UPM Annual Report 2025

We are UPM

Governance

Accounts and performance

Sustainability Statement

Report of the Board of Directors

Financial Statements

Auditor's Report

Sustainability Assurance Reports

Türkiye, Indonesia, Thailand, Argentina, India, South Africa, and Vietnam) are perceived as highly corrupt or corrupt according to Transparency International. In these countries, there is an increased risk of corruption in relation to interaction with government officials and in the use of intermediaries when applying for permits and licenses requiring governmental approval, for example. The due diligence of suppliers and third parties with whom UPM does business is an essential part of UPM's anti-corruption compliance program. UPM requires that due diligence is performed before entering or renewing any contract with a third party that meets specified criteria. UPM requires anti-bribery contract terms to be included in agreements with such third parties outlining the third-party's commitment to compliance with applicable anti-bribery laws and UPM's right to audit the third party to verify compliance with these terms. UPM also has corresponding due diligence procedures for joint ventures, mergers, and acquisitions.

Monitoring UPM aims to ensure compliance at all levels of the organization through monitoring. Monitoring activities are based on a Group company risk matrix which takes the country risk and complexity and scope of UPM's operations in each country into account. UPM's Compliance Team has a three-year monitoring plan for its unit-specific compliance reviews that are based on this matrix. In addition to these general reviews, which cover all business integrity issues, risk-based reviews are conducted on specific issues such as anti-corruption. The key findings and recommendations of the compliance reviews are reported to the Audit Committee of the Board of Directors and to businesses. These recommendations are then implemented in collaboration with the businesses concerned. Another example of UPM's monitoring activities is the counterparty screening procedures, which also cover anti-corruption and anti-bribery.

Anti-corruption and anti-bribery

G1-3

Covered by the UPM Compliance System The UPM Code of Conduct underlines the company's zero-tolerance attitude towards corruption and bribery in any form. UPM's Anti Corruption Rules, with the latest update in 2024, explain in more detail what prohibited conduct is, and what ethical behavior is expected.

UPM strives to ensure compliance with its Code of Conduct, policies, and rules by implementing a company-wide compliance program, including anti-corruption and anti-bribery, through the UPM compliance system. The compliance system is embedded in UPM's governance model and is designed to enhance company performance and a culture of integrity at all levels.

Risk assessments UPM regularly performs anti-corruption risk assessments. The 2025 compliance risk-assessment process included a top-down risk discussion (including corruption) with the management of each business area. All UPM entities were also assessed based on country risk and the

complexity of operations. UPM operates globally and has significant manufacturing operations in several countries in emerging markets. Such operations require several permits and other licenses from the relevant authorities. Some of the countries where UPM operates (such as Mexico,

UPM Financial Report 2025

242

UPM Financial Report 2025

243

242

243

UPM Annual Report 2025

UPM Annual Report 2025