Employees, self-employed workers, collaborators, volunteers and trainees, including unpaid ones, who work for RFI S.p.A.; employees or collaborators, who work for entities that supply goods or services or carry out works for third parties; freelance professionals and consultants who work for RFI S.p.A.; RFI S.p.A. shareholders and individuals with administrative, management, control, supervisory or representative functions. These individuals are to report information on violations of which they have become aware as part of their working environment. Reports can also be made:

a) even if the employment relationship has not yet begun, if the information on violations was acquired during the recruitment process or in other pre-contractual stages;

b) during the probationary period;

c) after the termination of the employment relationship if the information on violations was acquired in the course of that relationship.

Information on violations with regard to facts (of any nature whatsoever, including mere omissions), attributable to Rete Ferroviaria Italian SpA Employees or Third Parties, which may represent:

1) violations of RFI SpA’s 231 Model and procedures implementing it and/or of the RFI SpA’s Anti-Corruption Policy and Anti Bribery&Corruption management system (hereinafter the “ABC system”) and/or of the Code of Ethics and/or of the Company’s internal regulations and/or in any case likely to result in detriment or damage, even if only in terms of image or reputation, to the FS Italiane Group;

2) administrative, accounting, civil or criminal offences;

3) unlawful conduct pursuant to Legislative Decree No. 231 of 8 June 2001;

4) offences covered by European Union legislation and the national provisions implementing it;

5) acts or omissions detrimental to the financial interests of the European Union;

6) acts or omissions affecting the internal market (e.g. competition and state aid violations);

7) acts or misconduct that undermine the object or purpose of the European Union acts.

Reports must relate to facts about which the whistleblower has knowledge, where the whistleblower has reasonable ground to consider that the information reported is true at the time of the report.

Reports must be made promptly in relation to the knowledge of the facts so as to make it practically possible to verify them.

RFI SpA provides the following channels for making reports:

• IT platform: that can be accessed from the RFI SpA website - www.rfi.it - and the corporate intranet. This channel is preferred as it is best suited to ensure that, by computerised means, the Whistleblower's identity is kept confidential and that adequate information security measures are ensured;
• Ordinary mail: to the Rete Ferroviaria Italiana SpA address, Ethics Committee Technical Secretariat c/o Internal Audit Department of RFI S.p.A. - Piazza della Croce Rossa, 1 - 00161 Rome or Supervisory Body c/o RFI SpA Internal Audit Department - Piazza della Croce Rossa, 1 - 00161 Rome;
• E-mail: to the e-mail address ComitatoEticoRFI@rfi.it or org.vig@rfi.it;
• Telephone line/voice messaging system: currently being implemented, provides for the recording and transcription of the conversation with the Whistleblower's express consent;
• Verbally: through a statement made by the Whistleblower, during a hearing set within a reasonable time, to the RFI SpA Ethics Committee/Supervisory Board, recorded in the minutes and signed by the Whistleblower.

Reports may allow the company to promptly identify and remedy unlawful or irregular occurrences that may harm the Group or third parties’ interest and integrity.

In compliance with the legal provisions, RFI S.p.A. guarantees that the whistleblower’s identity is kept confidential from the time when the report is received, and prohibits (and sanctions to the extent permitted by its powers and faculties) any direct or indirect retaliation or discrimination and misconduct towards the whistleblower as a result of the report, including omissions, even attempted or threatened, or actions targeting third parties associated with the whistleblower, such as relatives, colleagues, legal entities owned by or for which the whistleblowers work, that work for or with the FS Italiane Group.

The Whistleblower is informed when the report is received and of the outcome of the investigation.

The whistleblower is given acknowledgement of receipt of the report within 7 days from the date of receipt. The whistleblower is also informed of the outcome of the investigation into the matter.

RFI SpA protects the rights of Involved Persons, firstly by ensuring, in order to guarantee appropriate confidentiality, that any communication relating to their identity strictly follows the “need to know” criterion. The Involved Person is informed of the existence and content of the report and receives a copy of it, excluding reference to the Whistleblower's identity, which may not in any case be disclosed to the Involved Person, except in the cases expressly provided for by law.

The Involved Person has the right to be informed of the outcome of the investigation, with the exception of the cases expressly provided for in the relevant company procedure.

Reports may be sent anonymously. However, RFI SpA prefers that the identity of the whistleblower, whose confidentiality is guaranteed in compliance with the legislation in force, be made clear in the reports, to facilitate verification of the facts reported and to inform the whistleblower on the results of the investigations conducted.

The competent corporate bodies (the Ethics Committee and the Supervisory Board) examine the content of the report and investigate the facts reported to ascertain whether they are well-founded and to adopt measures to prevent or penalise the reported wrongdoings or offences.

Slanderous or defamatory reports are prohibited and sanctioned in accordance with the law and will be disciplined by the Company.

Personal data is processed in compliance with the applicable legislation on the subject. Details regarding the processing purposes and methods are available on the RFI SpA website and on the company intranet.