UPM Annual Report 2025

We are UPM

Governance

Accounts and performance

Sustainability

UPM in brief

Our strategy

Our businesses

How we build a culture of integrity

Mindset Tone from the top Lead by example Ethical behavior Strong speak-up culture Building organizational justice Practices Upholding the Code of Conduct and other standards of integrity Training and communication Proactive advice

Promoting a culture of integrity

Driving responsible growth...

Strategy

Fostering ethical decisions

UPM compliance

UPM

Trust and be trusted Achieve together Renew with courage

Protecting the future Risk identification Risk mitigation and follow-up Remediating and reacting to misconduct

...by ensuring integrity every day

Managing compliance risks

The Code of Conduct reflects our respect for people, the planet, and ethical business practices and we demonstrate this through our actions.

Alleged misconduct cases UPM Code of Conduct section Our commitment to integrity 01. Our commitment to integrity Our people and operations 02. Respect people and human rights

Employee submitted a falsified invoice to conceal a gift that violated UPM’s policies. Warning.

2025

2024

1

10

Employee approved a payment to an entity with which they had a personal affiliation, resulting in a conflict of interest in breach of UPM’s policies. Warning.

47

57

In focus

03. Addressing environmental impact and sustainability of products

4

3

Building integrity together every day

Business integrity 04. Zero-tolerance for corruption and bribery

6

2

We provide compliance e-learnings also for the employees of our business partners who work on UPM premises or have access to our IT sys tems and tools. This is to ensure they share the same high standards of integrity with the UPM teams they collaborate closely with. The mandatory e-learning course on the new UPM Code of Conduct, our culture of integrity, and our expectations for employees is now available to the employees of our busi

ness partners on the platform. Cybersecurity is another example of shared responsibility. Thus, the employees of business partners must also complete our cybersecurity e-learn ing course annually. We recently expanded to include training on the Supplier and Third-Party Code for these partners, further reinforcing our commitment to responsible business practices across the value chain.

05. Avoid conflicts of interest

10

8

06. Compliance with competition laws 07. Protect assets and information Our Stakeholders 08. Know with whom you trade

0

1

Employee misappropriated UPM’s assets by seeking reimbursement for personal expenses from the company, in violation of UPM’s policies. Termination of employment.

18

13

11

5 0

09. Engaging with our stakeholders and society

0

Voice your concerns 10. Compliance involves everyone

0 6

0 0

Other

Total

103

99

78

79

UPM Annual Report 2025

UPM Annual Report 2025