A. Introduction

Whistleblowing is an important aspect of an accountability and transparency mechanism to enable staff to voice concerns in a responsible and effective manner. It is a fundamental term of every contract of employment that an employee will faithfully serve his or her employer and not disclose confidential information about the employer’s affairs.

Nevertheless, where an individual discovers information which they believe shows serious malpractice or wrongdoing within the organisation then this information should be disclosed internally without fear of discrimination or harassment.

B. The Whistleblower Protection Act 2010

“An Act to combat corruption and other wrong doings by encouraging and facilitating disclosures of improper conduct in the public and private sector, to protect persons making those disclosures from detrimental action, to provide for the matters disclosed to be investigated and dealt with and to provide for other matters connected therewith.”

Essentially this Act gives legal protection to employees against being dismissed or penalised by their employers as a result of disclosing serious concerns. The provisions of the Act are to ensure that no employees should feel at a disadvantage in raising legitimate concerns.

It should also be emphasised that this policy is intended to assist individuals who believe they have discovered malpractice or impropriety. It is not designed to question financial or business decisions taken by the Company nor should it be used to reconsider any matters which have already been addressed under harassment, complaint, disciplinary or any other procedures. Once the "whistleblowing” procedures are in place, it is reasonable to expect staff to use them rather than air their complaints outside the Company.

C. Scope of Policy

This policy applies to all personnel in the Company, which refers to directors (both executive and non-executive) and employees (including permanent, part-time and contract employees).

This policy is designed to:

• Support our values;

• Ensure employees raise concerns without fear of retribution, and

• Provide a transparent and confidential process for dealing with concerns

This policy covers not only possible improprieties in matters of financial reporting, but also include the following:

• Financial malpractice or impropriety or fraud

• Failure to comply with a legal or regulatory obligation

• Health and safety, or the environment

• Criminal activity

• Improper conduct or unethical behaviour

• Serious conflict of interest without disclosure

• Any other serious improper matters which may cause financial or non-financial loss to the Group or damage to the Group’s reputation

• Concealment of any of the above.

D. Principles

• All genuine concerns raised will be treated fairly.

• Harassment or victimisation of any employee raising a genuine concern will not be tolerated.

• The identity of the employee making the disclosure will be kept confidential unless he/she agrees otherwise, or the circumstances demand otherwise.

• Will ensure that the employee concern is aware of who is handling the matter.

• Will ensure that no one will be at risk of suffering any retribution as a result of raising a concern, even if the employee is mistaken. However, this assurance will not be extended to someone who maliciously raises a matter that is known to be untrue.

E. Safeguards

i. Protection

This policy is designed to offer protection to those employees of the Company who disclose such concerns provided the disclosure is made:

• in good faith; and

• in the reasonable belief of the individual making the disclosure that it tends to show malpractice or impropriety and if they make the disclosure to an appropriate person (see below).

ii. Confidentiality

The Company will treat all such disclosures in a confidential manner. The identity of the individual making the allegation may be kept confidential so long as it does not hinder or frustrate any investigation. However, the investigation process may reveal the source of the information and the individual making the disclosure may need to provide a statement as part of the process or evidence required.

In the event we are faced with a circumstance where the identity is to be revealed, the Company will endeavour to discuss this with the whistleblower first.

Should the whistleblower choose to disclose his/ her identity either internally or externally/publicly, the Company is no longer obligated to maintain the confidentiality of the whistleblower.

iii. Anonymous Allegations

This policy encourages individuals to put their name to any disclosures they make. However, whistleblowers may remain anonymous, if they choose to do so. Anonymous whistleblowers are encouraged to provide an email address or other contact information to facilitate proper investigation.

Whistleblowers are advised to provide sufficient information to enable the Company to conduct investigation. Additionally, the factors to be taken into account will include:

• The seriousness of the issue or concern raised

• The credibility of the concern

• The likelihood of confirming the allegation from attributable sources.

iv. Untrue Allegations

If an individual makes an allegation in good faith, which is not confirmed by subsequent investigation, no action will be taken against that individual. In making a disclosure the individual should exercise due care to ensure the accuracy of the information. If, however, an individual makes malicious or vexatious allegations, and particularly if he or she persists with making them, disciplinary action may be taken against that individual.

F. How to Raise a Concern or Provide Information

Whom to report to:

1. Option One : Report to your immediate supervisor.

2. Option Two : If the concern involves your immediate supervisor, manager or Head of Department, or for any reason you would prefer them not to be told, you may report to any of the following designated officers:

Designated Officers Email

(a) Chairman of the Audit Committee PPB Group Berhad sohct@ppb.com.my

(b) Senior Independent Non-Executive Director, PPB Group Berhad ahmadsufian@ppb.com.my

(c) Head of Internal Audit PPB Group Berhad tblim@ppb.com.my

(d) General Manager WB_GM@ffmb.com.my

(e) Chief Financial Officer WB_CFO@ffmb.com.my

(f) Group Chief Risk Officer WB_GCRO@ffmb.com.my

How to make the report:

• Concerns or information are preferably raised or provided in writing (letter or email). Ideally, the Company recommends any report to be detailed in setting out the background and history of events and the reasons for your concern.

• If you are not comfortable about writing in, you may telephone or meet the appropriate officer in confidence, at a time and location to be determined together.

G. Investigating Procedure

The investigation process will be as follows:

• An investigation panel which consists of the relevant business division/ personnel best-placed to address the reported issue will be formed.

• Full details and clarifications of the complaint should be obtained.

• The investigating panel should inform the employee against whom the complaint is made as soon as is practically possible. The employee will be informed of their right to be accompanied by a trade union or other representative (where applicable) at any future interview or hearing held under the provision of these procedures.

• The investigating panel should consult with the relevant General Manager/ Chief Executive/ Managing Director/ Chairman and if appropriate, consider the involvement of the Company’s internal auditors and/or the police at this stage.

• The allegations should be fully investigated by the investigating panel with the assistance where appropriate, of other individuals/ bodies.

• A finding concerning the complaint and validity of the complaint will be made by the investigating panel. This finding will be detailed in a written report containing the findings of the investigations and reasons for the finding. The report will be passed to the relevant General Manager/ Chief Executive / Managing Director/ Chairman as appropriate.

• The relevant General Manager/ Chief Executive / Managing Director/ Chairman will decide what action to take. If the complaint is found to be valid, disciplinary or other appropriate Company procedures will be invoked.

• The complainant should be kept informed of the progress of the investigation, if appropriate, and of the final outcome.

• If appropriate, a copy of the findings will be passed to the Company’s internal auditors to enable a review of the procedures.

• If the complainant is not satisfied that their concern is being properly dealt with by the Company’s investigating panel, he/she has the right to raise it in confidence with the Audit Committee of PPB Group Berhad or one of the designated persons described above.

• Depending on the type/ nature of reported case/ complaint, the Audit Committee of PPB Group Berhad holds the highest authority to form an investigating panel which may consist of the relevant business division/ personnel best-placed to address the reported issue.

What happens after the investigation is completed?

• The findings of the investigation(s) will be communicated to the Audit Committee of PPB Group Berhad for any necessary action.

• The investigating panel will communicate the conclusion of all findings to the whistle blower as a matter of policy, for closure.

H. Safe-keeping of Records

• All concerns received in writing via the above-said channels together with the relevant investigation documents are to be forwarded to PPB Group Berhad Internal Audit Department and will be retained by the Company for a minimum period of 7 years.

• All reports, its supporting evidence, findings of investigations and monitoring of corrective actions shall be maintained and monitored by PPB Group Berhad Internal Audit Department.

I. Oversight and Ownership of Policy

• The Board of the Company has overall responsibility for this Policy and shall oversee the implementation of this Policy.

• The Company will review this policy at least once every 3 years to assess its effectiveness.