Compliance

Message from the CEO

We can be proud of having integrated the ethical standards of business integrity and a conscience and social responsibility that define us as a company.

Miguel Stillwell de Andrade

At EDP, we promote a culture of sharing and mutual respect based on a compliance policy that encompasses our activity throughout the entire legal and regulatory value chain.

To this end, the EDP Group is aligned with a zero-tolerance Compliance policy, towards transparency and justice, within the scope of preventing and combating illegal acts, such as practices associated with bribery, corruption, money laundering, and terrorist financing, among others. This commitment is reflected in the creation of a Compliance Department, responding to the need to promote respect for and compliance with the law and regulations in force in all the countries where EDP operates, in line with the evolution of international best practices. We can be proud of being part of the ethical standards of business integrity and conscience and social responsibility that define us as a company.

The mission and the programs

The EDP Group's Compliance Management System, approved by the Executive Board of Directors and by the Financial Matters/Audit Committee, includes an internal control system based on the “3 lines of defense”, in order to identify and properly manage the risks arising from the activity.
Within the scope of this System, the Compliance function is part of the 2nd line of defense, with the mission of promoting a culture of compliance and integrity, through the identification of relevant compliance risks and the dissemination and coordination of the implementation of mechanisms that promote compliance, proactively and systematically providing advice to the entire organization.

The Compliance Management System, certified according to the requirements of ISO Standard 37301 - Compliance Management Systems, is based on a Global Compliance Program composed of different Specific Compliance Programs:

Integrity

Personal Data Protection

Competition

Money Laundering

Separation of Activities

Internal Control System for Financial Reporting

Integrity

The EDP Group's performance is guided by high ethical standards, business integrity, awareness, and social responsibility, as well as strict compliance with applicable laws and regulations.

The Integrity Compliance Program reinforces the general principles of action and duties of the Group's companies, its employees and business partners, with regard to preventing and combating unlawful acts, corruption and/or bribery practices.

EDP SA's Specific Integrity Compliance Program is certified in accordance with the requirements of Standard ISO 37001 - Anti-corruption Management Systems.

An Integrity Specific Compliance Program was implemented based on the company’s commitment to ethics and integrity in all businesses and partnerships.

Personal Data Protection

Privacy and protection of personal data are fundamental rights that, with new technologies and the growing mass sharing of information, are gaining increasing relevance.

Data holders, even if they share their personal data, are increasingly sensitive and aware that, in this area too, they have rights that must be safeguarded.

In this context, this Compliance Program aims to ensure the adequacy of EDP Group entities to the applicable legal requirements in terms of Data Protection.

To this end, a set of cross-cutting methodologies and procedures was defined.

Competition

Competition is a central aspect in the daily lives of companies, which today not only compete for the market and for the preference of their consumers, but they also compete for talent, innovation, and visibility among their stakeholders, among others.

However, it is essential that this performance complies with the highest standards of ethics, integrity, and competition compliance, contributing to the sustainability and development of the markets in which we operate, in favor of a fairer society.

In this context, the Specific Competition Compliance Program was established in order to systematize the mechanisms to be adopted by the different companies of the EDP Group, with a view to comply with and apply rules to promote and defend competition.

Money Laundering

Organized crime and terrorism are realities that have been growing and impacting various sectors of activity, leading to the development and strengthening of legislation and specific regulations on these matters, both nationally and internationally.

(i) the adequacy of EDP and the respective obliged entities in Portugal to the requirements of the Law No. 83/2017, of August 18, on money laundering and terrorism financing (LBCFT/LMLTF);

(ii) the structuring of the approach and operationalization of third-party/transactions identification and analysis mechanisms, in alignment with the third-party Integrity Due Diligence (DDI/IDD) process.

EDP promoted the development of the Specific Compliance Program for Money Laundering Prevention and the Fight against Terrorism Financing (PBC-CFT/MLP-FTF) with a view to ensure:

Separation of Activities

E-Redes, as a Distribution Network Operator (ORD/DNO), as part of a vertically integrated economic group, is subject to the independence obligations imposed by the legal regime applicable to the national energy sector.

The independence requirements imposed on E-Redes, of a legal, organic and functional nature, led to the systematization of a set of compliance mechanisms included in the respective Specific Compliance Program.

Internal Control System for Financial Reporting

The implementation and maintenance of the Internal Control System for Financial Reporting (SCIRF/ICSFR) in the EDP Group has the following objectives:

Promote the implementation of mechanisms that enhance the preparation of financial statements in accordance with International Financial Reporting Standards (IFRS), free from material distortions, due to fraud or error;

Identify and assess potential risks with an impact on the financial statements and plan, together with the respective areas, activities that will lead to their mitigation;

Coordinate the implementation and monitoring of management and control models, ensure proper reporting, as well as promote continuous improvement initiatives;

Proactively and systematically provide advice, assisting with specialized technical knowledge in the preparation and maintenance of internal procedures, as well as practical guidelines, training, controls, and processes related to the management of risks.

Prevention, Detection, and response to non-compliance situations

The Compliance Management System allows for the harmonization of Compliance management guidelines and methodologies across the organization and different regulatory areas, promoting alignment with other internal policies and procedures - namely with the Integrity Policy and the Code of Ethics of the EDP Group, based on the following nine components:

Corporate Governance

Risk management

Standards, policies and procedures

Training and communication

Report

Incident Management

Testing and Monitoring

Third Party Compliance

Continuous improvement

Corporate Governance

A governance model is adopted for the purposes of Compliance Management in the EDP Group, in which the roles, attributions, and responsibilities are defined for the various figures/areas involved.

The relationship and coordination model between them is aligned with the model of the three lines of defense.

Risk management

The EDP Group's Compliance risk management methodology is based on the following pillars:

Identification and systematization of legal and regulatory requirements, external and internal;

Risk identification, analysis and assessment;

Characterization of existing Compliance practices and analysis of their maturity;

Characterization of potential evolution, depending on maturity, risk, and specific requirements of regulations.

The identification and assessment of compliance risks are carried out periodically or whenever there are material changes in circumstances in the legal and regulatory context or in the organization.

Standards, policies and procedures

In addition to the Code of Ethics, the EDP Group adopts principles, rules, processes, and procedures in order to prevent, identify and respond to the practice of criminal or administrative offenses, such as:

Anti-money laundering / financing of terrorism internal regulations and procedures;

Insider trading, anti-competitive practices, Privacy protection, environment and health and safety.

In terms of integrity, within the scope of the Anti-Corruption Management System, EDP establishes guidelines relating to Offers and Events, Donations and Sponsorships, Interactions with Politically Exposed persons, Conflicts of interests, among others.

Training and communication

EDP systematically provides compliance training to all employees.

Adequate to the functions of employees and to the compliance risks to which the group is exposed;

Regularly revised and re-planned, in order to ensure alignment with changes in the Compliance Management System and the permanently updated knowledge of employees.

The compliance training and communications are:

Evaluated for its effectiveness;

Report

EDP adopts a reporting model based on the principle of transparency and communication of valid and reliable information on the evolution, implementation, functioning, and effectiveness of the Global and of the Specific Compliance Programs:

Bottom-up: Information arrives at adequate levels for timely decision-making purposes.

Top-down: Those responsible for management rely on the information received to make key decisions of a more operational nature or from a perspective of continuous improvement.

Incident Management

The EDP Group provides several channels of contact and communication of irregularities ("whistleblowing").

Ethics Channel (communications regarding misconduct and/or questions of an ethical nature);

Communication Channel for Irregularities in Financial Matters, Internal Control, and Auditing (communications relating to matters relating to the prevention of corruption, internal accounting controls, and auditing).

The reporting of non-compliance situations must be carried out through the following channels:

Irregularities Communication Channel related to Money Laundering and Terrorism Financing;

Testing and Monitoring

The Compliance function ensures continuous monitoring of the Compliance Programs, following up on the various compliance activities, namely through:

Periodic review of identified risks and defined and implemented compliance mechanisms;

Recording evidence of the execution of these control mechanisms;

Monitoring the development of the various Specific Compliance Programs, their respective implementation, and functioning;

Periodic assessment of the existence of opportunities for improvement and monitoring of their implementation.

Third Party Compliance

EDP ensures the identification of contractual relationships with third parties who participate in business processes that may affect the Group's Compliance environment, carrying out its risk assessment and defining control and risk mitigation measures:

In the obligation for third parties to adhere to EDP's policies, standards, and procedures;

In the implementation, by EDP, of a Due Diligence process for third-party integrity prior to carrying out a certain transaction/contracting;

In the adoption of contractual clauses or other equivalent compliance mechanisms, of a general and transversal nature, ensuring the responsibility of third parties for complying with legal and regulatory obligations and with the applicable EDP policies;

In defining service levels/penalties associated with compliance issues.

Finally, the monitoring of these third parties throughout the execution of the respective contract must be ensured, namely in terms of the effective implementation and operationalization of the established Compliance mechanisms, when applicable.

Continuous improvement

The Compliance Management System is constantly being updated and improved, namely through the conclusions reached in the monitoring carried out and in the periodic review of the Compliance processes and methodologies.

(1) determines the possibility of occurrence of similar situations in other circumstances;

(3) ensures the follow-up of the implementation.

Thus, whenever one becomes aware of non-compliance situations, the Compliance function:

(2) identifies the necessary corrective actions so that the situation does not recur and promotes the respective implementation;