Calen Whistleblowing Policy

A qualifying disclosure is a disclosure of information that, in the reasonable belief of the person making it, tends to show that one or more forms of relevant wrongdoing has occurred, is occurring, or is likely to occur. This policy is designed to operate consistently with the protections available under the UK Public Interest Disclosure Act 1998, as incorporated into the Employment Rights Act 1996, and with applicable United States federal whistle-blower protection laws, including protections available to individuals who report conduct to the Securities and Exchange Commission, the Commodity Futures Trading Commission, or other relevant federal bodies.

You do not need to have firm proof before raising a concern under this policy. You only need a genuine and reasonably held belief that the information you are disclosing is substantially true. You should never attempt to investigate a matter yourself beyond confirming your own reasonable belief, and you should not delay raising a concern in order to gather further evidence.

Relevant wrongdoing that should be reported under this policy includes, without limitation, the following categories of conduct.

• Financial fraud, including misstatement of accounts, misappropriation of Customer or company funds, or manipulation of financial records.
• Money laundering, terrorist financing, sanctions evasion, or any breach of Calen's anti-financial crime obligations.
• Deliberate tax evasion or the facilitation of tax evasion, whether affecting Calen, a Customer, or a third party.
• Systemic data protection or information security breaches, including the deliberate or negligent mishandling of personal data or Customer financial data.
• Bribery or corruption involving any employee, contractor, vendor, or public official.
• Human rights violations, including modern slavery, forced labour, or unsafe working conditions within Calen's own operations or its supply chain.
• A danger to the health and safety of any individual connected to Calen.
• A breach of any legal or regulatory obligation applicable to Calen, including our obligations to FINTRAC, the Bank of Canada, FinCEN, or any other regulator with authority over our business.
• The deliberate concealment of any of the matters listed above.

This policy is intended for concerns of genuine public or corporate interest. It is not the correct channel for a personal employment grievance, such as a dispute over pay, performance management, or a workplace disagreement, which should instead be raised under Calen's standard grievance procedures.

Calen will treat every report made under this policy as confidential and will make every effort to protect the identity of the person raising it. Information will only be shared with those who need to know it in order to properly investigate and address the concern, and a whistle-blower may request that their report be handled on an anonymous basis, subject to the practical limits this may place on the depth of investigation possible.

Calen will not tolerate victimisation, harassment, discrimination, demotion, exclusion, or any other form of professional detriment against any individual who raises a genuine concern in good faith under this policy, even if that concern is not ultimately upheld following investigation. Protection under this policy is lost only where a person is found to have knowingly made a false report, or to have made a report maliciously rather than in good faith.

Any manager, executive, or employee who is found to have engaged in retaliatory behaviour against a whistle-blower will face immediate summary dismissal, or, where the individual is a contractor or vendor, immediate termination of their engagement with Calen, in addition to any other legal consequence that may follow from that retaliation. Calen treats retaliation against a good faith whistle-blower as one of the most serious forms of misconduct an individual connected to our business can commit.

Calen provides a tiered set of reporting channels so that a concern can always be raised somewhere appropriate, even where the concern involves someone senior within the business.

Step one: your line manager or department head

In most cases, the fastest and most direct route is to raise your concern with your line manager, department head, or the most senior person you feel comfortable approaching. They are expected to escalate any qualifying disclosure to our compliance function without delay.

Step two: our independent compliance channel

Where you do not feel able to raise a concern with your line manager, or where your concern involves your line manager, you may report it directly and confidentially to our independent compliance channel at whistleblowing@calen.finance. This mailbox is monitored exclusively by our compliance function and is not accessible to line management.

Step three: external escalation

Where your concern involves a member of executive leadership, where you have already raised the matter internally and reasonably believe it has not been properly addressed, or where you reasonably believe internal reporting would not be appropriate given the seriousness of the matter, you are entitled to escalate your concern externally to the relevant financial regulator or law enforcement body. Depending on your location and the nature of your concern, this may include the Financial Conduct Authority in the United Kingdom, the Financial Transactions and Reports Analysis Centre of Canada, the Financial Crimes Enforcement Network or the Securities and Exchange Commission in the United States, or the equivalent law enforcement authority in your jurisdiction.

Whichever channel you use, you should provide as much detail as you reasonably can, including the nature of the concern, the individuals or teams involved, and any supporting information or documents you hold, so that we, or the relevant external body, can investigate effectively.

Every report received under this policy is reviewed by an independent compliance officer who has no direct involvement in the matter reported. This officer is responsible for triaging the report, determining the appropriate scope of investigation, and overseeing the process described in this section from start to finish.

• Within seven business days of receipt, the compliance officer will acknowledge the report in writing to the whistle-blower, where their identity is known, confirming that the report has been received and outlining the next steps.
• The compliance officer will then trigger a confidential internal audit appropriate to the nature of the concern, which may involve document review, system access review, and interviews with relevant individuals, all conducted on a need to know basis.
• Where the whistle-blower's identity is known, the compliance officer will provide periodic progress updates throughout the investigation, at intervals appropriate to the complexity of the matter, so that the whistle-blower is not left without visibility into the process.
• A final summary report will be delivered within thirty business days of the initial acknowledgement, setting out the findings of the investigation and any corrective action taken or recommended. Where an investigation is unusually complex and cannot reasonably be concluded within this window, the compliance officer will explain the reason for the delay and provide a revised expected timeline.

All findings are documented in full for internal governance and audit purposes. Where disclosure of specific findings to the whistle-blower could reveal the identity of another individual involved in the matter, or otherwise compromise the confidentiality this policy is designed to protect, the final summary report will describe the outcome and any action taken without disclosing those details.

All reports made under this policy, together with any supporting evidence, investigation notes, and final summary reports, are stored securely within an isolated compliance database maintained separately from Calen's standard corporate systems. Access to this database is restricted to the compliance function and, where strictly necessary, senior leadership or external legal counsel engaged to advise on a specific matter.

Records are retained for the period required to satisfy applicable regulatory audit parameters and corporate governance obligations in each jurisdiction in which Calen operates, and are then securely deleted or anonymised in accordance with our standard data retention schedule. Records are never used for any purpose other than the proper investigation and governance of the matter reported, and are never shared with a whistle-blower's line management in a way that would identify them, except where their identity is already known to that management as a result of the nature of the report.