Whistleblowing and Speaking Up

1. Purpose and scope

A firm that moves capital across 28 jurisdictions relies on its people to say when something is wrong. This policy exists so that saying so is safe, simple and taken seriously. It sets out the route, the recipient, the timetable and the protection. It is written for the person raising the concern, and it is meant to be understood in one sitting.

Any person may use the channel: employees in any of the 36 offices, members of the Board, contractors, secondees, agency workers, staff of suppliers and introducers, and people who have left the firm within the last three years. Clients and counterparties with a concern about wrongdoing may use the same route, although complaints about service follow the Complaints Handling policy.

The policy covers concerns about conduct that is unlawful, that breaches a group policy, that endangers a person, an animal or the environment, that conceals any of those things, or that damages the integrity of the firm or a market. It is not the route for a personal grievance about pay or management, which is handled under the fair employment procedures, although a grievance that reveals wrongdoing is treated under this policy from that point.

2. How to raise a concern

The primary route is the mailbox whistleblowing@iguako.tech. Messages to that address are delivered only to the Designated Independent Director and to the two-person independent case office that supports him, which sits outside the management line and reports to no executive. No member of the Executive Committee, no line manager and no local compliance officer can read the mailbox.

A concern may also be raised in person or in writing to the Designated Independent Director, to the chair of the Audit Committee, or to any local compliance officer, who must pass it to the case office within one working day without opening an inquiry of their own. A person may raise a concern with the supervisor of a licensed entity directly, and nothing in this policy restricts that right.

Anonymous reports are accepted and investigated on the same footing as named ones. A person who reports anonymously is asked to use a mailbox they will keep checking, so that the case office can ask questions and report the outcome. The firm does not attempt to identify an anonymous reporter, and any attempt to do so is itself a breach of this policy.

• Write to whistleblowing@iguako.tech, giving as much detail as you can and, if you wish, no name.
• Speak or write to the Designated Independent Director or to the chair of the Audit Committee.
• Tell any local compliance officer, who will pass the concern to the case office within one working day.
• Approach the supervisor of the licensed entity concerned; that route is always open.

3. What happens next

The case office acknowledges every report within three working days. Within ten working days the Designated Independent Director decides whether the concern falls under this policy, whether it needs investigation and who should investigate it. The reporter is told the decision and the name of the investigator. Where the concern touches a member of the Executive Committee or the Board, the investigator is appointed from outside the firm.

Investigations are proportionate and prompt. Most conclude within 60 days of the acknowledgement. Where more time is needed, the reporter is told why and given a new date. The investigator has the rights of access granted to Internal Audit under its charter: any record, any system, any person. Evidence is preserved from the day the report is acknowledged, and the Records Management and Retention policy suspends any scheduled deletion that could touch it.

When the investigation ends, the reporter is told the outcome in as much detail as the rights of other people allow. Findings that show wrongdoing go to the Compliance & Conduct Committee for disciplinary or remedial action, and to the Audit Committee where controls failed. The Designated Independent Director reports every case, its outcome and its elapsed time to the Board each half-year.

4. Protection of the reporter

No person suffers detriment for raising a concern in good faith, whether or not the concern is upheld. Detriment includes dismissal, demotion, loss of variable pay, exclusion from work, a hostile reference, or any change to a person's role or prospects that would not have happened without the report. A reporter who believes they have suffered detriment may say so through the same mailbox, and the claim is investigated by a person outside the reporter's division.

The identity of a reporter is confidential. It is known only to the Designated Independent Director, the case office and, where the reporter agrees, the investigator. It is not shared with the person the concern is about, with the reporter's manager or with any committee. Where a legal process in a jurisdiction requires disclosure, the reporter is told first and given the reasons.

Retaliation is gross misconduct. A person found to have retaliated against a reporter, or to have tried to discover the identity of an anonymous reporter, is subject to dismissal and to the malus and clawback provisions of the Remuneration policy. The firm has applied that sanction once since the policy was adopted, in 2024, and the case is described in anonymised form in the annual report to the Board.

5. Good faith and misuse

Good faith means an honest belief that the concern is true or worth examining. It does not require the reporter to be right. A concern that turns out to be mistaken, made in good faith, attracts full protection. The reporter is not expected to investigate before reporting and is not expected to prove anything. That is the job of the investigator.

A report made knowingly false, or made to harm another person rather than to expose wrongdoing, falls outside the policy. Such a report is a disciplinary matter for the person who made it. The threshold is high, and the decision that a report was made in bad faith is taken only by the Designated Independent Director after the reporter has been given the chance to respond.

Nothing in this policy prevents a person from reporting to a public authority, from giving evidence in a legal process or from obtaining independent legal advice. No contract, settlement or confidentiality undertaking entered into by any group entity restricts those rights, and any clause that purports to do so is unenforceable under the group's own rules.

6. Reporting and assurance

The channel is measured and published internally. In the year to 30 June 2026 the mailbox received 11 reports. Seven fell within the policy and were investigated; four were upheld in whole or in part; the median time from acknowledgement to outcome was 41 days. The four reports outside the policy were referred to the grievance or complaints route with the reporter's agreement.

Internal Audit reviews the operation of the channel every year and reports to the Audit Committee on whether reports were acknowledged and closed on time, whether confidentiality held and whether any detriment claims were made. The Designated Independent Director presents the annual report to the full Board, and the Board minutes record its discussion.

Every employee is trained on the policy at induction and every year afterwards. The training states the mailbox, the recipient and the protections in plain words, and it is signed off as understood. Line managers receive additional training on how to respond when a concern is raised to them directly, and on the prohibition against investigating it themselves.