Summaries of Conduit’s internal policies

The Anti-Bribery and Corruption Policy sets out the approach adopted by Conduit for the identification, assessment, mitigation and monitoring of the bribery and corruption risks to which Conduit is exposed. Any proposed changes to the Policy will be referred to the Board of Directors for review and approval.

Conduit is committed to preventing bribery and corruption in all parts of its operations. Conduit employees are prohibited from engaging in all activities that would be classified as bribery or corruption. Bribery is offering, promising, giving or accepting any financial or other advantage, to induce the recipient or any other person to act improperly in the performance of their functions, or to reward them for acting improperly, or where the recipient would act improperly by accepting the advantage. An advantage includes money (including facilitation payments, kickbacks, loans, fees, discounts, donations and political contributions), services, the award of a contract, gifts, hospitality or anything else of value.

In order to comply with applicable legislative and regulatory requirements in Bermuda and to mitigate the risks posed by bribery and corruption, Conduit has policies, procedures, systems and controls in place. The Policy also details relevant reporting mechanisms, due diligence procedures and record keeping guidance. Conduit staff are made aware of their responsibilities under the Policy. Additionally, staff are required to complete an anti-Bribery and Corruption training course at least annually, and more frequently if there are material changes in the requirements or other indications that refresher training is needed.

The Anti-Money Laundering/Anti-Terrorist Financing Policy (AML/ATF) sets out the approach adopted by Conduit for the identification, assessment, mitigation and monitoring of the money laundering and terrorist financing risks to which Conduit is exposed. Any proposed changes to the Policy will be referred to the Board of Directors for review and approval.

Conduit has no appetite or tolerance for any breach of applicable legislation or regulations that lead to censure by a regulatory authority.

In order to comply with applicable legislative and regulatory requirements in Bermuda and to mitigate the risks posed by money laundering and terrorist financing, Conduit has established appropriate risk-based policies, procedures systems and controls. This includes procedures for identifying and reporting suspicious activities, emphasising the importance of due diligence, sanctions screening and encouraging continuous monitoring from employees. The Policy provides examples of situations which could give rise to a suspicion of money laundering or terrorist financing.

Conduit has appointed a Money Laundering Reporting Officer (“MLRO”) with responsibility for identifying, managing and monitoring the money laundering and terrorist financing risks to which Conduit is exposed.

All employees are provided with AML/ATF training at least annually, and more frequently if there are material changes in the requirements or other indications that refresher training is needed.

This Policy sets out the approach adopted by Conduit for the identification, assessment, use and monitoring of Artificial Intelligence (AI) in the workplace and the management of associated risks.

All Conduit staff are responsible for review and acceptance of this Policy annually.

Certain AI platforms and technologies are not permitted for use within Conduit due to concerns related to security, privacy and compliance. Authorised AI applications must only be used by the workforce for the purposes specified in the Policy.

Guidelines for the use of AI are detailed in the Policy to reduce the risk of compromising Conduit's data. This includes guidelines on data protection and privacy, review of outputs (including avoiding potential bias in use), ethical and responsible use and being secure amongst others. Employees are expected to use AI responsibly and will receive guidance and training to ensure they understand both the capabilities and limitations of AI tools and systems.

Breach of this Policy may, where appropriate, result in disciplinary action up to and including dismissal or termination of employment or engagement with Conduit.

The Data Classification and Handling Policy sets out the approach adopted by Conduit on the handling of data. The Policy applies to the activities of Conduit. Any proposed changes to the Policy will be referred to the Board of Directors for review and approval.

Conduit has no appetite or tolerance for any breach of applicable legislation or regulations that lead to censure by a regulatory authority, nor for incidents that would lead to leaked or lost data that we are responsible for. As a Company licensed and operating in Bermuda, Conduit complies with various regulatory standards to manage the classification, handling, security and retention of data.

Conduit follows specific guidelines and handling expectations for identifying, labelling, and storing various types of data, including confidential, internal, and public information.

Employees are required to follow set guidelines to prevent unauthorised access and ensure compliance with legal and regulatory requirements. The Policy also details the procedures for reporting data breaches and handling incidents involving sensitive information.

Conduit has an established programme in place to protect its data from cyber risk incidents. The Cyber Risk Management Programme is subject to oversight by the Board of Directors. The daily management of this programme is delegated to Conduit's Chief Information Security Officer (“CISO”). The CISO role is also responsible for a risk assessment of the programme at least annually, with ongoing monitoring that would identify any changes necessary.

The Disclosure and External Communications Policy sets out the Group’s approach to the sharing of information about Conduit, or confidential information held by Conduit, with third parties, including public disclosures.

This Policy is designed to provide a framework and outline the controls in place to ensure disclosures by Conduit are accurate and complete, while maintaining quality, managing risks, and ensuring legal and regulatory compliance. It offers guidance on various types of disclosures, including routine disclosures, significant disclosures of confidential or commercially sensitive information, disclosures relevant to financial markets, and matters left to personal discretion.

The Employee Handbook is intended to set out the expected practices and behaviours to apply across Conduit. For the avoidance of doubt, the Employer is required to comply with local laws and regulations and if there is a conflict between the Handbook and such local laws or regulations, the laws and regulations will apply.

The Handbook is intended to promote fairness, transparency and consistency in the relationship between Conduit and employees. While the Handbook describes policies and practices that govern the workplace, it also explains many employee responsibilities.

Conduit has high expectations of employee practices and behaviours to ensure a high calibre and comfortable working environment. Conduit emphasises company values and adherence to ethical standards, maintaining a safe and inclusive environment, and respecting confidentiality.

Conduit believes that employees are entitled to fair compensation and reward schemes, which are determined by the People and Culture team and Management based on wider achievement of corporate goals and professional development. Conduit values employee safety and transparency with pre-screening and probationary periods as well as fostering an environment of open communication and consideration of employee complaints. Conduit aims to provide a work environment that is respectful and productive. This is established in rules and disciplinary procedures which aim to prevent conflicts.

Employee health and wellness is taken seriously at Conduit; the Policy sets out the expectations and requirements in requesting sick leave or parental leave throughout the year. In these policies, along with additional vacation days, Conduit aims to support its employees’ wellbeing. Conduit is focused on promoting a culture of integrity, respect, and continuous improvement within the organisation.

Equal Employment Opportunity

Conduit is an equal opportunity employer and does not discriminate against employees or job applicants based on race, religion, colour, sex, sexual orientation, marital status, age, nationality, disability, or any other grounds of discrimination prohibited by applicable legislation.

Equal opportunity extends to all aspects of the employment relationship, including but not limited to hiring, promotions, training and development, working conditions, compensation, and benefits. Candidacy for employment or advancement is based solely on the relevant qualities, qualifications and experience the candidate would bring to the position. All such decisions are made by using objective standards based on the individual’s qualifications as they relate to the job.

All employees are expected to act in accordance with the Policy and always treat colleagues with their due respect and dignity. This expectation on our employees also applies to employee interactions with visitors, clients, customers, and vendors or suppliers with whom they interact in the operation of Conduit’s business.

Diversity and Inclusion

We strive to create an inclusive environment which embraces differences and fosters inclusion.

The Diversity and Inclusion Policy applies to all employees and representatives, and contractors when they act on behalf of Conduit. It is intended to complement local statutory provisions.

Conduit embraces and supports our employees’ differences in age, ethnicity, gender, gender identity or expression, language differences, nationality or national origin, family or marital status, physical or mental development abilities, race, religion or belief, sexual orientation, skin colour, social economic class, education, work and behavioural styles, political affiliation, and other characteristics that make our employees unique.

In respecting and valuing the diversity among our employees, and all those with whom we do business, managers and employees are expected to ensure there is a work environment free of all forms of bullying, discrimination, and harassment.

Flexible Work Policy

Conduit recognises that for work or personal reasons there may be times when it makes sense for staff to work from another location, such as, but not limited to, their home. Similarly, there may be times when it makes sense to vary which hours an employee works on any given working day.

Employees are permitted to vary their working location and/or hours so long as doing so does not negatively impact the performance of their role and the ability for Conduit and employee to participate in role and career development activities.

Holiday entitlement

Full-time employees are provided an annual allowance of holiday days as stated in each employee’s Contract of Employment. Employees are expected to take their full allocation.

Volunteer Days

Conduit encourages employees to become involved in the local community, lending their voluntary support to programmes that positively impact the quality of life. In support of various initiatives locally, Conduit also arranges ‘Conduit in the Community’ days each year which all staff are invited to participate in.

In addition to the above “in the community days” arranged, employees, at the discretion of the relevant department head, can take one (1) day of paid time off each year to participate in their specific volunteer programme or fundraising initiative.

Should an employee wish to request any additional time for charitable initiatives beyond the scope of the Policy, the request should be made to their department head for consideration.

Parental Leave Policy

It is Conduit’s policy that all Conduit employees are eligible for Parental Leave benefits from the commencement of their employment, subject to having successfully completed any relevant probationary period. The Policy is in place for families welcoming the birth or adoption of a new child.

Conduit’s policy separates parental leave between primary and secondary carers for the child. For the primary carer, up to 26-weeks paid leave is available for all eligible employees, exclusive of any public holidays falling during that period. For secondary carers, Conduit provides up to four (4) weeks of paid parental leave to eligible employees from the date of the child’s birth, or placement of the adopted child.

Conduit recognises that at times, there may be a need for an employee to request additional parental leave or a period of flexible working arrangements. Following discussion of the request between the employee, their manager and the People and Culture team, a plan can be devised which is specific to the circumstance.

Conduit wants to support new parents with their return to work. The People and Culture team will schedule keeping in touch meetings and can discuss any desired alterations to contractual working arrangements or phased return to work arrangements. Facilities, such as a lactation room, will be provided to support a good return to work experience.

Family Medical Emergency Leave

On a case-by-case basis, family medical leave of up to 12 weeks may be available to staff who have served Conduit for at least one year. Such leave will typically be on an unpaid basis during which employment benefits will continue. There may be circumstances where a period of paid leave is considered, for example in cases where undue hardship may be caused. Family medical emergency leave is limited to caring for an employee’s spouse, child or parent who has a serious health condition.

Disciplinary Procedure

Conduit's intention is to maintain a creative, productive and positive work environment. Conduct that interferes with operations, brings discredit to Conduit, or is offensive to customers or fellow employees may subject the individual involved to disciplinary action, up to and including, termination.

Grievance Procedure

Conduit promotes open communication between employees and management to ensure that any issues arising during employment are raised and resolved promptly, to the mutual satisfaction of all parties. Employees with any employment-related complaint or grievance should first raise the issue with their immediate manager. If informal resolution efforts are unsuccessful, they must promptly initiate the formal procedure outlined in the Employee Handbook.

Discriminatory Harassment and Bullying

Discriminatory harassment, including sexual harassment and bullying, are not tolerated at Conduit and any such behaviour will be dealt with in accordance with Conduit’s disciplinary procedure. Conduit has a zero-tolerance policy against sexual harassment and discrimination.

If an employee believes that they have been the victim of bullying, sexual or other harassment or discrimination in the workplace, or if an employee has witnessed what is believed to be bullying, sexual or other harassment or discrimination of another, they should follow the steps outlined in the Employee Handbook.

If Conduit determines that bullying, harassment or discrimination has occurred, Conduit will take effective remedial action commensurate with the severity of the offence. Serious cases of harassment or bullying may amount to gross misconduct resulting in dismissal.

Retaliation against an individual for reporting bullying, harassment or discrimination or for participating in an investigation of a claim of bullying, harassment or discrimination is a serious violation of the Policy and, like bullying, harassment or discrimination itself, will be subject to disciplinary action.

The Fit and Proper Policy outlines the criteria and procedures for ensuring that individuals in key positions within Conduit meet the necessary standards of competence, integrity, and professionalism.

Conduit ensures that individuals in key positions such as directors, senior executives, and key function holders, meet necessary standards of competence. This process begins with recruitment and the consideration of all candidates’ qualifications, references, and background checks.

Conduit emphasises continual training and development of employees beginning with a probationary period to ensure the employee is equipped with competencies applicable to their role. Further, employees are encouraged to participate in further training and professional development to support their growth and maintain high standards of performance.

Conduit understands the importance of ongoing monitoring and evaluation of individuals through annual fitness and proprietary checks to ensure that they continue to meet the highest standards. Upholding high ethical standards and maintaining a capable and reliable leadership team remains central to Conduit’s goals.

The Green Loan Policy sets out the approach adopted by Conduit to support Employees who may need financial assistance to invest in assets that benefit the natural environment. Conduit aims to support employees and the environment through fostering and encouraging environmentally friendly employee purchases. Employees based in Bermuda who are interested in making environmentally conscious purchases, such as electric vehicles or solar panels, may be eligible for interest free loans designed to finance these green projects.

The Policy details the eligibility criteria, application process, and repayment terms all designed to assist full-time employees in achieving their environmental goals. While offering green loans, the Policy ensures that Conduit continues to abide by Company policies and regulatory guidelines surrounding compliance and monetary employee support.

The IT Policies sets out the approach adopted by Conduit to manage its Information Technology (“IT”) resources and infrastructure and the risks associated.

Conduit is committed to continuously improving information security systems, ensuring integrity and protection of data, and monitoring and responding to information security threats.

Conduit has no risk appetite for breaches of laws or regulations including data breaches or unplanned loss of data, or outages of systems or core processes that would materially disrupt the business.

The Policies outline Conduit's guidelines for managing and securing information technology resources. It emphasises the importance of protecting data, ensuring system integrity, and maintaining compliance with legal and regulatory requirements. The Policies provide detailed procedures for accessing, using, and safeguarding IT systems, including protocols for data encryption, user authentication, and regular security audits. Employees are required to adhere to these guidelines to prevent unauthorised access and mitigate risks associated with IT operations.

The governance of IT services and usage is the responsibility of the IT team; however, the Policies set out how each department collaborates to ensure Company-wide protection against viruses, phishing, and malware.

At Conduit, all employees are required to abide by these technological expectations and participate in annual training to prevent unauthorised access and mitigate technological and operational risks. To ensure Conduit remains protected from cyber threats, the Policies set out the unacceptable and acceptable uses of Conduit IT services and systems as well as the responsibilities of authorised users in maintaining a secure and compliant digital environment.

Employees, suppliers, contractors and any others with access to our systems are required to comply with the policies. Violation of any of Conduit’s IT Policies may result in disciplinary action which may include termination or immediate suspension of all access to Conduit’s devices and networks. Additionally, where applicable, individuals may be subject to civil and/or criminal prosecution.

The Privacy Programme outlines Conduit’s approach to handling personal information. Any proposed changes to the Policy will be referred to the Board of Directors for review and approval.

Conduit has zero tolerance for breaches of applicable legislation or regulations that could result in regulatory censure, or for any incidents involving the mishandling of personal information. We are committed to safeguarding personal data and ensuring full compliance with privacy regulations.

The Programme is embedded in group-wide risk/compliance management, with Information Security measures and controls put in place to safeguard personal information and ensure access is limited to employees and authorised Service Providers who require the access.

The Policy provides guidelines for data collection, storage, and processing, ensuring that all activities are conducted lawfully and transparently. Conduit requires employees to uphold their responsibilities in handling personal data, reporting, and managing data breaches.

Conduit has appointed a Privacy Officer who is responsible for monitoring compliance with data protection regulations, identifying and overseeing any remediation actions required, and communicating with regulators when necessary, including any breach incidents.

Conduit has appointed a Chief Information Security Officer (“CISO”) who works closely with the Privacy Officer to ensure the appropriate controls and security measures are in place to protect data held by Conduit. Both the Privacy Officer and the CISO report directly to a C-level executive.

The Procurement and Outsourcing Policy sets out the approach adopted by Conduit for the identification, assessment, mitigation and monitoring of the operational risks associated with its outsourcing arrangements with both affiliated and non-affiliated service providers.

Conduit has no appetite for risks such as system outages leading to financial loss, inability to meet business obligations, or core processing systems.

The Policy sets out Conduit’s expectations for employee conduct surrounding outsourcing, regulatory notifications, and maintenance of working relationships with reputable third-party providers. As a Company, Conduit focuses on due diligence, reliability, strategic alignment and compatibility when selecting potential vendors to ensure they meet Conduit’s operational, ethical, and regulatory standards.

Conduit recognises the importance of effectively managing outsourced activities to ensure compliance with regulatory requirements and maintain the highest standards of service. Conduit consciously selects reputable third-party providers and conducts thorough due diligence before entering into outsourcing agreements. Conduit also emphasises the need for clear contractual terms and regular performance reviews to maintain the quality and reliability of outsourced services.

The Sanctions Policy sets out the approach adopted by Conduit for the identification, assessment, mitigation and monitoring of the trade and financial sanctions-related risks to which Conduit is exposed. Any proposed changes to the Policy will be referred to the Board of Directors for review and approval.

Conduit has zero tolerance for breaches of applicable legislation or regulations that could result in regulatory censure. To comply with applicable legislative and regulatory requirements in Bermuda and to mitigate the risks associated with a breach of applicable sanctions, Conduit has established appropriate and effective risk-based policies, procedures, systems and controls.

The Policy provides guidelines for identifying and screening potential business partners, customers, and transactions to ensure compliance. The document also details the responsibilities of various departments in implementing and monitoring compliance with sanctions regulations. Employees are required to follow these procedures and complete sanctions training annually to prevent violations and mitigate risks associated with sanctions.

The Training, Development & Tuition Reimbursement Policy & Procedure sets out the approach adopted by Conduit for all employee training, professional development, and tuition reimbursement. The purpose of the Policy is to provide all employees with professional development opportunities that increase their skills and enhance their contributions to Conduit.

Conduit understands the importance of continuous learning and development and provides guidelines for accessing training programmes, educational development, and tuition reimbursement, ensuring that the process is transparent and accessible to all eligible employees.

Employees and their managers should discuss their learning and development as part of the annual goal setting process and should be an ongoing process to ensure that job specific training and development needs are agreed and aligned to the employee’s role within Conduit.

Conduit offers a training benefit to all its full-time employees. The benefit can be used for costs associated with:

• Professional exams and exam preparation courses
• Certificate programmes and credentials
• Courses offered by an accredited institution, including e-learning
• Workshops, seminars and conferences
• Membership in professional organisations

To support employees who wish to pursue qualifications or attend relevant courses, where employees have a suitable business case, Conduit will allow a certain number of days’ study leave. On completion of certain named professional courses/qualifications, a defined Completion Bonus may be awarded to the employee.

Conduit reserves the right to determine which training functions and association memberships are in the best interests of Conduit, its future planning and direction. By empowering employees to grow through structured learning and meaningful support, Conduit reinforces its commitment to excellence, innovation, and long-term success.

The aim of the Whistle-blower Policy and Procedure is to ensure that all Conduit staff are confident that they can raise any matters of genuine concern without fear of reprisals, in the knowledge that they will be taken seriously and that the matters will be investigated appropriately and regarded as confidential.

The Audit Committee of the Board of Directors is responsible for monitoring and reviewing the operation of the Whistle-blower Policy and Procedure, as well as considering recommendations for organisational changes arising from investigations into complaints under this Policy. The Whistle-blowing Policy and Procedures apply to all Conduit staff and encompasses individuals working for Conduit at all levels and grades, whether they are senior managers, directors, employees, contractors, trainees, home workers or agency staff.

Conduit has appointed a Whistle-blowers' Champion, who has responsibility for ensuring and overseeing the integrity, independence and effectiveness of the relevant firm's policies and procedures on whistleblowing. Conduit will ensure that any personnel who may be involved with administration or investigations carried out under the Policy receive regular and appropriate training to assist them with these duties.

The Policy details clear instructions on how employees can report issues confidentially either internally or anonymously through an independent outsourced provider through multiple channels, including the use of a hotline and helpdesk, to ensure that concerns are addressed promptly and appropriately.

Conduit is committed to investigating disclosures fully, fairly, quickly and confidentially where circumstances permit. Following submission of a formal written disclosure, the report recipient will acknowledge receipt within five working days and make appropriate arrangements for investigation. The length and scope of the investigation will depend on the subject matter of the disclosure. In most instances the report recipient will carry out an initial assessment of the disclosure to determine whether there are grounds for a more detailed investigation to take place. Following this, a report will be produced and copies will be provided to the Audit Committee.

If following the initial investigation by the report recipient a more detailed investigation is considered necessary, Conduit may appoint an investigator or investigative team including personnel with experience of operating workplace procedures or specialist knowledge of the subject matter of the disclosure. Recommendations for change will also be invited from the investigative team to enable Conduit to minimise the risk of the recurrence of any malpractice or impropriety which has been uncovered. The Audit Committee will then be responsible for reviewing and implementing these recommendations.

No member of staff who raises genuinely held concerns in good faith under this Procedure will be dismissed or subjected to a detriment as a result of such action. Members of staff who victimise or retaliate against those who have raised concerns under the Procedure will be subject to disciplinary action.