2022 Universal Registration Document

Soc i al , env i ronmental and soc i etal respons i b i l i ty i nformat i on Develop a culture of responsibility and ethics for the benefit of all our stakeholders

DEFINITION AND DIFFUSION OF POLICIES, RULES AND METHODS For the past five years, Groupe ADP has been working to develop an ethics and compliance culture at all levels within the Company. Initiated at the end of 2017, the Ethics and Compliance program has made it possible to set benchmarks on best practices for employees, in particular through the implementation of a code deployed in nine languages and procedures (gifts and invitations, conflicts of interest, sponsorship, assessment of third parties, international sanctions/embargoes, etc.). In 2022, the Group continued to standardize the third-party assessment process by training teams in the use of the dedicated tool. There are currently four levels of assessment activated according to the type of project and to the risk related to countries and third parties. In addition to the ethical culture that creates the right reflexes, the third-party assessment procedure makes it possible to prevent risks related to investment projects. ADP International, a subsidiary of Groupe ADP, signed on 4 January 2022 a transactional agreement with the International Finance Corporation (IFC), the main development institution within the World Bank Group. It is part of an out-of-court settlement negotiated by ADP International under which the Company assumes responsibility for practices considered fraudulent and collusive that occurred from 2013 to 2015, during the tender procedures organised for the award of the concessions of the Zagreb airports in Croatia and of Antananarivo and Nosy Be in Madagascar, the construction of which was partially financed by the IFC. Under this agreement, ADP International, as well as its subsidiaries (the “Sanctioned Group”), were no longer authorized, for a period of 12 months from 4 January 2022, to take part in projects financed by the World Bank Group (exclusion accompanied by a probationary period of 12 additional months during which an expert chosen by the World Bank continued their review of the internal processes of the companies of the Sanctioned Group in order to verify compliance with the principles of the World Bank and relating to the prevention of fraudulent acts). This debarment only applies to ADP International and the companies it controls – and therefore does not include within its scope Aéroports de Paris and its other subsidiaries, including TAV Airports. In 2022, the first report was issued by the expert appointed by theWorld Bank. Groupe ADP is working on the implementation of the recommendations it issued with all stakeholder departments. THE WHISTLE-BLOWING SYSTEM Available since 1 October 2018 to Group and supplier employees, the whistle-blowing platform (https://alert.groupeadp.fr/ entreprises) meets the requirements of the Potier law (duty of vigilance) and the Sapin II law (fight against corruption). The whistle-blowing system is accessible to all Group employees and those of our suppliers via an outsourced and secure platform. It allows everyone to ask questions or report problems. The processing of alerts is governed by a charter and an internal investigator is dedicated to Ethics and Compliance matters. In 2022, the Group processed 13 admissible alerts resulting in three investigations, one recommendation, and zero sanctions. TRAINING AND AWARENESS-RAISING An intranet site and website (https://www.parisaeroport.fr/en/ group/csr/ethics-and-compliance) are dedicated to the Ethics and Compliance action plan and on-site training and e-learning sessions are regularly held to raise employee awareness.

In 2019, the Group rolled out a mandatory e-learning course which was taken by more than 10,000 employees. After 2020 and 2021 when many employees were on partial employment, follow-ups were carried out in 2021 and 2022. In addition, the rate of completion of mandatory training is one of the criteria taken into account for profit-sharing. At the same time, face-to-face training continued in 2022. In 2021, the heads of assets within the operations department were trained in order to strengthen their ability to challenge the subsidiaries on their ethics and compliance program within the bodies in which they represent Groupe ADP. In 2022, the Group’s expatriates were made aware of their role as ambassadors in their missions within international assets. New specific modules will be rolled out in 2023 to continue training for exposed populations (relations with the authorities, patronage and sponsorship, etc.). A manager kit containing cases processed and anonymised as part of the whistleblowing system has been formalized to enable the Group’s main managers to lead sessions and practice how to deal with sensitive situations. Three awareness-raising sessions were offered to them to support them in adopting this kit. All Group employees within the scope subject to the GDPR (EU) are made aware of the protection of personal data. An e-learning course is being re-deployed for all employees and persons in key data protection positions are invited to in-person training on the requirements of the GDPR, which they must comply with, and/ or for which they must ensure application in their daily activities. MONITORING OF THE ETHICS AND COMPLIANCE MECHANISM Thanks to the ethics climate barometer conducted each year, more than 3,000 employees report their understanding of ethics and compliance issues and the level of reputation and trust in the whistle-blowing system, while comparing themselves to employees of large companies. The barometer enables the Group to guide awareness-raising to ensure a homogeneous ethics and compliance culture. 2022 survey figures: ◆ 84% believe that their managers act ethically (+14 points vs. employees of large companies); ◆ 79% of employees are aware of the whistle-blowing system (+12 points vs. employees of large companies) and 71% trust the whistle-blowing system (+7% vs. employees of large companies); ◆ the ethics and compliance controls included in the Group’s internal control framework are reviewed and tested in the field every year. In addition, specific ethics and compliance controls to verify the implementation of procedures have been formalized and will be rolled out in 2023; ◆ in terms of data protection, control is organised into three levels (business line, data protection team, and Audit Department). The GDPR compliance management platform and documentation (AIPD) make it possible to monitor action plans by processing or by department. The data protection team performs self-assessments as part of internal control. ADP SA monitors the compliance of Group entities through Group committees (two to three times a year).

4

295

AÉROPORTS DE PAR I S / UN I VERSAL REG I STRAT I ON DOCUMENT 2022