Whistleblowing

1. Introduction

1.1 What is the purpose of this policy?
This policy states Sterringsafe Trust’s (RBLs) framework on whistleblowing as a channel of last resort to report issues that (potentially) affect the integrity of the organisation and the reputation of RBL and any of its related parties (hereinafter jointly referred to as ‘RBL’) and to demonstrate compliance with SYSC18 of the FCA Handbook. The policy fits in the core values of RBL and the bank’s wider integrity structure. Abuses and irregularities negatively affect the integrity of RBL and could have serious consequences for individuals or society. It is important for RBL to be aware of any (potential or suspected) abuses and irregularities (hereinafter jointly referred to as ‘irregularities’) in order to address, mitigate and prevent them. The whistleblowing channel of RBL is open to all employees as well as third parties.

The policy provides clear insight about RBLs key principles on whistleblowing, the various reporting channels, the investigation process and the different roles and responsibilities within that process. The policy also addresses how the whistleblowing policy fits in the broader integrity framework of RBL.

1.2 Why do we need this policy?
It is important for RBL to have clear procedures and policies in place regarding whistleblowing for several reasons. For employees it is important to know that RBL provides for a channel where they can disclose information about suspected irregularities which they feel unable to address within the regular reporting structure. RBL recognises that certain barriers exist in speaking up, especially when loyalty is at play or if you are afraid of personal or professional consequences. It is therefore important to know that employees who report irregularities in good faith are protected by the whistleblower status and our non-retaliation principle. Reports may be filed anonymously, though it is important to note that the identity of the reporting person is kept confidential for all reports (see paragraph 2.3).

This policy is very important for RBL as an organisation as well. The integrity and reputation of RBL are of utmost importance for the bank, unreported irregularities may jeopardise this. RBL and its employees are under a statutory and/or regulatory obligation to report particular types of irregularities, such as financial crime and other criminal offences, to the regulatory or government authorities. A consistent and effective mechanism must be in place to facilitate such reporting. RBL encourages employees and third parties to report any irregularities, even when the rules or regulations do not require them to do so.

Having a culture in place which promotes employees to speak up will ensure that disclosures pertaining to possible irregularities are properly investigated and relevant information reaches senior management in good time when necessary. Early detection allows RBL to address (potential or suspected) irregularities before a situation escalates. Gathering information on the issues raised through the whistleblowing channel allows the organisation to detect patterns and make improvements to our policies, procedures and address conduct issues in order to prevent future problems. It also allows management to identify where more resources are needed to reduce risk exposure.

The policy gives effect to the latest regulations and legislation on whistleblowing and aims to adopt best practices in the field of whistleblowing protection and internal alert handling.

2. Principles

2.1 When to report
The whistleblowing channel of the bank is open to all employees to report irregularities which they cannot, or do not feel comfortable to, report to their manager or compliance officer. The whistleblowing channel complements the normal reporting channels. The whistleblowing channel is also open to third parties to report irregularities concerning RBL or its employees.

Potential and suspected irregularities can be reported under all circumstances. It is important to note however that there are several conditions which impair the likeliness that the report can be investigated. Paragraph 2.4.2 lists examples conditions which can be used in assessing and weighing information provided in whistleblowing reports and the decision to start an investigation into the matter.

2.2 What to report
This policy is designed to allow employees and third parties to report the following irregularities:

– Dishonest, fraudulent, inappropriate, illegal, or negligent professional activity or behaviour by another person;
– Failure by another person to act appropriately, with propriety, or in accordance with the law when carrying out their duties.

Examples of irregularities include (but are not limited to):

– Criminal offences
– Breaches of civil law or regulations
– Violations of RBLs core values or other unethical conduct
– Serious breaches of RBLs internal rules and regulations
– Repetitive and/or intentional breaches of RBLs internal rules and regulations
– Questionable accounting and audit issues
– Deliberate concealment of abuses and irregularities
– Breach of client confidentiality
– Harassment, bullying, or other forms of unfair discrimination in the workplace
– Endangerment of the health or safety of any person

In order to report an irregularity via the RBL whistleblowing channel:

– the irregularity should be directly related to RBL or any of its related parties;
– information provided should be as accurate and complete as possible;
– demonstrating evidence of the irregularity is preferred but not necessary, reporting persons should nevertheless have reasonable grounds to suspect the irregularity has taken place (or will take place).

It is important to note that the information included in the whistleblowing report can be an important factor in determining to launch an investigation (see paragraph 2.5.2).

2.3 Key principles
The Whistleblowing Policy of RBL is structured around four key principles: the protection of confidentiality; the prevention of victimisation and non-retaliation principle; reporting in good faith; and protection of accused persons. These five principles are laid down below in more detail.

2.3.1 Protection of confidentiality
The principle the confidentiality is a corner stone of the Whistleblowing Policy. The recipient of the whistleblowing report and all others involved in the whistleblowing process treat the information

confidentially and with utmost care. The data is saved digitally and physically only accessible to the
officers directly involved in the reporting and investigation process on a ‘need to know’ basis.

The identity of the reporting person and other details of the report are treated confidentially and are protected through all stages of the investigation process. The identity of the reporting person who has filed a whistleblowing report is not revealed without first obtaining the person’s explicit consent unless its disclosure is required by a court order in the context of subsequent judicial proceedings.

2.3.2 Prevention of victimisation and non-retaliation principle
The protection of the employee is of utmost importance to the bank. Employees who have filed a report under the Whistleblowing Policy ‘in good faith’ (see paragraph 2.3.4) are appropriately protected from any negative impact, e.g. retaliation, discrimination or other types of unfair treatment. Retaliation includes any adverse action taken against a reporting person, such as but not limited to demotion, discipline, firing, salary reduction or job or shift reassignment.

The non-retaliation principle does not entail that a whistleblower who has breached internal policies or laws cannot be confronted with consequences. Self-reporting can be a ground to reduce potential sanctions. It is important to note however that the focus is not on punishment, but rather on the question whether irregularities did take place, the (possible) consequences, and how to prevent future irregularities to happen.

Appropriate measures are taken against anyone under control of RBL who (attempts to) victimises an employee who has reported an irregularity. Appropriate measures can be disciplinary action, civil action, or criminal prosecution.

2.3.3 Reporting in good faith
This policy protects whistleblowers who report in good faith. A report is considered to be made in good faith if the individual had reasonable grounds to believe the information was true at the time of the reporting. If it later turns out the information was not true but the report was made in good faith, the whistleblower is still protected from retaliation.

Those who deliberately and knowingly report wrong or misleading information do not enjoy protection, which serves as a safeguard against malicious or abusive reports. Making malicious or false claims is incompatible with RBLs core values and deliberate misuse of the RBL whistleblowing channel may result in disciplinary action.

2.3.4 Protection of accused persons
The protection of the employee is of utmost importance to the bank. In case a natural person is allegedly responsible for the irregularity, their employments rights and right to privacy will need to be carefully considered. The person who is the subject of an investigation will be informed about the cause of the investigation if appropriate given the circumstances. When the investigation finds no evidence that justifies taking measures against the person who has been reported, that person should be protected from any negative effects. The same protection should apply for persons who are subjected to reports made in bad faith.

If evidence is found and measures are taken, the person concerned should be protected from unintended negative effects that go beyond the objective of the measure taken.

2.4 Filing a whistleblowing report
A whistleblowing report can be filed via the designated whistleblowing channel or via alternative channels described below. In accordance with SYSC18, the reporting mechanism and subsequent investigative procedures ensure the protection of the personal data of both the person who reports the irregularity and if relevant the natural person who is allegedly responsible for the irregularity.

2.4.1 Reporting channels available to RBL former and current employees
Per the HR Policy, Manual contact details for the Chair of the Board have been provided, however, a limited access email account has also been created for individuals that may wish to write to the Chair:

Whistleblowing@sterringsafetrust.com

Alternatively, if, for any reason, an employee should feel uncomfortable using this route, they can file a report with their manager, their manager’s manager, the HR business partner, the compliance officer, a trusted person, or a senior representative of the employee’s choice. Concerns can be reported in writing or by telephone; employees are expected to specify that they are filing a report under this policy. If a (potential or suspected) abuse or irregularity is reported to a line manager or senior officer (or any of the other alternative channels indicated above), the recipient is required to contact the Compliance Team without delay for further guidance.

2.4.2 Reporting channels third parties
The RBL whistleblowing channel is also open to third parties. Third parties include clients, suppliers, agents, etc. This policy is not designed for clients who wish to file a complaint. These clients are kindly requested to follow the complaints procedure.

Third parties can report any irregularities under this policy emailing;

Whistleblowing@sterringsafetrust.com

The four key principles of RBLs Whistleblowing Policy referred to in paragraph 2.3 (the protection of confidentiality; the prevention of victimisation and non-retaliation principle; reporting in good faith; and protection of accused persons) are also applicable to third parties making use of the policy. Whilst whistleblowing to the Bank allows us to investigate at source and take any actions quickly, sometimes it can be more appropriate to whistleblow to an external channel (eg for certain types of Conduct concerns). External notification may be made anonymously to either the FCA or PRA as follows:

2.5 Alternative external reporting channels
https://www.fca.org.uk/firms/whistleblowing

Call: +44 (0)20 7066 9200 during office hours or leave a message Email: whistle@fca.org.uk
Write to: Intelligence Department (Ref PIDA), Financial Conduct Authority, 12 Endeavour Square, London, E20 1JN

3. Procedure for Dealing with Concerns
3.1 All investigations will be conducted sensitively, as quickly as possible, and under this procedure. The investigation should be concluded within three months of the matter being raised, though some scenarios may result in a longer timeframe. While the Bank cannot guarantee that the outcome will be as the employee may wish, the matter will be handled fairly and in accordance with the Whistleblowing Policy.

3.2 Depending on the nature of the concern raised, Senior Management may be contacted and appointed to investigate, determine, and report the outcomes of the investigation to the Chair of the Board. There may be circumstances where the Chair appoints a Non- Executive Director to act as an independent investigator, who will then conduct the investigative process.

3.3 All whistleblowing concerns must immediately be communicated to the Human Resources consultant, even if it is identified that the matter should be managed under a different policy or appears to have no substantive basis.

3.4 Once a concern has been raised by an employee and an independent investigator has been appointed, a meeting may be arranged with them to determine how the concern should be taken forward. This may involve an internal inquiry or a formal investigation.

3.5 If a meeting is arranged, the employee may be accompanied by a colleague who is not involved in the area of work to which the concern relates if they wish. If the employee prefers, the meeting can be conducted over the telephone rather than face to face.

3.6 Where a concern has been raised which suggests inappropriate conduct involving a board member. In these circumstances the Whistleblowing Champion may seek advice from the Internal Audit team on how the investigation should proceed.

3.7 A decision will be made on whether the concern should be investigated internally under this policy or the Grievance, Disciplinary or another policy, as appropriate. It may also be decided that the matter should:

• be referred to Human Resources, and/or
• be referred to the Police, and/or
• be referred to the external auditor, and/or
• be the subject of an independent inquiry; or
• have no further action taken.

3.8 Some concerns may be resolved by agreed action without the need for formal investigation. If urgent action is required, this may be taken before any investigation is conducted.

3.9 The Bank may decide that no further action will be taken under this policy in the following (not exhaustive) set of circumstances:

• if, after investigation, there is no evidence that inappropriate conduct within the meaning of this policy has occurred, is occurring or is likely to occur;
• if the matter concerned is already the subject of other proceedings, or has already been referred to Human Resources.

3.10 The nominated investigator will aim to update the employee on the progress of the concern within 28 days of it being raised, where possible. However, in the event of a formal investigation or the involvement of third parties, the whistleblower will receive sufficient information about the outcome of any investigation to enable them to be informed that the concern is being dealt with.

3.11 Once the investigation has concluded, the individual will receive an explanation about how the matter has been addressed. If there are any constraints the whistleblower will receive sufficient information about the outcome of any investigation to enable them to be informed that the concern has been dealt with. If no further action is proposed the will inform the reasons for this in writing to the individual who has raised the concern.

3.12 If the investigation is not completed within three months or in the time originally estimated for the investigation, the nominated investigator will provide regular updates as agreed with the individual.

3.13 Throughout any investigation, the employee will still be expected to continue their duties/role as normal unless deemed inappropriate.

4. Scope
The Policy applies to all Directors, officers and employees of RBL, and to temporary workers, consultants, contractors and agents acting for, or on behalf of, RBL (“associated persons”) within the USA and overseas as well as third parties. All employees and associated persons are responsible for maintaining the highest standards of business conduct and required to familiarise themselves and comply with this Policy. This includes any future updates that may be issued from time to time by RBL.

5. Review and Approval governance
The Policy will be reviewed by the Compliance Team on an annual basis, and when any impacting event, such as regulatory changes or new guidance, takes place. Any material amendments will be submitted for approval via the Risk and Compliance Committee, Executive Committee and Audit, Risk and Compliance Committee and the Board.