UPM Annual Report 2024

WE ARE UPM

GOVERNANCE

ACCOUNTS AND PERFORMANCE

Report of the Board of Directors

Sustainability Statement

Financial Statements

Auditor's Report

Sustainability Assurance Reports

POLICIES

implementation will be updated in 2025. During 2025, the updated Code, the practical guide and training for UPM's own personnel will be available to cover UPM's broad supplier base. UPM Sustainability Policy Statement The Sustainability Policy Statement complements the UPM Code of Conduct, with a particular focus on the chapters Respect people and human rights, Addressing environmental impact and product safety, and Engaging with stakeholders and society. The purpose of the Policy Statement is to describe UPM's responsible business conduct regarding the above issues in more detail, and to define principles and commitments such as: • UPM is committed to contribute to science-based climate targets in line with the 1.5°C pathway; • ISO 14001 environmental management system certification is required for all UPM production sites; • All UPM-owned forests and plantations are 100% certified or will be certified if the site is new. The Policy Statement applies to all activities of UPM. The management of each business and function is responsible for ensuring that these principles and commitments are complied with. It is developed taking the views and perspectives of external stakeholders based on UPM's constant multi-stakeholder dialogue into account. The Policy Statement was approved by the Group Executive Team at the end of 2024. Implementation and trainings are planned for 2025. UPM's values UPM is determined to be a responsible and attractive employer now and in the future. UPM wants to strengthen its employees’ sense of belonging and the feeling that their work is meaningful. This promotes productivity, engagement and wellbeing. UPM's values – Trust and be trusted, Achieve together, and Renew with courage – guide the way. » Refer to S1-4 on actions to establish, develop and promote UPM's values. Progress is regularly measured through the annual Employee Engagement Survey (EES), which started in 2007 and invites all employees to evaluate different aspects of their work. Reporting and identifying concerns At UPM, all employees share responsibility for maintaining integrity and ethical standards. If misconduct is suspected, everyone is obligated to speak up and report it and to listen to the concerns of others. Practices aimed at preventing reporting are prohibited and are in themselves considered misconduct. UPM employees are encouraged to report their concerns to their manager, UPM Legal and Compliance, UPM HR, or UPM Internal Audit or to use the UPM Report Misconduct channel. Stakeholders play a crucial role in maintaining UPM's standards of integrity. One of the most important ways to contribute is to report any suspected or observed unethical behaviour. Speaking up enables UPM to address and correct issues in a timely manner and to prevent them from recurring in the same place or elsewhere in the organisation. It also contributes to a culture in which people feel comfortable speaking up, are trusted and treated fairly. External stakeholders are encouraged to make a report to their UPM contact person, the UPM Report Misconduct channel or local contact

G1-1

UPM Code of Conduct UPM's decision-making, management and operations are guided by UPM's values and the UPM Code of Conduct. Compliance with the law and responsible practices are the foundation of all UPM's operations and create long-term value for both UPM and its stakeholders. The UPM Code of Conduct underlines UPM's commitment to business integrity and responsible business operations and manifests the Company's guiding principles. The Code addresses UPM's material impacts, risks and opportunities. First, it includes UPM's commitment to integrity, which is seen as a general opportunity for success and growth: “Integrity is fundamental to all our business operations and provides the foundation for our continued success and growth.” Furthermore, the Code opens up what to do, and how to behave to minimise the negative impacts and potential risks of UPM's material sustainability topics in its chapters on Respect people and human rights, Addressing environmental impact and product safety, Zero tolerance for corruption and bribery, Know with whom you trade, and Engaging with stakeholders and society. The Code also focuses on governance-related topics such as Avoid conflicts of interest, Compliance with competition laws, and Protect assets and information. The last chapter, "Compliance involves everyone", includes the multiple ways to raise concerns for both UPMers and other stakeholders. To ensure implementation of UPM's commitments, UPM has established a Company-wide compliance system. » Refer to G1-3 UPM’s compliance system The UPM Code of Conduct is approved by the Board of Directors, UPM's highest governance body. The Group Executive Team (GET), led by the President and CEO, is responsible for managing corporate responsibility, including implementation of the Code of Conduct. The document is shared internally via the intranet and paper copies, and is available for external stakeholders on the Company webpage. The Code is complemented by more detailed policy statements, policies and rules approved by the Board of Directors, the Group Executive Team, business areas or global functions. These policy statements, policies and rules cover areas such as treasury, taxes, disclosures, insider matters, anti-corruption, competition law, confidentiality, human resources, sustainability, forestry, information security and data protection, environment, safety, international sanctions, and business partner risk management. The UPM Code of Conduct was last updated in 2022. UPM Supplier and Third-Party Code UPM expects its suppliers and third-party intermediaries (e.g. agents, advisers, representatives, joint ventures, joint venture partners, local partners, and distributors) to apply the same principles as in the UPM Code of Conduct and to meet social and environmental responsibility criteria. These requirements are defined in the UPM Supplier and Third Party Code, the latest update of which was adopted at the end of 2024. The practical guide which summarises the framework of the Code and UPM's position and provides examples and good practices for

Business conduct (ESRS G1) Regardless of the location, circumstances or people involved, UPM is committed to complying with applicable laws and regulation and the UPM Code of Conduct.

Percentage of active employees* completed the UPM Code of Conduct training

Percentage of UPM's total spend covered by the UPM Supplier and Third-Party Code

99% (Continuous target: 100%)

91% (Continuous target: >80%)

At the end of 2024, UPM adopted the updated UPM Supplier and Third-Party Code and the renewed UPM Sustainability Policy Statement.

*excluding UPM Raflatac companies acquired in 2024

UPM FINANCIAL REPORT 2024 236

236

237

UPM ANNUAL REPORT 2024

UPM ANNUAL REPORT 2024