Whistleblower Policy

Superhero Securities Limited (AFSL No. 430150) and all of its related entities, and any of its Corporate Authorised Representatives (together ‘Superhero’)

References to “Superhero”, “we”, “our”, or “us” refer to the above entity.

1. Definitions

APRA means the Australian Prudential Regulatory Authority.

ASIC means the Australian Securities and Investments Commission.

AUSTRAC means the Australian Transaction Reports and Analysis Centre.

Affiliated Entity(ies) means an organisation that directly or indirectly controls another entity, or is directly or indirectly controlled by another entity, or which is under common control alongside another entity.

CCO means the Superhero Chief Compliance Officer.

CEO means the Superhero Chief Executive Officer.

Discloser(s) means an individual who discloses wrongdoing or an Eligible Whistleblower.

Disclosure(s) means a disclosure of information relating to wrongdoing or a disclosable matter.

Eligible Whistleblower(s) means an individual to whom the Whistleblower protections apply.

Employee(s) means any individual who performs work under the direction and control of Superhero, including any persons working on a contractual basis.

Misconduct means an Employee behaving in an unacceptable or improper manner that is inconsistent with their continued employment.

Public Interest Disclosure means a disclosure made to AUSTRAC under the Public Interest Disclosure Act 2013.

Regulator(s) means any relevant regulatory body (i.e. ASIC, APRA, AUSTRAC or other) which has regulatory reporting obligations that Superhero must comply with.

Senior Manager(s) or Senior Management means the highest level of managers within Superhero immediately below the board of directors.

Whistleblower(s) means a Discloser who has made a Disclosure related to Misconduct, alleged dishonest or illegal activity occurring in an organisation and who qualifies for protection under the Corporations Act.

2. Purpose of Whistleblower policies

Whistleblower policies are essential to good risk management and corporate governance. They help uncover Misconduct that may not otherwise be detected. Often, such wrongdoing only comes to light because of individuals (acting alone or together) who are prepared to disclose it, sometimes at great personal and financial risk.

Whistleblower policies help:

• provide better protections for individuals who disclose wrongdoing (Disclosers);
• improve the whistleblowing culture of entities and increase transparency in how entities handle Disclosures of wrongdoing;
• encourage more Disclosures of wrongdoing; and
• deter wrongdoing, promote better compliance with the law and promote a more ethical culture, by increasing awareness that there is a higher likelihood that wrongdoing will be reported.

3. Our commitments

Superhero is committed to promoting and supporting the highest standards of conduct and ethical behaviour, compliance and good corporate governance.

Superhero encourages Employees to speak up when they see activity or behaviour that they feel is wrong or does not match the company’s values. This policy provides clear guidelines for how Superhero approaches and manages Employee feedback and aims to ensure:

• every Employee has the chance to speak up anonymously, without being subject to retaliation or abuse, when they feel we are not adhering to our corporate values;
• Employees know how and where to report Misconduct and that every report will be heard and acted upon;
• all Employees are aware of their right to be able to make Whistleblower reports anonymously and that their identity will only be revealed at their own discretion; and
• Employees understand that we investigate every report of Misconduct and document the results and provide feedback to the Whistleblower regarding any improvements made as a result of the report where it is possible to do so.

4. Conduct to be reported under this policy

Superhero encourages Employees to report the following types of behaviour or activities:

• fraudulent;
• illegal;
• corrupt;
• dishonest;
• unethical;
• violates the law or any legal code;
• is creating an unsafe environment;
• breaches any of our company’s policies;
• discrimination;
• harassment and/or bullying of any kind; and
• any conduct which is detrimental to Superhero and could cause financial or non-financial loss.

Matters not listed above are not covered by this policy, for example, personal work-related grievances. Such matters may be taken up with the Superhero People and Culture Manager and will be dealt with separately.

Examples of personal work related grievances include, but are not limited to, the following:

• an interpersonal conflict between the Discloser and another Employee;
• a decision that does not involve a breach of workplace laws;
• a decision about the engagement, transfer or promotion of the Discloser;
• a decision about the terms and conditions of engagement of the Discloser; or
• a decision to suspend or terminate the engagement of the Discloser, or otherwise to discipline the Discloser.

A personal work-related grievance may still qualify for Whistleblower protection if:

• it includes information about Misconduct, or where information about Misconduct is accompanied by a personal work-related grievance (mixed report);
• the entity has breached employment or other laws punishable by imprisonment for a period of 12 months or more, engaged in conduct that represents a danger to the public, or the Disclosure relates to information that suggests Misconduct beyond the Discloser’s personal circumstances;
• the Discloser suffers from or is threatened with detriment for making a Disclosure; or
• the Discloser seeks legal advice or legal representation about the operation of the Whistleblower protections under the Corporations Act.

The deliberate reporting of information known to be false under this policy will be taken seriously and may result in disciplinary action against the Employee.

5. Eligibility for Whistleblower protections

The following individuals are considered to be Eligible Whistleblowers and would qualify for protection under this policy:

• Employees (including directors and managers);
• contractors, consultants, service providers, suppliers and business partners; and
• former Employees.

This policy applies to all of Superhero’s businesses, Affiliate Entities, divisions, and offices. It also applies across all jurisdictions where we operate. If local legislation, regulation, or laws provide a higher level of protection than what is included in this policy, the local legislation will take precedence.

6. How to make a Whistleblower report

If an Employee or Eligible Whistleblower would like to make a Whistleblower report, they may do so via the following channels:

• contacting Superhero via post at:
  • Attention: CEO or CCO
  • PO Box R1055 Royal Exchange
  • NSW 2000
• contacting Superhero via email at: compliance@superhero.com.au to the attention of the CEO or CCO; or
• requesting to speak directly and privately with the CEO, CCO or the People and Culture Manager if you are an internal Employee.

An Eligible Whistleblower may also make a Whistleblower report directly to an external Regulator if this is preferable. Whistleblower reports can be made directly to an external Regulator via the below channels.

• To make a Whistleblower report directly to APRA email: whistleblower@apra.gov.au.
• To make a Whistleblower report directly to ASIC either complete ASIC’s online Misconduct Reporting Form or alternatively write to ASIC at:
  • Australian Securities and Investments Commission
  • GPO Box 9827
  • Brisbane QLD 4001
• To make a Whistleblower report directly to AUSTRAC you may make a Public Interest Disclosure by emailing pid@austrac.gov.au or by calling 1300 021 037 or alternatively by writing to AUSTRAC at:
  • Authorised Officer
  • C/- AUSTRAC
  • PO Box K534
  • Haymarket NSW 1240

7. Receipt of a Disclosure

If an entity is a body corporate, an eligible recipient of a Disclosure includes:

• an officer or Senior Manager of the entity or related body corporate;
• the internal or external auditor (including a member of an audit team conducting an audit) or actuary of the entity or related body corporate; or
• a person authorised by the entity to receive Disclosures that may qualify for protection.

Generally, an ‘officer’ includes a director or company secretary of an entity.

A ‘Senior Manager’ is generally a senior executive within an entity, other than a director or company secretary, who:

• makes or participates in making decisions that affect the whole, or a substantial part, of the business of the entity; or
• has the capacity to significantly affect the entity’s financial standing.

Disclosures to a legal practitioner for the purposes of obtaining legal advice or legal representation in relation to the operation of the Whistleblower provisions in the Corporations Act are protected (even in the event that the legal practitioner concludes that a Disclosure does not relate to a ‘disclosable matter’).

Disclosures of information relating to disclosable matters can be made to ASIC, APRA or another Commonwealth body prescribed by regulation and qualify for protection under the Corporations Act.

Disclosures can be made to a journalist or parliamentarian under certain circumstances and qualify for protection.

A ‘public interest Disclosure’ is the Disclosure of information to a journalist or a parliamentarian, where:

• at least 90 days have passed since the Discloser made the Disclosure to ASIC, APRA or another Commonwealth body prescribed by regulation;
• the Discloser does not have reasonable grounds to believe that action is being, or has been taken, in relation to their Disclosure;
• the Discloser has reasonable grounds to believe that making a further Disclosure of the information is in the public interest; and
• before making the public interest Disclosure, the Discloser has given written notice to the body to which the previous Disclosure was made (as per ASIC RG 270.75(a)) that:
  • includes sufficient information to identify the previous Disclosure; and
  • states that the Discloser intends to make a public interest Disclosure.

An ’emergency Disclosure’ is the Disclosure of information to a journalist or parliamentarian, where:

• the Discloser has previously made a Disclosure of the information to ASIC, APRA or another Commonwealth body prescribed by regulation;
• the Discloser has reasonable grounds to believe that the information concerns a substantial and imminent danger to the health or safety of one or more persons or to the natural environment;
• before making the emergency Disclosure, the Discloser has given written notice to the body in RG 270.76(a) (i.e. the body to which the previous Disclosure was made) that:
  • includes sufficient information to identify the previous Disclosure; and
  • states that the Discloser intends to make an emergency Disclosure; and
• the extent of the information disclosed in the emergency Disclosure is no greater than is necessary to inform the journalist or parliamentarian of the substantial and imminent danger.

It is important for the Discloser to understand the criteria for making a public interest or emergency Disclosure. Disclosure must have previously been made to ASIC, APRA or a prescribed body and written notice provided to the body to which the Disclosure was made. In the case of a public interest Disclosure, at least 90 days must have passed since the previous Disclosure.

A Discloser should contact an independent legal adviser before making a public interest Disclosure or an emergency Disclosure.

8. Whistleblowers may remain anonymous

Superhero respects and protects your identity if you choose to make an anonymous Whistleblower report. You can choose to remain anonymous while making a report, interacting with case managers during an investigation of your report, as well as after your case is closed. At any given time you can identify yourself, but this is your choice and at no point do you need to do this or will you be forced to provide your identity.

If you decide to disclose your identity, Superhero will work to protect your identity and will outline and document who in the organisation will know you submitted your report. Superhero will also take all steps necessary (and outlined in this policy) to ensure you do not suffer any retaliation.

A Whistleblower can refuse to answer questions that they feel could reveal their identity at any time, including during follow-up conversations.

Superhero will make every endeavour possible to investigate your report, but in some cases, there are limitations to what can be achieved if the Whistleblower decides to remain anonymous. It is helpful if a Whistleblower who wishes to remain anonymous maintains an ongoing two-way communication with the entity to which the Disclosure is made, so the entity can ask follow-up questions or provide feedback.

Even where a Whistleblower chooses to remain anonymous, in certain instances it may be required by law for Superhero to identify a Whistleblower to a Regulator, the Australian Federal Police, or to a lawyer for advice about the Whistleblower protections if required.

9. The investigative process

It is important for Superhero to be transparent with our Employees and outline what is the process for us to investigate a report submitted through our whistleblowing channels. Below, we have provided the different steps we will go through once a report is received until the matter is closed.

i. Report (anonymous or otherwise) is received.

ii. The report is read and its receipt confirmed within 48 hours.

iii. An initial assessment is done to confirm it is a valid report and investigation is warranted.

iv. The report is investigated. This can include corresponding with the Whistleblower if there is a channel to do this.

v. The report handler will investigate and update those persons who are authorised to be made aware of the Whistleblower report (as per section 10 of this policy) and the Whistleblower per policy guidelines.

vi. Once the report handler has finalised their investigation and report, Superhero’s Board and management, in addition to the Whistleblower (where appropriate), will be updated and provided with a copy of the final report. This will generally occur within 30 business days of receipt of the report, however timeframes may vary depending on the nature and complexity of the Disclosure.

vii. Superhero’s Board, and any Senior Management who are allowed to be made aware of a Whistleblower report, will then determine what, if any, subsequent action is required in the matter.

Where an individual or individuals are named in a Whistleblower report and any accusations are made against any individual, their identities will be protected in the same manner as that of the Whistleblower. The initial Whistleblower report will be kept confidential and will not be disclosed to any named individuals in the report. Following an investigation and the generation of a final report, Superhero’s Board, in conjunction with any Senior Management who are allowed to be made aware of a Whistleblower report, will determine if any disciplinary action regarding an individual or individuals named in a Whistleblower report is appropriate. Disciplinary action that can be taken may include termination of employment.

10. Who is to be made aware of a Whistleblower report

Once a Whistleblower report is submitted (anonymous or not), this report is sent to the Superhero Compliance Department, the Chief of Staff and the CEO. A member of the Superhero Compliance Department will then be assigned to provide an initial response to the Whistleblower and to perform an initial assessment of the report in order to determine if further investigations are warranted. If further investigation is warranted, a member of the Superhero Compliance Department will also be assigned to manage the investigation.

Certain members of Superhero Senior Management may be alerted to the report as part of the reporting process or if they are involved in the investigation in some manner.

Any information that could potentially identify an anonymous Whistleblower will be held in the strictest confidence and will not be shared, unless Superhero is compelled by law.

11. Process for updating the Whistleblower

As part of our investigative process, Superhero will update the Whistleblower of the progress of the investigation. Superhero will generally ensure the Whistleblower is made aware:

• of receipt of the Whistleblower report within 48 hours;
• that an investigation has been commenced or is ongoing and how long the investigative process may take;
• of the outcome of any investigation within 30 business days, where possible and depending on the nature and complexity of the Disclosure, of receipt of the Whistleblower report; and
• of when any investigation has been closed.

Superhero’s commitment is that even where an investigation is not able to be completed within 30 business days, that the Whistleblower will be updated once a month while the investigation is ongoing. They will then be updated once the investigation has been closed.

Superhero will strive to provide as much feedback on the investigation as possible. However, due to Superhero’s privacy guidelines, there may often be information that is unable to be shared with the Whistleblower.

12. Whistleblower is dissatisfied with the result of an investigation

If, after receiving the summarised report of the investigation, the Whistleblower is not satisfied with the result, they can escalate this to the Superhero CCO and CEO. The Whistleblower can provide this escalation in writing so that a formal review can take place.

While the CCO and CEO commit to review the request, Superhero is under no obligation to reopen the investigation. If the CCO and CEO conclude that the investigation was conducted properly and no new information exists that would change the results of the investigation, the investigation will be concluded.

If the Whistleblower remains dissatisfied with the result, the Eligible Whistleblower may escalate the matter to any relevant Regulator in accordance with Section 6 of this policy.

13. Protection for Whistleblowers

Section 8 of this policy outlines how an Eligible Whistleblower can remain anonymous during the process of submitting a Whistleblower report. Following the submission of a report, Superhero will ensure the Whistleblower’s identity is protected by:

• not requiring or forcing the Whistleblower to identify themselves at any time during the investigative process;
• storing any information or documentation pertaining to the Whistleblower report and the Whistleblower’s identity within the Compliance Department’s limited access share drive; and
• allowing the Whistleblower the right to refuse to answer questions they feel could identify themselves.

If the Whistleblower chooses to reveal themselves at any time, Superhero will document who will have access to their identity. This may include the Compliance Department’s case manager, the CCO, the Chief of Staff and the CEO.

14. Potential detriment to a Whistleblower

Superhero does not tolerate any attempts to retaliate against a Whistleblower who has made a Whistleblower report. Any Employee or associated person found to have engaged in retaliation against a Whistleblower will face disciplinary action, including the potential to be terminated from their role.

Superhero will provide protection for Whistleblowers from any potential retaliation or detrimental conduct for making a Whistleblower report, including from:

• dismissal;
• injury in his or her employment;
• alteration of their position or duties to his or her disadvantage;
• discrimination from other Employees of Superhero;
• harassment or intimidation;
• harm or injury, including psychological harm;
• damage to their property;
• damage to their reputation;
• damage to their business or financial position; or
• any other damage.

The following are examples of actions that are not considered detrimental conduct:

• an administrative action that is reasonable for the purpose of protecting a Whistleblower from detriment (e.g. moving a Whistleblower who has made a Disclosure about their immediate work area to another office to protect them from detriment, or having the Whistleblower take leave or assigning them to other duties to protect them from detriment); and
• managing a Whistleblower’s unsatisfactory work performance, if the action is in line with the entity’s performance management framework.

A Whistleblower may seek independent legal advice or contact regulatory bodies, such as ASIC or APRA, if they believe they have suffered detriment.

15. Governance

All Superhero Employees are provided with training at onboarding regarding the application of this policy.

From time to time, Superhero’s Whistleblower policy will need to be updated in order to remain consistent with our values, best practices, operational improvements and any legislative or regulatory changes.

Any changes to Superhero’s Whistleblower policy will be communicated to all Employees via Superhero’s internal document management system. A current version of the Whistleblower policy will also be made available to external parties via the Superhero website at www.superhero.com.au.

Any changes to Superhero’s Whistleblower policy will be undertaken by the Compliance Department and must be reviewed and approved by the CCO or a member of the Senior Management team.

16. Civil, criminal and administrative liability protection

A Discloser is protected from any of the following in relation to their Disclosure:

• civil liability (e.g. any legal action against the Discloser for breach of an employment contract, duty of confidentiality or another contractual obligation);
• criminal liability (e.g. attempted prosecution of the Discloser for unlawfully releasing information, or other use of the Disclosure against the Discloser in a prosecution (other than for making a false Disclosure)); and
• administrative liability (e.g. disciplinary action for making the Disclosure).

The protections do not grant immunity for any Misconduct a Discloser has engaged in that is revealed in their Disclosure.

17. Compensation and other remedies

A Discloser (or any other Employee or person) can seek compensation and other remedies through the courts if:

• they suffer loss, damage or injury because of a Disclosure; and
• Superhero failed to take reasonable precautions and exercise due diligence to prevent the detrimental conduct.

Disclosers are encouraged to seek independent legal advice.

18. Reporting

The Superhero Compliance Department will provide quarterly reporting to the Superhero Risk and Compliance Committee and the Board in relation to any Whistleblower reports that are received under this policy. The Board may, at any time, ask about any anonymous reports or investigations, as well as the state of Superhero’s Whistleblower program.

Any reporting to the Risk and Compliance Committee and the Board should contain the following information, when it is not likely to lead to the identification of a Discloser:

• the subject matter of each Disclosure;
• the status of each Disclosure;
• for each Disclosure, the type of person who made the Disclosure (e.g. Employee or supplier) and their status (e.g. whether they are still employed or contracted by the entity);
• the action taken for each Disclosure;
• how each Disclosure was finalised;
• the timeframe for finalising each Disclosure; and
• the outcome of each Disclosure.

— End of Policy —