Universal Registration Document 2024

RISK FACTORS AND INTERNAL CONTROL 2 RISK FACTORS

2.1.6 RISKS RELATED TO COMPLIANCE AND THE COMPANY’S CULTURE

5 – A: CORRUPTION AND OTHER RISKS RELATED TO BUSINESS INTEGRITY Prohibited practices contrary to ethics and compliance in business conduct by employees or partners may damage Groupe ADP’s reputation and share value Criticality ++ Change in 2024 è Detailed description of the risk factor

Potential effects for the Group u Legal consequences u Financial consequences u Image damage u Loss of stakeholder confidence u Consequences on the alignment of the Group’s activities with Regulation 2020/852, or “green taxonomy” u Environmental damage, Human Rights breaches and health and safety issues in the Group's value chain Interconnected risks u Risks related to the economic trajectory u Geopolitical risks u Risks related to the management of major projects u Risks related to data management

As an internationally active group, Groupe ADP is subject to several laws and regulatory frameworks, including accounting standards and economic sanctions programmes issued by governments or international organisations. The latter may also issue guidelines with which Groupe ADP must comply. The multiplicity of regulatory environments in which Groupe ADP operates, as well as the evolution of these, current and future, increase the complexity and risks associated with compliance in the conduct of the Group’s activities. The reinforcement of regulatory frameworks prohibiting unethical and non-compliant practices in the conduct of business are prone to expose the Group, its employees, associates or third parties acting for the Group, to administrative, criminal or civil charges, and to undermine its reputation. In France, law no. 2016-1691 of 9 December 2016, relating to transparency, the fight against corruption and modernisation of economic life (Sapin II), but also all anti-corruption laws (in particular the UK Bribery Act and the US Foreign Corrupt Practices Act) to which Groupe ADP is subject due to its worldwide presence, require that companies implement a programme aiming at preventing and detecting acts of corruption or influence peddling. In the event of a prevention failure, the Group is liable for administrative or penal sanctions. Under French law no. 2017-399 of 27 March 2017 on the duty of vigilance of parent companies instructing undertakings (the Potier Law), Groupe ADP is also required to deploy a Vigilance Plan to identify and prevent or mitigate, for its entire value chain, including its main suppliers and subcontractors with which it has an “established commercial relationship”, the risks of serious violations of Human Rights and fundamental freedoms, the health and safety of individuals, and the environment. In the event of failure to implement a Vigilance Plan, the Group may be challenged by any third party with an interest in the matter, and then ordered by a court to comply with the law, and in the event of damage caused as a result of failure to comply with these obligations, be required to pay compensation for the loss suffered. With the adoption of the Corporate Sustainability Due Diligence Directive (CSDDD), French regulations are set to change in the near future (the deadline for transposition is 26 July 2026). Within this framework, a national supervisory authority is to be appointed to operate in liaison with the European regulatory authority. Companies that fail to comply with the due diligence obligations may be held liable (civil liability; administrative penalty of a maximum of at least 5% of consolidated worldwide net revenue; public statement indicating the company's responsibility for the offence and a description of the failure).

MAIN RISK MANAGEMENT SYSTEMS After two years of monitoring, including one year of exclusion by the International Finance Corporation (IFC), a member of the World Bank Group, ADP International, a Groupe ADP company, obtained a release from the IFC, putting an end to the sanction and monitoring. Groupe ADP’s ethics and compliance programme is based on: 1. the anti-corruption programme, which complies with the requirements of the Sapin II law and in particular: u a Group Code of Conduct, reviewed in 2023 in line with the recommendations of the World Bank; u a Group whistleblowing system based on a processing charter setting out the principles governing the processing of alerts, reviewed in 2023 in line with the recommendations of the World Bank and the Waserman Law (French law no. 2022-401 of 21 March 2022 aimed at improving the protection of whistleblowers). This whistleblowing system is open to all players in the Group’s value chain and also includes alerts relating to the duty of vigilance scope;

u a corruption risk map updated on a regular basis. The last exercise was carried out in 2024, based on a revised methodology, following the recommendations of the World Bank. The next full mapping exercise is scheduled for 2027, with partial mapping, for example, of entities newly integrated into the Group; u an assessment of all third parties entering into business relationships with Groupe ADP based on a procedure and a group tool; u accounting control procedures and a specific key control manual for Ethics and Compliance procedures; u a training programme described in the training plan. This programme entails in particular an e-learning course for all Group employees on corruption, conflicts of interest and gifts/invitations, and specific e-learning modules for the most exposed populations; u a multi-year communication plan to disseminate the culture of ethics; u an internal control system specific to the Sapin II system.

119

UNIVERSAL REGISTRATION DOCUMENT 2024 w AÉROPORTS DE PARIS