Organisation and management model

Legal & Privacy

According to Legislative Decree No. 231 of 8 June 2001, as amended and supplemented.

Definitions

LIABILITY OF ENTITIES FOR OFFENCES: This refers to a specific form of liability introduced into Italian law by Legislative Decree 231/01, applicable to entities with legal personality and companies and associations without legal personality. This liability arises when a senior manager or subordinate of the entity commits one of the offences explicitly listed in the decree, and the entity derives an advantage or benefit from it.

INTEREST: This is the improper enrichment sought by the entity as a consequence of the administrative offence. The existence of this interest must be assessed from a perspective prior to the commission of the alleged conduct and, therefore, independently of its actual realisation.

BENEFIT: This refers to the actual and tangible economic utility that the entity has obtained as a direct and immediate consequence of the offence. The benefit must be established following the commission of the offence.

SENIOR MANAGER: A senior manager is defined as an individual holding functions of representation, administration, or management within the company or an organisational unit with financial and functional autonomy, as well as one who exercises management and control functions, even in a de facto capacity. When the perpetrator of the offence is a senior manager, there is a presumption of liability, given that this individual embodies, represents, and enacts the company’s management policy.

SUBORDINATE: This refers to an individual subject to the oversight and control of a senior manager. The offence committed by a subordinate incurs liability for the company only if it is shown that the commission of the offence was enabled by a failure to fulfil oversight and/or supervisory obligations.

The formal adoption of the Organisational Model

A small working group initially drafted the Organizational Model, then discussed in various stages of review and in-depth analysis with company personnel who were progressively involved in refining the document. This model was subsequently submitted to the Board of Directors, which examined and approved it, together with the Code of Ethics, by a resolution on October 6, 2021, following a review of the Risk Assessment. At the same meeting, the Board also appointed the Supervisory Body (“OdV”), in accordance with the provisions of the Decree.

The key stages and activities involved in defining the Model can be summarised as follows:

Drafting a detailed map of sensitive company activities, i.e., those activities where, by their nature, crimes listed in the Decree could potentially occur and which, therefore require analysis and monitoring. In other words, areas or processes at potential risk within company operations in relation to the predicate offences outlined in Legislative Decree 231/01 were identified.
Defining ethical and behavioural principles and rules aimed at ensuring that business activities comply with laws and regulations while safeguarding the company’s assets. These principles and rules were then incorporated into the Company’s Code of Ethics.
Ensuring the proper proceduralization of key business processes involved in sensitive activities in order to:
- Define and regulate the timing and methods for conducting these activities;
- ensure traceability of documents, operations, and transactions through adequate documentation that records the characteristics and motives of each transaction, as well as the parties involved (authorisation, execution, registration, verification of the transaction);
- ensure, where necessary, the objectification of decision-making processes to limit corporate decisions based on subjective choices unconnected to predefined objective criteria;
- establish a system of delegation and allocation of corporate powers that ensures a clear and transparent division of responsibilities and an equally clear delineation of the corporate decision-making and implementation processes;
- define organisational structures capable of inspiring and overseeing proper conduct, ensuring clear and systematic assignment of tasks, applying appropriate segregation and separation of functions, confirming that organisational structures desired by senior management are effectively implemented, and identifying processes for managing and controlling financial resources in potentially at-risk activities.
Identifying the supervisory body and assigning specific responsibilities for overseeing the effective and proper functioning of the model.
Defining activities for disseminating, promoting awareness of, and communicating the behavioural rules and procedures adopted at all company levels.
Defining and applying disciplinary measures appropriate to penalise non-compliance with the provisions of the Model.
Defining responsibilities for the approval, adoption, integration, and implementation of the model, verifying its proper functioning, and assessing the need for amendments or updates (ex-post control).

The analysis focused on areas of actual (albeit hypothetical) risk relevant to the Company’s operations, avoiding unnecessary burdens on areas unrelated to Young’s specific business activities. Thus, it aligned with the approach endorsed by respected judges and experts in the field.

Modification and dissemination of the Model

Following Art. 6, par. 1, letter a) of Legislative Decree 231/01, modifications and additions to the Model, due to regulatory updates or implementation requirements, fall under the responsibility of the Board of Directors, following a non-binding opinion from the Supervisory Body (OdV).

Regarding the monitoring and updating duties assigned to the OdV by Art. 6, par. 1, letter b) of Legislative Decree 231/01, the Model is subject to three types of checks:

a) verification of compliance with the preventive measures provided for in the individual Special Parts concerning the areas and type of criminal risk considered;

b) periodic checks on the effective functioning of the Model and its implementing procedures using the methods established by the Supervisory Body itself;

c) annual review of all reports received over the year, actions taken in response by the OdV and other relevant parties, incidents deemed most at risk, and the actual awareness among recipients of the content of the Code of Ethics and the Model.

The adoption of the Model and any subsequent updates and/or amendments are communicated to all Young employees (“Employees”) and Company Governing Bodies and are included in specific and periodic training activities for all recipients (“Recipients”) from the date of adoption onwards, as well as in specific training sessions for new hires.

Recipients are emailed or notified by other suitable means of communication that the adopted and applicable documentation regarding administrative liability under Decree 231 is available on the Company’s website.

Crimes under Legislative Decree 231/01

The list of all offences that may give rise to administrative liability for entities (“predicate offences” or “231 offences”) under Decree 231 is attached (Annex no. 5). This list has expanded significantly over time. Predicate offences are currently included in Section III, Chapter I of the Decree, specifically in articles 24 to 25-duodenitis, along with the category of so-called transnational offences under Law no. 146 of 2006.

The Special Part of the Model focuses exclusively on those offences from the extensive list of Predicate offences theoretically relevant to Young. That is offences which—based on analyses conducted and the results of the risk assessment—could, even if hypothetically, be committed in the interest or to the benefit of the Company.

These are, in practice, the following offences:

(a) computer crimes and unlawful data processing, including:

Forgery of a public computer document or one having an evidentiary effect (Article 491-bis of the criminal code);
Unauthorised access to a computer or telecommunications system (Article 615-ter of the criminal code);
Unauthorised possession and distribution of access codes to computer or telematic systems (Article 615-quater of the criminal code);
Unauthorised possession, dissemination and installation of equipment and other means of intercepting, impeding or interrupting telegraphic or telephone communications or conversations (Article 617-bis of the Criminal Code);
Illegal interception, obstruction, interruption of computer/telematic communications (Article 617-quater of the criminal code);
Installation of equipment designed to intercept, prevent or interrupt computer or telematic communications (Article 617-quinquies of the Criminal Code);
Falsification, alteration or suppression of the content of computer or telematic communications (Article 617-sexies of the criminal code);
Damage to computer information, data and programs (Article 635-bis of the Criminal Code);
Damage to computer information, data and programs used by the State or other public body or in any case of public utility (Article 635-ter of the Criminal Code);
Damage to computer or telecommunications systems (Article 635-quater of the criminal code);
Possession, dissemination and abusive installation of computer equipment, devices or programs intended to damage or interrupt a computer or telecommunications system (Article 635-quater.1 of the Criminal Code);
Damage to computer or telecommunications systems of public utility (Article 635-quinquies of the criminal code);
Computer fraud by the electronic signature certifier (Article 640-quinquies of the criminal code);
Extortion through the commission of computer crimes (Article 629(3) of the Criminal Code);

(b) offences against industry and trade, including:

Unlawful competition with threats or violence (Article 513-bis of the Criminal Code);
Fraud against national industries (Article 514);
Manufacture of and trade in goods made by usurping industrial property rights (Article 517-ter of the Criminal Code);

(c) corporate offences, including:

False corporate communications (Articles 2621, 2621-bis, 2621-ter of the Civil Code);
False corporate communications to the detriment of shareholders or creditors (Article 2622(1) and (3) of the Civil Code);
Obstruction of control (Article 2625(2) of the Civil Code);
Undue return of contributions (Article 2626 of the Civil Code);
Illegal distribution of profits and reserves (Article 2627 of the Civil Code);
Illegal transactions involving shares or quotas of the company or the parent company (Article 2628 of the Civil Code);
Transactions to the detriment of creditors (Article 2629 of the Civil Code);
Failure to disclose a conflict of interest (Article 2629-bis of the Civil Code);
Fictitious capital formation (Article 2632 of the Civil Code);
Improper distribution of company assets by liquidators (Article 2633 of the Civil Code);
Unlawful influence on the shareholders’ meeting (Article 2636 of the Civil Code);
Market rigging (Article 2637 of the Civil Code);
Obstructing the exercise of the functions of public supervisory authorities (Article 2638(1) and (2) of the Civil Code);
Bribery between private individuals is limited to cases covered by Article 2635 of the Civil Code;
Instigation of the bribery offence among private individuals referred to in c. 1 of Article 2635-bis of the Civil Code.

(d) offences of receiving, laundering and using money, goods or benefits of unlawful origin, including:

Receiving stolen goods (Article 648 of the Criminal Code);
Money laundering (Article 648-bis of the criminal code);
Use of money, goods or benefits of unlawful origin (Article 648-ter of the Criminal Code);
Self-money laundering (Article 648-ter.1 of the Criminal Code).

(e) offences relating to non-cash means of payment and fraudulent transfer of valuables (Article 493-ter and Article 493-quater of the Criminal Code and Article 640-ter(2) of the Criminal Code).

(f) occupational health and safety offences, including:

Manslaughter (Article 589(2) of the Criminal Code);
Grievous bodily harm (Art. 590(3) Penal Code).

(g) offences against cultural heritage, including:

Crimes against the cultural heritage (Articles 518-bis, 518-ter, 518-quater, 518-octies, 518-novies, 518-decies, 518-undecies, 518-duodecies and 518-quaterdecies of the Criminal Code);
Laundering of cultural goods and devastation and looting of cultural and landscape heritage (Article 518-sexies and Article 518-terdecies of the Criminal Code).

It should be specified that the remaining offences provided for by Decree 231, which are not expressly considered in the Special Part of the Model, are, from a practical point of view, probably devoid of effective risk profiles, making it reasonably impracticable to even abstractly suppose that they could be committed in the interest or to the advantage of Young. For these offences (listed in Annex no. 6), the reference to the principles contained both in the Model and in the Code of Ethics of the Company, which expressly bind all the Addressees to respect the values of protection of the individual personality, correctness, morality and legality, can therefore be considered sufficient.

Aims of the Model

The Organisation, Management, and Control Model is a fundamental document for managing the Company’s administrative responsibility. It should be read in sequence with the Code of Ethics and in conjunction with the Operations Manual, which the Company has had since the beginning of its activity.

The Model is subject to constant revision based on developments in the Company’s organisational set-up, the elements emerging from the periodic risk assessment and the plan of activities aimed at preventing the risk of money laundering and financing terrorist activities, and meets the following requirements:

identify the activities within the scope of which Offences-Complaints may be committed (so-called risk mapping);
provide for specific protocols aimed at planning the formation and implementation of the Company’s decisions about the offences to be prevented;
identify ways of managing financial resources that are suitable for preventing the commission of offences;
provide for obligations to inform the personnel towards the body responsible for supervising the functioning of and compliance with the Model;
introduce an appropriate disciplinary system to sanction non-compliance with the measures indicated in the Model;
provide, about the nature and size of the organisation, as well as the type of activity carried out, for appropriate measures to ensure that the activity is carried out in compliance with the law and to detect and eliminate risk situations in good time;
Provide for a periodic check and amend the Model when violations of its prescriptions emerge or when changes occur in the company’s organisation, the activity carried out, or the regulations under Decree 231.

Sanctions under Decree 231

The sanctions provided for by Legislative Decree 231/01 when the entity has adopted an organisational model that is not suitable for preventing the commission of the criminal offence or has not adopted it at all are:

(a) the financial penalty;

(b) the prohibitory sanction;

(d) publication of the judgment.

Supervisory Board

Article 6 of the Decree provides that, in order to be exempt from administrative liability, the entity must have entrusted a body ‘endowed with autonomous powers of initiative and control’ with the task of supervising the functioning of and compliance with the Model, as well as ensuring that it is updated. This body is characterised not only by autonomy, but also by functional independence, professionalism and continuity of action.

The member(s) of Young’s Supervisory Board shall be chosen from among qualified individuals and experts in legal/criminal law, labour law, management and consulting analysis of control systems, and expertise in the Company’s business sector. They must also meet the requirements of independence, autonomy, and honourableness, including the absence of criminal convictions.

The Company has deemed it appropriate to opt for a monocratic structure of the Supervisory Board, which is therefore currently made up of only one member, in possession of the requirements of independence, professionalism and competence in economic-financial and/or legal matters, with extensive knowledge of the company organisation and its processes.

The Supervisory Board is appointed and revoked by the Board of Directors and its term of office coincides with the term of the Board of Directors that appointed it; the lapsed Board retains its functions until the new Supervisory Board is appointed.

All levels of the company shall be promptly and adequately informed of the appointment of the Supervisory Board, its powers, responsibilities, and competences, as well as of the procedures for reporting to the Supervisory Board any discrepancies detected with respect to the adopted Organisational Model.

Any remuneration or reimbursement of expenses incurred in performing official duties shall be determined at the time of appointment.

The Supervisory Board may only be revocated, and its powers may be assigned to another person for just cause through a specific resolution of the Board of Directors.

Just cause’ for revocation means:

The loss of the subjective requirements of honour, integrity, respectability and independence present at the time of appointment;
The occurrence of a reason for incompatibility;
gross negligence in the performance of the duties connected with the assignment;
The omission or insufficient supervision by the Supervisory Board in accordance with the provisions of Article 6 c. 1 lett. d) of Legislative Decree 231/01 resulting from a final conviction handed down against the Company pursuant to Legislative Decree 231/01, or from a sentence imposing the penalty at the request of the parties;
The assignment of operational functions and responsibilities within the corporate organisation that are incompatible with the requirements of ‘autonomy and independence’ and ‘continuity of action’ of the Supervisory Board. In particularly serious cases, the Board of Directors may order the suspension of the powers of the SB and the appointment of an interim Body.

In addition to revocation, the Supervisory Board ceases to hold office due to resignation or supervening incapacity. In such cases, the Board of Directors shall replace it as soon as possible.

The Supervisory Board has the function of supervising:

Compliance with the Code of Ethics and the Organisational Model by corporate bodies, employees, collaborators and suppliers;
On the effectiveness and efficiency of the Code of Ethics and the Organisational Model concerning the corporate structure and the effective capacity to prevent the commission of the offences relevant to the Decree, with verification of the consistency between the practices and behaviour concretely adopted and the obligations and procedures laid down in the Model; providing for:
- periodically carry out targeted checks on certain operations or specific acts carried out by the Company, especially in the context of sensitive processes and activities at risk;
- collect, process and store information relevant to compliance with the Model, and update the list of information that must be transmitted to him or kept at his disposal;
- aligning with other corporate functions (including through special meetings) for the best monitoring of activities concerning the procedures laid down in the Model;
- initiate and carry out internal investigations to ascertain alleged violations of the provisions of the Model in the context of planned activities and/or following reports received.
- Expressing opinions on revising the most relevant company policies and procedures to ensure their consistency with the Model where adaptation is needed due to changed company and/or regulatory conditions.

In addition to its supervisory activity, the Supervisory Board periodically carries out specific checks on the actual capacity of the Model for the prevention of relevant offences through

Sample checks of the most important corporate acts and contracts about sensitive processes and their compliance with the rules set out in the Model;
Review all the reports received during the year, the actions taken by the company, the events considered risky, and the awareness of employees, collaborators, and corporate bodies regarding the issue of the company’s administrative liability with spot checks.

The Supervisory Board checks the model by performing specific in-depth analyses and control tests based on the audit plan approved by the Board of Directors.

At the end of the audit, a report is drawn up highlighting any shortcomings and suggesting actions to be taken to be submitted to the Board of Directors.

The Supervisory Board carries out periodic sample checks on the activities connected to the so-called sensitive processes in order to verify their correct performance in relation to the rules set out in the Model. The Supervisory Board may also intervene in the following reports received. To this end, the Supervisory Board is guaranteed free access to all the relevant company documentation and must also be kept constantly informed by the management about the company activities at risk of the commission of one of the offences pursuant to Legislative Decree No. 231/01.

It is mandatory for any company function, employee and/or member of the corporate bodies to provide the information in their possession in response to requests by the Supervisory Board or upon the occurrence of events or circumstances relevant to the performance of the activities falling within the remit of the Board itself. In any case, any information received will be processed in compliance with the privacy regulations in force. Failure to comply with the obligations mentioned above shall entail the forfeiture of the appointment to be adopted by resolution of the Board of Directors.

The Recipients must inform the Supervisory Board of the Model of any circumstance that could generate in the Company the liability provided for in Legislative Decree 231/01. The reports generally concern all news concerning the presumable commission of the offences provided for in the Decree in relation to the Company’s activities or behaviour that is not in line with the rules of conduct adopted by the Company itself. The Supervisory Board is also the recipient of the reports relating to the so-called whistleblowing system referred to in Legislative Decree no. 24 of 10.03.2023, under the terms and operating procedures described in the internal procedure adopted by Young, to which reference should be made.

The Supervisory Board at least once a year and as often as it deems appropriate reports in writing to the Board of Directors and its Chairman on

the supervisory activity carried out during the reporting period;
any criticalities that have emerged both in terms of internal conduct within the Company and in terms of the effectiveness of the Model;
the outcome of the monitoring activities carried out and the reporting of situations requiring timely initiatives by the Board of Directors;
the planned corrective and improvement actions and their status of implementation.

The Board of Directors may convene the Supervisory Board at any time to report on the functioning of the Model and specific situations.

Disciplinary system

Pursuant to Articles 6(2)(e) and 7(4)(b) of Legislative Decree No. 231/01, the organisation, management and control models, the adoption and implementation of which (together with the other situations provided for in the aforementioned Articles 6 and 7) constitute a condition sine qua non for the Company’s exemption from liability in the event of the commission of the offences referred to in the Decree, can only be considered effectively implemented if they provide for a disciplinary system capable of sanctioning non-compliance with the measures indicated therein.

The disciplinary system outlined herein is therefore aimed at sanctioning non-compliance with the principles and procedures set out in the Organisational Model, including the annexes that form an integral part of it and the Code of Ethics, as well as with all the protocols and procedures aimed at regulating operations in the areas at risk of offences by both Employees and collaborators and third parties operating on behalf of the Company, providing for appropriate sanctions of a disciplinary nature in one case and of a contractual/negotiated nature in the other case.

The application of disciplinary sanctions is irrespective of the initiation or outcome of any criminal proceedings initiated by the Judicial Authority, since the organisational models and internal procedures constitute binding rules for the Recipients thereof, the violation of which, in order to comply with the dictates of the Decree, must be sanctioned regardless of whether an offence has actually been committed or whether it is punishable.

Target audience and application criteria

They are subject to the disciplinary system:

– all employees of the Company;

– administrators;

– consultants, collaborators and other third parties;

– the members of the Supervisory Board.

The Company’s procedure for contesting disciplinary offences uses verbal and/or written communication.

Verbal contestations occur during learning-by-doing meetings with other colleagues and on known and defined facts. Written objections are delivered by registered mail and/or notified by email.

The addressee has five days from receipt of the notice to submit his written defence to the Company, which the Board of Directors assesses before any sanction is imposed. The procedure for the imposition of sanctions considers the particularities deriving from the legal status of the person against whom proceedings are being taken.

All sanctions are applied considering the following criteria:

– the degree of intentionality of the violations committed;

– the level of negligence, recklessness or inexperience relating to the violations committed;

– the extent and severity of the consequences produced;

– the overall conduct of the infringing party;

– the type of tasks and duties entrusted;

– the functional position occupied.

The Company makes a disciplinary system available to its addressees.

Sanctions for directors, employees and consultants.

In the event of a breach of the Model by one or more directors, the Supervisory Board shall promptly inform the other members of the Board of Directors so that it may assess the seriousness of the breach and the specific circumstances and take the most appropriate and adequate initiatives, including a formal reprimand, revocation of delegated powers, liability actions and, in the most serious cases, revocation of the office.

Employee conduct that breaches the rules of conduct set out in the Model is defined as disciplinary offences.

The Disciplinary System complements and does not replace the more general system of sanctions relating to the relationship between employer and employee, according to the applicable regulations, including the national collective labour agreement (CCNL) applied.

The disciplinary measures that may be imposed in cases of violation of the rules of conduct against employees correspond to the provisions of the Workers’ Statute (Law no. 300/1970 and subsequent amendments) and the applicable CCNLs and are:

– verbal reprimand;

– written reprimand;

– fine in the amount of four hours’ work;

– suspension from service with deprivation of pay;

– dismissal with notice;

– dismissal without notice.

A worker who violates the internal procedures set out in this Model (e.g. who fails to observe the prescribed procedures, fails to notify the Supervisory Board of the prescribed information, fails to carry out checks, adopts conduct not compliant with the provisions of the Model in the performance of sensitive activities) shall incur the measures of REPRIMAND AND/OR CLAIM, FINE, SUSPENSION. The sanction is commensurate with the seriousness of the breach and its repetition and for commensuration of a possible expulsion sanction.

The measure of DISMISSAL WITH NOTICE shall be applied to any worker who, in the performance of sensitive activities, adopts conduct that does not comply with the prescriptions of the Model and aims to commit an offence relevant both for the purposes of Legislative Decree No. 231/01 and with regard to the legislation in force.

An employee who, in the performance of sensitive activities, violates the provisions of the Model and the laws in force shall incur the measure of DISMISSAL WITHOUT NOTICE.

The Board of Directors is responsible for ascertaining violations, managing disciplinary proceedings, and imposing sanctions. In performing these functions, the Board informs and assists the Supervisory Board.

Any conduct by external collaborators, consultants or other third parties connected to the Company by a non-employee contractual relationship in breach of the provisions of Legislative Decree No. 231/2001 and/or of the Model and of the Code of Ethics for the parts for which they are responsible, shall be sanctioned following the provisions of the specific contractual clauses included in the relevant contracts and may lead to the application of penalties, the suspension of the assignment, the termination of the contractual relationship, without prejudice to any claim for compensation if such conduct causes damage to the Company, even independently of the termination of the contractual relationship.