Compliance

Aciturri strongly encourages the maintenance of high standards of integrity, ethics and compliance in its corporate strategies and management processes.

For this reason, the company counts on a transversal, structured, robust, practical and permanently reviewed Ethics and Compliance Management System (or SGEC in Spanish). This system intends to integrate ethics and compliance into the organization's management processes to ensure compliance with applicable legal (hard law) and voluntary (soft law) obligations, detect and prevent risks of non-compliance and adopt the appropriate corrective measures. At Aciturri, we take action against facts, attitudes, and/or behaviors that threaten those values and ethical principles that we deem fundamental rights, regardless of whether or not they are considered a crime.

It should be noted that the management of this variable has been developed independently in Aciturri and its subsidiaries (Aciturri Aeronáutica, S.L.U., Aciturri Aerostructures, S.L.U., Aciturri Engineering, S.L.U. and Aciturri Aeroengines, S.L.U.) and Alestis (including Alestis do Brasil) until now, Aciturri Engineering, S.L.U. and Aciturri Aeroengines, S.L.U.) and Alestis (including Alestis do Brasil) until now, although work is being carried out to align both SGECs, to achieve full integration by 2024 (also for the company in France). This integration process will reinforce the company's overall compliance culture and allow for improved identification and monitoring of ethics and compliance risks while establishing mechanisms to implement, develop, review and improve the resulting SGEC. All of the above will be conducted by taking as references the national and international rules and standards that inspired its definition (e.g., ISO 19600, ISO 37001 or UNE 19601) and the new governance rules published since then.

The fundamental element of the SGEC is the Ethics and Compliance Policy, which is developed through the Code of Ethics.

The Ethics and Compliance Policy, initially approved in June 2017 ⁴³ and last revised in November 2021, details the SGEC's essential principles and values, which the organization embodies in its Code of Ethics. These principles promote respect for all applicable laws and other regulations, including the Code of Ethics.

Meanwhile, the Code of Ethics (approved in 2017 by the Board of Directors and currently under review) is, from a formal point of view, the set of binding rules setting out the conduct that the company expects from each and every one of its members, establishing an ethical framework of reference. A set of sub-policies, procedures, guidelines, and other Ethics and Compliance standards are developed from the bases it defines.

43. Approval dates recorded here and in the rest of the “Compliance” section refer to Aciturri's SGEC, which is taken as a reference.

The company has a transversal, structured, robust, effective, and continuously reviewed Ethics and Compliance Management System.

Both the Policy and the Code are accessible for direct consultation by all employees through the intranet and for third parties through the website. Specifically, the Code was personally notified to all members of the governing bodies at the time of its approval, who assumed, in writing, the commitment to comply with it.

SGEC also includes a Crime Prevention Model (also approved in 2017) designed to establish the appropriate monitoring and control measures to prevent the commission of crimes and significantly reduce their risk of commission. It rests on the principle that “no type of utility or benefit for the organization justifies the commission of acts typified by the criminal law system,” i.e., a “zero tolerance” principle towards the commission of criminal acts.

Due to the company's internal and external context change, the Crime Prevention Manual and the criminal risk analysis will be completely revised in 2024. This update will include a study and review of potential risks under new legislation, processes and controls.

These three cornerstones, Crime Prevention Policy, Code and Model, are the foundation on which the rest of the regulations that the company self-imposes and assumes as its own, as well as those that develop mandatory regulations, are based.

In this regard, Aciturri counts with several “(Sub)Policies” that come to express more specifically its principles of action in specific areas, highlighting the Anti-Corruption, Procurement and Subcontracting, Conflict Minerals, Human Rights, Privacy and Data Protection and the Internal Information System. Of these, the latter two resulted from regulatory development in 2023.

(Sub)Policies are, in turn, developed and/or complemented through procedures and guides prepared by the Compliance department to facilitate knowledge of and compliance with their provisions throughout the company. In this regard, in addition to those already in place (for example, Policy on the Use of Electronic Devices, Procedure and Guide for the Use of Digital Certificates, Conflict of Interest Management, Corporate Compliance Training program, Export Compliance Procedures, Personal Data Protection Procedures - response to data subjects' rights, management of security breaches, etc.) new rules have been developed in 2023, such as the E&C Channel Regulation, Procedure for Granting and Use of Powers of Attorney or Regulation on International Transfer of Personal Data.

Aciturri has an Anti-Corruption Policy that reaffirms and strengthens the demand for standards of honesty, integrity, and transparency as essential principles in the conduct of its activities.

These three pillars—Policy, Code, and Crime Prevention Model—form the source whose spirit imbues the rest of the regulations that the company self-imposes and assumes as its own, as well as those that develop mandatory regulations.

The progress in the regulatory development of the Compliance area, as well as the ordinary management actions carried out during the year, training provided, and strategic objectives established, are periodically reported to the Ethics and Compliance Committee and the Board of Directors of the Organization, thus closing the vertical involvement of the organization and facilitating the proper coordination and alignment of principles, through the well-known tone from the top.

The conclusions of the periodic review and verification processes of the model to prevent, detect and act against possible criminal risks in compliance with the regulatory mandate of article 31 bis 5. 6th of the Criminal Code are included in the annual review report prepared by the Compliance Officer, who is responsible for detecting new risks.

To ensure proper control is exercised in Brazil, a representative of the Compliance department has been appointed, specifically designated for this purpose (internally called BCR, Business Compliance Representative), who coordinates and ensures the implementation of the company's policies.

Aciturri maintains an Anti-Corruption Policy (latest version 2018), which reasserts and reinforces the demand for standards of honesty, integrity and transparency as essential principles of action in the development of its activity. These standards are required both internally and from any business partner and are based on the commitment to the most rigorous compliance with the principle of “zero tolerance” to any practice that could be considered as conduct constituting corruption or bribery, understood in the broadest sense.

Furthermore, within this same compliance framework, we continue to reinforce the integrity requirement in the supply chain, checking that the third parties we interact with have a culture of regulatory compliance. This is achieved by incorporating specific contractual clauses in commercial contracts (included years ago) that foresee the obligation of business partners to have management systems based on principles and a framework of ethics and compliance similar to those advocated by the company and providing for contractual termination in the event of non-compliance with any of the obligations established in this regard.

Following the same line of strengthening due diligence in the supply chain, Aciturri has had a Code of Conduct for Suppliers since 2022, compliance with which is contractually required through its incorporation as an annexed document.

The circle of due diligence is completed with the update, in 2023, of the Suppliers Purchasing and Subcontracting (Sub)Policy, containing the principles required to all suppliers, which complete and complement the conditions and requirements imposed by local, national and international standards, as well as those that the company assumes as its own and incorporates as a requirement for the maintenance of a business relationship.

Such diligence, so marked by the principle of “zero tolerance” towards any criminal act, in general, and corruption in particular, is also deployed within the organization, not only through the Ethics and Compliance Policy, the Code of Ethics and the Crime Prevention Manual but also with specific procedures and guidelines such as the Gifts and Hospitality guide; the Procedure for the management of conflicts of interest; the Procedure for the approval of donations and sponsorships, Procedure for the granting and use of Powers of Attorney. All these documents are published on the corporate intranet.

Aciturri's commitment to regulatory compliance is especially relevant to Human Rights. The company is aware that corporations have not only the responsibility to respect them but also the ability to contribute positively to their development. And this commitment involves not only its members but its entire value chain.

To formalize this respect, Aciturri adopted a Human Rights (Sub)Policy in 2020 based on the International Bill of Human Rights, the fundamental conventions of the International Labor Organization, the United Nations Global Compact and the European Convention on Human Rights (HR).

This HR (Sub)Policy is developed through the Conflict Minerals (Sub)Policy, which strengthens the Due Diligence process geared towards globally responsible management of supply chains. It places special emphasis on minerals and metals coming from regions frequently affected by armed conflicts and/or generalized and systematic violations of International Law.

Compliance and Supply Chain departments launched a conflict minerals audit in 2023 to confirm that none of our suppliers´source minerals from conflict zones or places where human rights are systematically violated.

During 2023, an audit on conflict minerals was launched to confirm that none of the suppliers source minerals from conflict zones or areas with systematic human rights violations.

As for preventing money laundering, Aciturri is not required to comply, according to article 2 of Law 10/2010, of April 28t, on the prevention of money laundering and the financing of terrorism. Nevertheless, the commitment to regulatory compliance is evidenced by maintaining measures such as the following:

Any person who wants to establish a relationship with the Company must show relevant identification.
Cash payments are not accepted.
Refusal of use or possession of any property originating from criminal activity.
Special attention is paid to so-called “triangular operations”—when a client or supplier informs that a third party will receive the invoice payment.
Any suspicious operation is reported to Ethics and Compliance.
All financial transfers are identified and duly recorded in the accounting books.
In cases where there is evidence that the entity wanting to work with the Company is participating in money laundering operations, we conduct diligent checks of the account holder's identity.

Particularly significant in 2023 was the entry into Law 2/2023 of February 20th, regulating the protection of persons who report regulatory violations and the fight against corruption, which obliges companies of a specific size and/or nature to have an Internal Information System.

Aciturri has been fully and effectively adapting to this significant legislative innovation, taking as a starting point the “whistleblower channel” set up years ago. In general terms, the adaptation involved completing formal procedures but not changes in the essence of the Channel for Complaints, which had already been operating effectively with full guarantees.

The Internal Information System, known internally as the E&C Channel, has several communication channels, including the Digital Platform. The E&C Channel is accessible 24/7 and hosted on external servers. It allows any employee or third party to communicate with the Ethics and Compliance department in a straightforward and confidential manner.

Based on the same assumptions and principles that were established in its implementation (guarantees of confidentiality, anonymity and protection of the rights of those involved, among others), the E&C Channel is characterized by its broad scope, both subjective, being accessible to all members of the organization, as well as to third parties with a legitimate interest in its use; as well as objective, since it is possible to make queries and complaints, in good faith, about conduct in the context of its activities that may involve non-compliance, and to inform the Compliance department of any ethical and compliance issues or dilemmas that may arise in the performance of its functions.

The E&C Channel's scope is much broader than what is required by Law 2/2023 since the ethical culture that Aciturri pursues and promotes is not limited to specific regulatory breaches but to any that could involve a violation of the general principles of action under a strict framework of ethics and compliance.

The rights and warranties of those using the E&C Channel and its operating principles are regulated in the E&C Channel Regulations, approved and published in 2023. The Regulation contains the E&C Channel Sub-Policy, the Channel Organizational Procedure and Principles, the Inquiry and Complaint Management Procedure and the Non-Retaliation Protocol. The competent authority has also been notified of the appointment of a person to act as Channel Manager.

205-3] In 2023, 175 inquiries (10 fewer than in 2022 ⁴⁴) and 14 complaints (the same as in 2022 ⁴⁵) were received. All suspected complaints have been analyzed and closed once the possibility of a crime has been ruled out. After its resolution, it can be affirmed that no disciplinary proceedings have been opened in any of the cases, no complaint has been received related to corruption, in any of its types, or concerning Human Rights, and none of the complaints are framed in a case that could result in criminal liability for the company.

Regarding specific training on the Crime Prevention Model, 380 people were trained in 2023 (1354 people trained since its launch).

On the other hand, within the framework of the Harassment Prevention and Action Protocol, negotiated and approved with the Legal Representation of Workers, to address the criminal responsibilities of the company after the reform introduced by Organic Law 10/2022, of September 6, on the comprehensive guarantee of sexual freedom, specifically the criminal offenses of; sexual harassment, included in article 184, and workplace harassment, contained in article 173 of the Penal Code, we are working on training the people belonging to the specific Commission to analyze and solve harassment cases.

Furthermore, in 2023, the members and associates of the Andalusia Aerospace Cluster were given a specific workshop on ethics, compliance, and internal information systems.

44. 127 queries received at Aciturri and 58 at Alestis.
45. 2 complaints received at Aciturri and 12 at Alestis.