UPM Annual Report 2025

We are UPM

Governance

Accounts and performance

Sustainability Statement

Report of the Board of Directors

Financial Statements

Auditor's Report

Sustainability Assurance Reports

2025. UPM also offers compliance e-learning courses to employees of business partners working for UPM. This ensures that they are committed to the same standards of integrity. UPM complements the e-learning modules with in-person and virtual compliance training for specific target groups. The target groups are determined based on risk assessments. Compliance training is complemented by regular communication activities to maintain awareness among employees. UPM has identified its salaried employees as the most exposed to corruption and bribery, as they have financial and other decision-making power that can make them more susceptible to corruption and bribery compared to shop floor employees. Anti-corruption training is provided to all salaried employees.

All reports and related information are treated with strict confidentiality. No one will be considered liable for the alleged misconduct before a report has been thoroughly investigated. Protection against retaliation The identity of the person who made the report and any person mentioned in the report is strictly confidential. During the investigation, the investigator(s) must protect the reputation of all parties involved (those reporting and those being reported) by restricting access to information related to the allegations and the investigation to those who have a legitimate need to know. UPM also has a strict policy of non-retaliation. UPM does not tolerate retaliation against anyone who in good faith reports suspected misconduct or participates in an investigation to resolve suspected misconduct. Retaliation or tolerating retaliation is in itself considered misconduct and must be reported promptly. Among other things, UPM's Code of Conduct e-learning course, which is mandatory for all employees, covers how to raise concerns and UPM's non-retaliation policy. In addition, regular communication on the topic is provided to employees. UPM is subject to legal requirements under national law transposing EU Whistleblowing Directive on the protection of persons who report breaches. Training on business conduct policies

Reporting and identifying concerns At UPM, all employees share responsibility for maintaining integrity and ethical standards. If misconduct is suspected, everyone is obligated to speak up and report it and to listen to the concerns of others. Practices aimed at preventing reporting are prohibited and are in themselves considered misconduct. UPM employees are encouraged to report their concerns to their manager, UPM Legal and Compliance, UPM HR, UPM Internal Audit, or to use the UPM Report Misconduct channel. Stakeholders play a crucial role in maintaining UPM's standards of integrity. One of the most important ways to contribute is to report any suspected or observed unethical behavior. Speaking up enables UPM to address and correct issues in a timely manner and to prevent them from recurring in the same place or elsewhere in the organization. It also contributes to a culture in which people feel comfortable speaking up, are trusted, and treated fairly. External stakeholders are encouraged to make a report to their UPM contact person, the UPM Report Misconduct channel, or local contact points. External stakeholders include employees and representatives of UPM's business partners and their suppliers and sub-suppliers, people in the affected local communities, and job applicants. The platform for the UPM Report Misconduct channel SpeakUp® is provided by an external service provider. It allows anyone to raise concerns confidentially and anonymously if they wish. Reports can be made in more than 40 languages, and concerns can also be raised by telephone. Concerns about unlawful behavior or behavior that conflicts with the UPM Code of Conduct or other company policies may also be identified based on UPM's compliance monitoring activities (e.g. reviews, audits, and counterparty screening procedures). Investigating concerns and incident handling UPM has established procedures to investigate business conduct incidents, including suspected corruption and bribery, in a timely, independent, and objective manner. UPM's Senior Vice President of Internal Audit (“SVP of Internal Audit”) and the Chief Compliance Officer ensure that all cases reported through the UPM Report Misconduct channel are properly investigated and documented. The SVP of Internal Audit is responsible for the UPM Report Misconduct channel and its correct operation. Members of the Internal Audit Team and the Compliance Team, including the SVP of Internal Audit and the Chief Compliance Officer, as well as the appointed local person(s), are responsible for handling reports in accordance with the EU directive (EU) 2019/1937 (EU Whistleblowing Directive) as implemented at national level. The responsibility for handling each report is determined on a case-by-case basis by the SVP of Internal Audit and the Chief Compliance Officer. The people handling the reports receive appropriate training. The person(s) responsible for handling the reports take the necessary actions in response to the report, such as verifying the report’s validity, forwarding the case to a competent authority, conducting or overseeing the investigation, and informing the person who made the report of the action taken.

Responsible sourcing

G1-2

Suppliers are an essential part of UPM's value chain. UPM buys products, materials, and services from around 17,000 B2B suppliers globally. The sourcing network includes suppliers from startup companies to international corporations. The company also buys wood from around 13,000 private forest owners. The main sourcing categories are fibre, chemicals, other raw materials, logistics, energy, and indirect purchases such as services. When selecting suppliers, UPM's most important priorities include reliable long-term deliveries, cost-competitiveness, product and service quality, suppliers' financial stability, social and environmental responsibility, product safety, and the product's carbon footprint. Suppliers also play an important role in UPM's business-specific growth projects. Supplier management, with the required competencies and digitalization, boosts product development and the commercialization of new products.

UPM's responsible sourcing targets for 2030 Responsible sourcing has been identified as one of UPM's focus areas. The following targets for 2030 have been defined and are followed regularly. These targets support UPM's policy objective for responsible sourcing practices (UPM Code of Conduct). UPM's sustainability targets

are developed by UPM by taking the views, wishes, and perspectives of external stakeholders from UPM's constant multi-stakeholder dialogue into account.

Policies and procedures are implemented through training and communication.

Completion rates as of Dec 31, 2025

Compliance training for specific target groups

Size of target group

Base year value

2030 target

Target follow-up 2025 (2024)

Sustainability focus area and key performance indicator

Base year

Code of Conduct e-learning

94%

14,200

Responsible sourcing UPM total spend covered by UPM Supplier and Third-Party Code

Personal data protection e-learning

99%

6,300

2015

79%

>80% (continuous)

86% (91%)

Anti-Corruption e-learning

99%

6,300

Confidentiality e-learning

99%

6,300

Strategic, critical and high sustainability risk supplier spend covered by an EcoVadis assessment indicating low sustainability risk

2024

86%

100%

89% (86%)

Competition law e-learning

99%

2,800

CO 2 emissions from materials and logistics (Scope 3)

2018

6.08 mt CO 2 eq

-30%

-22% (-22%)

Insider Policy e-learning

99%

140

Association participation e-learning

100%

1,000

Cybersecurity e-learning

97%

6,300

UPM Group-level disclosure of 2030 sourcing-related targets is aligned with UPM’s Sustainable Supply Chain Program. UPM has identified 183 significant tier 1 suppliers, which are comprised of strategic, critical, and high sustainability risk suppliers. These correlate to an approximate spend of €1.7 billion. In 2025, UPM focused on managing the corporate responsibility performance of the significant suppliers to achieve the risk mitigation target. The 2024 target baseline was calculated as having 86% (by spend) of significant suppliers with an overall EcoVadis score indicating a low sustainability risk. In 2025, suppliers that did not meet the required performance level were actively engaged in sustainability assessments

and improvements. At the end of 2025, 89% of significant suppliers by spend had a score indicating a low sustainability risk. The progress of the other Group-level targets for sourcing is in line with the planned development.

UPM's e-learning modules are available on a global UPM e-learning platform and are easily accessible to all employees. Completion of mandatory e-learning courses is a prerequisite for short-term incentive payments. The e-learning courses are valid for three years, except for cybersecurity, which is valid for one year. UPM has a Group-level target of 100% participation in training on the UPM Code of Conduct. Since September 2025 and by the end of 2025, 94% (99%) of the active employees completed the new Code of Conduct training, excluding the UPM Adhesive Materials company acquired in

Refer to » E1-4 for details on the CO 2 target for Scope 3

Contractual payment terms

Refer to » G1-6 Payment practices

UPM Financial Report 2025

238

UPM Financial Report 2025

239

238

239

UPM Annual Report 2025

UPM Annual Report 2025