Whistleblowing

In compliance with current legislation, Banca Progetto has defined an internal system aimed at allowing the reporting of violations (whistleblowing) by internal / external parties (for more details, please refer to the Policy on the subject published at the end of this page), including conduct, acts or omissions that violate national or European regulations applicable to the Bank’s activities, and that may harm the public interest or the integrity of the Bank.

The system adopted by the Bank ensures:

- the confidentiality of the personal data for the Whistleblower, the alleged perpetrator of the breach (Reported) and any other parties mentioned in the report;

- the protection of the Whistleblower from retaliation risks.


SUBJECT OF THE REPORT

The report must contain a circumstantiated description of the breach, i.e., the conduct, acts, or omissions that the Whistleblower considers to be in violation of the law, including, where possible, the documents and rules that are considered to have been breached, as well as any other findings useful for conducting the investigation into the alleged facts.

The Whistleblower also has an obligation to disclose any personal interest related to the whistleblowing. Reports concerning disputes, claims or requests related to a personal interest of the Whistleblower that relate exclusively to their individual employment relationship are not allowed.

In particular, by way of example but not limited to, the reports may concern:

1. administrative, accounting, civil or criminal offenses, not falling under items 3), 4), 5), 6);

2. relevant unlawful conduct pursuant to Legislative Decree no. 231/2001 or violations of the Organization, Management and Control Model, not falling under items 3), 4), 5), 6);

3. violation of the provisions dictated in order to prevent money laundering and the financing of terrorism;

4. offenses committed in violation of European or national legislation applicable to the Bank’s activities, including, but not limited to, offenses relating to the following sectors: services, products and financial markets; environmental protection; consumer protection; privacy and personal data protection; security of networks and information systems;

5. acts or omissions that harm the financial interests of the European Union, as identified in the regulations, directives, decisions, recommendations and opinions of the European Union;

6. acts or omissions concerning the internal market, including breaches of EU rules on competition and state aid, and breaches related to the internal market concerning corporate tax legislation or schemes designed to gain a tax advantage that undermines the objective or purpose of applicable tax law; 7. further acts or conduct that defeat the object or purpose of the provisions of the acts of the European Union, covered under items 3), 4), 5).

Additionally, pursuant to Article 52-bis, paragraph 1, of the Consolidated Law on Banking (“TUB”), reports may also relate to any act or fact that may constitute a “violation of regulations concerning banking activity.”

To provide clarity on the scope of the regulation, here are some non-exhaustive examples of behaviours subject to reporting:

- violations of the TUB and regulations on payment services (e.g., Legislative Decree No. 218 of 15 December 2017, implementing the so-called “PSD2 Directive”);

- violations of the provisions of Model 231 and of the principles and rules of conduct set out in the Bank’s Code of Ethics;

- breaches of anti-money laundering and counter-terrorism financing legislation;

- violations of anti-usury regulations;

- unlawful or fraudulent behaviour by employees, members of corporate bodies, or third parties (e.g., financial agents / credit brokers and their collaborators, suppliers, consultants, contractors, etc.) that may directly or indirectly result in financial or reputational harm to the Bank;

- potential criminal offences committed by employees, members of corporate bodies, or third parties (e.g., financial agents / credit brokers and their collaborators, suppliers, consultants, contractors, etc.) to the detriment of the Bank, or which could expose the Bank to liability;

- any conduct giving rise to conflicts of interest that does not comply with the relevant rules and control procedures;

- in the area of consumer protection, violations of (i) the Consumer Code (Legislative Decree No. 206 of 6 September 2005, as amended), (ii) regulations on consumer credit agreements (Legislative Decree No. 241 of 13 August 2010, as amended), and (iii) regulations on the comparability of payment account fees, account switching and access to basic payment accounts (Legislative Decree No. 37 of 15 March 2017);

- in the area of privacy, personal data protection, and cybersecurity, violations of the Personal Data Protection Code and the GDPR;

- administrative irregularities and breaches in accounting and tax obligations;

- harassment.

INTERNAL REPORTING CHANNELS

A breach can be reported through internal channels, namely:

- the SignalACT computer tool from Inaz which can be accessed through the following link: https://bancaprogettospa.signalact-inaz.it/whistleblowing;

- written communication in paper form, delivered by hand to the head of the Legal, Compliance and Corporate Department (*) or sent in a closed and sealed envelope to the same (*) at the Bank's registered office in Via Bocchetto 6, 20123, Milan;

- telephone communication or direct interview with the aforementioned head of the Legal, Compliance and Corporate Department (*).

(*) Or the head of the Internal Audit Department, in the cases provided for by the relevant Policy, published at the end of the page.

A Guide for Whistleblowers using the tool is available at the following link https://signalact.it/guida-segnalatore/

The manager will send:

- within 7 days from the reporting date, a confirmation of receipt of the same;

- within 3 months from the date of confirmation of receipt of the report, the outcome of the investigations conducted.

The aforementioned channels may not be used to transmit a complaint relating to banking / financial and payment services offered by the Bank.

EXTERNAL REPORTING CHANNELS

It is possible to report a violation through the activated external channels:

- via the National Anti-Corruption Authority (ANAC), following the procedures published on the website https://www.anticorruzione.it/-/whistleblowing., where an access link to the tool for sending reports is available.

The Whistleblower may use this channel only if

- they have already made an internal report that has not been followed up;

- they have reasonable grounds to believe that an internal report would not be effectively followed up, or that making such a report may lead to a risk of retaliation;

- they have reasonable grounds to believe that the breach may constitute an imminent or obvious danger to the public interest.

In addition, the Whistleblower may also contact ANAC for notification of any retaliatory acts resulting from a report.

- via the Bank of Italy, following the procedures published on the website https://www.bancaditalia.it/compiti/vigilanza/whistleblowing/index.html.

Privacy policy

Policy on internal violation reporting system