Whistleblowing Framework

The Whistleblowing Framework shall not be used instead of existing reporting processes for raising customer and/or supplier complaints.

BNP Paribas Group is committed to strict compliance with laws and regulations and to enforce the rules set out in the Group's Code of Conduct .

The whistleblowing framework, accessible from this page, allows you to report information about a crime or an offence, a threat or damage to the public interest, a violation or an attempt to conceal a violation of applicable and binding law (laws, regulations, etc.) or a violation of the Organization, Management and Control Model pursuant to Legislative Decree 231/01 or a breach of the Group's Code of Conduct .

Based on the type of Alert received¹, reports are managed by the HR Conduct Referent - “Respect for People” and the Compliance Whistleblowing Referent in a confidential manner and in compliance with the current regulations.

Any abuse of the whistleblowing framework may expose the whistleblower to criminal proceeding and/or disciplinary sanctions (if employee), however, the good faith use of this framework will not expose the whistleblower to any disciplinary sanctions, even if the facts subsequently prove to be inaccurate or do not give rise to any follow-up.

By submitting a report, you declare that you have read and understood the information relating to the BNP Paribas Whistleblowing Framework and the Data Protection notice .

________________________________

¹ Whistleblowing pursuant to Legislative Decree 24/2023 does not apply to: a) disputes, claims or requests related to a blower personal interest or to the person who submitted a complaint to the judicial or accounting authority that exclusively concerns his/her individual employment or public employment relationships, or relating to his/her employment or public employment relationships with his/her managers; b) reports of violations where they are already regulated on a mandatory basis by the European Union or national acts indicated in Part II of the Annex to Legislative Decree no. 24/2023 or by the national acts that implement the European Union acts indicated in Part II of the Annex to Directive (EU) 2019/1937, even if not indicated in Part II of the Annex to the same Legislative Decree no. 24/2023; (c) reports of violations relating to national security, as well as to procurement relating to defence or national security aspects, unless such aspects are regulated by relevant secondary legislation of the European Union.

Frequently Asked Questions

Find below the most frequently asked question: ​

• When to report?

  When you have reason to believe that a violation of the law or of the Organization, Management and Control Model pursuant to Legislative Decree 231/01 or the BNP Paribas Code of Conduct has been committed or in the event of a threat or harm to the public interest.

• How to report?

  If you are an external third party, you can refer to the following in points 1 and 2 of the “How to raise a report” section, namely:

  -  use the Whistleblowing Platform or the form available on thispage for a written report;

  -   request a face-to-face meeting or a telephone interview for an oral report.

  If you are an employee (Group employee or external staff, i.e. any natural person who, although not an employee of the Group, collaborates with a Group Entity and has in-depth knowledge of its functioning), please use the specific channels indicated in the internal procedures and on the company intranet.

• What happen if the report is received by mistake by a wrong person?

  If a report arrives in a sealed envelope on which it is indicated that it is a whistleblowing report, the person receiving it, without opening it, will promptly forward it to the competent persons. In the absence of a clear indication, in fact, the report will be treated as ordinary and therefore outside the scope of application of Legislative Decree 24/2023.

• Can the report be anonymous?

Yes, your report may be anonymous, as long as it is duly detailed. 

However, for the purposes of applying the protections defined by Legislative Decree 24/2023 (see art. 16, paragraph 4), the anonymous whistleblower, subsequently identified, who has communicated to the ANAC (National Anti-Corruption Authority) that he has suffered retaliation, can benefit from the protection that the decree guarantees in the face of retaliatory measures.

• Will the Whistleblower be informed of the follow-up given to the report?

  A confirmation regarding the receipt of the report will be sent upon receipt of the same and some questions may be asked to conduct the investigation appropriately. Information will also be provided via the Whistleblowing Platform regarding the status of the management of the report and the outcome of the investigation. It will therefore be essential that those who have made the report via the IT platform carefully safeguard the password they have created and the reporting code generated by the system when entering and sending the report. These same credentials will also be essential for exercising the right of access, rectification, deletion, limitation of processing, portability and opposition to the processing of the data provided, in compliance with the regulatory provisions of EU Regulation 2016/679 (so-called General Data Protection Regulation or “GDPR”).

• Will confidentiality be ensured? ​

Yes, the Referents are trained in handling whistleblowing reports confidentially and they take appropriate steps to do so.

• What types of issues can be reported? ​

Pursuant to Legislative Decree 23/2024, violations of national or European Union regulations that harm the public interest or the integrity of the public administration or private entity may be reported.

Such violations may consist of:

-    criminal, civil, administrative or accounting offenses;

-  unlawful conduct relevant pursuant to Legislative Decree no.231/2001 or violations of the Organizational and Management Models provided for therein;

-   other unlawful acts, acts, omissions or behaviors specifically indicated in art. 2, paragraph 1, letter a), nos. 3, 4, 5 and 6, of Legislative Decree no. 24/2023

Information about reportable violations doesn’t include information that are manifestly unfounded, information already in the public domain, or information acquired only on the basis of rumours or hearsay with little evidence.

• How are reports managed?

  Depending on the nature of the report made, HR is responsible for collecting and processing Alerts relating to Respect for People, which do not fall within the scope of application of Legislative Decree 24/2023. Similarly, Whistleblowing Compliance reports relating to Sanctions and Embargoes, collected and managed directly by the Group, as well as those relating to Anti-Money Laundering and the Fight against Terrorist Financing, will be subject to specific management outside the scope of application of the aforementioned Decree and will be classified as ordinary. All other types of alerts addressed to the Whistleblowing Compliance tool (i.e. Professional Ethics, Market Integrity, Bribery and Corruption, Customer Interests, Group Protection, Involvement with the Company and Other) will fall within the scope of application of Legislative Decree 24/2023, if they actually fall within the objective perimeter provided for by the same.

   

How to raise a report:

1. IN WRITING FORM

    

   1. the report can be made using the Whistleblowing platform, to access which you must refer to this link: https://secure.ethicspoint.eu/domain/media/en/gui/110837/index.html

       

   2. Alternatively, the report can be made by placing it in two closed envelopes, in order to separate the whistleblower's identification data from the reporting form:
      • the first with a photocopy of a valid identification document of the whistleblower;
      • the second with the "Reporting Form".

         

        Insert the two envelopes into a third closed envelope bearing the words "riservata all’attenzione del Responsabile Dispositivo Allerta Etico" on the outside and sent to the following ordinary mail address:

        BNL S.p.A., Dispositivo Allerta Etico, Compliance Area, Viale Altiero Spinelli 30, 00157 Roma

         

2. IN ORAL FORM

   By making of an appointment requested in writing to the ordinary mail address "BNL S.p.A., Dispositivo Allerta Etico, Compliance Area, Viale Altiero Spinelli 30, 00157 Roma", specifying your desire to report by a direct meeting or telephone interview (even in the case of telephone contact it will be possible to remain anonymous)

3. EXTERNAL CHANNELS

The BNP Paribas Group encourages its employees to use the "internal reporting channels" as a priority.

The whistleblower can, however, make an "external alert" to Autorità Nazionale Anti Corruzione (ANAC) which, in implementation of Legislative Decree 24/2023, has been identified as the authority responsible for receiving and managing external alerts, even in anonymous form.

In accordance with the art. 6 of Legislative Decree 24/2023, in fact, "The whistleblower can therefore make an external alert to ANAC if, at the time of its submission, one of the following conditions occurs:

• the mandatory activation of the internal whistleblowing channel is not foreseen within his/her work context or this, even if mandatory, is not active or, even if activated, does not comply with the provisions of the Decree;
• the whistleblower has already made an internal alert and it has not been followed up on;
• the whistleblower has reasonable grounds to believe that, if he/she made an internal alert, it would not be followed up effectively or that the same report could lead to a risk of retaliation;
• the whistleblower has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest.

Furthermore, the whistleblower can also notify ANAC of any retaliatory acts resulting from an alert.

External alerts to ANAC must be carried out according to the methods indicated on the Authority's institutional website(www.anticorruzione.it).

Finally, it should be noted that if the Whistleblower deems it appropriate to contact the Supervisory Body (“Organismo di Vigilanza”), rather than the Whistleblowing framework, regarding reports relating to violations of the Organization, Management and Control Model pursuant to Legislative Decree 231/01, these will be managed while equally guaranteeing the confidentiality of the blower and the object of the report, even if outside the scope of application of Legislative Decree 24/2023.