UPM Annual Report 2021

ACCOUNTS FOR 2021

UPM

BEYOND FOSSILS

STRATEGY

BUSINESSES

RESPONSIBILITY

GOVERNANCE

Non-financial information Global megatrends represent many long-term opportunities and challenges for UPM towards 2030 and beyond. They are also driving demand for sustainable solutions and responsible business practices. To steer its responsibility activities, UPM has established a set of responsibility focus areas with targets and key performance indicators. They are reviewed every year based on a materiality analysis (page 66). The focus areas cover economic, social and environmental responsibility. Mitigation of and adaptation to climate change is becoming more important all the time, and it is relevant for UPM throughout the whole value chain: land use, sourcing, production and products. Thus, climate-related targets have been established for all of these areas. In 2021, UPM renewed its social responsibility targets to strengthen the social commitment. This is also reflected in corresponding updates of the non-financial key performance indicators. UPM’s Biofore strategy guides the company in achieving its responsibility targets for 2030 and in contributing to the Sustainable Development Goals (SDG) of the 2030 Agenda for Sustainable Development published by the UN. Connecting sustainability performance to financing demonstrates the importance of responsible business practices to UPM’s long term value creation. In 2020, UPM tied its syndicated revolving credit facility to both biodiversity and climate targets, and also issued a first green bond. In 2021, UPM published its first Green Bond report and issued a second green bond. Based on international frameworks and commitments UPM respects international human rights agreements and agreements concerning labour rights, including the UN Declaration of Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, and the OECD Guidelines for Multinational Enterprises. Since 2003, UPM is a signatory of the UN Global Compact initiative, whose ten universal principles are derived from international agreements in the areas of human rights, labour standards, the environment and anti-corruption. And since 2016, UPM has the LEAD participant status for its commitment to the UN Global Compact. In 2021, UPM was globally one of only 37 companies to receive this recognition, and the only representative of the forest industry and Finland. Regarding climate change UPM committed to the Science Based Targets (SBT) initiative in 2017 and received validation of its tightened CO 2 targets in 2020. To further strengthen its climate approach, UPM committed to the UN's Business Ambition for the 1.5°C pledge. In 2021, UPM joined The Climate Pledge to reach the targets set by the Paris Agreement by 2040. UPM follows the Finnish Corporate Governance Code issued by the Securities Market Association and complies with all of its recommendations. UPM Code of Conduct and other corporate policies UPM’s decision making, management and operations are guided by UPM values and the UPM Code of Conduct. Legal compliance and responsible practices are the foundation of all of UPM’s businesses and create long-term value for both UPM and its stakeholders. The UPM Code of Conduct emphasises UPM’s commitment to business integrity and responsible business operations, manifesting the company’s guiding principles. The UPM Code of Conduct is complemented by more detailed policies approved by the Board of Directors and rules or statements approved by the Group Executive Team, business areas or global functions. These policies, rules and statements cover such topics as

Strategic partners UPM collaborates with many partners. For example, product development in the biofuels, bioenergy or biochemicals increases the importance of partnerships in the search for new products and businesses or higher efficiency. Partnerships may, however, create risks to the profitability, for example, through changes occurring within the partner entity or changes in how the partnership operates. UPM is also subject to the risk that its strategic partners do not comply with UPM’s Code of Conduct with anti-corruption, competition law, HR practices, human rights, responsible sourcing and environmental matters. Partnership arrangements may also be too rigid to enable timely changes required, for example, in connection with changes in the market conditions or the economy. UPM’s partners may have different targets with respect to the business of the partnerships. As UPM may not have sole control over strategic direction and operational output of these entities, its partners may have the right to make certain decisions on key business matters with which UPM does not agree. In some cases, strategic partners may choose not to continue partnerships that they have with UPM. Intellectual property rights of third parties Molecular bioproducts form one of UPM’s three strategic focus areas for growth. Initiatives within this strategic focus area are technology intensive and require increasing investments in such technologies either through internal development or through third party licences or technological partnerships. In addition to UPM’s own IPR portfolio, UPM licences certain technologies developed by third parties. Evaluating the rights related to the third party technologies UPM uses or intends to use is increasingly challenging. Licensing third party technology exposes UPM to such risks as the increase of overall licensing costs, loss of negotiation power, the validity of such licensing arrangements and potential infringement claims, which could restrict UPM’s ability to use certain technologies, prevent the delivery of UPM’s products and/or result in costly and time-consuming litigation. Risk related to IPR claims and disputes relating to technological partnerships have been assessed to increase. Building capabilities to growth areas The success of UPM’s business largely depends on the ability to build the necessary new capabilities required for future growth. UPM is continuously developing its employee experience, leadership culture, evaluating its recruitment, compensation policies and career development opportunities and taking measures to attract and retain diversely skilled personnel for current and future growth areas. Financial risks Financial risks are described in consolidated financial statements 2021.

UPM is responsible for many projects in several of its countries of operation at any given time. All projects involve technical and operational risks, and projects require continuous operational planning, steering and supervision, quality control, input procurement, scheduling as well as resource and cost monitoring. Managing several projects requires that UPM has sufficient resources and efficient processes. Persistent port congestion issues, transportation bottlenecks, and rising logistics costs, all of which could be resulting from external events or market conditions beyond the control of UPM, may have an effect on the execution or profitability of investment projects. The COVID ‑ 19 pandemic and the required additional health and safety measures have also added a new challenge to large investment projects. UPM’s transformative pulp project in Uruguay and biochemicals project in Germany are proceeding with strict health and safety controls, but despite these efforts, some changes to the detailed timeline of the projects may occur due to containment measures or infections affecting project workers, suppliers or infrastructure. Unavailability of information systems as well as cybersecurity breaches UPM’s production and business operations depend on the availability of supporting information systems and network services. Unplanned interruptions in UPM's or a supplier's critical information system services, loss of critical, financial or personal data due to reasons beyond UPM’s or its suppliers' control, such as power cuts, software or telecommunication errors or other major disasters, such as fires or natural disasters, as well as user errors by UPM’s own personnel or suppliers, can potentially cause major damage to UPM’s businesses and disruptions to the continuity of operations. UPM’s or its suppliers' information systems may be exposed to various cybersecurity risks. Malicious cyber intrusion could cause leakage of sensitive information, violation of data privacy regulations, theft of intellectual property, production outages and damage to UPM’s reputation. Litigation and compliance UPM operates globally in a large number of jurisdictions and complex regulatory frameworks. UPM may from time to time be involved in litigation and other similar proceedings or it could become subject to various claims and actions based on various grounds. On a global scale, enforcement activities and jurisdictional reach regarding competition issues and anti-corruption have increased. Also, the recent development of Renewable Energy Sources Act (EEG) related lawsuits in Germany for alleged non-payment of EEG based surcharges may have an adverse impact on UPM, albeit UPM is not currently a party to any such lawsuits. The UPM Code of Conduct sets the standards of responsible behaviour and it covers topics relating to legal compliance and disclosure, anti-corruption, competition law, HR practices, human rights, responsible sourcing and environmental matters. UPM’s environmental performance and social responsibility play a significant role in UPM’s ability to operate and influence the long-term success of its businesses. UPM has significant manufacturing operations or sourcing in several developing countries, some of which are perceived as highly corrupt or corrupt according to Transparency International. In these countries, there is an increased risk of corruption, for example in relation to interaction with government officials and in the use of intermediaries when applying for permits and licences requiring governmental approval. Breaches of applicable laws and regulations or corporate policies by UPM employees may lead to legal processes, sanctions and fines as well as reputational damages effecting UPM’s operations. For example, In October 2021 the

European Commission conducted an unannounced inspection at UPM’s premises. According to the Commission’s press release on 12th October, the Commission has concerns that the inspected companies in the wood pulp sector may have violated EU antitrust rules that prohibit cartels and restrictive business practices. Commission states that the unannounced inspections are a preliminary step in an investigation into suspected anticompetitive practises, and the fact that the Commission carries out such inspections does not mean that the companies are guilty of anti-competitive behaviour nor does it prejudge the outcome of the investigation itself. UPM continues to support the Commission with any investigation activity that may follow. Industrial actions UPM is subject to risk of industrial actions, which could disrupt its business operations or the business operations of its stakeholders. Uncertainty may increase in the Finnish labour market amid the announcement of the Finnish Forest Industries Federation in fall 2020 to transfer collective bargaining to companies. For example, in the beginning of 2022, members of the Paperworkers’ Union, the Finnish Electrical Workers´ Union and the Trade Union Pro started strikes at UPM mills in Jämsänkoski, Kouvola, Lappeenranta, Pietarsaari, Rauma, Tampere and Valkeakoski, Finland. These strikes or other industrial actions in UPM’s business operations or related sectors could have an effect on UPM’s business operations. For example, industrial actions in the transport sector or among other stakeholders important to UPM, may disrupt UPM’s operations. Additionally, public dissatisfaction with UPM’s labour-related decisions may, in extreme cases, lead to unanticipated boycotts or disruptions at its facilities or construction sites. A natural disaster, fire, accident or other calamity at UPM’s production facilities UPM operates a significant number of production facilities globally that are exposed to risks related to environment, fires, natural events, site security and occupational health and safety risks. If UPM’s production facilities were to experience a major accident or were forced to shut down or curtail production due to such unforeseen events, such as a leak or spill due to malfunction or human error, this could cause major interruptions in UPM’s operations and result in significant costs in order to clean up and repair any potential damages to the production plant and the surrounding areas. Any failure to maintain high levels of safety management could also result in physical injury, sickness (such as a COVID ‑ 19 infection) or liability to UPM’s employees, contractors or third parties. These risks are managed through established management procedures, health and safety precautions and loss prevention programmes. UPM’s insurance programme provides coverage for insurable hazard risks, subject to insurance terms and conditions. Forests and plantations UPM’s plantations and forests may be affected by the impacts of climate change, which include more frequent and severe extreme weather conditions such as heavy rainfall, storms, floods and drought. Climate change is expected to have the biggest physical effect on UPM’s forest lands in Finland, where temperatures are expected to rise more significantly and rapidly compared with other countries where UPM owns forest. Although forest growth will likely accelerate, particularly in Finland, due to the longer growing season, extreme weather conditions will intensify, presenting new risks. The increase of droughts and fires are estimated to pose the most significant risks for UPM’s business. Also, damages caused by insects and tree diseases are becoming increasingly common, which could have an effect on the value of UPM’s forest assets. Should these risks materialise, they could harm UPM’s forest and plantations resulting in production interruption and additional costs.

CONSOLIDATED FINANCIAL STATEMENT NOTE

TYPE OF RISK

Credit risk

4.6 Working capital

Liquidity and refinancing risk

5.1 Capital management

Interest rate risk

6.1 Financial risk management 6.1 Financial risk management 6.1 Financial risk management

Foreign exchange risk Electricity price risk

Counterparty risk

6.2 Derivatives and hedge accounting

134

UPM FINANCIAL REPORT 2021 135 UPM ANNUAL REPORT 2021 135

UPM ANNUAL REPORT 2021

UPM FINANCIAL REPORT 2021 134