Whistleblower policies

1. Introduction
This Policy sets out the "Whistleblower" process for raising concerns about actual, suspected, or anticipated Wrongdoing (as defined in this Policy) within the Bluecurrent group of companies in Australia ("AGCs") ("Bluecurrent").

Bluecurrent Holdings (Australia) Pty Ltd, Bluecurrent No2 (Australia) Pty Ltd, Bluecurrent No3 (Australia) Pty Ltd, Bluecurrent Assets (Australia) Pty Ltd and Bluecurrent (Australia) Pty Ltd.

Bluecurrent is committed to complying with the laws and practices that protect the rights of people who raise concerns about Wrongdoing in or by Bluecurrent, including in Australia, the Treasury Laws Amendment (Enhancing Whistleblowers Protections) Act 2019 (Cth), the Corporations Act 2001 (Cth), and the Taxation Administration Act 1953 (Cth).

The General Counsel ("Accountable Executive") is responsible to the Board of Bluecurrent for this policy. This policy must be reviewed by the Board or its delegated committee with the assistance of the Accountable Executive at least every two years to ensure it is operating effectively. Any recommended changes must be approved by the Board or its delegated committee.

2. Purpose
The purpose of the Policy is to:

• support Bluecurrent Persons (as defined in section 3 below) to raise concerns regarding actual, suspected, or anticipated Wrongdoing within Bluecurrent;
• facilitate the disclosure and investigation of Wrongdoing, including to provide a process for Bluecurrent Persons and Former Employees (as defined in section 3 below) to raise any concerns and receive feedback on any actions taken as a result of their concerns; and
• reinforce the implementation of the Code of Conduct and Ethics by encouraging and ensuring Bluecurrent Persons can disclose Wrongdoing safely, securely and with confidence that they will be protected and supported from possible reprisals or victimisation if their allegation is made in good faith or on reasonable grounds (as applicable) (and to provide for those protections).

3. Scope
This Policy applies to Bluecurrent and all directors and employees of a Bluecurrent group company, and any individual who contracts, consults, is seconded to or works as a volunteer for Bluecurrent company ("Bluecurrent Persons").

An "Eligible Whistleblower" is a "Bluecurrent Person". A "Bluecurrent Person" includes a former officer, Former Employee, or an Associated Person.

A "Former Employee" means any individual who: (i) was previously employed by, or seconded or contracted to, an AGC; (ii) was previously employed by or contracted to Vector Limited while the AGCs were wholly owned by Vector Limited and provided services to the AGCs; or (iii) was involved in the management of an AGC (including a director), or who worked for it as a volunteer.

An "Associated Person" means:
(a) a current or former:

• individual who supplies services or goods to a AGC (whether paid or unpaid);
• employee of a person that supplies services or goods to a AGC (whether paid or unpaid);
• individual who is an associate of a AGC;

(b) a relative, dependant or spouse of an individual referred to in any of the paragraphs above.

4. Reporting Concerns of Wrongdoing
Each Bluecurrent Person must use good judgment to enhance trust, respect and Bluecurrent's reputation, including taking action to prevent the occurrence of Wrongdoing within the business.

To the extent that any Bluecurrent Person (and in some cases, any Former Employee) becomes aware of any Wrongdoing that they wish to report to Bluecurrent to be investigated they should follow the process set out in this Policy.

Wrongdoing (also known as Disclosable Matters)
"Wrongdoings" are where a Bluecurrent Person has reasonable grounds to suspect that the information concerns:

• misconduct, or an improper state of affairs or circumstances in relation to AGC;
• conduct of AGC or its officers or employees that constitutes an offence against, or a contravention of, a provision of any of the following:

(i) the Corporations Act 2001 (Cth);
(ii) the Australian Securities and Investments Commission Act 2001;
(iii) the Banking Act 1959;
(iv) the Financial Sector (Collection of Data) Act 2001;
(v) the Insurance Act 1973;
(vi) the Life Insurance Act 1995;
(vii) the National Consumer Credit Protection Act 2009;
(viii) the Superannuation Industry (Supervision) Act 1993;
(ix) an instrument made under an Act referred to in any of subparagraphs (i) to (viii) above;
(x) constitutes an offence against any other law of the Commonwealth of Australia that is punishable by imprisonment for a period of 12 months or more;
(xi) represents a danger to the public or the financial system; or
(xii) otherwise is prescribed by applicable regulations.

"Wrongdoing" does not include personal work-related grievances (i.e., a grievance about any matter in relation to the Bluecurrent Person's employment, or former employment, having or tending to have implications for the Bluecurrent Person personally), unless that grievance:

(a) has significant implications for AGC or another regulated entity that concerns the Bluecurrent Person making the disclosure; or
(b) concerns conduct, or alleged conduct, described at (b) above; or
(c) concerns a detriment caused to the Bluecurrent Person as a result of the disclosure or a threat made to the Bluecurrent Person of a detriment;
(d) relates to the Bluecurrent Person seeking legal advice or legal representation about the operation of whistleblower protections.

For example, AGC fraud or acceptance of bribes is likely to be Wrongdoing but interpersonal conflict with a colleague is not likely to be Wrongdoing.

Disclosures that are not about Wrongdoing as defined above do not qualify for protection under the Corporations Act, Australian Treasury Laws Amendment (Enhancing Whistleblowers Protections) Act or the Tax Administration Act (as applicable). If the matter you wish to report is a personal work-related grievance that does not fall into the above exceptions, you should not follow the process for reporting outlined in this Policy.

If you have any doubt as to whether a matter constitutes 'Wrongdoing', you are encouraged to follow the reporting process outlined below.

Reporting Process
In order to qualify for the protection as a whistleblower under this Policy and/or the relevant legislation, you must make the disclosure to a recipient referred to below and follow the reporting process detailed below. The reporting process is summarised in the following process map:

If you want to make a disclosure about a Wrongdoing, you can report it via the following Bluecurrent email: whistleblowersupport@bluecurrent.com.au

If you are not comfortable reporting allegations of Wrongdoing to any of the above individuals, you can call our whistleblowing number on the phone numbers listed on the Human Resources (HR) site on the Bluecurrent intranet. If you do that:

• Calls to these numbers are managed by the Employee Assistance Program ('EAP') on behalf of Bluecurrent.
• The EAP service is anonymous and is made available in order to protect the identity of people who report concerns. You will not be asked to reveal your identity unless you choose to do so. Calls will be treated confidentially and may be made at any time.
• The EAP representative who takes your call will ask you a number of questions to help fully understand the concern you are reporting and then prepare an anonymous report of the call (unless you chose to provide your identity).
• This report will be provided to the general counsel, or it will be redirected in line with a process agreed by the general counsel and this Policy.

The Employee Assistance Program general numbers listed on the Human Resources (HR) site on the Bluecurrent intranet are also available as a source of support for any Bluecurrent Person who has raised concerns under this Policy.

"Eligible Recipients" of a disclosure of "Wrongdoing" also include the following persons:

• an officer or senior manager of a AGC or a related body corporate;
• an internal or external auditor including a member of an audit team conducting an audit) or actuary of a AGC or a related body corporate; or
• the Australian Investments and Securities Commission (ASIC), the Australian Prudential Regulation Authority (APRA), or any other prescribed Commonwealth authority.

In addition, information relating to a "Wrongdoing" may be made to a legal practitioner for the purpose of obtaining legal advice or legal representation in relation to the whistleblowing regime.

In certain prescribed circumstances, a "Public Interest Disclosure" or an "Emergency Disclosure" of a "Wrongdoing" may also be made to a journalist or a parliamentarian. Given the criteria required (and consequences of a failure to comply with these criteria) can be complex to navigate, Bluecurrent recommends a Bluecurrent Person seeks independent legal advice before making a "Public Interest Disclosure" or an "Emergency Disclosure".

A disclosure of information qualifies for protection as a "Public Interest Disclosure" where:

• at least 90 days have passed since the Bluecurrent Person made the disclosure to ASIC, APRA or another Commonwealth body prescribed by regulation;
• the Bluecurrent Person does not have reasonable grounds to believe that action is being, or has been taken, in relation to their disclosure;
• the Bluecurrent Person has reasonable grounds to believe that making a further disclosure of the information is in the public interest; and
• before making the public interest disclosure, the Bluecurrent Person has given written notice to the body to which the previous disclosure was made that:
  (i) includes sufficient information to identify the previous disclosure; and
  (ii) states that the Bluecurrent Person intends to make a public interest disclosure.

A disclosure of information qualifies for protection as an "Emergency Disclosure" where:

• the Bluecurrent Person has previously made a disclosure of the information to ASIC, APRA or another Commonwealth body prescribed by regulation;
• the Bluecurrent Person has reasonable grounds to believe that the information concerns a substantial and imminent danger to the health or safety of one or more persons or to the natural environment;
• before making the emergency disclosure, the Bluecurrent Person has given written notice to the body to which the previous disclosure was made that:
  (i) includes sufficient information to identify the previous disclosure; and
  (ii) states that the Bluecurrent Person intends to make an emergency disclosure;

the extent of the information disclosed in the emergency disclosure is no greater than is necessary to inform the journalist or parliamentarian of the substantial and imminent danger.

The Bluecurrent Boards will be kept informed of any reported Wrongdoing.

5. Information to Provide in Support of a Disclosure
When you are reporting Wrongdoing you will need to disclose the information that you honestly believe shows what you are alleging has occurred.

Information that is helpful to provide as part of your report of any Wrongdoing:

• nature of the wrongdoing;
• any background to the wrongdoing including dates and history of the issue;
• why you believe the allegation of wrongdoing is true (relying on facts rather than speculation if possible); and
• any supporting information you may have.

Be aware that the earlier you report a concern, the easier it may be to take action.

6. Anonymity and Confidentiality
You have the right to report an allegation of Wrongdoing anonymously and to remain anonymous over the course of an investigation and after the investigation is finalised.

Bluecurrent is committed to protecting Bluecurrent Persons in making genuine disclosures and all reasonable efforts will be made to ensure that information that identifies you will be kept confidential.

Bluecurrent Persons (and where applicable, Former Employees) wishing to report Wrongdoing should be aware that it will be more difficult to investigate and take action in relation to Wrongdoing that is reported anonymously. Bluecurrent encourages individuals to put their name to concerns which they raise in case additional information is required as any investigation progresses. In these circumstances, you will be given support, if required.

Where you choose not to identify yourself, and it is not possible to keep your identity confidential (for the reasons set out below) Bluecurrent will consult with you about that in the first instance and explain to you the reasons why.

Bluecurrent Persons (and where applicable, Former Employees) who make a disclosure about Wrongdoing, must at all times keep the information disclosed confidential between themselves and the person to whom they have disclosed the information.

All Bluecurrent Persons have a duty to cooperate, as required, in the investigation of reports of any potential discrimination, retaliation, threats or harassment resulting from the reporting or investigation of any Wrongdoing.

Anonymity and Confidentiality
The requirements for your identity to be kept confidential are strict and disclosure outside of the exceptions listed below is unlawful.

No person can disclose the identity of the Bluecurrent Person who disclosed Wrongdoing or of information that is likely to lead to the identification of the Bluecurrent Person who disclosed Wrongdoing, except where a recipient of the information discloses the identity:

• to ASIC, APRA, or a member of the Australian Federal Police;
• to a legal practitioner (for the purposes of obtaining legal advice or legal representation about the whistleblower regime);
• to a person or body prescribed by regulations; or
• with the consent of the discloser.

ASIC, APRA, or the AFP can disclose the identity of a discloser, or information that is likely to lead to the identification of the discloser, to a Commonwealth, State or Territory authority to help the authority in the performance of its functions or duties.

A person can disclose the information contained in a disclosure with or without the consent of the Bluecurrent Person who disclosed the Wrongdoing if:

• the information does not include the Bluecurrent Person's identity;
• the AGC has taken all reasonable steps to reduce the risk that the Bluecurrent Person who disclosed Wrongdoing will be identified from the information; and
• it is reasonably necessary for investigating the issues raised in the disclosure.

7. Investigation Process
All disclosures of Wrongdoing will be treated seriously and addressed promptly, confidentially, and discretely as far as is reasonably possible, taking into account the provisions of this Policy.

Investigation processes will vary depending on the nature of the conduct reported.

Within 20 working days of receipt of the disclosure, Bluecurrent will examine the allegations of Wrongdoing and decide whether an investigation is warranted.

The disclosure and the evidence provided by the person making the disclosure will be considered in an unbiased and fair manner. Generally, an investigation will be warranted unless the allegation is considered to be frivolous or vexatious.

Where practicable, within 20 working days, the person to whom the disclosure was made, or the Chief Executive (as applicable), will report back to you to advise the outcome of their examination and their decision whether or not to investigate the matter.

Where it is impracticable to complete these actions within 20 working days, the person to whom the disclosure was made, or the Chief Executive (as applicable), will report back to you to advise how long they expect it will take to deal with the matter, and update you on progress to date.

If you make the disclosure of Wrongdoing anonymously and you do not provide for a method of contact, Bluecurrent may not be able to continue with an investigation or report back to you on the outcome of a disclosure if you are not contactable.

If warranted, an investigation will be undertaken by the Chief Executive (or Chairperson, where applicable), or their nominee, as soon as practicable.

If an allegation of Wrongdoing is made in good faith or on reasonable grounds (as applicable), by a Bluecurrent Person but is not confirmed by the investigation, no action will be taken against the Bluecurrent Person.

Prompt and appropriate corrective action will be taken as determined by the investigator (i.e., the Chief Executive, the Chairperson, or their nominee).

Those accused of the Wrongdoing will have the right to answer the allegation as and when required by the principles of natural justice and procedural fairness.

If you made the allegation of Wrongdoing, you will also have the right to be heard during the investigation and to be kept informed of regular progress as appropriate (if you are contactable). The frequency and timeframe for these regular updates will vary depending on the nature of the allegation. Bluecurrent will also have regard to confidentiality considerations when providing updates. There may be circumstances where it may not be appropriate to provide details of the outcome to the discloser.

8. Fair and Reasonable Treatment
In order to ensure that employees who are mentioned in a disclosure of Wrongdoing are treated fairly and reasonably, Bluecurrent will (where applicable):

(a) to the extent reasonably practicable, ensure that any disclosures are handled confidentially by being stored safely and securely;
(b) ensure that all persons involved in handling and investigating a disclosure are reminded of confidentiality of the process;
(c) ensure the disclosure and the evidence provided by the person making the disclosure will be considered in an unbiased and fair manner;
(d) conduct an investigation unless the allegation is considered to be frivolous or vexatious, or Bluecurrent otherwise reasonably considers that an investigation is not appropriate;
(e) ensure those accused will have the right to answer the allegation as and when required by the principles of natural justice and procedural fairness; and
(f) ensure a person who is the subject of a disclosure may access Bluecurrent's EAP.

9. Non-Retaliation
It is in Bluecurrent's best interests that Bluecurrent Persons (and, where applicable, Former Employees) report Wrongdoings. Bluecurrent will not tolerate any behaviour that discourages someone from reporting Wrongdoing, or is seen as retaliation (or a threat of retaliation) to a reported Wrongdoing.

You will not be subject to any detrimental conduct (or threats of the same) including but not limited to disciplinary proceedings or any other action causing a detriment or disadvantage, or any less favourable treatment, on the grounds that you have reported, or intend to report, or are suspected to intend to report, a Wrongdoing in good faith or on reasonable grounds.

If you provide, or intend to provide, information in support of, or related to, a disclosure of Wrongdoing made by another Bluecurrent Person or Former Employee, in good faith, you will not be subject to any less favourable treatment (or any threats of the same).

There is no requirement that a whistleblowing report be made in good faith or without malice. Rather, it is sufficient that the Whistleblower has objectively reasonable grounds to suspect the Wrongdoing. If any investigation of a disclosure finds that a disclosure was not made on objectively reasonable grounds, it will not be protected.

If a disclosure of a Wrongdoing is made in accordance with this Policy:

• you will not be subjected to conduct that causes a detriment to you or another person (or threatens to cause a detriment) because someone believes or suspects that you or another person has made, may have made, proposes to make, or could make a disclosure of Wrongdoing;
• you will not be subject to any civil, criminal, or administrative liability (including disciplinary action) for making the disclosure;
• no contractual or other remedy may be enforced, and no contractual or other right may be exercised, against you for making the disclosure;
• in certain circumstances, the information may not be admissible in evidence against you in criminal proceedings or in proceedings for the imposition of a penalty, other than proceedings in respect of the falsity of the information; and
• in certain circumstances you will be entitled to compensation or another remedy if you suffer loss, damage, or injury because you made a disclosure of Wrongdoing or the AGC failed to take reasonable precautions and exercise due diligence to prevent detrimental conduct.

It is important to note that reasonable administrative action for the purpose of protecting you (for example, moving a discloser for safety reasons) or a management action unrelated to your disclosure (for example, managing poor performance) are not detrimental conduct.