Whistleblowing
Whistleblowing Guidelines
Index
Premise
Purpose of the procedure and scope of application
Regulatory and best practice references
Persons who can make a report
Subject of the report
Procedures for submitting reports
Budget
Management of internal reports
Obligations of cooperation
General principles and protections
Training and information
Violation of the procedure
Sanctioning system
Updating of the procedure
1. Introduction
This procedure applies to EV MMC Italia S.r.l. (“MMC” or the “Company”) and aims to implement and regulate a system for reporting irregularities within the Company’s activities.
In particular, the procedure incorporates the provisions of Legislative Decree No. 24 of March 10, 2023 (the “Whistleblowing Decree”), implementing Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons who report breaches of Union law and containing provisions regarding the protection of persons who report violations of national or European Union regulations. This framework governs the protection of individuals who report violations of national or EU laws that harm the public interest or the integrity of public administration or private entities, and of which they have become aware in a public or private work context.
The objective of the EU Directive is to ensure both the protection of the whistleblower’s freedom of expression and the strengthening of legality and transparency within organizations for the prevention of offenses. It establishes the right to protection for whistleblowers (confidentiality, prohibition of retaliatory acts) and organizational obligations for entities (establishment of an internal reporting channel, instructions for the use of external reporting channels, and procedures to ensure confidentiality).
The purpose of whistleblowing is to enable the Company to address reported issues as quickly as possible, contributing to the prevention and detection of potential wrongdoing.
This procedure also complies with personal data protection regulations and, in particular, with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, concerning the protection of natural persons with regard to the processing of personal data.
The Company has implemented a system for reporting and managing violations and, in light of the regulatory changes outlined above, has consulted the company trade union representatives pursuant to Article 51 of Legislative Decree No. 81/2015, in accordance with Article 4, paragraph 1, of Legislative Decree No. 24/2023.
2. Purpose of the Procedure and Scope of Application
The purpose of this procedure is to provide clear operational guidance regarding the process of submitting, receiving, analyzing, and handling reports made by any authorized party, whether third parties or employees, as identified under Article 3, paragraph 3 of Legislative Decree No. 24/2023, including reports submitted anonymously, as well as the forms of protection granted to whistleblowers under Legislative Decree No. 24/2023.
Accordingly, this procedure aims to regulate the process of reporting violations in compliance with the aforementioned Legislative Decree No. 24/2023 and, therefore, to provide all necessary guidance to enable relevant parties to report—also anonymously—civil, criminal, administrative, and/or accounting offenses, as well as violations of national and/or European regulations.
For matters not expressly covered by this Procedure, the provisions of the aforementioned Legislative Decree No. 24 shall fully apply.
As stated, the purpose of whistleblowing is to enable the Company to address reported issues as promptly as possible, contributing to the prevention and detection of potential wrongdoing.
Therefore, the purpose of this document is also to remove factors that may hinder or discourage the use of this mechanism, such as doubts or uncertainties about the procedure to follow and fears of retaliation or discrimination.
From this perspective, the objective of the procedure is to provide the whistleblower with clear operational guidance regarding the subject matter, content, recipients, and methods for submitting reports, as well as the forms of protection available under the legal system.
To this end, this document mainly regulates the following areas:
what can be reported;
who can submit a report and any other individuals who benefit from the same protections as the whistleblower;
examples of actions, facts, and conduct that can be reported;
the form and content of the report;
reporting procedures, i.e., reporting channels;
the report management process, identifying: activity phases, roles, responsibilities, operational methods, and tools used;
the principles and general rules governing the reporting process, including the protection of the whistleblower, the person involved (reported person), and any other parties involved, as well as the consequences of any misuse of the reporting system.
This procedure also complies with personal data protection regulations and, in particular, with the provisions of Regulation (EU) No. 2016/679 of the European Parliament and of the Council of April 27, 2016, concerning the protection of natural persons with regard to the processing of personal data.
3. Regulatory and Best Practice References
Directive (EU) No. 2019/1937 on the protection of persons who report breaches of Union law (so-called Whistleblowing Directive).
Legislative Decree No. 24 of 2023 implementing Directive (EU) No. 2019/1937.
Guidelines on procedures for submitting and managing external reports, issued by ANAC in implementation of Legislative Decree No. 24 of 2023 (draft text for consultation dated June 1, 2023; final text approved by Resolution No. 311 of July 12, 2023).
Operational guide for private entities on the new whistleblowing framework – Confindustria, October 2023.
Research document on the new whistleblowing framework and its impact on Legislative Decree No. 231/2001 – National Council of Chartered Accountants and Accounting Experts and FNC, October 2023.
Regulation (EU) No. 2016/679 on the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data (General Data Protection Regulation, or GDPR).
Legislative Decree No. 196/2003, the Personal Data Protection Code (so-called Privacy Code), as subsequently amended and supplemented.
3.1 Principles and Nature of the Institution (Summary)
The term whistleblower refers to an individual who reports violations or irregularities committed to the detriment of the public interest to the authorities empowered to take action.
In this context, reporting (so-called whistleblowing) is an expression of civic responsibility through which the whistleblower contributes to the detection and prevention of risks and harmful situations affecting the organization or company to which they belong and, consequently, the broader public interest.
Whistleblowing is a procedure aimed at encouraging reporting and, given its social function, protecting the whistleblower.
The primary purpose of whistleblowing is to prevent or resolve issues internally and in a timely manner.
Whistleblowing legislation, in summary, provides for a system of protection for specific categories of individuals who report information acquired in a work context relating to violations of national or European Union laws that harm the public interest or the integrity of the entity, as well as protective measures including the prohibition of retaliation to safeguard the whistleblower, facilitators, colleagues, relatives of the whistleblower, and legal entities connected to the whistleblower.
It also provides for the establishment of internal reporting channels within the entity (including at least one IT-based channel) for submitting reports, ensuring—also through the use of encryption tools—the confidentiality of the identity of the whistleblower, the person involved and/or mentioned in the report, the content of the report, and the related documentation.
In addition, beyond the possibility of filing a report with judicial or accounting authorities, it allows (where one of the conditions set out in Article 6, paragraph 1, of Legislative Decree No. 24/2023 is met) external reporting through the channel managed by the National Anti-Corruption Authority (ANAC), as well as public disclosure (where one of the conditions set out in Article 15, paragraph 1, of Legislative Decree No. 24/2023 is met) through the press or electronic means or other channels capable of reaching a wide audience.
It also provides for disciplinary measures and administrative financial penalties imposed by ANAC in the cases provided for under Articles 16 and 21 of Legislative Decree No. 24/2023.
4. Subjects who may submit a report
According to Legislative Decree No. 24 of 2023, those who may report violations, the so-called whistleblowers, to whom the protections described below apply, are: employees; self-employed workers, collaborators, service providers, freelancers and consultants working for the company; workers or collaborators of suppliers and third parties; persons with functions of administration, management, control, supervision or representation, even if such functions are exercised de facto; shareholders (natural persons); volunteers and trainees, whether paid or unpaid, who carry out their activities within the Company.
4.1 Who is protected in the case of a report
The Decree protects the whistleblower by ensuring the confidentiality of their identity, prohibiting any retaliatory actions against them, and limiting their liability for the disclosure or dissemination of certain types of protected information.
Protection for the whistleblower also applies if the legal relationship has not yet started, during the probation period, and after the termination of the relationship. Therefore, such protection applies not only during the employment relationship but also before or after its establishment, if the information about the violation was obtained during the recruitment process or pre-contractual phase, during the probation period, or in any case during the employment relationship, as well as after its termination.
The protections granted to the whistleblower are also extended to other individuals who may be subject to retaliation due to their role or their close relationship with the whistleblower.
In particular, these include the following subjects:
the Facilitator, a natural person who assists the whistleblower in the reporting process, operating within the same work environment and whose assistance must remain confidential;
persons within the same work environment as the whistleblower who are linked to them by a stable emotional or family relationship up to the fourth degree;
work colleagues of the whistleblower who operate in the same work environment and who have a habitual and ongoing working relationship with the whistleblower;
the entity owned—exclusively or with a majority share by third parties—by the whistleblower, complainant, or person making a public disclosure;
the entity where the whistleblower, complainant, or person making a public disclosure works.
5. Subject of the Report
There is no exhaustive list of crimes or irregularities that may constitute the subject of whistleblowing. Reports are considered relevant when they concern behaviours, risks, crimes, or irregularities—whether committed or attempted—that harm the public interest and EV MMC Italia S.r.l.
In particular, a report may concern actions or omissions, whether committed or attempted, that are: criminally relevant; carried out in violation of Codes of Conduct or other internal provisions subject to disciplinary sanctions; capable of causing financial harm to MMC; capable of damaging MMC’s reputation; capable of causing harm to the health or safety of employees, users, or citizens, or environmental damage; or capable of causing harm to users, employees, or other individuals carrying out their activities at MMC.
The whistleblower may communicate information relating to inappropriate or improper conduct, reporting alleged violations—whether established or suspected—or behaviours, acts, or omissions that may harm the public interest or the integrity of the private entity, and which consist of:
unlawful acts falling within the scope of European Union or national acts relating to specific sectors, including public procurement; financial services, products and markets, and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; public health; consumer protection; privacy and personal data protection; and network and information system security;
acts or omissions that harm the financial interests of the European Union;
acts or omissions concerning the internal market of the European Union;
acts or behaviours that defeat the object or purpose of provisions contained in EU acts;
other violations related to Sustainability Policies.
5.1 Requirements of Reports
Reports must: be made in good faith; be detailed and based on precise and consistent factual elements; concern facts that can be verified and are directly known by the reporting person; and contain, if known, all information necessary to identify the authors of the potentially unlawful conduct.
It is the responsibility of the whistleblower, including an anonymous one, to submit reports in good faith, meaning based on the belief that what is stated is true (regardless of whether it is later confirmed by subsequent investigations), and in line with the spirit of this procedure.
To this end, the whistleblower may: describe the reported facts accurately; indicate the person(s) considered responsible for the violation(s), as well as any other individuals involved and/or able to provide information about the matter; describe the time and place in which the reported events occurred; attach all available supporting documents; and provide any useful elements for reconstructing the facts and verifying the validity of the report.
Clearly unfounded, opportunistic reports and/or those made solely with the intent to harm the reported person or any other individuals involved will not be taken into consideration and may result in sanctions and/or legal action before the competent judicial authority.
5.2 Reportable Violation under the Procedure: Conditions and Requirements
In order for a report to fall within the scope of the whistleblowing procedure (and for the whistleblower to consequently benefit from the confidentiality of identity and the protections provided by Legislative Decree No. 24/2023), it must meet the following objective requirements:
the violation must fall within those that can be subject to reporting;
at the time of the report, there must be reasonable grounds for the whistleblower to believe that the information regarding the violation is true.
5.3 What cannot be subject to reporting: prohibited reports
Whistleblowing does not cover personal grievances of the reporting person or claims/requests falling within the scope of employment relationships or relations with supervisors or colleagues, for which reference must be made to the applicable Human Resources regulations and procedures.
In particular, it is prohibited:
the mere use of insulting expressions;
the mere use of offensive tones, personal insults, or moral judgments aimed exclusively at offending or damaging the personal and/or professional honour and/or reputation of the person(s) referred to in the report;
the submission of reports with purely defamatory or slanderous intent;
the submission of reports concerning exclusively aspects of private life, without any direct or indirect link to the corporate and/or professional activity of the person reported;
the submission of discriminatory reports against the reported person and/or between colleagues;
the submission of reports made with the sole purpose of harming the reported person;
the submission of reports containing personal complaints or interpersonal conflicts;
the submission of reports concerning exclusively one’s own individual employment relationship.
In the case of submitting prohibited reports, the confidentiality of the whistleblower’s identity, as well as the other protective measures provided for, may not be guaranteed.
Therefore, the whistleblower must be aware that:
the report must not contain accusations that the whistleblower knows to be false and must not be used for the purpose of offending and/or harming the reported person;
the report does not guarantee any protection for the whistleblower in the event that they have contributed to the commission of the unlawful conduct;
the criminal, civil, and disciplinary liability of the whistleblower remains unaffected in the case of a defamatory or slanderous report, a report made with intent or gross negligence, or a report made solely with the aim of harming the reported person.
In short, all reports concerning behaviours or irregularities—whether committed or attempted—carried out by directors, managers, employees and/or collaborators, professionals, and external parties in the course of their activities, duties, functions, delegations, and assignments performed within the company, for its benefit and/or attributable or connected to it, are considered relevant.
Reports must concern situations in which the subject has directly come to know of the facts in question due to the employment relationship and those acquired in the course of and/or because of the performance of work duties, even if incidentally, with the exclusion of personal complaints or claims of a personal nature.
5.4 Reports not included in the procedure
The following are not permitted:
reports concerning security and defence matters, or procurement in the field of defence and national security;
reports concerning breaches already regulated by special laws (applicable to specific sectors such as financial services, prevention of money laundering, terrorist financing, transport safety, and environmental protection);
personal disputes, claims or requests relating to individual employment relationships or to relationships with hierarchically superior figures, colleagues, or collaborators.
5.5 Content of the Report and Protection of Anonymity
Reports may concern:
violations that have been committed or that may have been committed, based on well-founded and specific elements;
violations that have not yet been committed, but which, based on well-founded and specific elements, the whistleblower believes could be committed;
conduct aimed at concealing the violations.
Reports must include a detailed description of the facts and any supporting documents in order to allow an adequate understanding and assessment of their reliability.
It is not necessary for the whistleblower to be certain of the actual occurrence of the reported facts or of the identity of the person responsible. It is sufficient that the whistleblower believes, based on their own knowledge and in good faith, meaning on the basis of a reasonable conviction grounded in precise and specific factual elements, that the reported information is true and falls within the objective scope of the applicable regulation.
Therefore, not included among reportable information are clearly unfounded news, mere suspicions, information already entirely in the public domain, as well as information acquired solely on the basis of simple assumptions or poorly reliable rumours (“hearsay”).
The whistleblower must provide the necessary elements so that the recipient of the report can assess the matter and carry out appropriate checks and investigations independently, in order to verify the validity of the reported facts.
For this purpose, in order to allow the Report Manager to carry out the necessary and appropriate checks and investigations to verify the validity of the reported facts, the report must include the essential elements of the report, namely a clear and complete description of the fact, with an indication of the time and place in which the reported incident or conduct occurred, in order to enable a proper assessment of its validity.
In addition, the Whistleblower may indicate the following further elements:
a) their personal details (however, the report may also be anonymous reports);
b) any other persons who are aware of the facts;
c) the personal details or other elements that may allow the identification of the person(s) who carried out the reported conduct or the person(s) involved;
d) any supporting documents that may confirm the validity of the facts;
e) any other useful information for reconstructing and verifying the reported facts as well as for assessing the validity of the report.
Each channel established for receiving reports ensures the confidentiality of the whistleblower, protecting their identity, as provided by law.
Where the Report Manager deems that the reports describe the facts and persons involved in sufficient detail, the Company also accepts reports of violations in anonymous form.
Anonymous reports that demonstrate seriousness and credibility of the issue raised, as well as the likelihood that the facts can be confirmed by reliable sources, may also be considered.
Anonymous reports, meaning those without elements allowing the identification of their author, will be taken into consideration only if they are adequately detailed and supported by sufficient factual information, such that they can be linked to specific contexts and will be examined only if they contain adequate and detailed elements allowing verification.
The requirement of truthfulness of the reported facts and situations remains unchanged, in order to protect the person reported.
6. Procedures for submitting reports
Four procedures are provided for submitting reports:
the procedure for reporting through an internal channel within the Company;
the procedure for reporting through an external channel established and managed by ANAC;
public disclosure;
reporting to judicial and accounting authorities, in cases within their competence.
In short, the choice of the reporting channel is not at the discretion of the whistleblower: as a priority, the internal channel must be used, and only when the conditions expressly provided by law are met is it possible to submit a report through the external channel. Public disclosure represents a kind of last resort.
In this regard, although the Decree does not explicitly establish a hierarchy among the different reporting methods, it sets specific conditions for accessing both the external procedure and public disclosure; this aims to encourage entities to adopt efficient organisational systems integrated into their internal control systems and to achieve a proper balance between the protection of the whistleblower and the safeguarding of the entity’s reputation.
It follows that the use of the internal channel is encouraged, as it is closer to the origin of the issues being reported.
The preference for the internal channel is also evident from the fact that only when specific conditions established by law are met can whistleblowers resort to the “external channel” managed by ANAC.
The legislator’s intent is to encourage whistleblowers to first resort to the channels internal to the company to which they are connected. This is because more effective prevention and detection of violations comes from obtaining relevant information from those closest to the origin of the violations themselves.
This principle is also aimed, on the one hand, at fostering a culture of good communication and corporate social responsibility within organisations, and on the other, at ensuring that whistleblowers, by bringing to light unlawful acts, omissions, or conduct, significantly contribute to the improvement of their organisation.
With a view to allowing the selection of the most appropriate reporting channel depending on the specific circumstances of the case and thus ensuring broader protection, Legislative Decree No. 24/2023 also provides, under certain conditions, for public disclosure, which therefore represents a last resort reporting method.
The duty to report to the judicial authority remains, of course, unaffected where the legal requirements are met.
The procedure for reporting through an internal channel within the Company (so-called internal reporting)
The internal reporting channel is therefore the primary tool to be used and is in any case the only channel available for reports concerning violations of national legislation and violations of European Union law. The internal reporting channel must ensure confidentiality, also through the use of encryption tools.
The internal reporting channel must ensure confidentiality, also through the use of encryption tools, where IT systems are used:
of the whistleblower;
of the facilitator;
of the person involved or any other individuals mentioned in the report;
of the content of the report and the related documentation.
The Whistleblowing Decree provides that internal reports may be submitted:
in written form, through electronic means (for example, a whistleblowing IT platform) and/or through analog/written methods (for example, by ordinary mail).
Internal reporting methods
Internal reports of MMC may be submitted through the channel, which is active and available exclusively in the ways described below.
The use of this tool is the priority solution for the whistleblower.
The Company has activated and adopted, in compliance with the provisions of the Whistleblowing Decree, the following internal reporting channel which, through a specific cloud-based platform accessible and active 7 days a week, 24 hours a day, allows the submission of reports in electronic form and ensures—also through encryption tools—the confidentiality of the identity of the reporting person, the person concerned, and any person mentioned in the report, as well as the content of the report and the related documentation.
Reports via the online platform (hereinafter also the “platform” or “portal”) may be submitted in Italian and English (link: https://engelundvoelkers.integrityline.com/?lang=en)
The online portal is freely accessible via the link available on the EV MMC Italia S.r.l. website.
The reporting person accesses the portal, fills in a standard form/sheet (available in Italian and English) which contains the essential elements required to submit a proper report. Some of these fields are mandatory, as they are considered essential, while others are optional at the discretion of the reporting person.
Once the report is completed, credentials for the exclusive use of the reporting person will be provided. These credentials allow access to the report, the submission of additional information useful for verifying the reported facts, and communication with the report manager (including for anonymous reporters).
Personal credentials, linked to the initial report, are subsequently required for the reporting person to engage in further communications with the report manager (receive messages and/or clarification requests, and submit additional information that may become known to them in relation to the reported facts).
In case of loss of personal credentials, they cannot be recovered or duplicated in any way; in such an event, the reporting person must submit a new report and identify themselves again.
The adopted reporting portal, in order to allow for a proper investigation of the reported facts, enables a confidential “dialogue” between the reporting person and the report manager, as well as the possible submission of electronic documents as attachments.
The portal functions as an electronic register of reports, allowing: (i) the assignment of a progressive unique code, (ii) classification, and (iii) traceability of the management process; this also applies to reports received through other channels, once uploaded into the portal.
If the reporting person provides their identity, the report manager receives their identifying data and must ensure its confidentiality.
Anonymous reporting is also permitted.
In this regard, it should be noted that the platform allows the reporting person to remain in contact with the report manager during the handling of an anonymous report, enabling them to provide clarifications and/or supporting documents through a messaging system that ensures anonymity.
However, it should be taken into account that submitting an anonymous report may make it more difficult to investigate the reported conduct and to facilitate communication between the Report Manager and the Reporting Person, and may therefore reduce the usefulness of the report itself.
7. Budget
The body responsible for appointing the report manager assesses the opportunity to assign to the same an annual budget, which may be used for the performance of the assignment, in relation to specific investigative or decision-making needs concerning the handling of the report.
8. Management of Internal Reporting
The report manager is an independent and dedicated individual, with personnel specifically trained to perform this task, responsible for managing reports of violations².
The manager is governed by its own internal regulations and is provided with the necessary resources to carry out its assignment.
It is the responsibility of the report manager, during the verification phase, to promote the involvement of one or more other team members, when necessary, depending on the content of the report.
It is envisaged that reports will be managed by an external consulting company, which is independent and autonomous and able to provide adequate guarantees of confidentiality and data protection. This company will carry out a preliminary factual analysis as well as an assessment and classification of the reports.
Phases of management of whistleblowing reports
The report manager:
within seven days must issue the acknowledgment of receipt of the report to the reporting person from the submission of the report itself.
Once the phase relating to the transmission of the acknowledgment of receipt has been completed, proceeds with the preliminary examination of the received report;
evaluates admissibility (existence of subjective and objective requirements for submitting a whistleblowing report);
assesses whether it is admissible as a whistleblowing report.
For admissibility purposes, it is necessary that the report clearly indicates:
• the circumstances of time and place in which the reported fact occurred and, therefore, a description of the facts subject to the report, including details of the contextual information and, where available, the manner in which the reporting person became aware of the facts;
• the personal details or other elements that allow identification of the person to whom the reported facts are attributed.
If the report is deemed inadmissible or not actionable, the report manager may proceed with its closure, while ensuring traceability of the supporting reasons.
Carries out the investigation and verification of the report. Once admissibility and procedural requirements are confirmed, the report manager initiates an internal investigation into the reported facts and conduct in order to assess their validity:
• ensures that all appropriate checks are carried out on the reported facts, guaranteeing timeliness and compliance with the principles of objectivity, competence, and professional diligence.
• ensures appropriate measures are taken to manage any potential conflict of interest.
Once the investigation activity is completed, the report manager may:
a. close the report as unfounded, providing reasons;
b. declare the report well-founded and refer it to the competent internal bodies/functions for further action (e.g., company management, General Manager, legal department, or human resources). The report manager is not responsible for assessing individual liability or any subsequent measures or proceedings.
provide feedback to the reporting person, within three months from the date of the acknowledgment of receipt or—if such acknowledgment is not issued—within three months from the expiry of the seven-day deadline for issuing such acknowledgment.
Upon expiry of the three-month period, the report manager may inform the reporting person of:
a. the closure of the report, providing reasons;
b. the confirmation of the validity of the report and its transmission to the competent internal bodies;
c. the activities carried out up to that point and/or the activities it intends to carry out.
In the latter case, it is recommended to also communicate the final outcome of the investigation (closure or confirmation of the validity of the report with transmission to the competent bodies), in line with ANAC guidelines.
In order to ensure traceability of the activities carried out, the online platform also serves as a Register of Reports—protected by multi-factor authentication credentials—accessible to the report manager. This makes it possible to assign a progressive unique code to reports received, classify them, and track the management process.
9. Duty of Cooperation
The personnel and any other internal contact of the Company are required to cooperate with the utmost diligence in the investigative activity carried out by the report manager.
The reporting procedure through an external channel, established and managed by ANAC (so-called external reporting)
ANAC has established a reporting channel accessible not only to public sector entities but also to private sector entities, for:
(i) reports concerning violations of EU legal provisions, where the conditions provided by law are met; and
(ii) the communication of retaliatory measures.
The reporting person may submit an external report only if, at the time of submission, one of the following conditions provided by law is met:
a) the internal reporting channel has not been established or, if established, does not comply with legal requirements;
b) the internal report has not been followed up;
c) there are well-founded reasons to reasonably believe—based on concrete circumstances and information that is actually available and attached, and therefore not on mere speculation—that if an internal report were made, it would not be followed up or would result in retaliation (as per ANAC Guidelines);
d) there is reasonable ground to believe that the violation may constitute an imminent or obvious danger to the public interest. This may include, for example, cases where the violation requires urgent action to safeguard people’s health and safety or to protect the environment.
ANAC may request from the reporting person proof of the correct use of the external channel and
therefore proof of the existence of at least one of the aforementioned conditions.
Also the external channel established by ANAC, like the internal channels, must ensure confidentiality, as stated above, and the report must have the same form (written, oral, and, if requested by the reporting person, through a direct meeting).
If the external report has been submitted to an incompetent authority, it is forwarded, within seven days of receipt, by the recipient to ANAC, informing the reporting person of the transfer(3).
It should be noted that, in the event of a significant influx of external reports, ANAC may give priority to those relating to a serious violation of the public interest, constitutional principles, or European Union law. ANAC may also decide not to proceed with reports concerning minor violations and proceed with their closure.
ANAC is responsible for adopting specific Guidelines relating to procedures for the submission and management of external reports, in consultation with the Data Protection Authority.
The external reporting procedures
Instructions for using the external reporting channel are available on the ANAC website at the following link:https:/ /www.anticorruzione.it/-/whistleblowing
Public disclosure
The reporting person may make a public disclosure only if at least one of the following legal conditions is met, in order to benefit from the protections provided by the procedure:
has already made an internal and external report or has directly made an external report, under the conditions and procedures provided by law(4), but no response has been received within the legal deadlines(5);
has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest;
has reasonable grounds to believe that the external report may entail the risk of retaliation or may not be followed up due to the specific circumstances of the case, such as situations where evidence may be concealed or destroyed or where there is justified concern that the recipient of the report may be colluding with the perpetrator of the violation or involved in the violation itself.
The scope of application of this tool is therefore limited to strictly exceptional cases.
Reporting person
The Decree also recognizes to protected individuals the possibility of reporting to judicial authorities misconduct of which they have become aware in a private work context.
It should be noted that Articles 361 and 362 of the Criminal Code provide for the obligation to report only crimes (ex officio offences(6)), therefore with a narrower scope than whistleblowing reports, which also include other types of unlawful conduct.
The same rules on confidentiality and protection of the content of reports must also be respected by the offices of the Judicial Authorities where the complaint is filed.
9.1 Subject and procedures for submitting reports (what can be reported and how)
In EV MMC Italia S.r.l., the subject of reporting and the procedures for submitting reports can be summarized as follows.
For violations of national law and European Union law, the internal reporting channel is the primary channel that the reporting person must use to submit their report;
In the case of violations of provisions of EU law only, the reporting person may, where the conditions provided by law are met, use the external reporting channel established and managed by ANAC;
Where specific conditions provided by law are met, the reporting person may make a public disclosure;
The reporting person also has the possibility to contact the Judicial Authority to file a complaint regarding unlawful conduct of which they have become aware in the context of their working environment.
To the reporting person, the following is recommended:
use of a single reporting channel;
use of the online platform as the priority solution;
do not submit duplicate reports of the same incident.
The only channel that may be used for the communication of retaliatory measures is the external ANAC channel.
9.2 Internal reporting management procedural process
The procedural process for managing reports is described below in its main stages.
9.3 Receipt and acknowledgment of the report
a) For reports submitted through the internal reporting channel established via the Company’s online portal: the reporting person must complete a reporting form in order to provide a clear, precise, and complete description of the facts.
After submitting the report, the reporting person will receive an automatic notification confirming the successful submission of the report.
b) Reports received through other channels: during a face-to-face meeting, the report is documented, with the prior consent of the reporting person, by means of minutes. The reporting person is asked to review, correct, or confirm the minutes by signing them.
The Report Manager must, within seven days of receipt, issue an acknowledgment of receipt to the reporting person, through an automatic function.
9.4 Preliminary assessment and classification of the report
The report manager promptly carries out a preliminary analysis of the report, also referred to as a preliminary assessment, possibly requesting additional information and/or supporting documentation from the reporting person (through a dedicated function available on the online portal).
At the end of this preliminary analysis, the report manager will classify the report into one of the following categories:
a) non-relevant report: a report that is not relevant to the scope of this procedure (for example: it refers to individuals, companies and/or facts, actions, or behaviours that do not fall within the scope of the procedure).
It is closed, and feedback is provided to the reporting person If the report manager considers the report to be well-founded and sufficiently detailed, even if it does not fall within the scope of an unlawful act, they may decide to submit it to the attention of the Chief Executive Officer / Company Representative and/or the Corporate Legal department of the company (for example, if it concerns management-related matters).
In the event of such forwarding, feedback is still provided to the reporting person (if contact details are available).
b) Relevant but non-actionable report: a report that falls within the scope of this procedure, but due to insufficient information and/or elements regarding the subject and/or content of the report, it is not possible to proceed with further investigations. It is closed, and feedback is provided to the reporting person (if contact details are available).
c) Prohibited report: a report falling within the cases referred to in the relevant section. The report manager may decide to: i. submit the prohibited report to the Chief Executive Officer / Company Representative and/or the Corporate Legal department of the Company for the possible initiation of disciplinary proceedings; and ii. inform the reporting person of the communication referred to in the previous point (if contact details are available).
In the event that the report manager, also in coordination with the Chief Executive Officer / Company Representative and/or the Corporate Legal department, determines that the requirements set out in Legislative Decree No. 24/2023 for a possible disciplinary procedure are met, such procedure shall be duly initiated.
The report is closed with a record of any disciplinary proceedings and their outcome.
d) Relevant and actionable report: a report that falls within the scope of this procedure and is sufficiently detailed. The report manager initiates the verification phase, as described in the previous section “Internal reporting management”.
9.5 Verification phase and internal investigations, and feedback to the reporting person
If the report received has been classified as relevant and actionable, the report manager will proceed with the initiation of internal checks and investigations in order to gather further detailed information and verify the validity of the reported facts.
The manager reserves the right to request additional information or documentation from the reporting person, as well as to involve them during the investigation phase.
If further clarification is required, the manager may need to meet and/or contact the reporting person, who, in the case of an anonymous report, must give consent to disclose their identity.
During this phase, the manager may rely on the support of the relevant company functions from time to time, and, where deemed appropriate, on specialised consultants in relation to the report received, whose involvement is intended to support the verification of the report, while ensuring the confidentiality established in the procedure..
Feedback to the reporting person
The report manager provides feedback to the reporting person within three months from the date of the acknowledgment of receipt (or, in the absence of such acknowledgment, within three months from the expiry of the seven-day period following the submission of the report).
The report manager provides feedback to the reporting person via the platform or other suitable means regarding the report, informing them of the action that has been taken or is intended to be taken in relation to the report.
Any subsequent updates to the feedback provided to the reporting person must be ensured over time.
9.6 Conclusione della fase di verifica
All'esito della fase di verifica, il gestore della segnalazione predispone una relazione riepilogativa delle indagini effettuate e delle evidenze emerse condividendola, in base agli esiti, conlefunzioniaziendali divoltainvoltainteressate,alfinedidefinireglieventuali pianidi intervento da implementare e leazionida avviare a tutela della società, comunicando altresì i risultatidegliapprofondimentiedelle verifiche svolte, relativamente aciascuna segnalazione, alresponsabile della funzione aziendale interessata daicontenuti della stessa.
9.7 Reporting ai vertici aziendali
Ilgestore della segnalazione informerà tempestivamente,dell'esito delle proprie indagini, per la valutazione degli eventuali provvedimenti disciplinari da intraprendere/delle eventuali comunicazioni alle Autorità competenti, l'area Corporate legal, secondo poteri/deleghe attribuite, e/ogli Amministratori competenti.
ln ogni caso, tutte le segnalazioni ricevute confluiranno nella reportistica periodica all' Amministratore delegato Rappresentante dell'impresa di EV MMC Italia S.r.l..
9.8 Relevant and actionable report concerning company top management
In the case of a relevant and actionable report concerning individuals responsible for deciding on any disciplinary measures, complaints, or other actions, the report manager immediately involves the Chief Executive Officer, acting as the company’s representative, in order to coordinate and define the investigation process.
In the case of a relevant and actionable report concerning one of the Directors, the report manager, after assessing the case and determining that the report is well-founded, shall “diligently follow up (7)” on the received report, forwarding it to the competent internal bodies/functions or external bodies/institutions, each within their respective areas of responsibility, in order to establish individual liability or carry out substantive or compliance checks.
9.9 Archiving and retention of the report
Reports and the related documentation are retained for the time necessary to process the report itself and, in any case, for no longer than five years from the date of communication of the final outcome of the report management process.
9.10 Recipients of the reports
Regardless of the channels used for reporting, it is provided that reports are primarily handled by an external consulting company (report manager), which is independent and autonomous and capable of offering adequate guarantees of confidentiality and data protection. This company will carry out a preliminary factual analysis as well as the further activities previously indicated as the duties and activities performed by the Report Manager.
9.11 The role of the external company in managing the report
a) It oversees that the internal reporting management system is correct and compliant with legal regulations, monitoring any regulatory updates and the introduction/modification of new obligations for the purpose of adapting the system;
b) It performs the activities assigned to the report manager;
c) It coordinates investigations carried out following reports and provides initial consultancy to other involved company functions;
d) It supports the other recipients in managing and resolving reports and is responsible for the completeness, integrity, and archiving of the case.
9.12 Conflicts of interest situations
The procedure ensures that the management of reports is entrusted to individuals who are not in a conflict of interest situation.
This control mechanism, aimed at preventing improper handling of reports, is guaranteed by the external consulting company, which will avoid from the outset the involvement of any individuals who are in a conflict of interest situation.
In the case of a relevant and actionable report concerning the Chief Executive Officer, acting as the company’s representative, the report manager, after assessing the matter and determining that the report is well-founded, shall “diligently follow up (8)” on the received report, forwarding it to the competent internal bodies/functions or external bodies/institutions, each within their respective areas of responsibility, in order to establish individual liability or carry out substantive or compliance checks.
These provisions shall also apply in the event that a conflict of interest arises at a later stage after receipt of the report, with the replacement of the individuals involved in their respective roles in accordance with the above rules.
All conflict of interest situations must be declared without hesitation and recorded in the Reporting Register.
10. General principles and safeguards
10.1 Protection of the whistleblower
The proper management of the reporting system is aimed at supporting the spread of a culture of ethics, transparency, and legality within the Company.
To achieve this objective, the whistleblower and any other individuals involved in the reporting process are guaranteed a protection regime, in addition to the availability of appropriate reporting channels.
The legislation provides the following conditions in order to benefit from protection measures:
the person must be eligible to benefit from the safeguards; the reported violation must fall within the scope of the procedure;
the report must have been made in compliance with the applicable regulations.
The protection measures are summarized in the following safeguards:
right to confidentiality; prohibition of retaliation;
support measures;
limitations of liability regarding the disclosure of certain categories of information, when specific conditions are met.
The legislation generally prohibits waivers and settlements—if not signed under protected circumstances—of the rights and means of protection provided therein (9).
Right to confidentiality. The identity of the whistleblower and any other information from which such identity can be directly or indirectly inferred may not be disclosed without the whistleblower’s explicit consent to persons other than those responsible for receiving and following up on the reports, regardless of the reporting method used.
Prohibition of retaliation. Retaliatory acts are prohibited; any retaliatory measures suffered in violation of this prohibition are subject to a regime of nullity. The declaration of nullity of retaliatory acts is the responsibility of the Judicial Authority.
The burden of proving that such conduct is motivated by reasons unrelated to the report lies with the employer.
Below are some examples, provided for illustrative purposes and not exhaustively, of actions that constitute retaliation:
a) dismissal, suspension, or equivalent measures;
b) demotion or failure to promote;
c) change of duties, change of workplace, reduction of salary, modification of working hours;
d) suspension of training or any restriction of access to it;
e) negative performance notes or negative references;
f) disciplinary measures or other sanctions, including financial penalties;
g) coercion, intimidation, harassment, or ostracism;
h) discrimination or otherwise unfavorable treatment;
i) failure to convert a fixed-term employment contract into an indefinite-term contract, where the worker had a legitimate expectation of such conversion;
j) non-renewal or early termination of a fixed-term employment contract;
k) damage, including to a person’s reputation, particularly on social media, or economic or financial harm, including loss of economic opportunities and loss of income;
l) inclusion in improper lists based on a formal or informal sectoral or industry agreement, which may result in the person being unable to find employment in the sector or industry in the future;
m) early termination or cancellation of a contract for the supply of goods or services;
n) cancellation of a license or permit;
o) request for psychiatric or medical examinations.
Any retaliatory behavior may give rise to disciplinary proceedings against the responsible party.
The adoption of retaliatory measures may be reported to ANAC, using the external reporting channel. It is emphasized that there must be a close connection between the report and the adverse conduct, act, or omission suffered, directly or indirectly, by the whistleblower, in order for retaliation to be established and, consequently, for the person to benefit from protection.
Therefore, it is necessary for the whistleblower to provide ANAC with objective elements from which it is possible to infer a causal link between the report made and the alleged retaliation.
In order to obtain evidentiary elements essential for establishing retaliation, ANAC may rely on cooperation with the National Labour Inspectorate, without prejudice to ANAC’s exclusive competence regarding the assessment of the information obtained and the possible application of administrative (financial) sanctions.
Support measures. As an additional strengthening of whistleblower protection, the legislation provides that ANAC shall enter into agreements with third-sector organizations so that these entities may provide support measures to whistleblowers, offering assistance and consultancy free of charge. A register of third-sector organizations that provide support measures to whistleblowers is established at ANAC.
Limitations of liability. The whistleblower shall not be held liable, even where the reported facts:
(i) are found to be unfounded and/or inconsistent, based on the assessments and investigations carried out;
(ii) reveal information subject to the obligation of: (a) secrecy (including official secrecy, professional secrecy, scientific or industrial secrecy), (b) non-disclosure of information relating to the organization and production methods of the company, as imposed on the employee.
(e) copyright protection, (d) personal data protection; or if they harm the reputation of the person involved, provided that at the time of the report both of the following conditions are met:
• they had reasonable grounds to believe that the disclosure of the information was necessary to uncover the breach;
• the procedures provided for by the legislation were used.
This immunity may apply provided that the acquisition of the information or access to the documents occurred in a lawful manner.
10.2 Confidentiality protection of the whistleblower
The need to protect the identity of the whistleblower is reflected in the Company’s decision to prioritize IT-based tools, including the use of encryption systems, and to exclude the report and any attached documentation from the right of access to administrative documents.
Confidentiality protection is also ensured in judicial and disciplinary proceedings.
In two cases expressly provided for by law, in order to disclose the identity of the whistleblower, in addition to the whistleblower’s explicit consent, a written statement of the reasons for such disclosure is also required:
• in disciplinary proceedings, where the disclosure of the whistleblower’s identity is indispensable for the defence of the person against whom the disciplinary charge is brought;
• in proceedings initiated following internal or external reports, where such disclosure is also indispensable for the defence of the person involved.
The whistleblower loses the right to confidentiality:
• where their criminal liability for defamation and slander is established, including by a first-instance judgment;
• in the event of civil liability for the same offences, where intent or gross negligence is proven.
With specific reference to public disclosure
In cases where the person making a public disclosure contacts a journalist, they are protected under journalistic professional secrecy (as a source of the information) and do not fall within the scope of Legislative Decree No. 24/2023, thereby benefiting from greater protection.
Confidentiality protection does not apply, however, where the whistleblower has intentionally disclosed their identity (for example, through social media), without prejudice to all other forms of protection provided for by law. Where the person making the disclosure does not reveal their identity (for example, by using a pseudonym or nickname on social media), such disclosures are treated as equivalent to anonymous reports.
10.3 Confidentiality protection of the reported person (subject of the report)
In order to prevent any abuse of the reporting system, and therefore to avoid false accusations, defamation, or the disclosure of personal data of the reported person that could result in reputational harm, discrimination, or other disadvantages, the procedure also includes measures to protect the reported person.
The reported person is informed by the report manager of their involvement in the reporting process at the time deemed appropriate, in order to avoid compromising the internal verification and investigation phase.
The reported person may not be subject to disciplinary sanctions in the absence of objective evidence regarding the alleged violation, or without having first investigated the facts subject to the report and formally contested the related allegations in accordance with applicable law and/or contractual provisions.
The reported person may be heard, or upon request must be heard, including through a documentary procedure involving the submission of written observations and documents.
Decisions regarding any disciplinary measures, complaints, or other actions to be taken following the outcome of the investigations are made by company management, within the scope of assigned powers/delegations, and in any case by individuals other than those who conducted the investigation, in order to avoid conflicts of interest or lack of impartiality.
The protection of the reported person applies without prejudice to legal provisions requiring the disclosure of their identity (for example, requests from judicial authorities).
10.4 Further confidentiality protection of the reported person and protection of the confidentiality of any other individuals involved in the reporting process
The protection of the identity of the reported person and of any other individuals mentioned in the report must be ensured by the Company and (where applicable) by ANAC until the conclusion of the proceedings initiated as a result of the report, and in accordance with the same guarantees provided in favor of the whistleblower(10).
10.5 Personal data processing
It is also specified that the personal data of the whistleblower, the reported person, and all individuals involved in the report are processed in accordance with applicable legislation on:
(i) the protection of natural persons with regard to the processing of personal data under Regulation (EU) No. 2016/679, the so-called GDPR, and Legislative Decree No. 196/2003 (the Privacy Code), as subsequently amended and supplemented;
(ii) communication between competent authorities.
In this context, it is highlighted that:
• personal data are processed by the Company in its capacity as Data Controller, which determines the purposes and means of the processing of personal data, providing appropriate information notices to the data subjects (whistleblower, reported person, and any other individuals involved in the reporting process, hereinafter “data subjects” under privacy law);
• the Data Controller adopts the necessary safeguards to prevent the improper circulation of personal information, not only externally but also within the organization, ensuring that the processing of personal data is limited only to authorized persons;
• the Data Controller formally identifies and appoints authorized persons, i.e. those who are permitted to process personal data within the reporting process, and provides them with appropriate operational instructions;
• the Data Controller regulates the relationship with any external suppliers processing personal data on its behalf pursuant to Article 28 of the GDPR (the Data Processors);
• the Data Controller, Data Processors, and authorized persons are required to comply with the general principles of data protection law;
• the reporting process involves the processing only of personal data that are strictly necessary and relevant to the purposes for which they are collected, and reports may not be used beyond what is necessary to properly handle them;
• personal data that are manifestly not useful for handling a specific report are not collected or, if accidentally collected, are immediately deleted;
• the provision of personal data is voluntary. Failure to provide such data may make it impossible to examine and process the report;
• the Data Controller adopts appropriate technical and organizational measures to ensure a level of security appropriate to the specific risks arising from the processing, based on a Data Protection Impact Assessment (DPIA);
• the rights of data subjects (right of access, rectification, erasure and Right to be Forgotten, restriction of processing, data portability, objection, especially in relation to automated decision-making) may be exercised within the limits and under the procedures provided by law, and may be suspended where their exercise could cause an actual and concrete prejudice to the confidentiality of the whistleblower’s identity. In such cases, the reported person is also prevented from, where they believe that the processing concerning them violates their rights, contacting the Data Controller and, if no response is provided, lodging a complaint with the Data Protection Authority.
10.6 What the report manager cannot do
The report manager, within the reporting process and in accordance with applicable legislation:
does NOT protect individual rights and interests;
does NOT carry out activities aimed at investigating or resolving personal disputes;
cannot replace the competent institutions in the relevant subject matter;
does NOT provide legal or professional advice to the whistleblower.
11. Training and information
The Company recognizes training and information on whistleblowing as a fundamental tool for the implementation of the procedure.
The procedure is published on the website https://www.engelvoelkers.com/it/en/whistleblowing in the “Whistleblowing (Reports of violations)” section, on the EV MMC Italia S.r.l. intranet (Whistleblowing section), and on the online portal name https://engelundvoelkers.integrityline.com/?lang=en
The same is also displayed and made easily accessible in the workplace. A copy of it is provided to employees via email.
The Company promotes communication initiatives regarding the procedure and the use of the portal, involving all personnel.
12. Violation of the procedure
Any violation of this procedure may constitute a disciplinary offence punishable by the Company, in accordance with the provisions set out in the following section on the sanctioning system.
In particular, it is noted that, in order to ensure the above-mentioned protections and the whistleblower’s trust in the effective functioning of the reporting system, the following cases are subject to sanctions:
retaliation against the whistleblower and any other protected individuals for reasons directly or indirectly related to the report;
attempts to obstruct or actual obstruction of the reporting process; failure to establish the reporting channel;
absence or non-compliance of reporting management procedures;
failure to carry out the verification and analysis of received reports; violation of confidentiality and personal data protection obligations;
conviction, even at first-instance judgment, for defamation or slander offences, or established civil liability by a first-instance judgment, in cases where the report was made with intent or gross negligence.
13. Sanctioning system
Failure to comply with or violation of the rules contained in this procedure may result in the Company applying:
disciplinary measures against employees in the cases provided for by applicable legal provisions and the relevant National Collective Labour Agreement (CCNL);
termination of the contract and/or collaboration with collaborators and third parties.
In any case, the Company may initiate all criminal, civil, or administrative actions provided for by law, where the conditions for criminal, civil, or administrative liability are met.
14. Updating of the procedure
The procedure is subject to periodic review and is approved by the Chief Executive Officer, acting as the company’s legal representative.
Any such amendments or additions, as well as the reasons that led to the update, must be promptly communicated to the Chief Executive Officer and legal representative of EV MMC Italia S.r.l.
1 Ref. art. 1, para. 2 of Legislative Decree No. 24/2023
2 Art. 4, para. 2 of Legislative Decree No. 24/2023
3 Ref. art. 8, para. 1, letter f), Legislative Decree No. 24/2023
4 Ref. art. 4 (internal reporting channels) and art. 7 (external reporting channels), Legislative Decree No. 24/2023
5 Ref. art. 5 (management of the internal reporting channel) and art. 8 (activities carried out by ANAC), Legislative Decree No. 24/2023
6 Offences prosecutable ex officio are those crimes which, even in the absence of a complaint by the offended party, are still prosecuted by the judicial authority, and are considered among the most serious offences under Italian law and the Criminal Code.
7 Art. 5, para. 1, lett. e) of Legislative Decree No. 24/2023
8 Art. 5, para. 1, lett. c) of Legislative Decree No. 24/2023
9 “Waivers and settlements, in whole or in part, concerning rights and protections provided by the decree are not valid, unless they are concluded in the protected venues referred to in art. 2113, para. 4, of the Civil Code” (ANAC Guidelines).
10 “The legislator has also deemed it necessary to ensure confidentiality: – for the facilitator, both with regard to identity and the activity through which assistance is provided. – for persons other than the reported person but still involved, as they are mentioned in the report or public disclosure (for example, persons indicated as witnesses). The rationale behind the new rules lies in the need to safeguard the rights of individuals who, as a result of the report, could suffer damage to their reputation or other negative consequences even before it is established whether or not they were involved in the reported facts. (…) An exception to this confidentiality obligation regarding persons involved or mentioned in the report is made in cases where reports are submitted to Judicial Authorities and the Court of Auditors. This is confirmed by the fact that the legislator, when providing for confidentiality in judicial proceedings, refers only to the identity of the whistleblower and not to that of the person involved or mentioned in the report” (ANAC Guidelines) (see art. 12, paras. 3, 4 and 7 of Legislative Decree No. 24/2023).