a g e m e n t O ff i c e

Third Party Code of Conduct

Document Status:
Version:
Date:
Data Classification:
Data Owner
Audience:

FINAL
1.0
5/31/2024
PUBLICEnterprise Vendor
Management OfficePublicTA B LE O F C O N TE N TS

1PURPO SE AND SCO PE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . 22L EGAL COM PL I ANCE AND ET HI CAL O PERAT I NG PRACT ICES . . . . . . . . . . . . . . . . . . . . . 23 PROT ECT IO N OF I NT ERAC I NT ELL ECUT AL PRO PERT Y AND CO NFI DENT AL
INF ORMATION ....................................................................................... 44RESPO NSI BL E BUSI NESS PRACTI CES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 55RESPO NSI BL E TREATM ENT OF I NDI VIDUAL S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . 66M ONIT ORING AND REPO RT ING . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7VE NDO R CO DE O F CO NDU CTVERSION 1.0 – PUBLIC – 2024-05-31i1PURPOSE AND SCOPE

This Third-Party Code of Conduct (“Code”) sets out the principles and expectations as tohow organizations, including their representatives and employees, and subcontractors(together “Third Parties”), who supply goods and services to Interac Corp. and its
subsidiaries (“Interac”) are to conduct business with and deal with Interac.
At Interac, our approach to corporate governance is based on the principle that good,transparent processes lead to proper outcomes. The Principles that drive our corporate
governance approach can be found in Interac’s Corporate Year In Review.
Our organization and all our employees have a duty to comply with applicable laws andregulations and are expected to behave responsibly and ethically. Good business ethics
are essential to governance excellence. Interac has adopted a values-based andcompliance program that uses resources efficiently and closely aligns with our corporateculture. Our Code of Business Conduct and Ethics summarizes the basic ethical and legal
principles that guide the conduct of Interac and its employees.
This Code goes beyond compliance with local law and is based on universal principles
that align with our corporate values, therefore it applies to all Third Parties regardless oflocation. Where there is a conflict between the language in this Code and the agreementfor products and services between Interac and the Third Party (e.g., a Master Services
Agreement or a Master Supplier Agreement), it is understood that the terms in theexecuted agreement will apply. To ensure awareness of this Code, Third Parties areresponsible for providing awareness training for their staff, subcontractors, and otherrepresentatives.
Failure to comply with this Code will result in the Third Party being placed on enhanced
monitoring/governance and may result in termination of the Third Party’s relationship withInterac, in accordance with the applicable agreement.

2LE G A L , C O MP LI A N C E A N D E TH I C A L O P E R ATI N G P R A C TI C E S

Compliance with Laws
In all their activities, Third Parties must ensure that they conduct themselves incompliance with applicable laws, rules, and regulations of the jurisdictions in which theyoperate. This includes but is not limited to applicable human rights, labour and wage laws,
anti-money laundering, anti-terrorist financing, sanction laws, anti-corruption, privacy andinformation security laws, anti-tax evasion, insider trading and antitrust and competition

VE NDO R CO DE O F CO NDU CT
VERSION 1.0 – PUBLIC – 2024-05-31

2

laws. Interac expects Third Parties to proactively make us aware of any potential
violations of applicable laws (i.e. prior to being published in mainstream media). ThirdParties must not make any application, written or otherwise to any government body onbehalf of Interac without Interac approval.
Conflicts of Interest
At Interac, we are transparent in our business dealings and avoid situations that put
individual interests in conflict with those of Interac or lead others to question our businessobjectivity. In their relationship with our employees, Third Parties must not try to gain
improper advantage or preferential treatments for other relationships they may have withus or improperly impact an Interac employee’s ability to make a sound, impartial andobjective decisions on behalf of Interac. Third Parties are required to disclose any
situation that appears to conflict, or could conflict in anyway, with the interests of Interacand should have clear company-wide policies or processes on managing conflicts ofinterest.
Gifts, Meals, Travel and Entertainment
A Third Party is prohibited from offering or providing any gifts, meals, travel orentertainment to Interac or Interac employees or on behalf of Interac or Interac employees
for any purpose that is unlawful, unethical, or improper. The giving or receiving of cash or
cash equivalents as a business gift to Interac or Interac employees or on behalf of Interacor Interac employees is also prohibited. Although gift giving is common in some parts of
the world, caution must always be taken; gift giving with the appearance or intention ofinfluencing decisions or conduct is strictly prohibited.
Subject to the requirements above, gifts, meals, travel, or entertainment that isreasonable, appropriate, does not violate applicable law and does not exceed $100 isacceptable. In the case of a formal sourcing exercise (i.e. RFP, RFQ, etc), any amountof gift, meals, travel or entertainment is strictly prohibited.
Engagement with Interac Strategic Sourcing
Third Parties must be mindful that although they might interact with various members ofInterac staff to provide support for ongoing projects and services, Interac Strategic
Sourcing manages new engagements with Third Parties. As such, a Third Party should
engage the Strategic Sourcing team as a first point of contact for any new and potential
business or related activity.

VE NDO R CO DE O F CO NDU CT
VERSION 1.0 – PUBLIC – 2024-05-313

3

P R O TE C TI O N O F I N TE R A C I N TE LL E C TU A L P R O P E R TY A N DC O N FI D E N TI A L I N FO R MATI O NInterac intellectual property is an important asset and critical to our business. Third Parties
should understand its importance and protect Interac intellectual property accordingly.
Third Parties are expected to safeguard Interac confidential information. If a Third Party
has access to Interac confidential information, it is to be used only in a manner permitted
by Interac under the terms of the applicable agreement and in any event protected withthe same care with which the Third Party safeguards its own confidential information.
Third Parties should also respect Interac physical and electronic assets and use themappropriately for business purposes. Third Parties must wear badges on Interac premises
where required by Interac for security purposes and adhere to Interac security protocols.
Third Parties are not permitted to publicly disclose Interac as a client or use the Interac
name, logo, or trademarks unless authorized to do so.
Data Retention and Destruction
Third Parties must retain and securely destroy data in accordance with criteria establishedin executed agreements and in line with local regulatory requirements and provide
confirmation and/or evidence of destruction upon request. Unless specified differently in
our agreement, all Interac data is to be housed in Canada or the US. Data residency
cannot be altered without Interac prior consent.
Information Hold
Third Parties must not destroy Interac data that may be relevant to actual or anticipatedlegal or regulatory proceedings of which the Third Party becomes aware or for which theyreceive notification. Third Parties take reasonable measures to maintain adequate
internal data maintenance policies to ensure proper compliance with their obligations toInterac.
Encryption
In their dealing with Interac, Third Parties must protect Interac information throughout allstages of the information lifecycle, including creation/collection, storage, transmission,transporting, archiving, and destruction and use suitable methods of encryption whererequired.
Access Administration
Third Parties must have policies and procedures in place to approve, grant, remove,deactivate, and periodically review access to Interac information and services to ensure

VE NDO R CO DE O F CO NDU CT
VERSION 1.0 – PUBLIC – 2024-05-31

4

that the level of access is appropriate and remove unnecessary access without unduedelay.

4

R E S P O N S I B LE B U S I N E S S P R A C TI C E SBusiness Resumption and Contingency Planning
For services performed by Third Parties that are significant to theoperations of Interac,including Interac products and services, Interac expects that the Third Party develops,
maintains, and test robust business continuity and disaster recovery plans in accordancewith appliable regulatory, contractual, and service level requirements.
Subcontracting
Third Parties are not to subcontract services they perform for Interac or outsource
activities that directly impact the delivery of goods and services to Interac, without ourprior written approval. In situations where approval is given, it is important for Interac toknow the locations of where the work will be performed, the possibility of cross-border
movement of any Interac, Interac client or Interac employee data, and the identity ofparties involved in the provision of the services. For any approved subcontracting
arrangement, the Third Party retains all responsibility for delivery of products andservices.
In addition, where Third Parties are subcontracting certain activities, Third Parties mustmonitor the subcontracting engagement to ensure compliance with the Third Parties
contractual obligations and with this Code and provide evidence of such monitoring toInterac upon request.
Environmental Management
Third Parties must have the appropriate management policies and procedures in place tominimize material environmental impacts and comply with all environmental laws. ThirdParties are encouraged to develop targets to reduce the environmental impacts of theiroperations, products, and services, develop means of measurement and to publicly
disclose their progress relative to those commitments on an ongoing basis. As therequirements in this space grow over time, Third Parties should begin to lay thefoundations for client specific carbon emission reporting.
Artificial Intelligence

VE NDO R CO DE O F CO NDU CT
VERSION 1.0 – PUBLIC – 2024-05-31

5Interac expects all Third Parties to use AI in a responsible and transparent manner,complying with all current and future regulations. Where AI is used in a meaningfulmanner to provide services to Interac, Third Parties must disclose this proactively toInterac.

5R E S P O N S I B LE TR E ATME N T O F I N D I V I D U A LS

Employment Practices
Third Parties Interac expects that Third Parties be committed to non-discrimination
principles and operate in a way that does not unfairly differentiate between individuals.
Third Parties must adhere to applicable employment, labour, immigration, nondiscrimination and human rights standards, laws, and regulations, including with respect
to health and safety, working conditions and fair wages.
Interac is firmly committed to providing equal opportunity in all aspects of employment
and will not tolerate any form of discrimination, harassment, or retaliation in theworkplace.
Interac expects all Third Parties to provide a safe, secure, and healthy work environment
for their staff. Third Parties must adhere to all applicable laws regarding health and safety
in the workplace. Third Parties should have policies in place that prevent the use of illegal
substances at work and prevent behaviour that appears intimidating, violent, or threatens
the health and safety of employees or others.
Human Rights
Interac is committed to respecting human rights and operating responsibly by establishinghigh ethical standards across our company. Our commitment includes identifying,preventing, and mitigating any adverse human rights impacts of our activities wherepossible. Interac will not tolerate any forms of slavery, servitude, exploitation, child labour,forced labour, or human trafficking. Interac expects our Third Parties to share the same
human rights values and principles and must comply with applicable human rights
standards, laws, and regulations.
Third Parties Operating in Canada
In addition to acknowledging this Code, our corporation’s expectation is that Third Parties
that operate their business and provide services within Canada will support ourcommitment to Canadian jobs and prosperity and meet the following requirements:

VE NDO R CO DE O F CO NDU CT
VERSION 1.0 – PUBLIC – 2024-05-31

6•••••

6

Third Parties will not hire foreign workers from outside Canada when performing
services on behalf of Interac, where a worker eligible to work in Canada is available
and able to perform the service.
Third Parties will notify Interac immediately if they have been found in breach ofany employment, labour, immigration, or human rights standards, laws, orregulation.
Third Parties will not implement any material change to way services are provided
to Interac that has an impact of the Vendor’s employees, without consulting Interac
to ensure there is no breach of our policies and this Code.
In addition to obtaining specific written consent from Interac before subcontractingor outsourcing services, Third Parties will be required to provide up-to-date
information about subcontractors (and any such related information) as may bereasonably requested by Interac.
Third Parties, by their action in collaboration with Interac, will continue to create
investment and jobs in Canada in the provision of services to Interac.

MO N I TO R I N G A N D R E P O R TI N GInterac maintains the right to monitor a Vendor’s compliance to this Code. Interac will beentitled to request information from its Third Parties as to their compliance with theprinciples of this Code.
Any person with reason to believe that the spirit or principles of this Code are not being
respected by an Interac Third Party is asked to report this promptly to the attention of:
The Interac Ombudsman Office: ombudsman@interac.ca
The reporting of a violation of this Code may lead to an evaluation and an investigation
by Interac at its sole discretion. Failure to comply with this Code could result in the Third
Party being placed on enhanced monitoring/governance and may result in the terminationof the Third Party’s relationship with Interac, in accordance with the applicable agreement.

VE NDO R CO DE O F CO NDU CT
VERSION 1.0 – PUBLIC – 2024-05-31

7

Copyright © 2024, Interac Corp. All rights reserved.
Except as permitted by law, no part of this document may be reproduced or transmitted by any process or means without priorwritten consent of Interac Corp.
Published by Interac Corp., Royal Bank Plaza, North Tower, 200 Bay Street, Suite 2400, P.O. Box 45, Toronto, ON, M5J 2J1
Tel: 416-362-8550 Fax: 416-869-5080

VE NDO R CO DE O F CO NDU CT
VERSION 1.0 – PUBLIC – 2024-05-31

8