UPM Annual Report 2025

We are UPM

Governance

Accounts and performance

Sustainability

UPM in brief

Our strategy

Our businesses

Creating value for people and society

Our commitments

Our priorities

Compliance We are committed to complying with applicable laws, regulations, our Code of Conduct and our values – Trust and be trusted, Achieve together, Renew with courage. Our Code of Conduct reflects our respect for people, the planet, and ethical business practices. Building a culture of integrity We never compromise on our standards of integrity in any circumstances. We aim to continuously improve how we work and further embed a culture of business integrity. Accountability Accountability for compliance extends from the Board of Directors and senior management to all employees. Voicing concerns We strive to create an environment in which employees feel comfortable about voicing their concerns without fear of retaliation.

Risk assessment forms the basis of our compliance program Each business area, unit, and function is responsible for identifying and managing its compliance risks. Annual and ad-hoc risk as sessments guide our compliance activities and mitigation actions. These actions are updated throughout the year to reflect changes in the risk environment. Policies and procedures document what is expected of all employees Our compliance system is embedded in our governance model and is designed to promote a culture of integrity at all levels. As part of our policy management process, we review the need to update policies and procedures annually to ensure they remain relevant. Our e-learning modules on policies and proce dures are easily accessible to employees on a global e-learning platform. Completing these mandatory e-learning courses is a prerequisite for receiving short-term incentive payments. Training is also extended to employees of our business partners who work for UPM. Tailored Ongoing training and communication help us make the right choices

training and active communication support compliance e-learning modules.

Comprehensive monitoring enables us to take action Our monitoring activities are based on a risk matrix that considers country risk, complexity, and the scale of our operations in each country. In addition, we conduct risk-based reviews on specific topics such as competition law and anti-corruption, as well as ongoing counter party screening activities. Key findings and recommendations from compliance reviews are reported to the Audit Committee of the Board of Directors and the businesses, which take any necessary follow-up action. Response and remediation contribute to organisational justice We encourage employees to report any misconduct or unethical behavior, without fear of retaliation. We have procedures in place to promptly, independently, and objectively investigate incidents of alleged misconduct. The UPM Report Misconduct channel is open both to our employees and external stakeholders, including contractors, suppliers, and affected communities.

Committed to compliance Regardless of location, circumstances, or people involved, we are committed to complying with applicable laws, regulations, and our Code of Conduct.

Compliance monitoring

Regular discussions with management, monitoring significant projects, training rate monitoring, implementation of risk mitigation plan

Actions in 2025 • 94% (99%) of active employees

completed the new Code of Conduct training started in September, excl. the UPM Adhesive Materials company acquired in 2025 • The UPM Code of Conduct was updated • The Code of Conduct training for all personnel was renewed. • Compliance reviews in nine local units or operations in the Americas, the Asia-Pacific region and Europe.

Regular compliance reviews based on Group company risk matrix

UPM business areas and other operations

We are all responsible for building a culture of integrity in everything we do and in every choice we make. Our Code of Conduct and values help us make the right decisions and guide our work in a changing business environment. This is the foundation for long-term success.

We monitor the development of this culture through our annual Employee Engagement Survey (EES). In the EES, the average score for ethical behavior at UPM was 75 (74), while the external benchmark was 79 (79).

Regular discussions with employees, third-party due diligence and risk monitoring, reports through UPM Report Misconduct channel, EES and other employee surveys

See more in our Sustainability Statement, ESRS G1 Business conduct on page 236

76

77

UPM Annual Report 2025

UPM Annual Report 2025