WHISTLE BLOWING POLICY

1. Introduction

FirstTrust Mortgage Bank Plc (“FirstTrust”) is committed to adopting best practices and market standards in its operations and areas of accountability, transparency, business ethics and corporate governance. This document sets out the framework to guide Whistle blowing procedures at FirstTrust Mortgage Bank Plc. The Policy is introduced in furtherance to the Bank’s objective of improving its corporate governance practice.

The Investment and Securities Act provides that the employees of a Public Company shall have the right to disclose any information connected with all activities within the workplace which tends to show that a criminal offence has been, is being or is likely to be committed, or that a person has failed, is failing, is likely to fail or otherwise omitted to comply with any legal obligation in respect to the performance of his/her duties.

The CBN Code of Corporate Governance encourages Banks to establish whistleblowing procedures that encourage, including by assurance of confidentiality, all stakeholders such as staff, customers, suppliers and applicants to report any unethical activity or breach of the corporate governance code using, among others, a special email or hotline to both the Bank and the CBN.

The Bank is committed to the highest possible standards of openness, probity and accountability. The Bank’s policies and procedures are designed to promote and preserve stakeholders’ interests and provide adequate protection for whistleblowing on wrongdoings.

The Bank shall continue to encourage stakeholders to raise concerns with full assurance of confidentiality. Employees, stakeholders and other concerned persons may raise their concerns without fear of reprisals. The Bank shall investigate whistleblowing complaints promptly and with the strictest confidentiality.

The Bank shall not retaliate or act against employees for filing a report or assisting another employee in doing so. However, employees shall be discouraged from making deliberate false whistleblowing reports.

This Whistleblowing Policy provides a process for the submission of suspected wrongdoing by any employee of the Bank, vendor, supplier, customer or any other person who has concerns about the internal processes or questionable accounting or auditing matters of the Bank and desires to report those concerns.

The Whistleblowing mechanism enables the Bank to obtain early warning signals on serious issues, especially where it would be difficult to convey such concerns through formal communication channels. It is therefore a confidential channel open to all employees, customers and other stakeholders of the Bank to report any wrongdoing.

This Policy contains procedures for the receipt, retention and treatment of complaints received by the Bank.

2.0 Scope and Objectives of the Policy

2.1 To Whom Does the Policy Apply?

The Policy is applicable to everyone who carries out work for FirstTrust Head Office, Branches, SBUs and other supporting departments or units, including:

1. All employees.
2. All contract employees.
3. Customers and suppliers/vendors.
4. Contractors and subcontractors.
5. Investors and creditors.
6. Consultants.
7. Work experience or other trainees, including Youth Corpers, Industrial Trainees and Interns.

2.2 Why You Must Blow It

Because of the importance attached to whistleblowing globally by both private and public sectors, and the devastating effects that unethical practices and financial misconduct can cause if not quickly exposed, it is expedient that stakeholders uncover any form of unethical behaviour or conduct.

The following, though not exhaustive, are reasons why stakeholders, especially employees, must report unethical conduct:

• Silence is not always golden.
• To protect your source of livelihood.
• Silence may imply that I condone the misconduct.
• Silence may imply that I am a party to the misconduct.
• Failure to report may cast doubt on your integrity.
• Failure to report may cast doubt on your loyalty to FirstTrust Mortgage Bank Plc.
• You have a right and a duty to report.
• “Swallowing the whistle” may lead to fraud and misconduct.
• Unreported misconduct can result in loss of jobs and other benefits, adversely affecting everyone.

2.3 What Does the Policy Aim to Achieve?

This Policy aims to:

• Provide an enabling environment for all stakeholders of the Bank to disclose information or raise concerns in confidence about an event, act or omission that they reasonably believe could negatively impact the well-being of the Bank, its stakeholders or the general public.
• Encourage employees and stakeholders to raise serious concerns about the Bank without fear of victimization.
• Establish a structured process for investigating concerns and providing feedback on action taken.
• Ensure that stakeholders receive responses to concerns or reports of allegations that have been raised.
• Stipulate procedures to follow when stakeholders believe their concerns are not being properly addressed.
• Foster a work environment that drives openness, integrity and accountability.
• Promote a public image that supports transparency, accessibility and commitment to fiduciary responsibilities.
• Lay a foundation for ethical practices that promote the principles of good corporate citizenship.
• Protect whistleblowers from reprisals, reprimand, undue termination of services or discriminatory treatment arising from complaints or disclosures made in good faith.
• Reassure all stakeholders that they will be protected from reprisals or victimization for concerns raised in good faith.
• Ensure accountability, transparency and individual responsibility by encouraging employees to report workplace irregularities responsibly and ethically.

3. Rationale for Whistleblowing Policy

• By providing an avenue for corporate governance breaches and other issues at branches, departments and units to be disclosed, the Policy helps ensure the long-term sustainability of the Bank.
• The Policy allows unhindered disclosure of information that enables Senior Management to promptly respond to potential problems before they escalate.
• Providing a safe whistleblowing process and obtaining valuable information helps the Bank protect its customers and shareholders, reduce financial crime and maintain market confidence.
• The development and implementation of the Whistleblowing Policy enables the Bank to meet the requirements of the CBN Corporate Governance framework and strengthen confidence in Nigeria’s financial system.

4. Qualifying Disclosures

The Policy covers the disclosure of information relating to any of the following acts or omissions:

1. Disagreements between the Board and Management giving rise to squabbles amongst Board members.
2. Ineffective Board oversight functions.
3. Fraudulent and self-serving practices among members of the Board, Management and staff.
4. Overbearing influence of the Board Chairman or CEO.
5. Inadequate operational and financial controls.
6. Non-compliance with laid-down internal controls and operational procedures.
7. Non-compliance with rules, laws and regulations guiding banking business.
8. Passive shareholders.
9. Poor risk management practices resulting in increased levels of risk and large amounts of non-performing credits, including insider-related credits.
10. Abuses in lending, including lending in excess of the single obligor limit.
11. Poor relationships between Management and staff.
12. Succumbing to pressure from other stakeholders, such as shareholders’ appetite for high dividends and depositors’ quest for high interest on deposits.
13. Technical incompetence of the Board and Management, poor leadership and administrative ability.
14. Ineffective management information systems.
15. Poor integration and development of information technology systems, accounting systems and records.
16. Rendition of false returns.
17. Continued concealment of material issues discovered by the Bank.
18. Disposal of surplus assets to insiders below market price or indiscriminate disposal of surplus assets, with profits used to boost reported profits and cover operational losses or inefficiency.
19. Non-transparency and inadequate disclosure of information.
20. Financial crime, money laundering and terrorist financing.
21. Miscarriage of justice.
22. Putting the health and safety of any individual in danger.
23. Deliberate concealment relating to any of the above.
24. Fraud and fraudulent activities of staff, collusion and other malpractices.
25. Discrimination regarding employment, promotion or other employment matters based on gender, language or tribe.
26. Insider dealings and abuses.
27. Bribery and corruption.
28. Contravention of the Code of Business Conduct and Ethics, including insider dealing.
29. Conflict of interest and facilitation payments.
30. Abuse of office or responsibility in connection with unauthorized activity for personal gain.
31. Gross misuse of Bank assets, including information assets.
32. Intentional misrepresentations directly or indirectly affecting financial statements.
33. Sexual harassment or physical abuse.
34. Other unprofessional or unethical behaviour.

Please note that the categories of concerns that can be raised by stakeholders cannot be exhaustively and conclusively listed in this Policy.

4.1 Non-Qualifying Disclosures

The Whistleblowing Policy does not allow for disclosure of information:

4.1.1

Considered to be malicious, false and baseless, or aimed at undermining the integrity of persons within or outside the Bank.

4.1.2

On job-related issues already covered by other policies of the Bank or which could be disclosed through other internal information channels. These include:

• Staff complaints relating to Management decisions on recruitment, employment, deployment, promotion and incentive sharing.
• Complaints about Bank products bordering on pricing, service delivery and relationship management.
• Complaints concerning staff-boss relationships, workplace relationships or other personal or private matters.

5. Safeguards

5.1 Harassment or Victimization

The Bank recognizes that the decision to report a concern can be difficult, particularly because of the fear of reprisal from those responsible for the alleged violation. The Bank shall not tolerate harassment or victimization and shall act to protect employees or concerned persons who raise a concern in good faith.

This does not mean that if an employee or concerned person is already subject to disciplinary proceedings, such proceedings will be halted as a result of whistleblowing.

5.2 Confidentiality

Stakeholders may wish to raise concerns in confidence. Individuals who raise concerns will not have their identities disclosed without their prior consent.

It must be appreciated, however, that in some situations the investigation process may not be concluded unless the source of the information and a statement by the individual are produced as part of the evidence.

5.3 Anonymous Allegations

This Policy encourages employees or concerned persons to put their names to allegations. Concerns expressed anonymously are less powerful, but they will be considered at the discretion of the Bank.

In exercising this discretion, the factors to be considered include:

• The seriousness of the issue raised.
• The credibility of the concern.
• The likelihood of confirming the allegation from attributable sources.

5.4 False or Untrue Allegations

If an allegation is made in good faith, the whistleblower has reasonable belief in its truth, and after due investigation it turns out to be untrue, there will be no indictment against such a person.

However, if the reporter makes malicious and vexatious allegations, disciplinary action may be considered or implemented.

In making whistleblowing reports, the whistleblower should ensure that:

• The report is made in good faith.
• He or she has reasonable grounds to believe that the report is substantially true and reliable.
• He or she is not making the report for personal gain.

Where there are deliberate false allegations, the following disciplinary measures shall be taken:

• Staff: Disciplinary measures will be taken in line with Bank policy and may, in some cases, lead to dismissal.
• Suppliers or service providers: The supplier or service provider may be blacklisted.

5.5 Protection for the Whistleblower

The Bank will do its best to maintain the confidentiality of the whistleblower’s identity. The Bank shall ensure that the whistleblower is not victimized in any way, even if it becomes necessary for him or her to come forward to give evidence.

The Bank undertakes to investigate all whistleblowing reports and, where necessary, provide feedback to the whistleblower on the outcome of the investigation.

The whistleblower will continue to enjoy the protection under this paragraph even if the report turns out not to be true after investigation, provided that the obligations in paragraph 5.4 have been fulfilled.

5.6 Retaliation

We view retaliation or any form of reprisal by any employee, manager, director or business partner against anyone who reports a violation as a very serious offence.

All cases of retaliation shall be reported to the Head of Internal Audit or Company Secretary who, after investigation, shall refer the issue to the Disciplinary Committee for appropriate sanctions.

5.7 Non-Exclusive Procedure

This Whistleblowing Policy does not replace other policies and procedures. It complements procedures established or to be established for communicating genuine concerns about the running of the Bank.

6. How to Raise a Concern

6.1

For minor issues, such as personal use of Bank equipment or abuse of benefits, employees or concerned persons should normally raise concerns with their immediate Manager or Supervisor.

In general, the Whistleblowing procedure is intended for potentially more serious and sensitive issues. The first step will be to approach the Supervisor, unless the Supervisor is part of Senior Management and is the subject of the complaint. In such cases, the Chief Executive Officer or Managing Director should be informed.

If you feel unable to raise the matter with your Business Unit Head, for whatever reason, the matter should be reported to the responsible officers of the Bank through an adopted email channel.

6.2

Reports can be made in writing by email or verbally by telephone or in person. As much as possible, all whistleblowers should ensure that concrete issues raised are addressed.

Where possible, concerns should be raised in writing. The background and history of the concern, names, dates and places, where known, should be set out, together with the reason why the individual is particularly concerned about the situation.

Those who do not feel able to put their concerns in writing can place a call to or meet the appropriate officer.

The Bank encourages all whistleblowers to put their names to reports. However, reports can be made anonymously where the whistleblower feels it is in his or her interest to do so.

Anonymous reports may be more difficult to investigate, especially where there is insufficient documentary evidence. Before making an anonymous report, the whistleblower should ensure that the report contains pointers to credible sources that can be used to confirm the issues raised.

6.3

The earlier a concern is expressed, the easier it is to act.

6.4

Although employees or concerned persons are not expected to prove the truth of an allegation, they will need to demonstrate to the person contacted that there are sufficient grounds for concern.

6.5

Advice and guidance on how matters of concern may be pursued can be obtained from the Head of Department or Internal Audit Department.

6.6 Creation of a Portal for Whistleblowing for Staff

To facilitate seamless and confidential reporting of issues using the whistleblowing option, a portal has been created for staff to log on to and provide information.

Information on the portal shall be accessible only to the Head of Internal Audit, Company Secretary and Chief Risk Officer.

Where concerns or allegations relate directly to the activities of the Bank’s Management and the whistleblower determines that the concerns are best disclosed to parties outside the Bank, the whistleblower may consider the following channels:

• Dedicated Public Complaint Boxes: These boxes shall only be opened by the Control Officer in the relevant section of the Bank, who shall forward the complaint in a sealed envelope to the Head of Internal Audit.
• The CBN Public Complaints Desk.

6.7 Contents of a Whistleblowing Report

The whistleblower’s report should contain as much information as possible, including the persons involved, any witnesses and the location of other information that would assist in investigating the breach.

7. How the Complaints Will Be Addressed

7.1

The action to be taken by the Bank will depend on the nature of the concern. Complaints raised may be:

• Investigated internally.
• Referred to the Police.
• Referred to the External Auditor or Audit Committee.

7.2

To protect individuals and the Bank, initial enquiries will be made to determine whether an investigation is appropriate and, if so, what form it should take. Concerns or allegations that fall within the scope of existing procedures will normally be referred for consideration under those procedures.

7.3

Some concerns may be resolved through agreed action without the need for an investigation.

7.4

Where it is established that an investigation is necessary, the issues will be thoroughly investigated using available evidence. Where the report is not anonymous, the whistleblower may be called upon to provide, in strict confidence, available evidence necessary to confirm the issues raised.

7.5

If the report is not anonymous, the whistleblower will be the first to be informed of the outcome.

7.6

Where allegations are confirmed, the Bank undertakes to take necessary disciplinary measures against identified offenders in line with Bank policy. Where injuries have been suffered by the whistleblower, the Bank undertakes to provide necessary remedies as may be permitted by Bank policy.

7.7

Whenever a report is received, it should be reported to the Board Audit Committee by the Head of Internal Audit.

7.8

The Head of Internal Audit will provide regular updates to the Audit Committee on all whistleblowing reports received, including investigation outcomes and remedial actions taken.

7.9

Within ten working days of a concern being received, the Bank will write to the complainant:

• Acknowledging that the concern has been received.
• Indicating how it proposes to deal with the matter.
• Giving an estimate of how long it will take to provide a final response.
• Informing the complainant whether any initial enquiries have been made.
• Informing the complainant whether further investigations will take place, and if not, why.

7.10

The amount of contact between the body considering the issues and the complainant will depend on the nature of the matters raised, the potential difficulties involved and the clarity of the information provided. Where necessary, further information will be sought from the individual.

7.11

When a meeting is arranged, employees or concerned persons have the right, if they so wish, to be accompanied by a work colleague who is not involved in the area of work to which the concern relates.

7.12

The Bank will take steps to minimize any difficulties that employees or concerned persons may experience as a result of raising a concern. For instance, where employees or concerned persons are required to give evidence in criminal or disciplinary proceedings, the Bank will advise and support them through the procedure.

7.13

The Bank recognizes that employees or concerned persons need assurance that the matter has been properly addressed. Subject to legal constraints, they will receive information about the outcomes of investigations.

8. Investigation of Whistleblowing Reports

8.1 Reports Against Members of the Board

Investigation will be handled by a Disciplinary Committee comprising:

• The Chairman of the Audit Committee.
• The Chairman of the Finance and Risk Management Committee.
• An Independent Director.
• The Company Secretary.

The Chairman of the Audit Committee will serve as Chairman of the Disciplinary Committee.

The Head of Internal Audit, Chief Risk Officer, Head of Human Resources and Company Secretary may also be co-opted at the discretion of the Committee to provide technical input.

8.2 Reports Against Members of Staff

Investigation will be handled by a Disciplinary Committee comprising:

• Head of Internal Audit Department.
• Chief Risk Officer.
• Head of Legal Department.
• Head of Human Resources.
• The supervisor of the employee concerned.

8.3

Where the person to be investigated is one of the persons listed above, such person shall not take any part in the investigation process or interfere with available evidence in any way whatsoever.

9. Alternative Methods of Taking Forward a Complaint

9.1

This Policy is intended to provide stakeholders with an avenue to raise concerns with the Bank. The Bank hopes that this mechanism will satisfy the concerns of those who make use of it.

If an individual feels it is appropriate to take the matter outside this process, the following are possible contact points:

• The individual’s solicitors.
• The Bank’s Disciplinary Committee Chairman appointed under Section 8.2.

9.2

If employees or concerned persons take the matter outside the Bank, they must ensure that any disclosure is made in a reasonable and responsible manner.

A disclosure will be protected, even if it is proven to be unfounded, as long as it was made in good faith. However, an employee or concerned person making a rash disclosure will not be protected.

This can be discussed with the Chief Risk or Compliance Officers, who will also advise on ways to proceed.

9.3 False Reporting

9.3.1

The Bank shall not tolerate false reports. The whistleblower must therefore be sure of his or her facts before making a report.

9.3.2

If a staff member makes a report of a breach that he or she knows, or reasonably should know, to be false, the staff member shall be subject to disciplinary action, which may involve termination of employment.

9.3.3

False reporting could also lead to civil or criminal prosecution. The staff member may be liable for damages towards anyone who has suffered from a false report.

9.3.4

The Bank shall not indemnify or reimburse any staff member who has made a false report for costs or other consequences related to such false reporting.

9.4 Reward for the Whistleblower

In a bid to encourage whistleblowing, Management may, at its discretion, reward whistleblowers. This will depend on the significance of each whistleblowing report.

10. The Responsible Officers

The Company Secretary, Chief Risk Officer and Head of Internal Audit, in consultation with the Managing Director or Chief Executive Officer, have overall responsibility for the maintenance and operation of this Policy.

The Head of Internal Audit will maintain a record of concerns raised and their outcomes, in a form that does not endanger confidentiality, and will report as necessary to the MD/CEO and the Board Audit Committee.

Where there is an allegation or concern against the Head of Internal Audit, the allegation or concern should be reported to the MD/CEO. However, where the allegation or concern is against the MD/CEO, it should be reported to the Board.

11. Public Concerns

11.1

It is recognized that some members of the public may be reluctant or unaware of how to report incidents and concerns through formal procedures.

In order to reduce barriers to reporting fraud within the Bank, dedicated Fraud Hotlines have been established in line with the requirements of the CBN Code of Corporate Governance.

11.2

The objective of these hotlines is to provide an avenue for reporting suspicions of fraud within the Bank to the Bank and the CBN.

All calls to the Bank will be dealt with by experienced employees or concerned persons, and all concerns will be professionally investigated. Any person who wishes to remain anonymous may do so.

12. Evidence

Evidence and documentation shall be presented in accordance with reporting instructions and requirements, disciplinary procedures and applicable policies.

13. Co-operation

13.1

Management is obligated to fully cooperate with and assist investigators and other parties engaged to investigate a breach.

13.2

All levels of Management are expected to give adequate attention to the handling of all matters concerning a breach seriously, confidentially and promptly.

14. Feedback

If requested, any staff member making a whistleblowing report may receive general information on the progress and closing of the investigation and its outcome, unless giving such feedback would be detrimental to the investigation.

15. Records

15.1

The Head of Internal Audit shall maintain a log of all reports received, tracking their reporting, investigation and resolution. The Head of Internal Audit shall also prepare periodic summary reports on whistleblowing activities for the MD/CEO and the Audit Committee.

15.2

Copies of such reports and logs will be maintained in accordance with applicable policies and procedures.

16. Rendition of Report to CBN

In compliance with Section 6.1.13 of the CBN Code, the Head of Internal Audit shall make monthly returns to the CBN on all whistleblowing reports and corporate governance-related breaches.

17. Disciplinary Action

17.1

Staff suspected of a breach shall not be considered guilty unless the allegations or suspicions have been proven and they have been given the opportunity to defend themselves.

17.2

Executive Management shall be responsible for implementing measures, disciplinary or otherwise, deemed necessary as a result of established breach incidents, in conjunction with the recommendations of the relevant Disciplinary Committee.

17.3

If and when such measures deviate from those recommended by the Disciplinary Committee, they will require the prior approval of the MD/CEO of the Bank or the Board.

18. Responsibilities of Stakeholders

18.1 Staff and Other Stakeholders

1. To be guided by the provisions of this Policy.
2. In making any disclosure, the whistleblower must be guided by the truth and avoid false reporting.

18.2 Supervisors

1. To ensure that their subordinates are aware of this Policy and its procedures.
2. To encourage a positive, open-working culture for staff and other stakeholders to express their concerns easily.
3. To take breaches seriously.
4. To guide staff on the most appropriate course of action whenever there is a breach.
5. To refer reports made under this Whistleblowing Policy to the Head of Internal Audit within 48 hours of receiving the report.

18.3 Head of Internal Audit

1. To acknowledge receipt of disclosures to the whistleblower.
2. To keep the whistleblower informed of progress regularly.
3. To take concerns seriously and consider them fully and fairly.
4. To resolve issues as expeditiously as possible.
5. To indicate to the whistleblower, where possible, how Management proposes to investigate the disclosure and the likely timescales.
6. To communicate findings to the individuals under investigation and, where appropriate, Executive Management, the Board or other external authorities, including the CBN.
7. To keep a confidential log to assess the effectiveness of the Policy and identify emerging trends.
8. To keep the Policy under review.

19. Fraud Hotline

For all areas of concern:

20. Review and Update

This Policy shall be subject to review from time to time in line with developments in the regulatory environment and global best practices in the handling of the whistleblowing process.