• Recommendations issued by the Compliance Department to strengthen the third party management process, focused on the following areas:
  • Third-party Due Diligence Procedure management.
  • Compliance with guidelines of the LBMA Responsible Sourcing Programme Guide Version 8.
  • Negotiating formal contracts with shippers
  • Precise systems information
  • Improved controls over precious metals accreditation
  • Training within the Raw Materials Department to build awareness about compliance risks

Third Party Code of Conduct

Aware of the risks inherent in all interactions with companies and individuals outside the company, we developed a Third Party Code of Conduct for distribution in 2021. This document expressly outlines the conduct we expect of our business partners, as a first step in initiating and maintaining any commercial relationship with Peñoles. The document is intended to ensure that every interaction with such partners is firmly grounded in corporate integrity, guaranteeing a responsible supply chain, protection of the environment, a proven commitment to occupational healthy and safety and respect for human and labor rights. It also provides guidelines on asset protection, intellectual information and property, and mechanisms to ensure compliance with the Code, including guidance in the event of any questions.

This external Code of Conduct is consistent with internationally-recognized rules and standards like the United Nations Global Compact, the basic conventions of the International Labor Organization and business responsibility guidelines issued by the OECD and the UN.

Whistleblowers' hotline

In 2020, we further strengthened our systems for receiving and addressing reports of actions that violate our Code of Conduct through the Correct Line, an institutional channel available to our employees and other stakeholders.

Our key actions in this regard were:

• Reinforcing and adapting our research methodological framework to the new context of awareness regarding human resources (workplace violence, bullying and harassment) or, where appropriate, those related to compliance aspects (fraud, conflict of interest, bribery and corruption).
• Classifying reports on workplace violence, harassment, bullying and/or abuse of authority, depending on the areas that will handle them: Human Resources, Corporate or Divisional. Matters pertaining to unionized employees are channeled to the Department of Labor Relations.
• Providing training to people newly hired to conduct the investigations, regarding the methods and protocols for addressing reports, particularly in cases that fall into the Human Resources and Labor Relations categories.
• Creating commissions to address cases relating to workplace violence, harassment or bullying, in keeping with existing federal laws.
• Amendment to the bylaws of the Ethics and Corporate Values Committee with regards to decision-making on substantiated violations of the Code of Conduct.
• Detailed follow-up on remedial and/or disciplinary actions in human resource and compliance-related issues.
• Incorporating the area responsible for investigations into the Compliance Department.

For more information about the results of Correct Line, see our 2020 Sustainable Development Report.

Money laundering prevention

Peñoles has a set of standing mechanisms to prevent exposure to money-laundering and terrorism financing, and will not do business with any third party that might use our company as a vehicle for incorporating illegal resources into the formal economy.

Peñoles took the following preventive and remedial actions to address existing regulatory requirements:

• Update and distribution of the Anti-Money Laundering Law Compliance Manual available in our Internal Compliance System.
• Tracking all deals subject to the provisions of the Anti-Money Laundering Law: purchase and sales of precious metals, real-estate leasing and receipt of donations.
• Update of client, tenant and donor identification files.
• Monitoring any reports/notices on the website administered by the corresponding supervisory authority.
• Remedial self-corrective actions permitted by the law in the company’s businesses.

Regulatory compliance

We conducted an exhaustive review of external compliance—laws, regulations, official standards and others—in Peñoles business units and workplaces, focusing on the eleven most critical issues to our operations: the environment, health, industrial safety, union relations, human resources, taxes, telecommunications, civil aviation, mining, energy and agriculture. In this regard, we analyzed a total of 3,129 obligations that currently apply to the company, distributed in differing degrees across our various divisions (Mines, Metals-Chemicals, Exploration and Administrative Services). We also identified the risk of any discrepancies detected during our verifications and, in coordination with all the areas, defined action plans to mitigate these risks with regular follow-up on the status of their implementation.

Parallel to this effort, we updated the compliance map applicable to our industry according to changes in federal laws, and conducted an awareness-raising campaign for the relevant personnel regarding the importance of strengthening this culture of regulatory compliance.

The company’s Personal Data Committee, headed by the Compliance Office, developed and published the policies, procedures and manual on the transfer and protection of personal data collected by the different areas, in addition to the procedures already in place to comply with the Federal Law regarding Personal Data Protection, and coordinated a risk analysis for safeguarding them.

We also set up a multidisciplinary work group, headed by the Compliance Office and the Department of Human Resources, which prepared policies and procedures for complying with national standard NOM-035-STPS-2018. There was a massive dissemination campaign on the new standard.

A questionnaire was applied to detect personnel subject to severe traumatic events and psychosocial risk factors, in order to implement the corresponding action plans; the participation was 94%.

Cybersecurity

We made substantial progress in both technical aspects and fortifying our technology governance for cybersecurity. Among the priority actions of this program we identified and analyzed the cyber-risks to which the organization is exposed, and controls that must be strengthened or applied to reduce them. We also put together a catalogue of all the services that make up the organization’s capacities to strengthen operational and technical security of the processes.

To enhance the visibility of our cybersecurity measures, we engaged the services of an independent consultant to help detect such incidents and respond to them. We are also deploying technology to enhance visibility which will enable us to act in a coordinated, efficient manner to address the vulnerabilities identified in our infrastructure.

Through these actions, we look to reduce and address any cybersecurity risks that we might face in an orderly and timely fashion, confident in the power of technology as an enabler of business processes.