External channel for reporting of breaches of the legislation supervised by the NBB

NBB_2024_15 – October, 11th 2024 Circular – Page 1/15 14 Boulevard de Berlaimont – 1000 Brussels Phone : +32 2 221 38 15 Company number : 0203.201.340 RPM (Trade Register) Brussels www.nbb.be Circular Brussels, october 11th 2024 Reference: NBB_2024_15 Your correspondent: Isabelle Gérard Phone: +32 2 221 38 15 isabelle.gerard@nbb.be External channel for reporting of breaches of the legislation supervised by the NBB Scope Reports to the National Bank of Belgium (hereinafter the “NBB”) of breaches of legislation falling within the supervisory remit of the NBB. Summary/Objectives This circular lays down and clarifies the procedural rules for the receiving and handling by the NBB of reports of breaches of the legislation supervised by the NBB and the ECB. It also clarifies the protection measures that apply in this context. Structure Definitions ........................................................................................................................................... 3

1. Scope of application ....................................................................................................................... 4 1.1 Material scope ............................................................................................................................. 4 1.2 Personal scope............................................................................................................................ 5
2. Procedural rules ............................................................................................................................. 6 2.1 Authorised staff members ........................................................................................................... 6 2.2 Information in the NBB’s website ................................................................................................ 6 2.3 Procedures applicable to the reporting of breaches ................................................................... 6 2.3.1 Filing of a report and provision of additional explanations or information ................................. 6 2.3.2 Acknowledgement of receipt ..................................................................................................... 7 2.3.3 Preliminary analysis................................................................................................................... 7 2.3.4 Follow-up of reports of breaches for which the NBB is not the competent authority ................ 8 2.3.5 Feedback................................................................................................................................... 8 2.3.6 Rules of confidentiality .............................................................................................................. 9 2.4 Dedicated reporting channels ................................................................................................... 10 2.5 Recording and storage of reports.............................................................................................. 11 2.6 Evaluation of the reporting procedures ..................................................................................... 11
3. Protection measures .................................................................................................................... 12

NBB_2024_15 – October, 11th 2024 Circular – Page 2/15

NBB_2024_15 – October, 11th 2024 Circular – Page 3/15 Dear Sir, Dear Madam, This circular lays down and clarifies the procedural rules for the receiving and handling by the NBB of reports of breaches of the rules supervised by the NBB and the ECB.1 In doing so, it implements the Act of 28 November 2022 on the protection of persons reporting breaches of Union or national law (“whistleblowers”) within a legal entity in the private sector (hereinafter the “Act of 28 November 2022”).2 It also implements Article 90 of the Act of 18 September 2017 on the prevention of money laundering and terrorist financing and on restriction of the use of cash, which, based on Article 3 §1 in conjunction with Article 4(1) of the Act of 28 November 2022, remains valid and is supplemented by the provisions of the Act of 28 November 2022 insofar as a matter is not governed by the aforementioned article.3 As a competent authority within the meaning of the Act of 28 November 2022,4 the NBB is required to set up external reporting channels to receive and follow up on reports of breaches that meet the requirements of said legislation. Definitions

1. In order to enhance the readability of this circular, the following defined terms are used herein. These terms are based on the definitions found in Article 7 of the Act of 28 November 2022, but have been specifically tailored to the NBB.
2. “report” or “reporting”: the provision of information on breaches to the NBB, either orally or in writing;
3. “information on breaches”: information, including reasonable suspicions, about actual or possible breaches that have occurred or are very likely to occur, as well as attempts to conceal such breaches;
4. ”breaches”: acts or omissions that are unlawful and relate to statutory and regulatory provisions as well as directly applicable provisions of EU law, including those adopted in implementation thereof, that apply to the financial institutions referred to in Article 36/2 of the Act of 22 February 1998 laying down the organic statute of the National Bank of Belgium, with which the NBB or the ECB has been entrusted with ensuring compliance pursuant to the aforementioned article or on the basis of the SSM Regulation;
5. “competent authority”: a national authority designated to receive reports in accordance with Chapter 4 of the Act of 28 November 2022 and provide reporting persons with feedback, and/or designated to carry out the duties referred to in that legislation, in particular as regards follow-up; in the absence of a designated authority, the competent authority is the federal coordinator;
6. “reporting person” (or “whistleblower”): a person who reports information on breaches to the NBB;
7. “facilitator”: a natural person who assists a reporting person in the reporting process and whose assistance should be confidential; 1 Insofar as necessary, it should be noted that reports of breaches of rules falling within the supervisory remit of the ECB can also be reported to the ECB using the form available on its website. This circular does not cover the procedural rules and protection measures applicable to reports submitted directly to the ECB. 2 See, in particular, Article 14 §5 of the Act of 28 November 2022, which states that the competent authorities shall, either by means of regulations or in a circular, determine the procedural rules for the receiving and handling of reports. 3 The requirements of Article 90 of the Act of 18 September 2017 on the prevention of money laundering and terrorist financing and on restriction of the use of cash are in line with the Act of 28 November 2022 and hence there is no need for specific rules on the reporting of breaches of that legislation. 4 See the Royal Decree of 22 January 2023 designating the competent authorities for implementation of the Act of 28 November 2022 on the protection of persons reporting breaches of Union or national law within a legal entity in the private sector.

NBB_2024_15 – October, 11th 2024 Circular – Page 4/15 7. “person concerned”: a natural or legal person that is referred to in the report as a person to whom the breach is attributed or with whom that person is associated; 8. “retaliation”: a direct or indirect act or omission as the result of a report, which causes or may cause unjustified detriment to the reporting person; 9. “follow-up”: action on the part of the NBB to assess the accuracy of the allegations made in the report and, if necessary, address the reported breach; 10. “feedback”: the provision of information to the reporting person on the measures envisaged or taken as follow-up and on the grounds for such follow-up; 11. “federal coordinator”: the authority entrusted with the coordination of external reports for the private sector in accordance with Section 4 of Chapter 4 of the Act of 28 November 2022, namely the federal ombudsmen within the meaning of the Act of 22 March 1995 establishing the federal ombudsmen; 12. “FIRM/IFDH”: the Federal Institute for the Protection and Promotion of Human Rights, created by the Act of 12 May 2019 establishing the Federal Institute for the Protection and Promotion of Human Rights, as referred to in Article 25 of the Act of 28 November 2022; 13. “Act of 22 February 1998”: the Act of 22 February 1998 defining the organic statute of the National Bank of Belgium; 14. “SSM Regulation”: Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions.

1. Scope of application 1.1 Material scope
2. The procedures governing the receiving and handling of reports of breaches set out in this circular apply to reports to the NBB of breaches of the financial legislation falling within the supervisory remit of the NBB and the ECB, specifically the statutory and regulatory provisions and directly applicable provisions of EU law, including provisions adopted in implementation thereof, that apply to the financial institutions referred to in Article 36/2 of the Act of 22 February 1998, with which the NBB or the ECB has been entrusted with ensuring compliance pursuant to the aforementioned article or on the basis of the SSM Regulation. The financial institutions concerned include, in particular, credit institutions, investment firms with the status of stockbroking firm, insurance companies, reinsurance companies, mutual guarantee societies, central counterparties, settlement institutions, institutions considered equivalent to settlement institutions, payment institutions, electronic money institutions, central securities depositories, institutions providing support to central securities depositories, and custodian banks. However, these procedures do not apply to:5 a) the field of national security;6 b) classified data; 5 See Article 5 of the Act of 28 November 2022. 6 With the exception of reports of breaches of rules relating to public contracts in the fields of defence and security, insofar as those rules are subject to Directive 2009/81/EC of the European Parliament and of the Council of 13 July 2009.

NBB_2024_15 – October, 11th 2024 Circular – Page 5/15 c) information covered by medical professional privilege (medical privacy) or legal professional privilege;7 and d) information covered by the confidentiality of judicial proceedings. Insofar as necessary, it is expressly stated that the provision of information that does not relate to breaches but, for instance, solely to commercial complaints from clients of financial institutions or to personal conflicts with the employer or co-contracting parties, does not fall within the material scope of this circular. The NBB is not the competent authority to handle such questions or complaints. 1.2 Personal scope 3. Anyone who observes a breach of the financial legislation falling within the supervisory remit of the NBB and the ECB may report it.8 This refers primarily to persons who obtain information on breaches in a work-related context, regardless of whether they are employees or self-employed persons, as well as shareholders and members of the administrative, management or supervisory bodies of a company (including persons not involved in day-to-day management, volunteers and (un)paid trainees) and anyone working under the supervision of (sub)contractors and suppliers.9 Information on breaches that is obtained during the recruitment process or other pre-contractual negotiations or in the context of a work-related relationship that has since ended also falls within the scope of application this circular.10 4. Moreover, for the financial sector, the scope of application is broader and extends to persons who report information they obtained outside a work-related context. For example, clients of a financial institution may report breaches with a view to action on the part of the NBB.11 These persons may have valuable information that can help the supervisor detect, remedy and sanction breaches of the prudential legislation. Therefore, it is important that they also be able to rely on some sort of protection when they wish to report breaches. That being said, the protection afforded persons in a work-related context, on the one hand, and all other reporting persons, on the other hand, is, by definition, different, given that the risks and consequences to which these groups may be exposed also differ. Thus, reporting persons acting on the basis of certain statutory obligations12 will not fall within the scope of the Act of 28 November 2022, except insofar as the protection measures for reporting persons are concerned should these be more favourable to them.13 5. The protection measures for reporting persons provided for by the Act of 28 November 2022 (see Section 4 below) also apply to natural persons who assist the reporting person in the reporting process in a confidential manner (so-called “facilitators”), to third parties connected to the reporting person and who could suffer retaliation in a work-related context, such as colleagues or relatives of the reporting person, and legal entities owned by the reporting person, for which the reporting person works, or with which the reporting person is otherwise associated in a work-related context.14 7 However, information provided to lawyers is only excluded if it has been received in the context of legal proceedings or the provision of advice on legal proceedings. 8 See Article 6 §§1 and 6 of the Act of 28 November 2022. 9 See Article 6 §1 of the Act of 28 November 2022. 10 See Article 6 §§2 and 3 of the Act of 28 November 2022. 11 See Article 6 §6 of the Act of 28 November 2022. 12 This refers to the statutory obligations laid down in the sector-specific Union acts listed in Part II of the Annex to Directive (EU) 2019/1937. These include, for instance, accredited auditors of credit institutions acting on thebasis of Article 225 of the Act of 25 April 2014 on the legal status and supervision of credit institutions. 13 See Article 6 §5 of the Act of 28 November 2022. 14 See Article 6 §4 of the Act of 28 November 2022.

NBB_2024_15 – October, 11th 2024 Circular – Page 6/15 2. Procedural rules 2.1 Authorised staff members 6. Within the NBB, certain members of personnel have been designated as responsible for the handling of reports of breaches (hereinafter referred to as “authorised staff members”). The authorised staff members are trained to handle such reports.15 The authorised staff members perform the following tasks:

1. provision of information to interested persons on the procedures applicable to reports of breaches, for reports that fall within the scope of the Act of 28 November 2022;
2. receipt and follow-up of reports of breaches;
3. maintenance of contacts with reporting persons in order to provide feedback, where applicable, and request further information if necessary. 2.2 Information in the NBB’s website
4. The NBB publishes on its website information on the receipt and follow-up of reports of breaches in a separate, easily identifiable and accessible section.16 Deze informatie omvat volgende elementen: This information includes the following:
5. the conditions to qualify for protection under the Act of 28 November 2022;
6. a link to the reporting platform and details of the reporting channels referred to in Section 2.4;
7. the procedures applicable to the reporting of breaches, as specified in Section 2.3;
8. the rules of confidentiality applicable to reports of breaches, as laid down in Section 2.3.6, and information on the processing of personal data;
9. the nature of the follow-up to be given to reports;
10. the remedies and procedures for protection against retaliation and the availability of confidential advice for persons contemplating reporting;
11. a statement clearly explaining the conditions under which persons reporting breaches to the NBB are protected from incurring liability for a breach of confidentiality pursuant to Article 27 of the Act of 28 November 2022;
12. the contact details of the federal coordinator and the FIRM/IFDH. 2.3 Procedures applicable to the reporting of breaches 2.3.1 Filing of a report and provision of additional explanations or information
13. Reporting persons may report a breach to the NBB:

• either through the internal reporting channels of the entity in question or 15 See Article 15 §§4 and 5 of the Act of 28 November 2022. 16 See Article 16 of the Act of 28 November 2022.

NBB_2024_15 – October, 11th 2024 Circular – Page 7/15

• through the external reporting channels set up by the NBB.17 18

9. A report can be filed anonymously if the reporting person so wishes.19
10. The reporting person should provide the NBB with the following information and documents if available: the name of the entity, the facts indicating a breach, the nature of the breach, the name and, if available, the position of the person concerned, the period to which the breach relates, any proof of the breach and any other information deemed relevant. The authorised staff members may, using the contact details provided by the reporting person on the reporting platform, ask the reporting person to clarify the information and documents provided or to provide additional information and documents, unless the reporting person has expressly indicated that they do not wish to be contacted or the authorised staff members find, based on reasonable grounds, that this would put at risk the protection of the reporting person’s identity. The requested explanations, additional information or documents must be provided through the reporting channels referred to in Section 2.4. 2.3.2 Acknowledgement of receipt
11. The Bank will, without delay and in any case within seven days from receipt of a report, send an acknowledgement of receipt to the reporting person using the contact details provided by the latter, unless the reporting person has expressly indicated that they do not wish to be contacted or the authorised staff members find, based on reasonable grounds, that this would put at risk the protection of the reporting person’s identity.20 The acknowledgement of receipt constitutes proof of submission by the reporting person of information through a designated reporting channel, the date of submission and, if technically possible, the time of submission. However, having regard to point (12), the acknowledgement of receipt does not prove that the information submitted amounts to a report of a breach. The acknowledgement of receipt will include the information referred to in point (7). 2.3.3 Preliminary analysis The NBB is the competent authority to handle the report
12. If, after conducting a preliminary analysis, the NBB is of the opinion that the information submitted by the reporting person constitutes a report of information on an actual or possible breach of the financial legislation falling within the supervisory remit of the NBB and/or the ECB, it will confirm this finding using the contact details provided by the reporting person, unless the later has expressly indicated that they do not wish to be contacted or the NBB finds, based on reasonable grounds, that doing so would put at risk the protection of the reporting person’s identity. The NBB will also inform the reporting person of the fact that they can contact the FIRM/IFDH for the support referred to in the Act of 28 November 2022. If the reporting person filed a report with the NBB directly, the NBB will, in accordance with Article 18 §3 of the Act of 28 November 2022, inform the federal coordinator of the report, provided the NBB is not prevented from doing so by its duty of professional secrecy. This will only be the case in exceptional instances, given that a report of a breach within the meaning of the Act of 28 November 2022 and this circular relates to the financial legislation which the NBB and/or the ECB are responsible for supervising 17 See Article 13 of the Act of 28 November 2022. 18 In the case of external reporting, the reporting person can turn directly to the NBB or go through the federal coordinator. In the latter case, if the NBB is the competent authority to deal with the report, the federal coordinator will forward the report to the NBB without examining whether it is admissible, whether there are reasonable suspicions of a breach, or whether the report meets the conditions set out in the Act of 28 November 2022 (see Article 18 §2 second subparagraph of the Act of 28 November 2022). 19 See in this regard Article 8 §2 of the Act of 28 November 2022. 20 See Article 14 §2(2) of the Act of 28 November 2022.

NBB_2024_15 – October, 11th 2024 Circular – Page 8/15 and, in principle, concerns confidential information of which the NBB became aware in the performance of tasks covered by its duty professional secrecy. The NBB is not the competent authority to handle the report 13. If, after conducting a preliminary analysis, the NBB is of the opinion that the information provided by the reporting person does not constitute a report of a possible breach of financial legislation falling within the supervisory remit of the NBB and/or the ECB, it will inform the reporting person of this finding using the contact details provided by the latter and, if appropriate, refer the reporting person to the channel that can provide further assistance, unless the reporting person has expressly indicated that they do not wish to be contacted or the NBB finds, based on reasonable grounds, that this would put at risk the protection of the reporting person’s identity. Competent authorities other than the NBB are (also) authorised to handle the report 14. If the NBB is of the opinion that other competent authorities should handle the report or that, besides itself, other competent authorities are also authorised to handle the report, it will forward the report to the federal coordinator within a reasonable period of time and immediately inform the reporting person of this fact using the contact details provided by the latter. If the other competent authority is authorised to receive reports of breaches of provisions relating to financial services, products and markets or the prevention of money laundering and terrorist financing (see Article 4 §1 of the Act of 28 November 2022), the NBB may forward the report to that authority directly. In this case, it will inform the federal coordinator and the reporting person accordingly.21 In addition, if so provided by EU or Belgian law, the authorised staff members will forward the information in the report, in a timely manner, to the competent EU institutions, bodies or agencies, as the case may be, for further investigation. If the NBB is of the opinion that the ECB, pursuant to the SSM Regulation, is empowered to deal with the reported breach or that, besides the NBB, the ECB is authorised as well, it will forward the report to the ECB within a reasonable period of time and immediately inform the reporting person of this fact using the contact details provided by the latter. In doing so, it will observe all applicable Belgian and European provisions, including those relating to the international exchange of information.22 The forwarding of reports in accordance with this paragraph does not constitute a breach of the NBB’s duty of professional secrecy.23 2.3.4 Follow-up of reports of breaches for which the NBB is not the competent authority 15. The NBB carefully follows up on reports. The NBB examines the veracity of the allegations made in the report and, if necessary, addresses the breach. After appropriate assessment of a report, the NBB may decide that no further follow-up is required other than closure of the procedure, for example when a reported breach is clearly minor, where the NBB receives repetitive reports which do not contain any meaningful new information adding to a past report or when it is faced with a high inflow of reports and decides to prioritise the treatment of reports of serious breaches or breaches of essential provisions.24 This is without prejudice to the protection provided for by the Act of 28 November 2022. 2.3.5 Feedback 16. If the NBB is the competent authority to handle the reported breach, it will provide feedback on the report to the reporting person using the contact details provided by the latter within a reasonable period of 21 See Article 14 §3 of the Act of 28 November 2022. 22 See Article 14 §2(6) of the Act of 28 November 2022. 23 See Article 14 §3 sixth subparagraph of the Act of 28 November 2022. 24 See Article 14 §4 of the Act of 28 November 2022.

NBB_2024_15 – October, 11th 2024 Circular – Page 9/15 no more than three months or, in duly justified cases, six months, unless prohibited from doing so by law.25 The main statutory limitation on the provision of feedback to the reporting person by the authorised staff members is the duty of professional secrecy binding on the NBB and its personnel.26 Due to this duty, reporting persons will not receive feedback (through the contact details provided by them) other than that mentioned in points (12), (13) and (15), and, in principle, will not be informed of the outcome of the investigation following a report. However, if the report of a breach leads to a measure or sanction that is made public by name, the authorised staff members will inform the reporting person of this fact and refer them to the publication disclosing the measure or sanction. 2.3.6 Rules of confidentiality External confidentiality of information relating to reports 17. Reports of breaches fall under the duty of professional secrecy binding on the NBB, the members and former members of its bodies and personnel, and the experts upon which it calls based on Article 35 of the Organic Act. Consequently, information relating to a report of a breach, including the identity of the person concerned, must not be disclosed to any person or authority whatsoever, unless such disclosure falls within the limits established by the Organic Act. Pursuant to Article 20 of the Act of 28 November 2022, the NBB guarantees the confidentiality of the identity of the reporting person. Even within the limits of Article 35 et seq. of the Organic Act, the NBB may not disclose the identity of the reporting person to any other person or authority except with the reporting person’s consent or if the NBB is required to do so by law.27 In addition, if the NBB is required by law to disclose the identity of the reporting person, it will inform the reporting person of this fact in advance. This explanation must be provided in writing and set out the reasons for disclosure of the confidential information. However, the NBB will not inform the reporting person in advance of the fact that it is obliged to reveal the latter’s identity if such a notification would jeopardise the related investigations or judicial proceedings.28 The foregoing does not apply when the NBB is of the opinion that it is not the competent authority to handle the reported breach and rather that one or more other authorities are authorised to do so or that, in addition to the NBB, one or more other authorities are also empowered to handle the breach and thus forwards the report to the federal coordinator or to the competent authority concerned, in accordance with the obligation provided for by the Act of 28 November 2022 (see point (14) above). In this case, in order to allow the competent authority to adequately follow up on the report, it will be forwarded without modification. In accordance with Article 20 §1, second subparagraph, of the Act of 28 November 2022, the NBB will also reject any request for inspection, explanation or disclosure, in any form whatsoever, of administrative documents that would directly or indirectly disclose the reporting person’s identity, except with the reporting person’s consent.29 The principles set out above regarding protection of the reporting person’s identity also apply, where relevant, to the identity of the person concerned,30 facilitators, and third parties who are connected to the 25 See Article 14 §2(4) of the Act of 28 November 2022. 26 Article 14 §6 of the Act of 28 November 2022 expressly states that the competent authorities must respect their duty of professional secrecy when providing feedback. 27 Furthermore, according to Article 20 §2 of the Act of 28 November 2022, this obligation should be “a necessary and proportionate obligation under specific legislation in the context of investigations by national authorities or judicial proceedings, in particular to safeguard the rights of defence of the person concerned”. 28 See Article 20 §3 of the Act of 28 November 2022. 29 This applies not only when the request is made by a third party, but also when it is made by the person concerned. 30 See Article 32 of the Act of 28 November 2022.

NBB_2024_15 – October, 11th 2024 Circular – Page 10/15 reporting person and who could suffer retaliation in a work-related context, such as colleagues or relatives of the reporting person, as well as legal entities that the reporting person owns or works for or with which the reporting person is otherwise connected in a work-related context.31 If the NBB receives information on breaches that includes trade secrets, it may not use or disclose those trade secrets for purposes going beyond what is strictly necessary for proper follow-up of the report.32 Internal confidentiality of information relating to reports 18. Within the NBB, information relating to a report of a breach may only be disclosed to persons for whom such disclosure is necessary in order for them to discharge their professional duties: the authorised staff members, members of personnel involved in the handling of the file resulting from the report of a breach and experts called upon by the NBB in this context, the governor and members of the NBB’s Board of Directors and Sanctions Committee. Disclosure takes place through the channels provided for this purpose, which are confidential and secure. Except in the cases described in point (21), only the authorised staff members will be aware of the reporting person’s identity. They will do everything reasonably possible to ensure that, when informing persons within the NBB of a report of a breach, this notification does not disclose the reporting person’s identity, either directly or indirectly, or contain any other reference to circumstances from which the reporting person’s identity could be inferred. In derogation from the foregoing, the reporting person may consent to the disclosure of their identity. In that case, the reporting person’s identity will be included in the file resulting from the report of a breach and may only be disclosed to persons for whom the sharing of information on the report of the breach is necessary in order for them to discharge their professional duties. In particular, the reporting person may consent to the inclusion of their identity in the file in order to allow the NBB to provide assistance, in accordance with Article 24 §2 of the Act of 28 November 2022, in dealings with any administrative or judicial authority involved in the protection against retaliation and, consequently, can confirm in particular that they have filed a report in accordance with the Act of 28 November 2022. The principles set out above regarding the protection of the reporting person’s identity also apply, where relevant, to facilitators, and third parties who are connected to the reporting person and who could suffer retaliation in a work-related context, such as colleagues or relatives of the reporting person, as well as legal entities that the reporting person owns or works for or with which the reporting person is otherwise connected in a work-related context.33 2.4 Dedicated reporting channels 19. The NBB makes dedicated reporting channels available to receive and follow up on reports of breaches. These channels are secure and ensure confidentiality.34 In addition, they are independent and autonomous, meaning that they:

1. are separate from the NBB's general communication channels, including those through which the NBB communicates internally and externally in the ordinary course of business;
2. are designed, established and operated in a manner that ensures the completeness, integrity and confidentiality of the information and prevents access thereto by non-authorised staff members; and 31 See Article 20 §5 of the Act of 28 November 2022. 32 See Article 20 §4 of the Act of 28 November 2022. 33 See Article 20 §5 of the Act of 28 November 2022. 34 See Articles 14 and 15 of the Act of 28 November 2022.

NBB_2024_15 – October, 11th 2024 Circular – Page 11/15 3. enable the durable storage of information to allow further investigations to be carried out in accordance with Section 2.5. 20. These dedicated reporting channels allow breaches to be reported in the following ways and can be accessed via the NBB’s website:

1. through an online platform, available on the NBB’s website;
2. by telephone, with no recording made of the conversations;
3. during a physical meeting, set up by making an appointment via the online platform or by telephone; the discussions are not recorded;
4. in writing, addressed to the NBB, c/o Compliance Department, Confidential, 3 Boulevard de Berlaimont, B-1000 Brussels.
5. If a report is received via channels other than the dedicated reporting channels referred to in points (19) and (20) or by personnel other than the authorised staff members referred to in point (6), the staff members that receive the report are prohibited from disclosing any information that might identify the reporting person or the person concerned and must promptly forward the report without modification to the authorised staff members.35 2.5 Recording and storage of reports
6. The authorised staff members keep records of every report received, which only they can access.36 The data relating to these reports are stored in a confidential and secure system, access to which is limited to the authorised staff members and the other persons referred to in the first paragraph of point 18. The abovementioned access by the other persons referred to in the first paragraph of point (18) is in accordance with the provisions on the protection of the reporting person’s identity set out in point (18).
7. If a person provides information through the dedicated reporting channels referred to in point 20(2) and (3), the authorised staff members will provide the reporting person with the information referred to in point (7) during their discussion. The authorised staff members will set down the report in the form of an accurate and, in the case of a physical meeting, complete transcript of the conversation. They will offer the reporting person the opportunity to check, rectify and agree the transcript, unless the reporting person has expressly indicated that they do not wish to be contacted or the authorised staff members find, based on reasonable grounds, that this would put at risk the protection of the reporting person’s identity. If the written transcript of the conversation is provided to the person concerned, the information mentioned in point (7) will be appended thereto. 2.6 Evaluation of the reporting procedures
8. The NBB evaluates the procedures for receiving and handling reports of breaches on a regular basis and at least every two years.37 In doing so, it takes into account its own experience and that of other competent authorities and the federal coordinator and adjusts the procedures accordingly, including based on technological and market developments. The NBB informs the federal coordinator of the results of this review. 35 See Article 15 §3 of the Act of 28 November 2022. 36 See Article 22 of the Act of 28 November 2022. 37 See Article 17 of the Act of 28 November 2022.

NBB_2024_15 – October, 11th 2024 Circular – Page 12/15 The NBB provides the federal coordinator with the following statistics on external reports on an annual basis:38

1. the number of reports received;
2. the number of investigations and proceedings initiated as a result of such reports and their outcome;
3. the estimated financial damage and the amounts recovered following investigations and proceedings related to the breaches reported, if ascertained. These statistics are included in an anonymised summary report.
4. Protection measures
5. Reporting persons who report breaches to the NBB qualify for protection under Chapters 6 and 7 of the Act of 28 November 2022 if they had reasonable grounds to believe that the reported information was true at the time of reporting and that it fell within the scope of the Act of 28 November 2022.39 Reporting persons do not lose the benefit of this protection merely on the ground that a report, filed in good faith, is later found to be erroneous or unfounded. This also applies to persons that file a report anonymously but are subsequently identified. Facilitators and third parties connected to reporting persons qualify for the same protection if they had reasonable grounds to believe that the reporting person fell within the scope of the protection provided for by the Act of 28 November 2022.40 This mainly concerns the provisions on confidentiality (see Section 2.3.6 above) and the protection measures against retaliation.41
6. Any form of retaliation against a reporting person and other protected persons,42 including threats of retaliation and attempts of retaliation, is prohibited,43 in particular in the form of:
7. suspension, lay-off, dismissal or equivalent measures;
8. demotion or the withholding of promotion;
9. transfer of duties, change of location of place of work, reduction in wages, change in working hours;
10. withholding of training;
11. a negative performance assessment or employment reference;
12. imposition or administering of any disciplinary measure, reprimand or other penalty, including a financial penalty;
13. coercion, intimidation, harassment or ostracism;
14. discrimination, disadvantageous or unfair treatment; 38 See Article 17 §2 of the Act of 28 November 2022. 39 See Article 8 §1(1) of the Act of 28 November 2022. 40 See Article 9 of the Act of 28 November 2022. 41 See Articles 23 and 26 to 31 of the Act of 28 November 2022. 42 In particular (i) facilitators, (ii) third parties who are related to the reporting person and may become victims of retaliation in a work-related context, such as colleagues or relatives of the reporter; and (iii) legal entities owned by the reporter, for which the reporter works, or with which the reporter is otherwise associated in a work-related context. 43 See Article 23 of the Act of 28 November 2022.

NBB_2024_15 – October, 11th 2024 Circular – Page 13/15 9. failure to convert a temporary employment contract into a permanent one, where the worker had legitimate expectations that he or she would be offered permanent employment; 10. failure to renew or early termination of a temporary employment contract; 11. harm, including to the person’s reputation, particularly in social media, or financial loss, including loss of business and loss of income; 12. blacklisting on the basis of a sector or industry-wide informal or formal agreement, which may entail that the person will not, in the future, find employment in the sector or industry; 13. early termination or cancellation of a contract for the supply of goods or services; 14. cancellation of a licence or permit; and 15. psychiatric or medical referrals. 27. With regard to the protection measures, persons reporting information on breaches are not considered to have breached any contractual, statutory or administrative restriction on the non-disclosure of information and can in no way be held liable for a report or public disclosure, provided they had reasonable grounds to believe that reporting was necessary to reveal a breach under the Act of 28 November 2022.44 Likewise, no claims may be filed against these persons under civil, criminal or disciplinary law, nor may any professional sanctions be imposed on them, as a result of the report. Reporting persons cannot be held liable for the acquisition of or access to the information that is reported or publicly disclosed, provided such acquisition or access did not constitute a self-standing criminal offence. Any other possible liability of reporting persons resulting from acts or omissions unrelated to the reporting or public disclosure of a breach under the Act of 28 November 2022 remains governed by the applicable law. 28. Reporting persons and other protected persons who believe they have suffered retaliation can file a complaint with the federal coordinator, who will start an extrajudicial protection procedure and can also take legal action.45 29. Reporting persons and other protected persons who believe they have suffered retaliation can claim damages in accordance with the statutory provisions on contractual or extra-contractual liability.46 For reports of breaches of the rules falling within the supervisory remit of the NBB, these damages are equal, at the injured party’s choosing and insofar as applicable, to a fixed amount of six months’ gross pay, including all fringe benefits, or the damage actually suffered. In the latter case, the injured party must prove the extent of its damage. Without prejudice to the preceding paragraph, an employee who reports such a breach, or the employee’s union, may, if the employer terminates the employment contract or unilaterally modifies the employment conditions contrary to the prohibition on retaliation, request reinstatement by the company or institution at the conditions applicable prior to the termination or modification. Such a request must be made by registered letter within thirty days from the date of service of the notice of termination, termination without notice, or unilateral modification of the employment conditions. The employer must respond to the request within thirty days from receipt thereof. If the employer reinstates the employee or allows the employee to perform their former function at the conditions applicable prior to the termination or unilateral modification, it must pay the wages lost by the employee as a result of the termination or modification of the employment conditions, as well as both the employer and employee social security contributions due thereon. 44 See Article 27 of the Act of 28 November 2022. 45 See Article 26 of the Act of 28 November 2022. 46 See Article 27 §§2 and 3 of the Act of 28 November 2022.

NBB_2024_15 – October, 11th 2024 Circular – Page 14/15 When an employee who reports a breach suffers prohibited retaliation, the employee is entitled to the compensation referred to in the first paragraph of this point if, after the request referred to therein or even if the employee did not submit such a request, the employee is not reinstated by the company or institution or allowed to perform their former function under the conditions applicable prior to the termination or unilateral modification. If prohibited retaliation takes place after the employment relationship has ended, an employee who reported a breach during the employment relationship will be entitled to the same compensation. This protection also applies to civil servants and to persons employed in a professional capacity or who are entrusted with contractual assignments by persons other than employers. 30. In proceedings before a court or other authority in relation to the detriment suffered by the reporting person, and subject to that person establishing the filing of a report and suffering detriment, it will be presumed that the detriment was in retaliation for the report or the public disclosure. It is then up to the person who took the detrimental measure to prove that it was on duly justified grounds.47 In legal proceedings, including for defamation, breach of copyright, breach of secrecy, breach of data protection rules or disclosure of trade secrets or for compensation claims based on private, public or collective labour law, the reporting person and other protected persons48 can in no way be held liable as a result of reports or public disclosures made in accordance with the Act of 28 November 2022.49 When a person reports information to the NBB on breaches falling within the scope of the Act of 28 November 2022 and that information contains trade secrets, such reporting will be considered lawful pursuant to Article XI.332/3 §2 of the Code of Economic Law, where that person meets the conditions of the Act of 28 November 2022. 31. In addition, reporting persons and other protected persons have access to a number of support measures, in particular:50 51

1. comprehensive and independent information and advice, which is easily accessible and free of charge, on the procedures and remedies available, on protection against retaliation, and on the rights of the person concerned, including in relation to the protection of personal data; furthermore, the reporting person must be informed of the fact that they qualify for the protection measures provided for by the Act of 28 November 2022;
2. effective assistance from any competent authority involved in the reporting person’s protection against retaliation;
3. legal aid in criminal and cross-border civil proceedings in accordance with Directive (EU) 2016/1919 and Directive 2008/52/EC of the European Parliament and of the Council, and legal aid in other proceedings, as well as legal advice or other legal assistance, in accordance with the provisions on secondary legal assistance and legal aid;
4. support measures, including technical, psychological, media-related and social support, for the reporting persons referred to in point (25); 47 See Article 29 of the Act of 28 November 2022. 48 In particular (i) facilitators, (ii) third parties who are connected to the reporting person and who could suffer retaliation in a work-related context, such as colleagues or relatives of the reporting person, and (iii) legal entities that the reporting person owns or works for or with which the reporting person is otherwise connected in a work￾related context. 49 See Article 30 of the Act of 28 November 2022. 50 See Article 24 of the Act of 28 November 2022. 51 In accordance with Article 25 §1(1) of the Act of 28 november 2022, the FIRM/IFDH is responsible for the support measures referred to in (1) and (3) to (5).

NBB_2024_15 – October, 11th 2024 Circular – Page 15/15 5. financial assistance for whistleblowers in the context of legal proceedings.52 Finally, the NBB may, at the request of the person concerned and without prejudice to the duty of confidentiality, assist the reporting person and other protected persons53 in their dealings with any administrative or judicial authority involved in their protection against retaliation, and, in particular, may confirm in that context that the person concerned filed a report in accordance with the Act of 28 November 2022. Yours faithfully, Pierre Wunsch Governor 52 In accordance with Article 25 §1(1) of the Act of 28 November 2022, the FIRM/IFDH is responsible for the protection measures referred to in (1) and (3) to (5). 53 In particular (i) facilitators, (ii) third parties who are connected to the reporting person and who could suffer retaliation in a work-related context, such as colleagues or relatives of the reporting person, and (iii) legal entities that the reporting person owns or works for or with which the reporting person is otherwise connected in a work￾related context.