Whistleblowing Procedure at Bulgarian Development Bank Group

Section I. 
Introduction

The Group of Bulgarian Development Bank (the Bank and its subsidiaries) is aware of the negative effect that misconduct, malpractice or wrongdoing (hereafter referred to as "irregularities") may have on its business and encourages you to raise any concerns or specific suspicions you may have about irregularities. 
The companies of BDB Group are committed to creating and maintaining a culture of openness within their organisation so that people feel encouraged and confident to raise concerns about suspected wrongdoing at an early stage.
This Whistleblowing Procedure is intended to create an internal safe mechanism for raising concerns within the material scope described in Section III below, while providing balanced and effective protection for whistleblowers.
The whistleblowing procedure is an element of the corruption prevention system implemented in BDB Group.
This Procedure applies to employees, members of management and supervisory bodies of the BDB Group of companies and third parties with whom the BDB Group of companies enter into business relationships.

Section II.
Definitions

Except where otherwise indicated in the text, the terms used in this Procedure shall have the following meanings:
Affected person refers to the natural or legal person who is identified in the alert and in the report of the person responsible for whistleblowing as the perpetrator who caused or is associated with the irregularity.
Responsible person refers to a competent person within the Bank to whom the whistleblower sends the relevant alert.
Alert refers to any concern raised by the whistleblower within the material scope of this Procedure and as described below.
Sender of whistleblowing report or Reporting Person refers to an individual who makes a report and who must be protected under the rules of this Procedure.
Whistle Officer (person responsible for receiving whistleblowing reports) refers to an independent, self-employed individual who is designated to assist the Reporting Person in the whistleblowing process, who represents that he or she is not related to any other officer, member of any corporate body, such as a board of directors, management or supervisory board, and who has agreed to handle all whistleblowing issues in accordance with the rules of this Procedure. The person responsible for receiving whistleblowing reports is external to the Group.
Third Party - a joint venture, partner, agent, consultant, contractor, supplier, intermediary and other third parties performing similar functions.
Internal whistleblowing means the verbal or written communication of information about wrongdoing within an entity (the Bank);
External whistleblowing means reporting information about violations orally or in writing to the competent authorities;
Public disclosure or to be publicly disclosed means to make information about violations public;
Whistleblower means an individual who blows the whistle or publicly discloses information about violations received in the context of his or her work-related activities
Retaliatory action means any direct or indirect act or omission that occurs in a working context, is caused by an internal or external whistleblowing or public disclosure, and that causes or is likely to cause unjustified harm to the whistleblower.

Section III.
Material scope

This Procedure provides protection to whistleblowers who report potential violations in the following areas:
3.1. Rules for the activities of approval and control of administrative expenses and/or selection of external suppliers of goods and services;
3.2. Marketing and use of sensitive and hazardous products;
3.3. Environmental protection;
3.4. Consumer rights and protection;
3.5. The protection of privacy, confidentiality, personal data and the security of network and information systems;
3.6. The prevention of money laundering and terrorist financing;
3.7. Competition and State aid rules, and in respect of acts that breach corporation tax rules or arrangements designed to obtain a tax advantage that defeats the object or purpose of the applicable corporation tax legislation;
3.8. Financial malpractice, corruption, fraud and concealment;
3.9. Failure to comply with legal obligations;
3.10. Serious ethical violations;
3.11. Product safety and compliance;
3.12. Protection of public health;
3.13. Acts or circumstances which the whistleblower believes constitute a material breach of the Bank's internal rules or the law and have come to his or her attention in the context of his or her work-related activities

Section IV. 
Protection and confidentiality

4.1. Employees of BDB Group shall be protected against dismissal or sanction for making a report disclosing information which, in the reasonable belief of that employee, is in the best interests of the Group and exhibits the characteristics set out in this Whistleblowing Procedure. No whistleblower will suffer any detriment or adverse treatment by the Group company acting as the employer because of the whistleblowing. Protection is provided against retaliatory actions taken not only directly against the whistleblower themselves, but also against such actions that may be taken indirectly, including against the whistleblower's associates, colleagues or relatives. Protection shall also be afforded to any other natural person who blows the whistle on a violation of which he becomes aware in connection with his/her professional or economic activity. Protection shall also be granted to a candidate for employment who has participated in a competition or other form of selection for employment and received it, in that capacity, as well as to persons who are not employees within the meaning of the Labour Code (LC): shareholders or partners, members of a management or supervisory body, and other persons having that capacity.
4.2 Any reporting person who has submitted information concerning irregularities falling within the material scope of this Procedure shall qualify for protection provided that:
4.2.1. the person had reasonable grounds to believe that the information reported was true at the time of reporting, 
4.2.2.. the information falls within the scope of this Procedure, and
4.2.3.. the report was made by one of the means/channels provided for in this Procedure.
4.3. Whistleblowers who report in accordance with this Procedure are protected from retaliation as follows:
4.3.1. suspension, discharge, dismissal, or other grounds for termination of the employment relationship under which that person performs dependent work;
4.3.2. demotion, delay in promotion or other career advancement;
4.3.3. a change in job description, in assigned duties, a change in job location, a reduction in pay, or a change in hours of work;
4.3.4. coercion, intimidation, harassment or isolation;
4.3.5. discrimination, unequal or unfair treatment;
4.3.6. denial of the opportunity to move from a fixed-term contract to a permanent contract where the employee had a legitimate expectation of being offered permanent employment;
4.3.7. non-renewal or early termination of a fixed-term contract;
h. pecuniary damage in the form of loss of earnings, loss of profits or any other pecuniary damage related thereto;
4.3.8. non-pecuniary damage, including damage to a person's reputation, through social media posts or otherwise;
4.3.8. inclusion on a list drawn up on the basis of a formal or informal agreement in a sector or industry which may result in the person being unable to take up employment or being unable to supply goods or service in that sector or industry (blacklisting);
4.3.9. early termination or cancellation of a contract for the supply of goods or services;
4.4. Protection is not granted where the information contained in the alert is publicly available.
4.5. Whistleblowers who submit an alert in accordance with this Procedure shall not be deemed to have violated the restrictions on disclosure of bank secrecy and shall not be liable in any manner with respect to such alerts, provided that they have reasonable grounds to believe that the alert or the disclosure of such information is necessary for the discovery of wrongdoing in accordance with this Procedure.
4.6. Reporting Persons shall not be liable in respect of the acquisition of or access to relevant information, provided that the acquisition or access does not constitute an independent offence. In the latter case, criminal liability shall be governed by applicable national law.
4.7. Any other possible liability of the reporting persons arising from acts or omissions not related to the reporting or not necessary for the detection of an irregularity or breach in accordance with this Procedure shall remain governed by Bulgarian law.
4.8. Alerts will be treated in a confidential and sensitive manner and all related material will be securely stored. Information obtained in handling an alert will be considered confidential, with limited access by persons relevant to the investigation. The identity of whistleblowers will be kept confidential to the extent that it does not hinder or impede the investigation. In such cases, the person responsible is obliged to inform the whistleblower before taking any further action that might involve breaching the original confidentiality. However, it should be noted that, if necessary, the identity of the whistleblower may be disclosed during the investigation and such person may have to testify as part of the required evidence.
4.9. In the case of whistleblowing made through the Bank's record-keeping office, the alert shall be forwarded to the Whistle Officer.
4.10. The identity of the person concerned shall also be kept confidential. The affected person has the right to remedy, including the right of access to the file, the right to be heard and the right to seek an effective remedy. 

Section V.
Anonymous and unfounded allegations

5.1. Persons making a report in accordance with this Whistleblowing Procedure are encouraged to identify themselves.
5.2. Anonymous reports may not be processed under this Procedure.
5.3. Notwithstanding the rule in 5.2, in cases where information is provided by a Group employee through the Whistleblowing Procedure, if the Whistle Officer considers it appropriate, the information may be provided anonymously to the Managing Body and other responsible functions. This should be done in accordance with the Whistleblowing Action Protocol. 
5.4. If a person discloses information under this Whistleblowing Procedure which he or she believes to constitute misconduct, malpractice, wrongdoing or a danger to the public interest, but which action is not confirmed by the investigation conducted, no adverse or disciplinary action will be taken against the person.
5.5. If it is proved beyond reasonable doubt that the reporting person has made malicious or unfounded allegations in pursuit of personal gain, action may be taken against the person under the appropriate disciplinary or other applicable procedure. However, the reporting person's actions shall be deemed to have been taken in good faith until proven otherwise by proper evidence.

Section VI.
Procedure

6.1. Whistleblowing should be done at the earliest opportunity.
6.2. The alert must state that it is being submitted under this Whistleblowing Procedure and identify the issue set out in the material scope of Section III.
6.3. The alert must contain as much detail as possible regarding the issues raised, including, where applicable, the names of persons, events, places and dates.
6.4. If one or more persons wish to submit a report concerning matters within the material scope of Section III, each person must submit his or her own report, and such persons need not discuss the matter further among themselves. Joint alerts may result in controversy, confusion, or misinterpreted information.
6.5 Whistleblowing reports should be submitted in writing only and addressed to the Whistle Officer at e-mail address: signals@bdbank.bg or at the Bank's record-keeping office located at: 1000 Sofia, 1 Dyakon Ignatiy Str. Employees of the BDB Group of companies may submit a report through a specially placed whistleblower mailbox located on the fourth floor of the Bank's head office. The key to the box is kept by the Head of Compliance Division, who is required to check it on a weekly basis. Alerts received at the record-keeping office shall be placed in a sealed envelope bearing an incoming number and handed over to the Head of Compliance. In turn, the Head of Compliance shall forward as soon as possible the alerts received at the record-keeping office and in the mailbox to the Whistle Officer in the form in which they were received, sealed.
6.6. The Whistle Officer shall record each alert received under the preceding Article in an electronic Register of Whistleblowing Reports at BDB Group (Annex 1). Each alert shall be assigned a unique identification number and shall be recorded in the order of its receipt. BDB Group’s Register of Whistleblowing Reports shall be kept independently - outside the clerical record of all documents at BDB Group. The confidentiality of the identity of the whistleblower shall be maintained by replacing his/her personal details with an identification number. The identification number is given by the person receiving the alert and is unique. The reception and processing of the alert shall be carried out by the identification number and not by the personal data of the alerting person. 
6.7. The Whistle Officer shall, as soon as possible but no later than seven days after receipt of the alert, send an acknowledgement of receipt of the whistleblowing report, together with details of the unique ID number, to the person who has submitted the report. Within the same time limit, he/she shall forward the alert received to the person responsible.
6.8. The functions of the Whistle Officer are related to the receipt of whistleblowing reports and their forwarding to the relevant responsible person at the Bank for consideration, subject to the Action Protocol in such cases.
6.9. Upon receipt of a whistleblowing report forwarded to him/her, the relevant Responsible Person shall review the information contained therein and make a determination as to the compliance of the alert with the scope of this Whistleblowing Procedure. If the alert is found to fall within the scope of this Whistleblowing Procedure within three working days of receipt by the whistleblowing report, the responsible person shall forward the information to the persons specified in the Action Protocol.
6.10. If the alert is found not to meet the criteria set out in this Whistleblowing Procedure and/or is otherwise without merit, the Responsible Person shall send a reasoned response to the person refusing to consider the alert.
6.11. Where it is determined that the alert falls within the scope of another BDB Group’s company policy or procedure, the responsible person shall forward the alert to the appropriate manager for action in accordance with the applicable BDB Group policy or procedure.
6.12. Where the alert meets the criteria set out in this Whistleblowing Procedure, the Responsible Person shall take any of the following actions:
    6.12.1. Suggests the appointment of an internal person of the Bank to verify the data contained in the alert;
    6.12.2. Suggests the appointment of a person external to the Bank to verify the data contained in the alert; or
    6.12.3. Forwards the alert for external investigation, following a decision of a competent authority (BoD, MB, SB, SOC) - e.g. police, prosecutor's office, NRA, PFIA, etc.
    6.12.4. The competent authority may request additional clarifications, evidence, documents, etc. related to the alert.
6.13. Where the report of suspected misconduct or illegal activity concerns actions/inactions of a senior administrative official, the responsible person shall forward the report to the next level in the Group's hierarchy - Board of Directors, Management Board, Supervisory Board or Sole Owner of the Capital. The Audit Committee addresses all matters relating to financial and accounting practices, internal controls and audit.
6.14. The whistleblower may be required to attend additional meetings in order to provide further information that would be of help in the making of an initial assessment.
6.15. Where the matter contained in a report accepted under Article 6.12.1 or Article 6.12.2 is to be dealt with within the Bank, the person conducting the investigation shall be designated by order of the Board of Directors, with a domain other than the division/department in which the violation or malpractice is alleged to have occurred. The verifier will not be involved in any decisions made in response to the findings of the investigation. He/she will independently determine the scope of the investigation and will be supported by an appropriate team, if necessary. Following a decision by the competent authority, the results of the investigation will be communicated to the whistleblower by the Whistle Officer.
6.16. Alerts will be investigated as thoroughly and promptly as possible. Where possible, the investigation should be completed within 30 working days.
6.17. All issues raised in a whistleblowing report are treated fairly and responsibly.
6.18. Formal written records are kept at each stage of the whistleblowing process.
6.19. Upon completion of the verification (whether carried out by the Bank's internal or external verifiers), a written report is prepared and submitted to the Responsible Person. In accordance with the findings of the report, the responsible person shall prepare a reasoned proposal to the relevant managing bodies of BDB Group for a decision on the facts and circumstances found.
6.20. Within a period not exceeding 45 business days from receipt of confirmation of the submission of the alert, or within 7 days from receipt of the verification report in cases where no confirmation has been sent, the responsible person shall inform the person who submitted the alert of the decision of the relevant authorities of BDB Group on the results of the verification and the follow-up action taken or refused.
6.21. The whistleblower may not request a review of the decision made, except in cases where there has been a failure to follow policies or procedures, or there is evidence of bias or prejudice in the handling of the alert, or there is other evidence of misconduct that was not available at the time of the original whistleblowing. The request must be submitted to the Chair of the Audit Committee, with a copy to the Chair of the Supervisory Board (if the whistleblowing is not directed against the Chair). On review, the Chair of the Audit Committee may uphold the decision not to take further action or overrule it, specifying the action to be taken. The decision of the Chair of the Audit Committee is final. The decision shall be sent to the person who submitted the alert.
6.22.  The Whistle Officer shall establish and maintain a register of the whistleblowing reports received, a separate file for each alert with details of the whistleblower, all incoming and outgoing correspondence, the decision of the Competent Authority and any other data relating to the alert. All information received in electronic and/or paper format shall be kept for a period of 5 years from the sending of the final reply to the alert.
6.23. The Whistle Officer shall submit by the 5th day of the month following the reporting quarter, summarized statistical information on the alerts received during the quarter to the Compliance Department, including number, type of alert, alerts rejected, alerts referred to other authorities. The results shall be reported to the MB/SB.

Transitional and Final Provisions

§1. This Whistleblowing Procedure at the Group of Bulgarian Development Bank EAD supersedes the existing Rules and Procedures for the handling of whistleblowing reports by employees in the Group of Bulgarian Development Bank , as of the date of its adoption.
§2. This Whistleblowing Procedure at BDB Group was adopted by the Decision of the Management Board of Bulgarian Development Bank under Minutes No. 30/31.03.2022 and the Decision of the Supervisory Board under Minutes No. 15/01.04.2022.