Plan for the Prevention of Corruption Risks and Related Infringements

Contents

1. Overview, Purpose and Scope

2. Organisational Structure

3. FinTrU Risk Framework

4. Mitigating Factors and Compliance to RPP

5. Employee Non-Adherence

6. Monitoring of RPP 

APPENDIX 1 – Risk Classification

APPENDIX 2 – Legal Regulations

APPENDIX 3 – Requirements That May Result in Disciplinary Action if Not Followed, as Stipulated in Article 128, No 1 of the Portuguese Labour Code

Overview, Purpose and Scope

Corruption and related infringements might occur within a wide range of situations, with consequences that bear a detrimental effect on economic development, political systems, justice, and public confidence in the functioning of society.

Alongside guidelines and recommendations on preventing and fighting corruption issued by international organisations such as the United Nations, the OECD or Transparency International, there are other applicable legal regulations, such as the UK’s Bribery Act.

In Portugal, following the publication of Decree-Law 109-E/2021, which creates the National Anti-Corruption Mechanism (“MENAC”) and approves the General Regime for the Prevention of Corruption (“RGPC”), corruption risks and related infringements prevention now has a specific legal framework within the Portuguese legal system.

FinTrU Limited (“FinTrU”) is an organisation that adheres to strict rules concerning conduct ethics in all its global locations. We are committed to identifying, preventing, and controlling all corruption and related risks. This commitment extends to all FinTrU employees, interns, contractors, suppliers and third parties with whom FinTrU engage in all the global locations in which it operates.

FinTrU is a multi-award-winning company providing regulatory technology and service solutions for our clients, primarily Tier 1 investment banks. It has a zero-tolerance approach to any signs of corruption or bribery as laid out in its Code of Ethics and Conduct and internal policies. FinTrU is guided by principles of transparency, integrity, honesty, and accuracy and has a risk framework that ensures that rules of professional conduct are observed by all our staff and stakeholders.

This document describes FinTrU’s Risk Prevention Plan (“RPP” or “Plan”), which identifies the risks of corruption and related infringements connected with each department/area of activity, and the measures to prevent/mitigate their occurrence, procedures for updating, monitoring and defining those responsible for supervision. The RPP covers the entire organisation and activities of FinTrU Limited, and compliance is mandatory.

The purpose of this Plan is to implement FinTrU’s commitment to proactively fight and prevent all forms of corruption, by defining principles and guidelines for preventing these practices. The RPP further develops and embodies the principles and rules of conduct established by FinTrU, in its Code of Ethics and Conduct, its Policies and its Compliance Framework which are internal regulations that bind all employees regardless of their function, relationship or place of work.  The RPP applies to all employees of FinTrU Group, regardless of their employment relationship. This Plan also applies to the various stakeholders who are directly or indirectly involved in the activities of FinTrU.

1.1 Definitions

Corruption is understood as the abuse of a power or function to benefit a third party, against the payment of a sum or other type of advantage.

The crime of corruption always implies the combination of four elements:

• An action or omission.
• The commission of a lawful or unlawful act.
• Return for an undue advantage.
• Benefiting him or herself or a third party appointed by him or her.

The following are considered acts of corruption:

• The promise, offering or giving, directly or indirectly, of an undue advantage of a pecuniary or nonpecuniary nature to a person in order that he/she performs or refrains from performing an act in the exercise of his/her functions.
• The solicitation or acceptance, directly or indirectly, of an undue advantage of a pecuniary or nonpecuniary nature by a person for him/her to perform or refrain from performing an act in the exercise of his/her functions.

A bribe is the offer, promise, gift, acceptance, or request of an advantage as an inducement for an action that is illegal, ethically incorrect or a breach of trust. These types of incentives can take the form of gifts, loans, fees, rewards, or other benefits.

Trading in influence is the behaviour of anyone who, by him or herself or through an intermediary, with his or her consent or ratification, solicits or accepts, for him or herself or for a third party, a pecuniary or nonpecuniary advantage, or the promise thereof, in order to abuse his/her influence, be it real or alleged, with any public entity.

Facilitation payment refers to a payment or any other compensation promised or offered to a public official, intended to secure the performance, or hasten a course of action which that public official had a legal duty to perform.

FinTrU defines improper conduct as that which, in addition to others, incorporates the following behaviours:

• Offering, promising, giving, asking, agreeing to receive, or accepting a bribe, including facilitating a payment.
• Offering or receiving gifts that could affect future or existing business.
• Donating or extending sponsorship as a way of obtaining or keeping an illicit advantage for the benefit of the company itself or one of its employees.
• Establish or keep business relationships with the different stakeholders of the FinTrU whilst being aware that they do not comply with the principles and rules contained in the FinTrU 's Code of Ethics and Conduct.
• Intervene in the assessment and business decision-making, on the professional situation of employees and on procedures for the acquisition of goods and services, where there is a risk of conflicts of interest or of conducting activities that may lead to such conflicts.
• Supplying any kind of monetary or financial support to political parties or related entities.

The criminal sanctions associated with acts of corruption and related offences are, in addition to those provided for in the Portuguese Penal Code, namely for the crimes of:

• Active corruption
• Passive corruption
• Undue receipt of an advantage
• Embezzlement
• Economic participation in business
• Concussion
• Abuse of power
• Prevarication
• Influence peddling and money laundering, those provided for in the legal regime for ‘Antieconomic Offences and Offences against Public Health’ for the crimes of fraud in obtaining a subsidy or grant, embezzlement of a subsidy, grant or credit and fraud in obtaining credit, and also those provided for in the ‘Criminal Regime for Corruption in International Trade and the Private Sector’ for the crimes of active corruption to the detriment of international trade, passive corruption in the private sector and active corruption in the private sector

2. Organisational Structure

FinTrU Limited – Sucursal em Portugal

3. FinTrU Risk Framework (Risk Prevention Plan)

3.1 Introduction

This Plan adheres to the terms set forth by the MENAC legislation and the resulting article 3 of the GRPC – Corruption and Related Offences. It encompasses the entire organisation and all activities of FinTrU, including management, administration, commercial, operations and support functions.

Whilst the Risk Framework looks at all risks FinTrU may be susceptible too, it also identifies, analyses, and classifies the risks and situations that could expose FinTrU to acts of corruption and related offenses. It covers risks associated with executive and managerial responsibilities, considering both the sector and the geographical areas in which we operate.

Moreover, it includes preventive and corrective measures designed to reduce the likelihood of these risks occurring, as well as mitigating the impact should they occur.

3.2   Responsibility for the Execution, Control and Revision of the Plan

FinTrU has appointed Roland Shaw to the position of Regulatory Compliance Officer. The Regulatory Compliance Officer has overall responsibility for the execution, control, and review of this plan.  The Regulatory Compliance Officer is Head of the Risk and Compliance Team with a dedicated Compliance Manager and Risk Manager supporting the position of Regulatory Compliance Officer and the maintenance and implementation of this Plan. The Regulatory Compliance Officer is responsible for the oversight of the company risk and compliance framework including oversight and maintenance of relevant policies, training and awareness, data privacy and internal controls.

The monitoring of this Plan is ensured through documentation, periodic review of controls and the implementation and recording of evidence of their execution.  The monitoring is accompanied by reports on the implementation and development of relevant initiatives as well as the consolidation and internal reporting of information on the Plan’s implementation progress. It particularly covers the analysis of risks, the implementation of controls, reporting of situations of noncompliance that have occurred, the results of assessments and audits of the Plan implementation carried out by the Risk and Internal Controls and Compliance department.

Furthermore, the Regulatory Compliance Officer ensures the dissemination of the RPP to all employees by way of initial reporting to ExCo and uploading the plan onto the FinTrU intranet and external internet pages.

3.3   Identifying, Analysing and Classifying Risks

3.3.1 Introduction

Within the scope of its risk management and internal control systems, FinTrU has a set of mechanisms and procedures aimed at preventing, detecting and/or mitigating the possible effects of the risks to which it is exposed.  The Plan for the Prevention of Corruption Risks and Related Infractions is part of the Risk Framework within FinTrU which includes among others the risks of bribery and corruption.

The Risk Framework embodies the following main activities.

3.3.2 Risk Identification and Assessment

FinTrU’s Risk Prevention Plan seeks to ensure that all risks related to bribery and corruption faced by FinTrU are effectively identified, assessed, mitigated and monitored.  The goal is to safeguard FinTrU’s assets, reputation, and strategic objectives by implementing a structured risk management process. It applies to all employees including contractors and interns, departments, and operations in all jurisdictions across FinTrU. It includes all strategic, operational, financial, legal, regulatory, and environmental risks that may affect the company.

All employees, contractors, and interns throughout FinTrU need to have an appropriate level of awareness of the requirements of FinTrU’s Risk Framework as it relates to their role and supports its adoption and integration into the way risk is managed.

Risks are identified and assessed in the following manner.

Risk Identification and Assessment:

• The FinTrU risk taxonomy is used as a guide to identify the potential risks that could arise from Anti Bribery and Corruption. The FinTrU Risk Taxonomy is a dictionary of all risks which can arise in the nature of work which is carried out and includes all know risks which are present across our industry as well as horizon scanning for new risks.  All of these risks are independently evaluated for Anti Bribery and Corruption.
• Each risk is considered for causes and is evaluated using the probability and impact tables as well as risk appetite statements.
• Determine the causes within these risks which may increase the likelihood of them occurring.
• Assess the likelihood and impact of each risk occurring.
• Quantify an Inherent risk position.

Manage and Mitigate

• Review the controls in place to mitigate the causes and risks identified:
  • Preventative Measures – controls which will prevent the risk happening.
  • Detective Measures – systems and processes to detect risk early.
• Assess any causes which do not have controls in place to mitigate and create an action plan to address.
• Quantify a residual risk position.
• Agree acceptance or non-acceptance of the risk using pre-determined Risk Appetite Statements.

Monitor

• All Risks will be held on a Risk Register in each Business Area.
• Ongoing monitoring of the risk register through key risk indicators, horizon scanning and incidents. Risks will be reassessed on an annual basis.
• When anything happens which may impact our risks a reassessment will take place.

Report

• Reporting of the risk profile, emerging themes, current issues and other key information to inform decision making. Reporting to stakeholders ensures transparency and accountability.

The risks considered within FinTrU’s Risk Taxonomy which have been identified relating to corruption and related offences are detailed below:

• Vendor /Third Party Management Risk
• Regulatory Compliance Risk
• Client Contract Risk
• Information and Cybersecurity
• People and Employee Relations Risk
• Client Account Management Risk
• Anti Bribery and Corruption Risk

(See Appendix 1 for classification of these risks)

Probability and Impact Tables

During facilitated risk assessments FinTrU measure the potential exposure of the risks that have been identified and the likelihood of them occurring within the next 12 months.  Impacts must be assessed against four impact sections: Client, Regulatory, Reputational and Financial with Major, Significant, Important and Minor being the impact categories.

Likelihood is an expression of the possibility of the risk occurring in the next 12 months, with each risk being assigned to one of four quantitative probability categories: Unlikely, Possible, Likely, or Almost Certain.

Unlikely - <10% - Would require highly unusual circumstances for the risk to occur at the impact assessed within the next 12 months.

Possible – 10-49% - There are circumstances where the risk could occur at the impact assessed within the next 12 months.

Likely – 50-75% - Circumstances where the risk could occur at the impact assessed within the next 12 months can be readily envisaged.

Almost Certain - >75% - It seems very likely that the risk will occur at the impact assessed within the next 12 months.

FinTrU’s Risk Appetite statement for Anti Bribery and Corruption Risk is as follows:

FinTrU maintains a Low-risk appetite for Anti-Bribery and Corruption (ABC) Risk, prioritising adherence to all relevant laws and regulations to safeguard our reputation and operational integrity. We have Zero tolerance for bribery and corruption that could result in significant legal penalties or reputational damage, aiming for 100% compliance with all anti-bribery and corruption requirements. Low tolerance is set for moderate ABC issues, with a target of resolving 95% of such incidents within 24 hours. Medium tolerance applies to minor ABC challenges, ensuring that 90% of identified issues are addressed within one week. This structured approach ensures we uphold the highest standards of ethical business practices, fostering trust and reliability.

If any risk relating to Anti Bribery and Corruption falls outside of FinTrU’s Risk Appetite, immediate corrective measure will be taken.

Preventative and Corrective Measures

FinTrU undertakes to implement the Risk Prevention Plan through the adoption of preventative and correctives measures according to the level of risk of the various situations with the aim of preventing or eliminating their possible occurrence.  In the event of high-risk situations (Major and Almost Certain) more exhaustive preventative measure are put in place and given a priority status. See Appendix 1 for further details.

4. Mitigating Factors and Compliance with RPP

Code of Conduct

FinTrU’s Code of Conduct sets forth the core principles applicable to FinTrU activities in all jurisdictions. The Code of Conduct is applicable to all employees in FinTrU.

Whistleblowing Channel

FinTrU’s Whistleblowing Policy outlines the guidance for all staff. This independent reporting service provides a medium for all current and former employees and third parties to report, anonymously if they wish, any concerns about FinTrU or the way we do business.

Training Programme

FinTrU has an extensive mandatory compliance training programme throughout the time an employee is with the company. FinTrU has recently collaborated with a new training provider who will be providing bespoke anti-bribery and corruption and related regulatory-based training. Training will include risk management as it relates to anti-bribery and corruption and related offenses, FinTrU’s Code Conduct and the operation of the FinTrU Whistleblowing Policy, including rights associated with whistleblowing protection.

Mandatory training will also be provided for the following areas:

• Anti-Fraud
• Conflicts of Interest
• Password Security
• Phishing
• Data Protection
• Information Security
• Outside Business Interests
• Personal Trading Accounts
• Risk management

This essential training is a crucial component of our commitment to maintaining the highest standards of ethical behaviour and regulatory adherence within our organisation. Completion of training is mandatory for all employees, which ensures that everybody is equipped with the knowledge and tools necessary to uphold our shared values and legal responsibilities.  Furthermore, at employee induction every member of staff is provided with training relating to Anti-Bribery and Corruption.

Responsibility for ensuring the delivery and completion of training rests with the Risk & Compliance Manager, reporting directly to the Regulatory Compliance Officer.

5. Employee Non-Adherence

At FinTrU, employees who fail to comply with the RPP and FinTrU’s internal Anti-Bribery and Corruption (ABC) policies and Compliance Programmes may face a range of disciplinary measures and sanctions. These can include verbal or written warnings, suspension, demotion, or even termination, depending on the severity of the non-compliance. Additionally, FinTrU may conduct internal investigations and, if necessary, report the misconduct to relevant authorities. The company emphasizes a culture of integrity and transparency, ensuring that all employees are aware of the consequences of violating the ABC policy.

6. Monitoring of the Risk Prevention Plan

The prevention of corruption risks and related infringements applies to all FinTrU’s employees in the exercise of their duties and powers, in accordance with the established internal rules and policies. It is the responsibility of everyone in charge of each FinTrU business area to ensure that their teams are aware of the RPP and act in strict compliance with it. To this end, FinTrU provides all employees with training on the prevention of corruption and related infringements.

The Compliance Department monitors the implementation of this Plan. FinTrU’s Risk Manager and Compliance Manager assume the responsibility for implementing, monitoring, and reviewing this Plan. The monitoring of this Plan is ensured through documentation, periodic review of controls, and the implementation and recording of evidence of their execution.

It particularly covers the analysis of relevant risks; the implementation of controls; reporting of situations of noncompliance that have occurred; the results of assessments and audits of the Plan implementation carried out by the Risk and Internal Control Department or by an external entity.

FinTrU’s General Counsel and Regulatory Compliance Officer presents to the Executive Committee of FinTrU on the assessment and implementation of the Plan in relation to the previous year.

This RPP is reviewed every year, whenever there is a change in FinTrU’s duties or corporate structure, or when there are applicable legislative changes.

APPENDIX 1 – ABC Risk Assessment Results

APPENDIX 2 – Legal Regulations