UPM SUPPLIER AND THIRD-PARTY CODE PRACTICAL GUIDE TO EVERYDAY . - UPM

COMMITMENTPEOPLE ANDOPERATIONSBUSINESS INTEGRITYSUPPLY CHAIN ANDOTHER STAKEHOLDERSVOICE YOURCONCERNSExamples and good practices for youReduce, reuse,recycle! Determine and assess yourenvironmental aspects andtheir associated environmentalimpacts. Manage the significantenvironmental impacts in normaland exceptional situations. Obtain and maintain therequired environmental permitsfor waste, air, water, andchemicals and ensure yourcontractors also have therequired permits. Measure and record emissionsand waste affecting air, soil,and water and know your directCO2 emissions as well as youremissions from bought energy. If you have field operations(forestry, agriculture, open pitmining, etc.), promote biodiversityin the areas under your influence. Make sure that your productsfulfil legal and UPM productsafety requirements. Set targets for lower emissions. Set requirements for yoursuppliers to report their CO2emissions. secondary trays and/or pools,and a means for managingthese substances. Also reportrelevant deviations or leakagesto UPM. Set up and maintainprocedures that ensure youcomply with your wasteComply with material restrictionsmanagement obligations.specified in applicable laws andAlways look for opportunitiesto reduce and reuse the wasteby UPM.from your operations or fromproducts, or customers’ assets.Maintain a complete data recordon raw material content, such asEnsure hazardous waste isthe chemicals and compounds intreated according to applicableuse.legislation and manufacturer’sinstructions.Ensure that all your rawmaterials come from legal Ensure that you apply thesources.appropriate environmentalmanagement system (EMS) toyour operations. UPM prefersPrevent chemicals and otheran EMS certified in line withhazardous substances fromleaking into the environment byan appropriate environmentalhaving proper processes, such asstandard such as ISO 14001.UPM SUPPLIER AND THIRD-PARTY CODE11

COMMITMENT4PEOPLE ANDOPERATIONSBUSINESS INTEGRITYSUPPLY CHAIN ANDOTHER STAKEHOLDERSVOICE YOURCONCERNSZero-tolerancefor corruptionand briberyTHE UPM WAYUPM’s guiding principle is clear: we do not toleratecorruption or bribery in any form. We never offeror pay bribes to government officials or to privateindividuals, and we never solicit or accept bribes.No compromises,no excuses, no exceptions!THE UPM SUPPLIER/THIRD-PARTY NEEDS TO: Never pay, give, offer, or approve bribes togovernment officials or to private individuals underany circumstances, directly or indirectly. Never receive, solicit, or accept a bribe from anyparty under any circumstances, directly or indirectly. Never, under any circumstances, engage in any formof corruption or other improper or illegal businesspractices, such as extortion, embezzlement, or fraud. Maintain adequate procedures to prevent corruptionand bribery in its operations.12UPM SUPPLIER AND THIRD-PARTY CODE

COMMITMENTPEOPLE ANDOPERATIONSBUSINESS INTEGRITYSUPPLY CHAIN ANDOTHER STAKEHOLDERSVOICE YOURCONCERNSExamples and good practices for youGeneral principles Do not give or offer anything ofvalue to improperly influence abusiness decision to get business,keep business, or gain an unfairadvantage. This is forbidden bothdirectly and indirectly, i.e. througha third-party acting on your behalf. Do not, directly or indirectly,ask for or accept anything of valuethat might affect or appear toaffect your ability to be objectivein your business decisions. Note that “anything of value”should be broadly understoodand includes any payment, loan,discount, political or charitablecontribution, reimbursement, gift,gift card, meal, entertainment, trip,employment or internship, businessopportunity, service, or other benefit. Remember that with governmentofficials the rules on corruptionand bribery are even stricter, andeven a minor benefit offered orgiven to a government official maybe considered bribery. The term “governmentofficial” has a wide range ofmeanings under various anticorruption laws. It often includesany officer, employee,representative of, or candidatefor any government department,agency, state-owned or statecontrolled enterprise, municipality,parish, political party, or publicinternational organisation.Corruption and other improperand illegal business practices Do your share in weedingout corruption by identifyingand rejecting it. Other improper businesspractices cover all types ofunfair and unethical meansto get business, keep business,or benefit improperly fromyour own or someone else’sbusiness. Examples includeextortion, embezzlement, fraud,misrepresentation, and falseadvertising. Many of thesepractices are illegal in differentcountries.Gifts and hospitalitymisconduct) that areproportionate to the corruptionand bribery risks of yourorganisation. Do not offer, give, or acceptany gift or hospitality, meal,travel, or entertainment that isexcessive or used to influence Ensure that your topimproperly business decisionsmanagement demonstrates –or secure special treatment, orin communication and inthat could create the appearancepractice – full commitment toof impropriety.zero-tolerance for corruptionand bribery and that all Gifts or hospitality must havemanagers lead by example.a legitimate business purposeand must always be reasonable Ensure, through training andin kind and size.communication, that youremployees are aware of and Maintain expense recordscommitted to your zero-tolerancerelating to all gifts, hospitality,for corruption and bribery.meals, travel, and entertainment.Perform background checks onsuppliers and third parties actingRisk managementon your behalf and impose onthem a contractual obligation to Regularly assess andcomply with the applicable antidocument internal and externalcorruption and anti-bribery laws.corruption and bribery risksAlso monitor this obligation isyour organisation is exposed to.respected. Maintain corruption andbribery prevention procedures(e.g. policies, training, andencouragement to report Monitor and review yourprocedures for preventingcorruption and bribery and makeimprovements, where necessary.UPM SUPPLIER AND THIRD-PARTY CODE13

COMMITMENT5PEOPLE ANDOPERATIONSBusinesstransparencyTHE UPM WAYBy knowing our customers, suppliers, and otherbusiness partners and developing businessrelationships with them, UPM can improvebusiness performance, supply security, andbusiness continuity.At the same time, UPM can mitigate the risk ofbecoming involved in illegal business activitiesand suffering losses or reputational damagebecause of such relationships. This is why wemust select our business partners carefully onthe basis of objective criteria, such as requiringthem to conduct business in compliance withapplicable laws.14UPM SUPPLIER AND THIRD-PARTY CODEBUSINESS INTEGRITYSUPPLY CHAIN ANDOTHER STAKEHOLDERSVOICE YOURCONCERNSTHE UPM SUPPLIER/THIRD-PARTY NEEDS TO: Be a legal entity that is dulyorganised and legitimatelyexists under applicable laws. Comply fully with allapplicable anti-moneylaundering laws and tradesanction regimes. Have the right to conduct itsbusiness, enter into an agreement Disclose to UPM any actualwith UPM, and perform itsor potential conflicts of interestobligations accordingly.relating to its activities as aUPM supplier or third-party Be aware of the risks it is subjectintermediary. These includeto, have adequate risk mitigationpersonal affiliations betweenmeasures in place, and notifyemployees of supplier/thirdUPM immediately if the risksparty intermediary andmight have an impact on UPM’sUPM as well as any materialbusiness.financial interests UPM Comply fully with all applicableemployees may have in thetax laws and pay all taxes andsupplier’s/third-partyother official payments as set byintermediary’s business.the authorities.

COMMITMENTPEOPLE ANDOPERATIONSBUSINESS INTEGRITYSUPPLY CHAIN ANDOTHER STAKEHOLDERSVOICE YOURCONCERNSExamples and good practices for you Complete the appropriateregistration requirements foryour legal entity. Obtain and maintain allnecessary licenses and permitsrequired for conducting yourbusiness and entering intoagreements. Get and maintain in force witha reputable insurance companyadequate insurance policiesrelating to your activities withUPM. Regularly perform an effectiverisk assessment to identify therisks your business is exposed to,e.g. economic, delivery of rawmaterials, environmental (storms,floods, etc.), social, and cyberrisks.Every choicemakes adifference! Deal with risks consistently andestablish controls to manage them. Inform UPM if you notice a riskthat could have an impact onUPM’s business. Doing so ensuresthat we can consider togetherhow to proactively andeffectively manage the risk.e.g. in certain geographicareas, to identify and mitigatecompliance risks. Be aware of the tax legislationthat is applicable to yourbusiness and any taxes andother official payments yourbusiness is subject to. Preventtax evasion at your operations,e.g. through appropriatemonitoring. Prevent money laundering atyour operations, e.g. by doingappropriate financial and otherbackground checks on yourbusiness partners. Keep up to date with andapply trade restrictionsimposed due to internationalsanction regimes. In practice,monitor your customers andother business partners, e.g.by screening them againstsanctions lists to avoid anytransactions with sanctionedparties. Conduct additionalmonitoring where necessary,Conflicts of interest A conflict of interest occurswhen your interests as aUPM supplier or third-partyintermediary conflict withUPM’s interests. Normal conflicting interestsrelating to commercial termsand customer service are notconsidered as conflict of interesthere but situations whereobjective decision-making isthreatened by such interests. Conflicts of interest occure.g. if your employees havepersonal affiliations with UPMor UPM employees havematerial financial interest inyour business. By disclosingthese we can ensure thatobjective decision making isguaranteed on both sides.UPM SUPPLIER AND THIRD-PARTY CODE15

COMMITMENT6PEOPLE ANDOPERATIONSBUSINESS INTEGRITYSUPPLY CHAIN ANDOTHER STAKEHOLDERSVOICE YOURCONCERNSCompliancewith competition lawsTHE UPM WAYIn UPM, our actions need to comply with allapplicable laws regulating competition at all times.Compliance with competition laws prevents us frommaking agreements or establishing other practicesthat restrict competition. We do not discuss orprovide any sensitive information to a competitor.16UPM SUPPLIER AND THIRD-PARTY CODETHE UPM SUPPLIER/THIRD-PARTY NEEDS TO: Comply with all applicable competition laws andnot make or engage in any agreements, tradepractices, or meetings with customers, distributors,suppliers, or other business partners that could beconsidered distorting competition, or otherwiseengage in any anti-competitive practices.

COMMITMENTPEOPLE ANDOPERATIONSBUSINESS INTEGRITYBusinesssuccessbuilds oncompliance.SUPPLY CHAIN ANDOTHER STAKEHOLDERSVOICE YOURCONCERNSExamples andgood practices for you Do not engage in price fixing, marketor customer allocation, bid rigging,boycotting, or limiting production withcompetitors. Do not discuss or exchange sensitiveinformation with competitors in violationof competition laws. Any contacts or commercial agreementswith competitors as well as participation intrade and professional associations musttake place in accordance with competitionlaws. Note that certain contractual terms,e.g. reselling restrictions, resale pricemaintenance, and exclusivityarrangements, may require a legal review. If you have a dominant market position,you must not abuse this position.UPM SUPPLIER AND THIRD-PARTY CODE17

COMMITMENT7PEOPLE ANDOPERATIONSBUSINESS INTEGRITYSUPPLY CHAIN ANDOTHER STAKEHOLDERSVOICE YOURCONCERNSProtect assetsand informationTHE UPM WAYUPM employees are responsible for handling UPM’s andour business partners’ assets, such as machinery, equipment,raw materials, vehicles, IT and mobile devices, and funds,with care and protect them from damage, loss, theft, andmisuse. We handle confidential information and personaldata carefully and protect the company against cyber risks.As a publicly listed company, all public disclosures ofUPM’s information need to be made in compliance withthe applicable laws and rules of the stock exchange.THE UPM SUPPLIER/THIRD-PARTY NEEDS TO: Handle UPM’s assets with care. Protect UPM’s confidential information against unauthoriseduse or disclosure. Process personal data in accordance with applicable laws. Never publish any announcements, press releases, or otherpublic disclosures concerning UPM without UPM’s approval. Respect the intellectual property rights of UPM and other parties.18UPM SUPPLIER AND THIRD-PARTY CODE

COMMITMENTPEOPLE ANDOPERATIONSBUSINESS INTEGRITYSUPPLY CHAIN ANDOTHER STAKEHOLDERSVOICE YOURCONCERNSExamples and good practices for you Do not use UPM’s assets,including information, for any otherpurpose than for what they havebeen entrusted to you. Do not discuss confidentialtopics in public areas or onsocial media, or with relativesor friends. Handle and maintain anypersonal data in compliancewith the laws that are applicableto your business. Take appropriate measures tosafeguard the confidentiality andsecurity of data, including UPM’strade secrets, e.g. by usingappropriate non-disclosureagreements and other protectionsystems and restricting access todata to only those people whoneed the confidential informationfor the purposes for which theconfidential information was given. Use appropriate IT tools andimplement IT information securitypolicies to protect data againstcyber risks. Safeguard UPM’s intellectualproperty in the form of e.g.inventions, patents, trademarks,and domain names bymaintaining adequate legalprotection or confidentiality. Ensure that your employeesand business partners knowand are committed to yourrequirements on confidentialityand cyber security by means oftraining and communication. Ensure that your products andservices do not infringe anyintellectual property rights ofany third parties.Prevent, protect, pay attention.UPM SUPPLIER AND THIRD-PARTY CODE19

COMMITMENT8PEOPLE ANDOPERATIONSBUSINESS INTEGRITYSUPPLY CHAIN ANDOTHER STAKEHOLDERSVOICE YOURCONCERNSKnow with whom you tradeTHE UPM WAYUPM wants to identify and address the risks relating to its businesspartners before entering a business relationship with them. We alsomonitor our business partners throughout the business relationship.UPM is committed to responsible sourcing practices and expects itsbusiness partners to comply with applicable laws and to share theprinciples outlined in the UPM Code of Conduct.In the Supplier and Third-Party Code, we define requirements forour suppliers and third-party intermediaries, and we expect themto promote these requirements within their supply chain.20UPM SUPPLIER AND THIRD-PARTY CODETHE UPM SUPPLIER/THIRD-PARTY NEEDS TO: Know and select its business partners carefullyto identify and mitigate the risks of becominginvolved in illegal business activities or violationof any requirements of this Supplier and ThirdParty Code. Promote the requirements described in thisSupplier and Third-Party Code or similarstandards to other parties in their supply chain. Keep complete and accurate records of all itsbusiness transactions.

COMMITMENTPEOPLE ANDOPERATIONSBUSINESS INTEGRITYSUPPLY CHAIN ANDOTHER STAKEHOLDERSVOICE YOURCONCERNSDo you know yourbusiness partner?Examples and good practices for you Openly declare your owncommitment to business integrity. Define requirements for yourbusiness partners andcommunicate these requirementsin a transparent manner. Therequirements need to cover thescope of this Supplier and ThirdParty Code.can be done e.g. by conductingbackground checks beforeentering a business relationshipand by auditing during thebusiness relationship. Screen your business partnersagainst applicable sanctions lists. Perform regular credit andfinancial checks within yoursupply chain. Pay attention to red Assess your business partners'flags, such as complex or unusualrisks in terms of employee andpayment structures, multiplehuman rights, anti-bribery andpayments from various parties,anti-corruption, material or serviceand requests for payments to anquality, environmental emissions,unrelated account or third-party.and other compliance risks. This Set targets for the performanceof your key and high-risksuppliers, for e.g. environmentaland social impacts. Monitor theprogress. Actively support your businesspartners in improving theirresponsible business practiceson a continuous basis. Take appropriate measuresif you find any misconduct. Demonstrate the legality ofyour business transactions bykeeping records of all businesstransactions. This may berequired by authorities in e.g.anti-money-laundering or anticorruption investigations. Monitor compliance with therequirements set for yourbusiness partners and reserveright to audit. Conduct riskbased audits with follow-up andclosing of corrective actions.UPM SUPPLIER AND THIRD-PARTY CODE21

COMMITMENT9PEOPLE ANDOPERATIONSBUSINESS INTEGRITYEngaging withour stakeholdersand societyTHE UPM WAYUPM aims to understand stakeholder-specific expectations andengage in dialogue with various stakeholders to discuss UPM’stargets, operating principles, and challenges we face. We respectthe right to different opinions, as we want to foster dialogue withour stakeholders and society. We participate in the developmentof our local communities through various projects and initiatives.THE UPM SUPPLIER/THIRD-PARTY NEEDS TO: Communicate with its stakeholders openly andtransparently and promote dialogue with them.22UPM SUPPLIER AND THIRD-PARTY CODESUPPLY CHAIN ANDOTHER STAKEHOLDERSVOICE YOURCONCERNS

COMMITMENTPEOPLE ANDOPERATIONSBUSINESS INTEGRITYStakeholderdialoguestarts with trust.SUPPLY CHAIN ANDOTHER STAKEHOLDERSVOICE YOURCONCERNSExamples and good practices for you Identify your stakeholders and theirexpectations and listen to their views.Make sure you have adequate systemsfor documenting possible complaintsand use them consistently. Engage with different stakeholders andbe open to dialogue. Provide transparent and fact-basedinformation on your impacts and performanceto your local stakeholders and society. If there are changes in your businessoperations, increased environmental impactsor other changes that may significantly affectthe wellbeing of your stakeholders, activelyengage with them and let them know whatactions you

BUSINESS INTEGRITY 4. Zero-tolerance for corruption and bribery 12 5. Business transparency 14 6. Compliance with competition laws 16 7. Protect assets and information 18 SUPPLY CHAIN AND OTHER STAKEHOLDERS 8. Know with whom you trade 20 9. Engaging with our stakeholders and society 22 VOICE YOUR CONCERNS 10. Compliance involves everyone 24