A report can be made anonymously.

If you choose to stay anonymous, you're encouraged to provide sufficient evidence of the reported facts, in order for the report to be properly processed. In fact, it is more difficult - if not sometimes impossible - to process an anonymous report or to establish that the facts are correct.

Ledger recommends that you identify yourself in order to facilitate the conduct of investigations, It is specified that, in any case, your identity will remain confidential throughout the entire process.

After you raise a report, the platform generates a unique password that you must keep in order to keep track of your report and access the secure messaging system from the home page.

You will also get a notification:

• confirming that your report has been received, within 7 business days; and

• of the steps taken or initiated to assess the accuracy of the allegations and, if appropriate, to correct the subject matter of the report, within a maximum of 3 months as from the acknowledgment of receipt of the report.

The time taken to process your report varies and depends on the complexity of the facts or events reported and on the type of the supporting material provided. All exchanges on the platform are fully encrypted and can be accessed by clicking on the "ACCESS AN EXISTING REPORT" button and entering your password

Whistleblowing reports are received and processed in a way that guarantees the strict confidentiality of:

• your identity as a whistleblower;

• the identity of the person(s) implicated in the whistleblowing alert;

• any third party mentioned in the report; and

• the documents, information or data collected in the context the report.

All persons with knowledge of the content of a whistleblowing report must take all necessary measures to ensure the security and confidentiality of any information or documents provided, not only when it is received but also during the investigations and as long as such information is retained. They are bound by a strict confidentiality undertaking.

In accordance with applicable law, the admissibility of your report will be assessed in particular with regard to the following criteria:

• Are the facts or events reported contrary to the law, regulations or the Ledger's Code of Conduct?

• Are the facts or events reported described in sufficient detail?

• Has the report been raised in good faith and without direct financial incentive?

To be noted: If the information was not known in a professional context, whistleblowers must have had personal knowledge of it.