Page 79 - Demo

78-792025 SUSTAINABILITY REPORTwww.omnescapital.comThird-Party Due DiligenceKYC due diligence is conducted at the investment stage on co-shareholders and partners, forming part of the additional first-level control process. KYC files are updated when the preceding review is more than 12 months old. The firm maps the ownership structure of targets and partners, conducts reputational checks, and formalizes a documented risk assessment for each counterparty. When politically exposed persons are identified, their connection to the relevant transaction is assessed and the file is submitted to the CEO for validation in light of the investment%u2019s specific risk profile. Ultimate responsibility for the AML-CTF policy and the KYC process rests with the Corporate Secretary.Incident Reporting and WhistleblowingCompliance incidents may be reported by any means (oral, written, or electronic) and are recorded in a central incident register. Each entry includes the date, the reporting party, a description of the incident, the measures taken, the potential financial and reputational impact, and any corrective actions implemented. This register provides an auditable record of how compliance concerns are identified, assessed, and resolved. Compliance investigations are formalized and stored; there is a documented step-by-step record of the assessment process.Whistleblowing and compliance incident reporting operate as formally separate channels. The designated whistleblowing referent is the HR Manager, in line with the firm%u2019s obligations under French Sapin II legislation. Employees may also report concerns directly to the CEO, the Corporate Secretary, or an external competent authority. CybersecurityCybersecurity risk is integrated into Omnes%u2019 risk mapping and is subject to ongoing monitoring and efforts to raise awareness activity. In 2025, the firm delivered quarterly cybersecurity awareness updates to all employees as a follow-up to the company-wide training session conducted in 2024. At a technical level, controls include USB port blocking, mandatory password renewal requirements, and enhanced controls over document sharing. Omnes benchmarks its cybersecurity practices against the AMF%u2019s control standards to identify its strengths and areas requiring improvement; this process has led to successive updates to the firm%u2019s control framework and has resulted in practices that are consistently aligned with, or ahead of, industry standards.Although Omnes is not directly subject to the NIS2 Directive, the firm continues to monitor its implications for the companies in which it invests. In addition, Omnes undertook a programme to align its internal framework with the requirements of the Digital Operational Resilience Act (DORA). The framework transition was completed in September 2025, with ongoing efforts focused on operational implementation and the strengthening of ICT third-party contractual arrangements.