Whistleblowing

Internal Reporting Channels

The Grand Duchy of Luxembourg transposed Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons who report breaches of Union law through the Law of May 16, 2023, transposing Directive (EU) 2019/1937 (hereinafter the "Law").This law came into force on May 21, 2023.

The Law establishes reporting channels allowing whistleblowers who have obtained information in a professional context to report actual or potential violations of Luxembourg law or European Union law. It provides for a prohibition of all forms of retaliation against whistleblowers acting in good faith.

In this context, iBanFirst makes this procedure available to persons who may make a report, in accordance with the legal requirements applicable in Luxembourg.

A whistleblower has several internal channels to make a report and enjoys free choice between them:

• Secure Reporting System (dedicated platform):

https://whistleblowersoftware.com/secure/ibanfirstsa

• In-person Interview

Particularly upon simple request to a compliance officer of iBanFirst S.A., Luxembourg branch

• Email

whistleblowing@ibanfirst.com

Postal Mail (preferably by registered letter)

iBanFirst S.A., Luxembourg branch
Compliance Officer
26, Boulevard Royal
2449 Luxembourg
Grand Duchy of Luxembourg

External Reporting Channels

A whistleblower may also use an external reporting channel, either after using internal channels or directly, when they believe that external reporting is more appropriate.In Luxembourg, external reports can be addressed to the Office of Reports, the competent national authority under the responsibility of the Ministry of Justice.

🔹 Competent Authority

Office of Reports

🔹 Official Reporting Platform (secure channel)

https://mj.gouvernement.lu/en/dossiers/2023/lanceurs-d-alerte.html

🔹 Available Forms of Reporting

Reports can be made:

• Electronically via the dedicated platform
• In writing (mail), accompanied by any evidence supporting the reported facts
• Through in-person interview, upon request

🔹 Postal Address (written report)

Office of Reports
13, rue Erasme, Centre administratif Werner
L-1468 Luxembourg
Grand Duchy of Luxembourg

Financial Sector Specific Reporting (CSSF)

When the report concerns violations falling under financial regulations and prudential supervision, the whistleblower may also contact the Commission de Surveillance du Secteur Financier (CSSF) via its independent and confidential reporting channel, in accordance with the rules applicable to the Luxembourg financial sector.

🔹 Competent Authority

Commission de Surveillance du Secteur Financier (CSSF)

🔹 CSSF Reporting Channels:

1. Secure platform: https://whistleblowing.apps.cssf.lu/index.html?language=fr
2. Email: whistleblowing@cssf.lu
3. In person at CSSF headquarters
4. By phone: +352 2625 1 2757 during business hours for initial contact

🔹 Scope

This channel is intended for persons acting in good faith wishing to report:

• Malfunctions
• Irregularities
• Violations of financial regulations committed by entities or persons subject to CSSF supervision.

🔹 CSSF Postal Address

Commission de Surveillance du Secteur Financier
L-2991 Luxembourg
Grand Duchy of Luxembourg