UPM Annual Report 2023

ACCOUNTS FOR 2023

UPM

BEYOND FOSSILS

BUSINESSES

RESPONSIBILITY

GOVERNANCE

Non-financial information To steer its responsibility activities, UPM has established a set of responsibility focus areas with targets and key performance indicators. They are reviewed every year based on a materiality analysis (page 63). The focus areas cover economic, governance, social and environmental responsibility. Mitigation of and adaptation to climate change is one of the most material topics, and it is relevant for UPM throughout the whole value chain: land use, sourcing, production and products. Thus, climate-related targets are established for all of these areas. Further material topics are related to biodiversity and human rights, for example. UPM’s Biofore strategy guides the company in achieving its responsibility targets for 2030 and in contributing to the Sustainable Development Goals (SDG) of the 2030 Agenda for Sustainable Development published by the UN. Connecting sustainability performance to financing demonstrates the importance of responsible business practices to UPM’s long term value creation. UPM’s revolving credit facility is linked to the long-term biodiversity and climate targets, and three green bonds have been issued since 2020. Since January 2022, responsibility-related measures are included in UPM’s management remuneration. Based on international frameworks and commitments UPM respects international human rights agreements and agreements concerning labour rights, including the UN Declaration of Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, and the OECD Guidelines for Multinational Enterprises. Since 2003, UPM is a signatory of the UN Global Compact initiative, whose ten universal principles are derived from international agreements in the areas of human rights, labour standards, the environment and anti-corruption. In 2023, UPM joined the UN Global Compact’s Forward Faster initiative. Regarding climate change UPM committed to the Science Based Targets initiative (SBTi) in 2017 and received validation of its tightened CO 2 targets in 2020. To further strengthen its climate approach, UPM committed to the UN´s Business Ambition for the 1.5°C pledge and joined The Climate Pledge to reach the targets set by the Paris Agreement by 2040. In 2023, as part of the Forward Faster initiative, UPM also committed to set Net Zero targets as defined by SBTi. The work will be finalised during 2024. UPM follows the Finnish Corporate Governance Code issued by the Securities Market Association and complies with all of its recommendations. UPM Code of Conduct and other corporate policies UPM’s decision making, management and operations are guided by UPM values and the UPM Code of Conduct. Legal compliance and responsible practices are the foundation of all of UPM’s businesses and create long-term value for both UPM and its stakeholders. The UPM Code of Conduct emphasises UPM’s commitment to business integrity and responsible business operations, manifesting the company’s guiding principles. The UPM Code of Conduct is approved by the Board of Directors as UPM’s highest governance body. It is complemented by more detailed policies approved by the Board of Directors and rules, statements and standards approved by the Group Executive Team, business areas or global functions. These policies, rules, statements and standards cover such topics as treasury, taxes, disclosures, insider matters, anti corruption, competition law, confidentiality, human resources, responsibility, forestry, information security and data protection, environment and safety.

UPM expects its suppliers, third party intermediaries and joint venture partners to apply the same principles as in the UPM Code of Conduct and to fulfil criteria concerning social and environmental responsibility. These requirements are defined in the UPM Supplier and Third Party Code, latest updates effective as of beginning of 2020. The UPM Code of Conduct was last updated in 2022. Roles of the group management and functions in leading non financial matters The Board of Directors, with the assistance of the Audit Committee, is responsible for monitoring compliance with applicable legal and regulatory requirements and with the UPM Code of Conduct and other corporate policies. The non-financial information in this Report of the Board of Directors is reviewed by the Board as part of the approval process. In addition, the Audit Committee reviews reports on non financial matters and related reporting on a regular cadence. The Audit Committee also oversees procedures for treatment of complaints and concerns received by the company, anonymous or otherwise. As part of the committee’s compliance review, the committee is provided with a quarterly report by the company’s Chief Compliance Officer, and a report of submissions under the company’s Report Misconduct channel by the Head of Internal Audit. The Remuneration Committee is responsible for the review, evaluation and preparation of the company’s incentive schemes and annually commencing plans for the Board’s approval, including their linkage to company’s ESG performance. The Nomination and Governance Committee reviews regularly the adequacy of the Board and committee charters also related to ESG topics. In line with its main duties and responsibilities, the Board reviewed and approved UPM’s strategic objectives and the strategic plans of the Company and its business areas during its strategy session in May 2023. The main focus areas of the UPM Biofore strategy continue to be performance, growth, innovation, responsibility and portfolio development. This strategy is enhanced by the UPM purpose: We create a future beyond fossils (read more on pages 20-21). An essential part of the Board’s annual strategy work is to review and assess strategic and operational risks and opportunities (see UPM Corporate Governance Statement 2023). These risks and opportunities and their impact on operations and strategy are described on pages 34–35. Since 2022, the Board has included measures related to environmental, social and governance (ESG) themes in the Company’s performance share plan (PSP), one of its long-term incentive plans. The PSP includes three distinct ESG performance measures and the total weighting of these measures accounts for 20% of all measures. The President and CEO’s duty is to manage and oversee UPM’s day to-day business operations in accordance with the instructions and orders given by the Board of Directors. In the operative management of the Company, including the management of corporate responsibility, the President and CEO is assisted by the Group Executive Team, the Business Area Boards, the Strategy Team, the Disclosure Committee and the Ethics Advisory Committee. The Group Executive Team approves and executes group-level rules, guidelines and procedures relating to amongst others corporate responsibility, including possible impacts on economy, environment and people, determining courses of action and guiding development work. The role of the Business Area Boards is business area level decision making in matters pertaining to amongst others corporate responsibility and they oversee implementation of the group-level rules, guidelines and procedures in the Business Area. The Strategy Team assists the President and CEO in matters pertaining to amongst others the integration of corporate responsibility into group strategies for Boards’ approval and

preparation of changes in responsibility focus areas and targets for the Group Executive Team’s approval. The Ethics Advisory Committee is chaired by the General Counsel and its other members are the EVP of the UPM Human Resources function, the Chief Audit Executive and the Chief Compliance Officer. The Ethics Advisory Committee supports the President and CEO and the Board’s Audit Committee in their responsibilities relating to monitoring compliance with legal and regulatory requirements and company policies and the effectiveness of UPM’s compliance system. The Disclosure Committee monitors, assesses, gives recommendations and guidelines regarding external disclosure pertaining to amongst others corporate responsibility. The Disclosure Committee is chaired by the CFO and its other members are the General Counsel, the EVP of UPM Stakeholder Relations function and the Head of Investor Relations. In practice, corporate responsibility work takes place in businesses and functions, and in the group’s Responsibility team, which co ordinates the projects carried out by businesses and functions. UPM Legal Function and its Compliance team manage legal compliance programmes and arrange related training at regular intervals for specific target groups, which have been defined based on risk assessments. UPM Sourcing organisations follow clearly defined selection and follow-up processes when evaluating suppliers. Reliable long-term deliveries, product and service quality, cost competitiveness, financial sustainability of suppliers, social and environmental responsibility and product safety are the key factors when selecting and evaluating suppliers. While executing strategies, UPM and its business areas, functions and production units are exposed to a number of financial and non financial risks and opportunities. Each business area, function and unit is responsible for identifying, measuring and managing risks related to its own operations, and for reporting on risk exposures, risk management activities and results to its own management team and to the Risk Management Function. Management of non-financial matters UPM’s responsible thinking starts with anticipating, mitigating and managing risks, and extends to creating a competitive advantage and long-term value. UPM continually strives to reduce its risk exposure and improve its performance by using tools such as certified management systems. All production sites have a certified ISO 14001 environmental management system, except the new pulp mill in Uruguay which started production in 2023 and two Raflatac sites in Germany which were acquired at the end of 2022. Certification is expected during 2024. Nearly all production sites and wood sourcing operations implemented integrated management systems for environmental protection, quality management and occupational health and safety in accordance with ISO 14001, ISO 9001 and ISO 45001 standards. All pulp and paper mills in the EU, as well as the UPM Fray Bentos pulp mill in Uruguay and the UPM Changshu paper mill in China, also adhere to the EU’s Eco-Management and Audit Scheme (EMAS). Many of the sites also have energy management systems certified under ISO 50001 or the Finnish ETJ+ system, and food safety management systems certified under ISO 22000, if relevant. Should stakeholders have any concerns or suspect misconduct, they are encouraged to contact UPM or to use the UPM Report Misconduct channel. The service is available on the corporate website for both the company’s employees and external stakeholders. Operated by an independent external service provider, the channel is accessible in over 40 languages, 24/7. In 2023, 83 (54) cases were reported either through the UPM Report Misconduct channel or directly to Internal Audit or the Compliance team. 10 (9) of these cases related to alleged

discrimination or harassment. 21(8) cases led to disciplinary action including warnings and terminations of employment. Reporting framework used For its Group-level sustainability reporting UPM follows the Global Reporting Initiative’s (GRI) Sustainability Reporting Standards, the Task Force on Climate-related Financial Disclosures (TCFD), the Task Force on Nature-related Disclosures (TNFD) as well as the AA 1000 AccountAbility Principles Standard. The respective information is assured by an independent third-party, PricewaterhouseCoopers, Oy (pages 118–119). Committed to anti-corruption The UPM Code of Conduct underlines the company’s zero tolerance attitude towards corruption and bribery in any form. UPM Anti Corruption Rules explain prohibited conduct and expected ethical behaviour in further detail. UPM performs anti-corruption risk assessment on a regular basis. The 2023 compliance risk-assessment process included a top-down risk discussion (including corruption) with the management of each business area. All UPM group entities were also assessed on the basis of country risk and complexity of operations. UPM operates globally and has significant manufacturing operations in several emerging market countries. Such operations require a number of permits and other licenses from the relevant authorities. Some of the countries where UPM operates are perceived as highly corrupt or corrupt according to Transparency International. In these countries, there is an increased risk of corruption, for example in relation to interaction with government officials and in the use of intermediaries when applying for permits and licences requiring governmental approval. Due diligence of suppliers and third parties with whom UPM does business is an essential part of UPM’s anti-corruption compliance programme. UPM requires that due diligence is performed before entering into or renewing any contract with a third party that meets specified criteria. UPM requires anti-bribery contract terms to be included in agreements with such third parties outlining the third party’s commitment to compliance with applicable anti-bribery laws and UPM’s right to audit the third party to verify compliance with these terms. UPM also has corresponding due diligence procedures for joint ventures, including mergers and acquisitions. UPM has a dedicated anti-corruption e-learning platform. The anti corruption training covers all white-collar employees. In 2023, the company organised tailored anti-corruption training workshops for selected target groups across the company and performed risk-based compliance reviews in selected jurisdictions and operations. Respect for human rights UPM is committed to respecting and promoting human rights in line with the United Nations Guiding Principles on Business and Human Rights. UPM has assessed all its own operations and activities and has identified the potential human rights issues and impacts. When considering both the severity and likelihood of these potential issues and impacts, UPM considers the salient human rights issues in the company’s sphere of influence to be environmental pollution, occupational health and safety (OHS), working conditions, protection of children, and forced labour. UPM regularly analyses the saliency of its human rights impacts recognising that impacts on people continue to evolve as business changes and the approach to due diligence develops. UPM reviews its human rights risks as part of the UPM compliance process quarterly. In 2023, the assessment of human rights issues on a business area level as well as the integration of the process to unit specific management systems continued. UPM also started a human

138

139

UPM ANNUAL REPORT 2023

UPM ANNUAL REPORT 2023

UPM FINANCIAL REPORT 2023

138

UPM FINANCIAL REPORT 2023

139