Crime prevention and anti-corruption policy

The principles of action of the crime prevention and anti-corruption policy are as follows:

1. Comply with current legislation and with internal regulations, acting in accordance with the values and the Code of Ethics of the DIA Group.
2. Promote a culture of fighting corruption and crime prevention, applying, to the fullest extent, the principle of “zero tolerance” to corruption described in the Code of Ethics of the DIA Group.
3. Provide the necessary human and material resources so that, in an efficient manner, the work of promotion of this policy can be carried out, as well as implementing the methods for the prevention and detection of illegal actions.
4. Implement the models for oversight and prevention of crimes and anti-fraud systems for all of the companies that are included within the DIA Group.
5. Analyse and investigate, as quickly as possible, any report on conduct that is contrary to the Code of Ethics or external or internal regulations, applying the principles of confidentiality, non-reprisal, and protection of personal information for all persons affected by the investigation process, with particular attention in relation to the reporting and reported person.
6. Collaborate and cooperate with the State’s security forces and any judicial or administrative body, in relation to the investigation of alleged criminal acts by the administrators and employees of the DIA Group.
7. Incentivise the use of the ethics channel for consultation and information that the DIA Group has made available to employees and third parties, in order to be able to report on possible criminal actions or those that are contrary to the Code of Ethics.
8. Provide suitable ongoing training in relation to ethics and compliance, whether in person or through e-learning, to all of the administrators and employees of the DIA Group, placing special emphasis on the fight against fraud and corruption.
9. Impose relevant disciplinary measures on persons responsible for conduct that is corrupt or contrary to the Code of Ethics, and on those who, with their behaviour, cover up or prevent the investigation or clarification of the allegedly criminal actions, all of this in accordance with the penalty scheme applicable in each jurisdiction to each company of the DIA Group.

The suitable implementation of the crime prevention and anti-corruption policy has the objective of mitigating the risk of non-ethical and corrupt practices within the DIA Group.

In order to achieve this objective it will be necessary for the DIA Group to carry out the following actions:

1. Approve a Code of Ethics and create a communications channel for consultation and ethical information that is a channel for communication and information in relation to behaviour that is contrary to the Code or which relates to corrupt practices.
2. Design and implement a model for the prevention of crimes (Modelo de Prevención de Delitos, MPD) within all of the companies of the DIA Group located in Spain.
3. Design and implement an anti-fraud program.
4. Design and implement a program for regulatory compliance.
5. Implement a system for the management of risks, with particular oversight of regulatory compliance risks, actions that are corrupt or contrary to the Code of Ethics and in relation to the criminal responsibility of legal entities.
6. Carry out “due diligence of compliance” in strategic and corporate operations.

The DIA Group possesses an instrument that enables it to put a comprehensive compliance policy into practice, guiding employees through example with particular methods of conduct or behaviour, the Code of Ethics of the DIA Group.

The Code establishes and outlines five principles of conduct, the first of them highlighting “compliance with standards, both external, such as laws and regulations, as well as internal, which are included in policies, procedures and control mechanisms,” and the second “the fight against corruption.”

The Code, as well as the rest of the rules of the DIA Group, must be complied with obligatorily by all employees.

Starting from the premise that what is important is not the existence of a code but rather that it be understood and observed, within the DIA Group there is an Ethics Committee at a corporate level and an Ethics Committee (hereinafter “Committee”) within each country or jurisdiction.

The corporate and country Committees have, among their principal tasks, that of facilitating the dissemination and implementation of the Code, ensuring that it is observed, understood, and followed, as well as implementing, assessing, and reviewing the models or programs for the prevention of crime and the fight against corruption.

The DIA Group has an Ethics Channel for consultation and information (by electronic mail and postal address) at a corporate level and at the level of each jurisdiction in which the Group operates, in order to clarify queries on interpretation and in order to analyse, investigate and resolve possible violations of the Code or corrupt actions.

Violations of the Code will be analysed and dealt with by the corporate and/or country Ethics Committees in accordance with their operating protocol and will be resolved in accordance with the applicable internal and external regulations.

The companies of the DIA Group based in Spain have implemented a MPD which identifies and assesses the risks of committing crimes associated with each area and activity of the corporate structure which can result in criminal liability for the legal entity, as well as the respective regulations, procedures, and control mechanisms for the identification and prevention of the commission of said crimes.

The purpose of the MPD is to establish the most appropriate internal control procedures and policies in order to prevent the omission of illegal acts, and when applicable, to be able to exempt the companies of the DIA Group from liability, in accordance with the provisions of the current Organic Law 1/2015 of 30 March 30, which modifies Organic Law 10/1995, 23 March of the Penal Code.

The companies of the DIA Group will have an anti-fraud and corruption fighting program which identifies and assesses the risks of corruption and fraud in relation to their activity, as well as the associated control mechanisms for the prevention and detection of the commission of corrupt and fraudulent practices. As a consequence of this program, the DIA Group will have a fraud risk matrix that analyses them in relation to their frequency and impact, which should incorporate the existing control mechanisms in order to avoid said conduct.

The DIA Group has the responsibility of identifying, assessing and minimising the legal risks, continually complying with the applicable regulatory framework and reporting on compliance with legal obligations to the internal persons who are responsible for operations.

In order to suitably carry out the duties of identification of the regulatory framework and of supervising compliance with it, the DIA Group has implemented a procedure for regulatory identification and monitoring.

Each company of the DIA Group has a “regulations map” which identifies and describes all of the regulations that apply to DIA, with particular emphasis on the key legislation for the principal processes of the supply chain.

In order to carry out this function, the DIA Group has established a procedure for monitoring and updating the regulations which defines the internal and external resources, responsibilities and tools needed in order to carry out this task and to achieve the dual objective of having an updated regulatory map and an organisation that is informed on its legal obligations.

For all strategic and corporate operations in which any company of the DIA Group intervenes it will be essential, prior to the formalisation of the operation, to review the current status, in the area of compliance in which the company subject to purchase or merger is found, or the partner, legal entity or individual with which it is intended to enter into a joint venture, commercial, or strategic agreement.

The Ethics Committee has, among its main duties, to facilitate the dissemination and implementation of the Code, safeguarding its observance, understanding and compliance, as well as implementing, assessing and reviewing the models for the prevention of crimes and fight against corruption.

The Ethics Committee should keep a record of all of the communications received through the ethics channel, including the information for the respective investigations and the results of these investigations.

On an annual basis, a report will be submitted to the Auditing and Compliance Commission of the board of directors, which will provide consolidated statistical and detailed information at a Group level in accordance with the information received from each of the jurisdictions.

The Ethics Committee will control the implementation and development of the MPD in the companies of the DIA Group in Spain, the Legal and Compliance Department being responsible for coordinating and supervising the implementation and development of anti-fraud and corruption fighting programs in the other companies of the DIA Group that operate outside of Spain.

The Legal and Compliance Department will be responsible for the review of this policy on an annual basis, and will propose to the board of directors its modification or updating with the purpose of optimising the process of the fight against corruption and the prevention of non-ethical conduct.