Regulations of the Compliance Unit

Rules for the independent and effective functioning of the Compliance Unit

Regulations of the Compliance Unit

25 March 2025

TITLE I. NATURE AND OBJECT

Article 1. Nature and Object

The Compliance Unit (the “Unit”) of IBERDROLA, S.A. (the “Company”) is a collective permanent and internal body, configured in accordance with the highest standards of independence and transparency, and linked to the Sustainable Development Committee.
The Unit is the body of the Company responsible for proactively and autonomously ensuring the implementation and effectiveness of the Company’s compliance system (the “Compliance System”), configured in accordance with the provisions of its Governance and Sustainability System, for which purpose it is vested with the broadest powers, budgetary autonomy and independence of action, all without prejudice to the responsibilities of other bodies and divisions of the Company.

The Compliance System is made up of all rules, formal procedures and material actions −including the Company’s crime prevention programme and its internal reporting and whistleblower protection system (described in Title VII below, the “Internal Reporting System”)− that are intended to ensure that the Company acts in accordance with ethical principles, the law and internal rules, particularly the Governance and Sustainability System, to contribute to the full realisation of the Purpose and Values of the Iberdrola Group and the corporate interest and the achievement of the Ethical and Basic Principles of Governance and Sustainability of the Iberdrola Group, and to prevent, manage and mitigate the risk of regulatory and ethical breaches that may be committed by the directors, professionals, or suppliers thereof within the organisation.
The Unit shall be governed by the provisions of these Regulations of the Compliance Unit (the “Regulations”) and the other rules forming part of the Company’s Governance and Sustainability System, as well as by any other applicable internal rules.
The establishment of the Unit should be understood to be without prejudice to the existence at the Group’s country subholding companies and head of business or country companies of their own compliance unit (collectively, the “Compliance Units of the Subsidiaries”) (as well as the existence at other companies forming part of the Group of their own compliance unit or function), which are particularly responsible for proactively and autonomously ensuring the implementation and effectiveness of the compliance system of their respective company, which includes, among other rules and procedures, their own programme for the prevention of crimes.
For the purposes of the provisions of these Regulations, “Group” shall mean the Company and the companies comprising it, of which the Company is the controlling company within the meaning established by law.

TITLE II. COMPOSITION

Article 2. Composition and Positions

The Unit shall be made up of the following persons, appointed for an indefinite term by the Board of Directors, at the proposal of the Sustainable Development Committee and following a report from the Company’s Appointments Committee, who shall hold the positions indicated below:
1. the chair of the Unit, a position held by a professional external to the Group’s companies, who shall be an expert of recognised prestige in compliance matters;
2. the members of the Unit, one of whom shall be the chief compliance officer of the Company (the “Director of Compliance”), and others who may include the heads of various areas or functions related to risk management in the area of regulatory compliance; and
3. the (non-member) secretary of the Unit, who shall be a professional external to the Group’s companies.
Pursuant to the provisions of the Governance and Sustainability System, particularly with respect to the decentralisation of the effective management of the businesses and the corresponding individualisation and separation of responsibilities arising therefrom for each of the companies of the Group, those persons who are members of the Compliance Units of the Subsidiaries may not form part of the Unit.

The directors of the Company may also not be members of the Unit.
The members of the Unit shall act with independence of judgement in the performance of their duties, shall have multidisciplinary profiles and must have the knowledge, skills and experience appropriate to the powers vested therein.
The Sustainable Development Committee, on its own initiative or upon a proposal of the Unit, may propose to the Board of Directors the appointment of new members of this body, considering the profiles that may be appropriate for the performance of the duties thereof based on the Company’s activities.
The secretary of the Unit shall have the following main duties: (i) preparing the minutes of meetings of the Unit; (ii) certifying the resolutions and decisions thereof; (iii) ensuring the formal and substantive legality of its activities and conformance thereof to the internal rules, and particularly to the Governance and Sustainability System; and (iv) generally channelling the relations of the Unit with its members (in all matters relating to the operation thereof, in compliance with the instructions of its chair and under the supervision thereof), and providing the support necessary for the proper operation of the Unit and the conduct of its meetings.

Article 3. Director of Compliance

The Director of Compliance shall manage the operation of the Unit and its budget and shall be responsible for carrying out the corresponding measures and action plans and ensuring that the Unit proactively and autonomously complies with its duties, regularly reporting thereto on the performance of said activities, and shall perform such other duties as are assigned thereto in the rules, and particularly in the Governance and Sustainability System.

TITLE III. POWERS AND COORDINATION IN THE COMPLIANCE AREA

Article 4. Powers regarding the Code of Conduct for Directors, Professionals and Suppliers

As regards the Code of Conduct for Directors, Professionals and Suppliers (the “Code of Conduct”) (excluding section B thereof regarding the directors of the Group’s companies), the Unit shall have the following main powers:
1. Ensure and coordinate the application of the Code of Conduct by the various companies of the Group.
2. Provide a binding interpretation of the Code of Conduct and resolve any questions or concerns raised with respect to the content or application thereof or compliance therewith, particularly with respect to the application of disciplinary measures by the competent bodies.
3. Promote the approval of rules needed to further develop the Code of Conduct and to prevent violations thereof, in collaboration with the various corporate divisions of the Company and on a coordinated basis with the Compliance Units of the Subsidiaries.
4. Approve behavioural procedures and protocols in order to ensure compliance with the Code of Conduct. These rules must in all cases be in accord with the provisions of the Company’s Governance and Sustainability System.
In order to promote the dissemination of the content of the Code of Conduct among the professionals of the Company, the Unit shall include training and internal communication activities in its annual activities plan.
1. Training initiatives shall be communicated to the division in charge of the human resources function for the coordination thereof, if appropriate, pursuant to the provisions of the general training activities plan.
2. Internal communication initiatives shall be communicated to the division in charge of this function for implementation, if appropriate, pursuant to the provisions of the corresponding communication plan.
The Unit shall be supported by the division in charge of the procurement function in the dissemination of the content of the Code of Conduct among the suppliers and other members of the supply chain.
Proposals for the external dissemination of the Code of Conduct among the other Stakeholders of the Company shall be sent by the Unit to the division in charge of the communication function for assessment thereof and possible inclusion in the communication plan at the Group level in accordance with the general priorities and objectives established in each case.
The Compliance Units of the Subsidiaries, in view of the general guidelines of the Unit, shall in turn promote the dissemination of the content of the Code of Conduct within their respective purview through the divisions in each case assuming the functions of human resources, procurement and communication. The Unit shall ensure that the dissemination thereof at the Group level follows general uniform standards, and in coordination with the Compliance Units of the Subsidiaries shall also endeavour to ensure that the particular features applicable in each country or territory and in the various businesses are taken into account.

Article 5. Powers regarding the Effectiveness of the Compliance System and relating to the Internal Reporting and Whistleblower Protection System

The Unit shall:
1. establish the basic elements of the structure and operation of the Company’s Compliance System, annually evaluate the effectiveness thereof, as well as the overall effectiveness of the compliance systems of the Group’s companies, in this latter case for purposes of preparing the report provided for in section 3 of Article 10;
2. report to the Sustainable Development Committee regarding significant matters relating to the effectiveness of the Compliance System; and
3. proactively monitor the application and effectiveness of the Compliance Policy and of the Internal Reporting and Whistleblower Protection System and the dissemination of the contents thereof among the people to whom it is addressed.
The Unit shall be the body responsible for the management of the Company’s Internal Reporting System, without prejudice to the delegation of such management to the Director of Compliance.

In this regard, the Unit shall be responsible for receiving grievances or reports sent through the Internal Reporting System in accordance with the provisions of Title VII of these Regulations, processing the corresponding case files, moving forward the procedures for verification and investigation of the grievances or reports received, and making the corresponding decisions in relation to the files processed.
The Unit shall endeavour to ensure the implementation of the protection measures provided for in the Company’s Compliance Policy and in the Compliance System and the Compliance and Internal Reporting and Whistleblower Protection System for the persons who submit grievances or reports through the Internal Reporting System and for the persons affected thereby.
The Unit shall also be responsible for establishing the tools required to ensure the recording and registration of the corresponding activities that make up the Compliance System.

Article 6. Powers regarding Crime Prevention

The Unit shall be responsible for drafting, approving, keeping permanently updated and endeavouring to ensure the application of the action and supervision protocols it deems necessary or appropriate for the prevention and detection of the risk of commission of criminal offences and, in general, of improprieties and acts that are illegal or contrary to law or the Governance and Sustainability System relating to or affecting the activities of the Company and that make up the crime prevention programme thereof.
In addition, the Unit shall:
1. at least once per year, evaluate the observance and effectiveness of the Company’s crime prevention programme and assess the appropriateness of modification and regular update thereof if the circumstances so require;
2. foster a preventive culture based on the principle of “zero tolerance” towards improper conduct and acts that are illegal or contrary to law or the Governance and Sustainability System and on the application of ethical principles and principles of responsible behaviour that should govern the conduct of the members of the management decision-making bodies and of the professionals of the Company and of the other companies of the Group, irrespective of their level, their geographic location or their functional subordination, as well as the conduct of the suppliers of all of them;
3. disseminate the contents of the Anti-Corruption and Anti-Fraud Policy and monitor the implementation of specific procedures to prevent any conduct that might be considered an act of corruption; and
4. promote the preparation and implementation of suitable training programmes for the professionals of the Group’s companies regarding crime prevention and the fight against corruption and fraud with sufficient frequency to ensure the refreshment of knowledge in these matters.

Article 7. Powers regarding the Securities Markets

The Unit is entrusted with the duty of ensuring compliance with the Internal Regulations for Conduct in the Securities Markets, performing the duties assigned thereto by such regulations.
It shall also have such other powers as are vested therein by the Internal Rules for the Processing of Inside Information.

Article 8. Powers regarding Separation of Activities

The Unit shall obtain from the compliance units of the country subholding companies all required information relating to their duty to ensure compliance with the legal provisions regarding the separation of regulated activities applicable in each jurisdiction.

Article 9. Other Powers

The Unit shall also be directly vested with such other powers, whether of a particular or permanent nature, that may be assigned thereto by the Sustainable Development Committee or the Board of Directors, or that are vested therein by applicable law and the internal rules of the Company, particularly the Governance and Sustainability System.

Article 10. Coordination in Compliance Matters

While respecting the purviews proper to the country subholding companies and head of business or country companies, the Unit shall establish the framework for relations of coordination, cooperation and information with the respective Compliance Units of the Subsidiaries and with the heads of the compliance function of the other companies of the Group in order to promote the highest ethical standards in the compliance area, particularly but not limited to issues relating to investigation procedures, the analysis and evaluation of criminal risks, the measures and controls implemented for the mitigation thereof, internal compliance rules, and the promotion of training plans.

In this regard, the Unit shall establish the appropriate mechanisms for coordination with the Compliance Units of the Subsidiaries in order to:
1. foster knowledge sharing and maximising the generation of synergies and the exploitation thereof among the compliance systems of the companies of the Group;
2. propose improvements and initiatives for the optimisation and responsible use of financial and human resources allocated to the compliance function;
3. monitor and systematise the compliance training plans or programmes of the Group’s companies; and
4. collaborate in the preparation of public compliance information that the Group’s companies disclose within their purviews.
In any case, the Unit shall establish the basic principles of structure and operation of the compliance systems of the Group’s companies as well as the main duties and responsibilities of the various bodies involved.

To this end, the Unit shall promote the exchange of best practices and the approval of general rules encouraging all companies of the Group to have homogeneous, solid, comprehensive and effective compliance systems that conform to the particularities of each country or territory and of the various businesses.
On an annual basis, the Unit shall issue: (i) a report evaluating the effectiveness of the Company’s Compliance System; and (ii) with the help of the Compliance Units of the Subsidiaries, a report evaluating the effectiveness of the compliance systems of the Group’s companies. These reports shall be submitted to the Sustainable Development Committee for it to issue its opinion and forward them to the Board of Directors.

The Unit may subsequently publish information contained in these reports in a transparent and clear manner, as a mechanism to make explicit the effectiveness of its compliance culture and its own social commitment to the public interest.

TITLE IV. MEETINGS

Article 11. Meetings

The Unit shall meet as many times as necessary to exercise the powers entrusted thereto.

Article 12. Call to Meeting

The secretary of the Unit shall, by order of the chair thereof, call the Unit to meeting at least three days in advance thereof, except in the case of urgent meetings.
The call to meeting shall be made through a specific software application, to which all members of the Unit shall have access in order to facilitate the performance of their duties and their powers of information, and, except in justified cases, shall include the agenda for the meeting and have attached thereto any information that may be deemed necessary. In the absence thereof, the call to meeting shall be sent to the e-mail address provided by the members of the Unit at the time of acceptance of their position or at a later time, and they must notify the secretary of the Unit of any change in the aforementioned address.
No prior call to a meeting of the Unit shall be required when all of its members are present and unanimously agree to the holding of the meeting and to the items of the agenda to be dealt with.

Article 13. Place of the Meeting

Meetings of the Unit shall be held at such place as is designated in the call to meeting or, in the absence thereof, at the registered office of the Company.
Meetings of the Unit may be held in several places connected to each other, or by remote means using remote communication systems that permit the recognition and identification of the attendees, permanent communication among them, and participation in discussion and the casting of votes, all in real time (including videoconference or remote attendance systems or any other similar system). The members of the Unit in attendance at any of such interconnected places shall be deemed to have attended the same meeting of the Unit for all purposes and the meeting shall be deemed to have been held at the registered office.

Article 14. Establishment of a Quorum

A valid quorum for Unit meetings shall be established with the attendance, in person or by proxy, of more than half of its members.
The chair of the Unit shall preside over meetings of the Unit. In the event of vacancy, illness, incapacity or absence of the chair of the Unit, the member having the longest length of service in the Unit, and if equal lengths of service, the oldest, shall act as such.
The secretary of the Unit shall act as secretary for the meeting. In the event of vacancy, illness, incapacity or absence of the secretary of the Unit, the person appointed by the chair of the meeting for such purpose shall act as secretary.
Unit members may give a proxy to another member by notice delivered by any of the means showing receipt thereof, addressed to the chair or to the secretary of the Unit and including the terms on which the proxy is given, provided that it includes specific instructions for each of the items on which the proxy representative must vote. In no case may they give a proxy in connection with matters affecting them personally or regarding which they are involved in any conflict of interest.

Article 15. Resolutions

Resolutions of the Unit shall be adopted by a majority of the votes of the members present at the meeting in person or by proxy. In the event of a tie, the chair of the Unit shall have the tie-breaking vote.
All resolutions adopted shall be recorded in minutes signed by the chair and the secretary of the Unit or by the persons acting in their stead. They shall be approved at the same meeting or at the meeting held immediately thereafter and shall be entered in a book of minutes of the Unit that shall be in the custody of the secretary thereof.
Voting by the Unit may occur in writing without a meeting provided that no member objects thereto. In this case, the members of the Unit may deliver to the secretary their votes and the considerations they wish to appear in the minutes. Resolutions adopted using this procedure shall be recorded in the minutes.

Article 16. Conflicts of Interest

The members of the Unit involved in a potential conflict of interest must give notice thereof to the Unit itself, which shall also have the power to resolve questions or conflicts that might arise in this regard.
A conflict of interest shall be deemed to exist in those situations in which the interest of the member of the Unit conflicts, whether directly or indirectly, with the interest of the Company and with their duties as a member of the Unit.
An interest of the member of the Unit shall exist if a matter dealt with by the Unit affects such member or an individual or legal person connected thereto.
If a member of the Unit is involved in a conflict of interest, they must refrain from participating in the matter in question and leave the meeting until a decision is made, and such member shall be subtracted from the number of Unit members for purposes of calculating the quorum and majorities at the relevant meeting and with respect to the matter at hand.

Article 17. Attendance of Guests

The chair of the Unit may request the attendance at meetings of any director or professional of the Group’s companies and of any member of the Compliance Units of the Subsidiaries, as well as of any member of the management decision-making bodies of the companies in which the Group has an interest, or seek their opinion at any time.
Requests for attendance by members of the Company’s Board of Directors shall be channelled through the secretary thereof.

TITLE V. RESOURCES, BUDGET AND ANNUAL ACTIVITIES PLAN

Article 18. Material and Human Resources

The Unit shall enjoy the required autonomy, freedom to take initiatives and capacity for control, and shall have the material and human resources necessary to perform its duties.
The personnel of the Unit must have the knowledge, skills and experience appropriate to the powers vested therein.

Article 19. Budget

Prior to the commencement of each financial year, the Unit, at the proposal of the Director of Compliance, shall submit to the Sustainable Development Committee a draft budget for carrying out its activities during the upcoming financial year.
Once validated by the Sustainable Development Committee, the draft budget shall be sent to the chair of the Board of Directors, who shall present it to the Board of Directors for final approval.

Article 20. Annual Activities Plan and Performance of the Unit

Prior to the commencement of each financial year, the Unit, at the proposal of the Director of Compliance, shall approve an annual activities plan for the upcoming financial year and shall submit it to the Sustainable Development Committee for validation thereby.
Each year, the Sustainable Development Committee shall give its opinion on compliance with the annual activities plan and the performance of the Unit.

TITLE VI. INFORMATION AND ADVICE AND DUTIES OF ITS MEMBERS

Article 21. Information and Advice

Provided that applicable law so allows, the Unit shall have access to the information, documents, offices, directors and professionals of the Company, including the minutes of the meetings of the management, supervisory and control bodies, as may be necessary for the proper performance of its duties.

The members of the Board of Directors and the professionals of the Company must also provide the cooperation requested by the Unit for the proper performance of its duties.

Requests addressed to directors or that cover minutes of meetings of the Company’s management decision-making body or of the committees thereof shall be channelled through the secretary of the Board of Directors.
The Unit may also seek cooperation or advice from outside professionals.
To the extent possible and provided it does not affect the effectiveness of its work, the Unit shall seek to act transparently, informing the affected directors and professionals of the purpose and scope of its actions whenever practicable and appropriate.

Article 22. Duties of Unit Members

Unit members must act with independence of judgement and action with respect to the rest of the organisation and perform their work with the utmost diligence and professional competence.
Unit members shall keep confidential the deliberations and resolutions of this body and, in general, shall not disclose any communications, reports, grievances, data, reports or background information to which they may have access while in office, nor use any of the foregoing for their own benefit or that of third parties, without prejudice to the duties of transparency and information imposed by the Company’s Governance and Sustainability System and by applicable law. The duty of confidentiality of the members of the Unit shall survive even after the members no longer hold such position.

TITLE VII. INFORMATION MANAGEMENT PROCEDURE

Article 23. Internal Reporting System

The Company has implemented an Internal Reporting System in accordance with applicable legal provisions. Without prejudice to the provisions of these Regulations, the principles governing the Internal Reporting System are set out in the Ethical and Basic Principles of Governance and Sustainability of the Iberdrola Group, in the Code of Conduct, in the Compliance Policy and in the Internal Reporting and Whistleblower Protection System.
The Unit shall investigate any conduct that may involve the commission of any impropriety or any act that is illegal or contrary to law or the Governance and Sustainability System, particularly including any conduct that might constitute a criminal offence, a serious or very serious administrative offence, or a breach of European Union law, with implications for the Company, its contractual relationship with its suppliers, or the interests and image of the Company.
The Unit may commence an investigation if it is aware of facts or circumstances that might constitute an impropriety or an act from among those indicated in the preceding section, whether on its own initiative or by virtue of a grievance or report received through the Internal Reporting Channels (as defined in the following section) or by any other means.
The internal reporting channels activated by the Company (the “Internal Reporting Channels”), which form part of its Internal Reporting System, allow its shareholders, directors, people, members of the supply chain and other third parties as determined by law to report any of the conduct referred to in section 2 above and to process the grievances or reports received in connection therewith, all without prejudice to the ability to address such grievances or reports to the Spanish Independent Whistleblower Protection Authority (Autoridad Independiente de Protección del Informante) (A.A.I.) or to any other competent institution, body or entity.

The Internal Reporting System includes all the Internal Reporting Channels set up by the Company for the communication of grievances or reports related to such conduct by the aforementioned persons.
The principles, rules of conduct and guarantees established in this Title VII shall apply to the investigation files handled by the Unit, regardless of the manner in which they are commenced.

Article 24. Management of Grievances or Reports

The management of grievances or reports sent through the Internal Reporting Channels is the responsibility of the Unit, without prejudice to the delegation of this duty to the Chief Compliance Officer in accordance with applicable legal provisions.
In order to perform such duty, the Unit and the Chief Compliance Officer must comply with the provisions of these Regulations, the Ethical and Basic Principles of Governance and Sustainability of the Iberdrola Group, the Code of Conduct, the Compliance Policy, the Internal Reporting and Whistleblower Protection System, and the Policy regarding Communication and Contacts with Shareholders, Institutional Investors and Proxy Advisors.
In the management of grievances or reports received through the Internal Reporting Channels, the confidentiality of the identity of the whistleblower and of any third party mentioned in the grievance or report, and of the activities carried out in the management and processing thereof, as well as the protection of personal data, must be guaranteed, preventing access to the content of the investigation by personnel who are not expressly authorised to do so.
The Unit shall also handle and respond to all enquiries submitted to it through the Internal Reporting System that are within its purview.

Article 25. Referral of Grievances or Reports

Shareholders, directors, people, members of the Company’s supply chain and other third parties as determined by law may report, including anonymously, any of the conduct referred to in section 2 of Article 23: (a) in writing, using the appropriate form available on the Company’s corporate website; and (b) by any other means established by the Company, which may include telephone.

At the request of the whistleblower, the grievance or report may also be presented in a face-to-face meeting with the Unit’s staff to be held no later than seven days of the request.
In any case, those who submit a grievance or report through the Internal Reporting Channels shall be informed, in a clear and accessible manner, of the existence of external reporting channels to the competent authorities and, where appropriate, to the institutions, bodies or entities of the European Union.
Verbal communications, including those made in a face-to-face meeting, by telephone or voice messaging, must be documented in one of the following ways:
1. by recording the conversation in a secure, durable and accessible format; or
2. through a complete and accurate transcript of the conversation prepared by the staff responsible for handling it.
Without prejudice to the rights thereof under the legal provisions regarding the protection of personal data, the whistleblower shall be given the opportunity to verify, correct and agree to the transcription of the conversation by signing it.
The confidentiality of the grievance or report received shall also be guaranteed if the grievance or report is received by the Unit by a means not provided for herein or has been made to any director, professional or supplier of the Company that has immediately forwarded it to the Unit in compliance with the provisions of the Code of Conduct.

Article 26. Acceptance of Grievances or Reports for Processing

Once a grievance or report has been received, the Unit shall send an acknowledgement of receipt to the whistleblower within seven calendar days of receipt (unless this might jeopardise the confidentiality of the grievance or report or the whistleblower has not identified themself or has declined to receive information about the whistleblower’s communication), and shall determine whether or not to process it.
The fact that the whistleblower does not disclose their identity shall not bar the Unit from processing the grievance or report if it is reasonably plausible.
If the matter affects a company of the Group that has its own compliance body or function, or a professional performing duties thereof, the Unit shall forward the grievance or report to said body (or to the head of the compliance function) for it to proceed with the autonomous and independent evaluation and processing thereof in accordance with its own rules, which shall be consistent with the principles established in the Compliance Policy, in the Internal Reporting and Whistleblower Protection System and in these Regulations and with those applicable by the Unit.

In the event that the matter affects more than one company of the Group or persons from different companies thereof, the appropriate coordination measures shall be adopted by the corresponding compliance units, bodies and functions in order to handle the grievance or report in the most efficient manner.
The Unit shall not process any grievance or report in which the conduct complained of is clearly unfounded or implausible or is not likely to constitute an act referred to in section 2 of Article 23.
The decision to not accept the grievance or report for processing shall be reasoned, sufficiently documented and notified to the whistleblower within five business days of the decision, unless the whistleblower has not identified themself or has declined to be informed of the outcome of their communication.
For purposes of deciding whether to accept a grievance or report for processing, the Unit may request the whistleblower, if the whistleblower has identified themself and has not waived the right to receive information, to clarify or complete it by providing the documentation or data necessary to verify the existence of an act or conduct of the kind referred to in section 2 of Article 23.
The Audit and Risk Supervision Committee shall have direct access to the grievances or reports submitted through the Internal Reporting Channels that might have a material impact on the financial statements or internal control of the Company. To this end, the Unit shall inform said committee of the existence of the aforementioned grievances or reports and shall provide it with any documentation requested in relation to the processing of the case files.

Article 27. Processing of Case Files

Once a grievance or report within the purview of the Unit has been accepted for processing, the Unit shall appoint an investigating officer to carry out the investigation and process the case file, with the power to entrust these duties to an external investigating officer.
If the grievance or report is submitted against a member of the Unit, such member shall not participate in the processing thereof.
If the grievance or report concerns a member of the Board of Directors, the chair of the Unit shall inform the legal advisor of said body in order for the legal advisor to assist the chair in the processing of the case file. In these cases, to ensure independence, the investigating officer shall be a person from outside the companies of the Group.
The maximum period for carrying out the investigation and replying to the whistleblower shall not exceed three months from receipt of the grievance or report, except in cases of particular complexity requiring an extension of the period, in which case the period may be extended by up to a maximum of an additional three months.
The investigating officer shall verify the truthfulness and accuracy of the information contained in the grievance or report received, and specifically of the conduct in question, while respecting the rights of the affected parties. For such purposes, the investigating officer shall give all affected parties the opportunity to be heard, shall receive the statements of witnesses and shall carry out such proceedings as the investigating officer deems necessary.

In particular, the investigating officer must inform those affected by the grievance or report of the acts or omissions attributed to them and of their right to be heard at any time during the investigation at the time the investigating officer initiates the investigatory activities. This information must be provided in such time and manner as is deemed appropriate to ensure the proper outcome of the investigation.
All professionals of the Group’s companies have the duty to faithfully cooperate in the investigation. The participation of witnesses and affected parties shall be considered strictly confidential.
The investigation shall be carried out pursuant to the provisions of an internal protocol approved by the Unit, all affected parties shall be informed regarding the processing of their personal data, and any other duty imposed by applicable legal provisions shall be complied with.
In all investigations, the rights to privacy, respectability, defence and the presumption of innocence of the persons investigated or affected shall be guaranteed, and all measures shall be taken that are required to avoid any kind of retaliation against the whistleblower upon the terms of applicable legal provisions.

In particular, as provided by applicable legal provisions, the Company undertakes to not adopt, and to ensure that the professionals of the Group do not adopt, any form of retaliation, whether direct or indirect, including threats of or attempted retaliation, against shareholders, directors, professionals, suppliers or other third parties determined by law who have reported any potential impropriety or the potential commission of any act that is illegal or contrary to law or the Governance and Sustainability System that may be investigated by the Unit, unless the grievance or report is false or such person has acted in bad faith and it has not been accepted in accordance with the provisions of Article 26 above, with the whistleblower being deprived of the protection provided thereto by Law 2/2023 of 20 February governing the protection of persons who report regulatory violations and the fight against corruption pursuant to Section 35 thereof (or such provision as replaces it at any time).

Likewise, as provided by applicable legal provisions, the Company undertakes to not adopt, and to ensure that the professionals of the Group do not adopt, any form of retaliation against any natural person who, within the framework of the organisation in which the whistleblower works, assists him/her in the process, or is related to him/her, as a representative of the employees, co-worker or relative, as well as against any legal person for whom the whistleblower works or with whom the whistleblower has another type of relationship in an employment context or in which the whistleblower has a significant shareholding.
At any time during the proceeding, the Unit and the investigating officer may seek the advice and cooperation of the professionals of the Group’s companies, and particularly the division in charge of the finance and control functions and of the legal affairs division for purposes of determining the consequences and manner to proceed with respect to any grievance or report.

They may also seek the advice of independent third parties to assist them in any proceedings or whenever they deem it appropriate.
The Unit shall keep a record of the grievances or reports received through the Internal Reporting Channels and of any internal investigations to which they have given rise.

Article 28. Resolution of Case Files

Once the processing of the case file has been completed, the investigating officer shall forward the file together with a proposed decision to the Unit for resolution as it deems appropriate and shall notify the whistleblower thereof within the period established in section 4 of Article 27 above.
In the event that the decision concludes that a professional has committed an improper act or an act that is illegal or contrary to law or the Governance and Sustainability System, the Unit shall notify the division responsible for the human resources function of the Company for the application of the appropriate disciplinary measures, the adoption and content of which shall be reported to the Unit.
If it is an improper act or act that is illegal or contrary to law or the Governance and Sustainability System that affects a member of the Company’s Board of Directors, the Unit shall submit the decision to the Appointments Committee, through the secretary of said management decision-making body, for application of any of the measures provided for in the Governance and Sustainability System, the adoption and content of which shall be reported to the Unit.
If the decision rendered concludes that a supplier of the Company has committed an improper act or an act that is illegal or contrary to law or the rules of conduct laid down in the Code of Conduct, the Unit shall notify the division of the Company responsible for procurement in order to exercise such contractual rights as may be appropriate, of which the Unit shall be informed.
If it is verified that a breach of the Governance and Sustainability System has occurred that is not covered by sections 2, 3 or 4 above, the Unit shall adopt the measures that it deems appropriate.
If the result of the investigation reveals the possible adoption of legal actions, the Unit shall give notice of the case file to the legal affairs division for purposes of commencing the relevant governmental or court actions in each case, of which the Unit must be informed. In particular, if the facts might indicate that a crime may have been committed, the legal affairs division shall immediately forward the information to the Public Prosecutor’s Office (Ministerio Fiscal), and it shall be forwarded to the European Public Prosecutor's Office if the facts affect the financial interests of the European Union.

Article 29. Protection of Personal Data

The delivery of personal information through the Internal Reporting Channels shall comply with the provisions of personal data protection legislation.
As a general rule, the party affected by the grievance or report shall be informed of the existence thereof at the time that the investigating officer commences the investigation proceedings. However, in those cases in which there is a significant risk that such notice may threaten the ability to effectively investigate the grievance or report or to collect any required evidence, notice to the affected person may be delayed for as long as such risk exists, pursuant to the provisions of personal data protection legislation.
Persons submitting a grievance or report through the Internal Reporting Channels must guarantee that the personal data provided are true, accurate, complete and up to date.
Data processed within the framework of the investigations shall be deleted in accordance with the provisions of personal data protection legislation.
Pursuant to the legal provisions applicable in each case, users of the Internal Reporting Channels may at any time exercise the rights of access, rectification, erasure, objection and limitation of processing of their personal data by sending a written communication to the registered office of the Company, in compliance with the legal requirements from time to time in effect, and indicating the specific right they wish to exercise.

TITLE VIII. AMENDMENT, COMPLIANCE AND INTERPRETATION

Article 30. Amendment

The amendment of these Regulations must be approved by resolution adopted by the Board of Directors on the initiative of the Board, of the chair thereof, of the Sustainable Development Committee, of the chair of the Unit, of one-third of the directors or of the members of the Unit itself, after a report from the Sustainable Development Committee unless the amendment is on the initiative thereof or of the Board of Directors itself.

Article 31. Compliance

The members of the Unit have the obligation to know and comply with these Regulations, for which purpose the secretary of the Unit shall provide them with a copy.
The Unit shall have the obligation to ensure compliance with these Regulations.

Article 32. Interpretation

These Regulations shall be interpreted in accordance with the Company’s Governance and Sustainability System.
Issues that might arise in regarding the interpretation and in the application of these Regulations shall be resolved by majority vote within the Unit itself, and in the absence of such resolution, by the chair of the Unit, who shall be assisted by the secretary or by such persons, if any, as may be appointed by the Unit for such purpose. The Sustainable Development Committee must be informed of the interpretation and resolution of the issues that may arise.
In the absence of a specific rule, the provisions of the Regulations of the Board of Directors governing its operation, and specifically as regards the calls to meeting, the granting of a proxy to another member of the Unit, the establishment of a quorum for meetings, the holding of meetings without prior notice, the rules for adopting resolutions, voting in writing and without a meeting, and the approval of the minutes of meetings shall apply to the Unit, to the extent not inconsistent with the nature thereof.

Download the Regulations of the Compliance Unit

Book Three

Internal Audit,
Risks and Compliance