Whistleblowing Procedure

Internal system for reporting violations pursuant to Legislative Decree 24/2023

Document code PRO-WB-01 Version [1.0] Date of issue 03/11/2026
Approval by the Board of Directors

1. Introduction and Purpose

Halcyon Insurance S.p.A. (hereinafter “Halcyon” or the “Company”) considers legality, fairness, and transparency to be essential prerequisites for the conduct of its insurance brokerage business. In accordance with these principles, the Company has adopted this procedure to govern its internal system for reporting violations (known as “whistleblowing”) in implementation of Legislative Decree No. 10 March 2023, 24.

The procedure defines the scope of reports, the authorized parties, the channels made available, the procedures for handling reports, and the protections afforded to whistleblowers, ensuring at every stage the confidentiality of the whistleblower’s identity, the identities of those involved, and the content of the report, as well as prohibiting any act of retaliation.

Halcyon, as an entity operating in the insurance sector and subject to anti-money laundering obligations, is required to establish an internal reporting channel regardless of the number of employees it has.

2. Regulatory References

Reference	Subject
Directive (EU) 2019/1937	Protection of individuals who report violations of Union law.
Legislative Decree No. 10 March 2023, 24	Transposition of Directive (EU) 2019/1937 — General Provisions on Whistleblowing.
Legislative Decree No. 209/2005 (CAP), Articles 10-quater and 10-quinquies	Internal Whistleblowing Systems in the Insurance Industry.
Legislative Decree No. 231/2007, Art. 48	Reporting of Anti-Money Laundering Violations.
Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003	Protection of the personal data of individuals involved in the report.
ANAC Guidelines (Resolutions 311/2023 and 478/2025)	Operational guidelines for internal channels, platform requirements, and incident management.
IVASS Regulation No. 38/2018	Corporate Governance System for Intermediaries and Insurance Companies.

3. Persons Authorized to File Reports

Anyone who, in the course of their work or professional relationship with Halcyon, becomes aware of violations may file a report. Specifically:

• employees, including those with fixed-term, part-time, temporary, or probationary contracts;
• self-employed individuals, contractors, independent professionals, and consultants who provide services to the Company;
• parties to collaborative arrangements pursuant to Article 409 of the Italian Code of Civil Procedure (e.g., agency agreements) and intermediaries in the distribution network;
• suppliers, subcontractors, and parties with whom they have business relationships;
• interns and volunteers, both paid and unpaid;
• shareholders and persons holding positions of administration, management, control, oversight, or representation.

This protection also applies when the legal relationship has not yet begun (information obtained during the selection process or in the pre-contractual phase), as well as during the probationary period and after the termination of the relationship, if the information was obtained during the course of that relationship. These protections extend not only to the whistleblower but also to facilitators, colleagues, and relatives of the whistleblower, as well as to entities owned by the whistleblower or for which the whistleblower works, within the limits set forth by law.

4. Subject of the report

Behaviors, acts, or omissions that harm the public interest or the integrity of the Company and of which the whistleblower has become aware in the course of their work may be reported, including:

• administrative, accounting, civil, or criminal offenses;
• conduct that constitutes a violation under Legislative Decree 231/2001 or breaches of the Company’s organizational and management policies;
• violations of the provisions governing insurance brokerage and distribution (CAP, IVASS Regulation) and of the obligations regarding conduct toward customers;
• violations of anti-money laundering and counter-terrorism financing regulations;
• violations of laws and regulations governing personal data protection and information security;
• offenses falling within the scope of European Union legislation relating, among other things, to financial services and products, the prevention of money laundering, product safety, consumer protection, and privacy.

4.1 Exclusions

The following are not covered by the scope of this procedure:

• complaints, claims, or requests related to the whistleblower’s personal interests and pertaining exclusively to their individual employment relationship;
• reports of violations that are already subject to mandatory reporting requirements under specific Union or national laws through their own dedicated channels;
• news that is clearly unfounded, information in the public domain, and mere rumors or speculation.

5. Internal Reporting Channels

The Company provides the following channels, which are designed to ensure the confidentiality of the identity of the whistleblower, the person involved and mentioned, as well as the content of the report and the related documentation, including through the use of encryption tools.

5.1 Online channel (preferred method)

Reports may be submitted in writing via the dedicated online platform accessible at the following address. The platform ensures confidentiality through security protocols and encryption and allows you to communicate with the Administrator in a secure manner. In accordance with ANAC Guidelines, standard email addresses and certified email (PEC) addresses do not constitute a dedicated channel and must not be used to submit reports.

5.2 Oral Channel

At the whistleblower’s request, the report may be made orally, or, upon request, through a face-to-face meeting with the Manager scheduled within a reasonable timeframe. The meeting is documented, with the whistleblower’s prior consent, through a recording or a written account signed by the whistleblower.

5.3 Print Media

The report may be submitted in paper form. To ensure confidentiality, the document must be placed in a sealed envelope marked “CONFIDENTIAL TO THE WHISTLEBLOWING OFFICER — WHISTLEBLOWING,” which in turn must be placed in a second envelope addressed to the Company’s headquarters: .

5.4 Report Manager

Management of the internal reporting channel is entrusted to an independent and specifically trained individual within the Company’s Compliance and Anti-Money Laundering Department (the “Manager”), who acts impartially and free from conflicts of interest. Any report received from a party other than the Manager is forwarded to the Manager within 7 days, with simultaneous notification to the reporting party. The Manager’s operational contact is: .

6. External Report to ANAC

A whistleblower may file an external report through the channel established by the National Anti-Corruption Authority (ANAC) if any of the following conditions apply:

1. the internal channel is not active or does not comply with regulatory requirements;
2. the whistleblower has already filed an internal report and no action was taken on it;
3. the whistleblower has reasonable grounds to believe that the internal report would not be effectively addressed or could result in the risk of retaliation;
4. the whistleblower has reasonable grounds to believe that the violation may pose an imminent or clear danger to the public interest.

External reporting is carried out in accordance with the procedures and through the platform provided by ANAC on its official website.

7. Public Disclosure

A whistleblower who makes a public disclosure is entitled to the protections provided if, at the time of disclosure, one of the following conditions applies: the whistleblower has previously filed an internal and external report, or an external report, without receiving a response within the prescribed time frame; or they have reasonable grounds to believe that the violation may pose an imminent or clear danger to the public interest, or that the external report may entail a risk of retaliation or may not be effectively followed up due to the specific circumstances of the particular case.

8. Report Handling and Timelines

The Manager processes the reports received in accordance with the following terms and requirements:

Term	Operator Compliance
Within 7 days	Issuance of an acknowledgment of receipt of the report to the person who filed it.
Promptly	Eligibility review, maintaining communication with the reporter, and requesting additional information if necessary.
Within 3 months	Response to the reporter regarding the action taken in response to the report, effective as of the date of the acknowledgment of receipt or, in the absence thereof, as of the expiration of 7 days.
No more than 5 years	Retention of the report and related documentation, effective from the date of notification of the final outcome.

The Manager reviews the report, conducts the necessary preliminary investigation, may request additional information from the reporter, and maintains appropriate communication with the reporter. Upon completion of the preliminary investigation, the Manager provides feedback and, if the report is found to be well-founded, proposes appropriate measures to the competent bodies. Reports that are manifestly unfounded or outside the scope of application are dismissed with an appropriate explanation.

9. Protections for Whistleblowers

9.1 Confidentiality

The identity of the whistleblower and any other information from which that identity could be inferred, directly or indirectly, may not be disclosed without the whistleblower’s express consent to parties other than those authorized to receive or act on reports. Confidentiality is also guaranteed in the context of any proceedings, within the limits and in accordance with the procedures provided by law.

9.2 Prohibition on Retaliation

Any form of retaliation against the whistleblower and other protected individuals is prohibited. The following, among other things, are null and void: dismissal, suspension, demotion, denial of promotion, transfer, change in job duties, disciplinary sanctions, demerit notes, failure to convert or renew a contract, and any other measure taken as a result of the report. Acts of retaliation may be reported to ANAC, which has the authority to impose the relevant sanctions.

9.3 Support Measures and Limitations of Liability

The support measures provided for by law are guaranteed, including the information and assistance provided by third-sector organizations registered on the relevant ANAC list. Within the limits established by law, a person is not liable to punishment for disclosing or disseminating information regarding violations covered by the duty of confidentiality or relating to the protection of copyright or personal data, or who violates confidentiality provisions, provided that, at the time of disclosure, they had reasonable grounds to believe that the report was necessary to expose the violation and made the report in accordance with the established procedure.

9.4 Conditions for Protections

Protections apply if, at the time of the report, the whistleblower had reasonable grounds to believe that the information was true and fell within the objective scope of the procedure. These protections are not guaranteed, and liability may arise, in the event of a report made with intent or gross negligence that is subsequently found to be unfounded.

10. Processing of Personal Data

The processing of personal data related to the management of reports is carried out by Halcyon Insurance S.p.A., acting as the Data Controller, in compliance with Regulation (EU) 2016/679 and Legislative Decree 196/2003, for the purpose of fulfilling a legal obligation. Data is processed in accordance with the principles of data minimization, accuracy, and storage limitation, using appropriate technical and organizational measures (including channel encryption and dedicated authorization profiles). Any data not necessary for the processing of a specific report is not collected; if collected accidentally, it is deleted. The Data Protection Officer (DPO) is Attorney Andrea Bettini, who can be contacted at dpo@halcyoninsurancespa.it.

Specific Privacy Notice. A specific privacy notice regarding the processing of data related to the reporting system, in accordance with Articles 13 and 14 of the GDPR, is made available to the reporter and to all individuals involved (those reported and facilitators).

11. Retention of Documentation

Reports and related documentation are retained for as long as necessary to process the report and, in any case, for no longer than 5 years from the date of notification of the final outcome of the procedure, in compliance with confidentiality obligations and data protection regulations.

12. Penalty System

Failure to comply with the provisions of this procedure constitutes a disciplinary offense, punishable in accordance with the applicable disciplinary system. Furthermore, attention is drawn to the administrative fines that may be imposed by ANAC, including those provided for in cases of retaliation, obstruction of reporting, breach of the duty of confidentiality, failure to establish the reporting channel, or failure to adopt compliant procedures.

13. Distribution and Updates

This procedure is published on the Company’s official website and is made available to all authorized parties, including those who, although they do not work on-site, have a legal relationship with the Company. The Company ensures that its staff receives adequate information and training and arranges for the periodic review of this procedure, as well as its updating in light of changes in laws and regulations.

Document approved by the Board of Directors of Halcyon Insurance S.p.A. on .

The Legal Representative

Daniela Mantia

Halcyon Insurance S.p.A. — Whistleblowing Procedure · PRO-WB-01

Document for public use — published on the institutional website