2022 Universal Registration Document

R i sk and r i sk management 2 Risk factors

2.1 .6 COMPLIANCE RISKS

5 - A: CORRUPTION AND BUSINESS INTEGRITY RISKS Prohibited practices contrary to ethics and compliance in business conduct by employees or partners may damage Groupe ADP’s reputation and share value. Criticality + + Change in 2022 Detailed description of the risk factor

Potential effects for the Group — Legal consequences — Financial consequences — Image damage — Loss of stakeholder confidence — Consequences on non‑financial ratings (taxonomy in particular) Interconnected risks — Risks related to the economic trajectory — Geopolitical risks — Risks related to the management of major projects — Risks related to data management

As an internationally active group, Groupe ADP is subject to several laws and regulatory frameworks, including accounting standards and economic sanctions programs issued by governments or international organisations. The latter may also issue guidelines with which Groupe ADP must comply. The multiplicity of regulatory environments in which Groupe ADP operates, as well as the evolution of these, current and future, increase the complexity and risks associated with compliance in the conduct of the Group’s activities. The reinforcement of regulatory frameworks prohibiting unethical and non-compliant practices in the conduct of business are prone to expose the Group, its employees, associates or third parties acting for the Group, to administrative, criminal or civil charges, and to undermine its reputation. In France, law No. 2016-1691 of 9 December 2016, relating to transparency, the fight against corruption and modernisation of economic life (Sapin 2), but also all anti-corruption laws (in particular the Foreign Corrupt Practices Act) to which Groupe ADP is subject due to its worldwide presence, require that companies implement a program aiming at preventing and detecting acts of corruption or influence peddling. Under the supervision of the French anticorruption agency, and under penalty of administrative or penal sanctions. Under French Law No. 2017-399 of 27 March 2017 on the duty of care of parent companies and contractors (the Potier Law), Groupe ADP is also required to deploy a due diligence plan to identify and prevent or mitigate, for its entire value chain, including its main suppliers and subcontractors with which it has an “established commercial relationship”, the risks of serious violations of human rights and fundamental freedoms, the health and safety of individuals, and the environment. In the event of failure to implement a due diligence plan, the Group may be challenged by any third party with an interest in the matter, and then ordered by a court to comply with the law, and in the event of damage caused as a result of failure to comply with these obligations, be required to pay compensation for the loss suffered.

MAIN RISK MANAGEMENT SYSTEMS Despite the implementation and improvement of procedures to ensure compliance with these laws and regulations, it remains possible that Groupe ADP employees or subcontractors will not comply with these policies or that these programs will not prevent breaches. Nor can it be ruled out that transactions carried out in contradiction with Groupe ADP’s policies may be identified and may result in penalties or sanctions or impede Groupe ADP’s ability to continue its activities without restriction. In addition, Groupe ADP does not control, directly or indirectly, in terms of voting rights, certain entities in which it holds an interest and which carry out international activities. In such cases, its ability to enforce compliance with its internal policies and procedures may be more limited. Such actions could lead to legal action against Groupe ADP and have negative repercussions on its development, results and reputation. In addition, changes in these regulations or potential sanctions could increase the costs of compliance. ADP International, a subsidiary of Groupe ADP, signed on 4 January 2022 a transactional agreement with the International Finance Corporation (IFC), the main development institution within the World Bank Group. It is part of an out-of-court settlement negotiated by ADP International under which the Company assumes responsibility for practices considered fraudulent and collusive that occurred, from 2013 and in 2015, during the tender procedures organised for the award of the

concessions of the Zagreb airports in Croatia and of Antananarivo and Nosy Be in Madagascar, the construction of which was partially financed by the IFC. Under this agreement, ADP International, as well as its subsidiaries (the “Sanctioned Group”), were no longer authorised, for a period of 12 months from 4 January 2022, to take part in projects financed by the World Bank Group (exclusion accompanied by a probationary period of 12 additional months during which an expert chosen by the World Bank will continue their review of the internal processes of the companies of the Sanctioned Group in order to verify compliance with the principles of the World Bank related to the prevention of fraudulent acts). This debarment only applies to ADP International and the companies it controls - and therefore does not include within its scope Aéroports de Paris SA and its other subsidiaries, including TAV Airports’ companies. In 2022, the first report was issued by the expert appointed by theWorld Bank. Groupe ADP is working on the implementation of the recommendations it issued with all stakeholder departments. The Group has set aside additional resources for this purpose. The World Bank lifted the sanction referred to above on 5 January 2023, but ADP International remains on probation for the next 12 months as of 5 January 2023. During this period, ADP International and its subsidiaries will have the opportunity to take part in calls for tenders for projects financed by the World Bank Group.

154

AÉROPORTS DE PAR I S / UN I VERSAL REG I STRAT I ON DOCUMENT 2022