Principles of the Channel and Guarantees

All reports shall be handled in line with the following principles, hence ensuring the protection of the rights of both the whistleblower and the person concerned:

• Authority and Independence: the Deputy Director General of Regulatory Compliance, as the person responsible for the Channel, shall carry out his/her functions independently and autonomously from the rest of the entity’s bodies, whereby he/she has sufficient authority to avoid any type of interference in the exercise of his/her functions.
• Anonymity: any report of an irregular act, behaviour, action or event that may constitute a breach may be anonymous.
• Confidentiality: all information reported, regardless of whether it is anonymous or not, shall be treated as confidential by the Group, unless disclosure is required under national law or in the context of a legal investigation or proceedings.
  Confidentiality shall also be guaranteed when the report has been filed via a channel other than the Whistleblower Channel or has been made to personnel not responsible for its processing, whereby the person informed shall be obliged to communicate it to the person in charge of the Channel.
• Any report received will be handled impartially and objectively by the Group.
• Prohibition of retaliation: a person who reports an event or action via the channel in good faith, employee representatives who advise or support the whistleblower, people within the Group who have assisted the whistleblower in the process, individuals related to the whistleblower (co-workers or family members), as well as legal entities for which the whistleblower works or with which the whistleblower has any other employment relationship or in which the whistleblower has a significant stake, may not be subject to any form of retaliation or undergo any other adverse consequences as a result of the report. The Group shall take the necessary measures to guarantee this principle.
• Diligent response: all reports shall be handled with due diligence and respect, responding to the whistleblower within the time limits established in the regulations for each type of communication.
• The maximum period to respond to an investigation shall be three months counted from the date the report is received or, if no acknowledgement of receipt was sent to the whistleblower, three months from the expiry of the seven-day period after the report was filed, except in cases of particular complexity, which require this period to be extended, in which case it may be extended by up to a maximum of a further three months.
• Respect for the person concerned: he/she shall be entitled to the presumption of innocence and the right to honour, as well as the right to be kept informed of the actions or omissions attributed to him/her and to be heard at any time, exercising his/her right of defence. This communication shall be issued at the time and in the way deemed appropriate to ensure the proper completion of the investigation.
• Privacy and security of information: any reports received shall be safeguarded in compliance with the data protection and information security measures and guarantees.

If, during the course of the investigation or upon its conclusion, facts are detected that could be indicative of a crime, the information shall be immediately forwarded to the Public Prosecutor's Office. Should the facts affect the financial interests of the Union, they shall be referred to the European Public Prosecutor's Office.