Whistleblower & Speak-Up Policy

GBCORP is committed to operating with the highest standards of integrity. We want anyone connected with GBCORP — including employees, contractors, suppliers, customers, and members of the public — to feel safe and supported when raising concerns about suspected wrongdoing. This Whistleblower / Speak-Up Policy explains how to raise concerns and how GBCORP will respond.

1) Purpose

This Policy gives effect to GBCORP's commitments under:

• EU Whistleblower Directive (2019/1937)
• United States Sarbanes-Oxley Act, Dodd-Frank Act, and related federal protections
• UK Public Interest Disclosure Act 1998
• Equivalent whistleblower-protection laws in our other operating jurisdictions

2) Scope

This Policy applies to anyone who, in the course of their relationship with GBCORP, becomes aware of suspected wrongdoing. This includes current and former employees, directors, officers, contractors, agents, suppliers, customers, and any other party in our network.

3) What to Report

You should report any genuinely held concern about:

• Criminal conduct (including fraud, bribery, money laundering, theft)
• Breach of competition or antitrust law
• Breach of data-protection or privacy law
• Health, safety, and environmental risks
• Modern slavery, human trafficking, or labour exploitation in our operations or supply chain
• Discrimination, harassment, or retaliation
• Financial irregularities, accounting fraud, or false reporting
• Conflicts of interest involving GBCORP staff or contractors
• Deliberate concealment of any of the above

This Policy is not intended for routine business complaints, personal grievances about employment terms, or customer-service issues — those should go through the relevant HR or customer-support channels.

4) Reporting Channels

Internal Channels

• Your line manager — for concerns you feel comfortable raising directly within your team
• Human Resources — for employment-related concerns
• GBCORP Compliance team — [email protected]
• General Counsel — [email protected]

Confidential / Anonymous Channel

For concerns where confidentiality or anonymity is important, use the secure intake at:

• Email: [email protected] (encrypted; messages go directly to the Audit Committee Chair and General Counsel)
• Post (anonymous accepted): Audit Committee Chair, GBCORP, One World Trade Center, 285 Fulton Street, Manhattan, New York, USA

External Channels

You always retain the right to report to a competent external authority (e.g., a national whistleblower agency, regulator, or law-enforcement body). This Policy does not affect that right.

5) Confidentiality

GBCORP will take all reasonable steps to keep your identity confidential. Information will be shared only with people who need to know to investigate and respond, and as required by law. If we need to disclose your identity, we will tell you first wherever possible.

6) Anonymous Reports

You may report anonymously. Anonymous reports are taken seriously and investigated to the extent the information allows. Note that lack of contact information may limit our ability to follow up or to give you feedback on the outcome.

7) Non-Retaliation

GBCORP absolutely prohibits retaliation of any kind against a person who in good faith raises a concern, supports an investigation, or refuses to participate in suspected wrongdoing. Prohibited retaliation includes (without limitation): dismissal, demotion, withholding promotion, reduction of pay, transfer, discipline, harassment, or threats.

Any person found to have retaliated will be subject to disciplinary action up to and including termination of employment or contract, and possible referral to law enforcement.

8) Investigation Process

When a report is received, GBCORP will:

• Acknowledge the report within 7 days (where contact information is provided)
• Triage and decide whether and how to investigate
• Investigate proportionately, often by appointing an internal or external investigator independent of those involved
• Provide feedback on the outcome, where appropriate and lawful, typically within 90 days
• Take action to remedy substantiated wrongdoing, prevent recurrence, and discipline those responsible

9) Reports Made in Bad Faith

Making a report you know to be false, or making a report for an improper purpose (e.g., to harm a colleague), is itself a serious breach of GBCORP policy and may result in disciplinary action. Honest concerns reported in good faith that turn out to be mistaken are not bad-faith reports and you are protected.

10) Records and Review

GBCORP keeps confidential records of all reports and investigations. The Audit Committee reviews aggregated whistleblower data annually as part of its oversight function.

11) Contact

• General compliance: [email protected]
• Confidential Speak-Up: [email protected]
• Legal: [email protected]