UPM Annual Report 2025

We are UPM

Governance

Accounts and performance

Sustainability Statement

Report of the Board of Directors

Financial Statements

Auditor's Report

Sustainability Assurance Reports

UPM Supplier and Third-Party Code UPM expects its suppliers and third-party intermediaries (e.g. agents, advisers, representatives, joint ventures, joint venture partners, local partners, and distributors) to apply the same principles as in the UPM Code of Conduct and to meet social and environmental responsibility criteria. These requirements are defined in the UPM Supplier and Third Party Code, the latest update of which was adopted at the end of 2024. The practical guide, updated in 2025, summarizes the framework of the Code and UPM's position and provides examples and good practices for implementation. In 2025, the updated Code, the practical guide, and training for UPM's personnel became available to cover UPM's broad supplier base. UPM Sustainability Policy Statement The Sustainability Policy Statement complements the UPM Code of Conduct, with a particular focus on the chapters Respect people and human rights, Addressing environmental impact and sustainability of products, and Engaging with stakeholders and society. The purpose of the Policy Statement is to describe UPM's responsible business conduct regarding the above issues in more detail, and to define principles and commitments such as: • UPM is committed to contribute to science-based climate targets in line with the 1.5 °C pathway; • ISO 14001 environmental management system certification is required for all UPM production sites; • All UPM-owned forests and plantations are 100% certified or will be certified if the site is new. The Policy Statement applies to all activities of UPM. The management of each business and function is responsible for ensuring that these principles and commitments are complied with. It is developed taking the views and perspectives of external stakeholders based on UPM's constant multi-stakeholder dialogue into account. The Policy Statement was approved by the Group Executive Team at the end of 2024. In 2025, the Statement was introduced to the business areas and functions of UPM, which are responsible for the implementation and training. UPM's values UPM is determined to be a responsible and attractive employer now and in the future. UPM wants to strengthen its employees’ sense of belonging and the feeling that their work is meaningful. This promotes productivity, engagement, and well-being. UPM's values – Trust and be trusted, Achieve together, and Renew with courage – guide the way. Refer to » S1-4 on actions to establish, develop and promote UPM's values. Progress is regularly measured through the annual Employee Engagement Survey (EES), which started in 2007 and invites all employees to evaluate different aspects of their work.

Policies

G1-1

UPM Code of Conduct UPM's decision-making, management, and operations are guided by UPM's values and the UPM Code of Conduct. Compliance with the laws and responsible practices are the foundation of all UPM's operations and create long-term value for both UPM and its stakeholders. The UPM Code of Conduct underlines UPM's commitment to business integrity and responsible business operations and manifests the company's guiding principles. The Code addresses UPM's material impacts, risks, and opportunities. First, it includes UPM's commitment to integrity, which is seen as a general opportunity for success and growth: “Integrity is fundamental to our business operations and provides the foundation for our continued success and growth.” Furthermore, the Code opens up what to do, and how to behave to minimize the negative impacts and potential risks of UPM's material sustainability topics in its chapters on Respect people and human rights, Addressing environmental impact and sustainability of products, Zero tolerance for corruption and bribery, Know with whom you trade, and Engaging with stakeholders and society. The Code also focuses on governance-related topics such as Avoid conflicts of interest, Compliance with competition laws, and Protect assets and information. The last chapter, "Compliance involves everyone", includes multiple ways to raise concerns for both UPMers and other stakeholders. To ensure implementation of UPM's commitments, UPM has established a company-wide compliance system. Refer to » G1-3 UPM’s compliance system The UPM Code of Conduct is approved by the Board of Directors, UPM's highest governance body. The Group Executive Team (GET), led by the President and CEO, is responsible for managing corporate responsibility, including implementation of the Code of Conduct. The document is shared internally via the intranet and supporting printed materials. It is available for external stakeholders on the UPM webpage. The Code is complemented by more detailed policy statements, policies, and rules that are approved by the Board of Directors, the Group Executive Team, business areas, or global functions. These policy statements, policies, and rules cover areas such as treasury, taxes, disclosures, insider matters, anti-corruption, competition law, confidentiality, human resources, sustainability, forestry, digital safety, environment, safety, international sanctions, and business partner risk management. The UPM Code of Conduct was last updated in 2025 to reflect changes in regulations and the business environment. The updates embed UPM’s new safety vision and include refinements in several sections to reflect ongoing regulatory developments on addressing and reporting human rights and environmental impacts in UPM's own operations and value chains. The section on cybersecurity and data protection has also been further clarified.

Business conduct (ESRS G1) Regardless of the location, circumstances or people involved, UPM is committed to complying with applicable laws and regulation and the UPM Code of Conduct.

Percentage of active employees* who completed the new UPM Code of Conduct training since Sept. 2025

Percentage of UPM's total spend covered by the UPM Supplier and Third-Party Code

94% (Continuous target: 100%)

86% (Continuous target: >80%)

In 2025, UPM updated its Code of Conduct in accordance with its three year update plan.

*excluding the UPM Adhesive Materials company acquired in 2025

UPM FINANCIAL REPORT 2024

128

UPM Financial Report 2025

236

236

237

UPM Annual Report 2025

UPM Annual Report 2025