Compliance and Business Ethics Culture

Code of Business Conduct and Ethics of MTS PJSC

The Code of Business Conduct and Ethics of MTS PJSC includes key principles, a set of standards and requirements accepted at the Company to facilitate MTS PJSC fair and ethical business and prevent abuse. Provisions of the Code were updated in 2021. In 2023, more than 92% of MTS PJSC employees completed e-training in the Code of Business Conduct and Ethics.

MTS PJSC Counterparty Code of Business Conduct

In accordance with the best international practices, the Company has approved the MTS PJSC Counterparty Code of Business Conduct, which contains basic requirements and ethical standards, compliance with which is expected from MTS counterparties. The provisions of the Code apply to all counterparties of MTS, as well as any third parties involved by a counterparty to act on behalf and/or for the benefit of the MTS Group. Familiarization with the Code and acceptance of its commitments are an integral part of the contractual relationship with the Company. In 2023, more than 4,000 counterparties were trained, which is 23% more than the year before.

Unified Compliance System Supporting the ESG Strategy

Since 2016, the Company has been actively developing the Unified Compliance System (UCS) on the basis of the norms of the applicable law, recommendations of regulatory authorities, the specific nature of the industry, and best practices in this sphere.

The compliance programs of the Company supporting the ESG Strategy allow developing the MTS ecosystem based on the principles of business ethics, strictly comply with the requirements of regulators, invest in the sustainable development of society, balancing the interests of concerned parties.

MTS makes a significant contribution to the processes of digitalization and increasing the transparency of information flows. In this regard, it is especially important for the Company to build an efficient compliance risk management system at all levels, in all businesses and in all areas of presence. The UCS (the Unified Compliance System) for the entire MTS digital holding is based on the general principles of sustainable development and ethical behavior, forms the foundation of its responsible management (the G part of the ESG Strategy).

Ключевые направления Единой системы комплаенс МТС

Anti-Corruption Compliance

Inside Compliance

Personal Data Processing Organization

Antitrust Compliance

Occupational Safety and Health Management System

Observance of Human Rights at the Workplace

Environment

Combatting Laundering of Criminal Proceeds, Financing of Terrorism and Financing Dissemination of Weapons of Mass Destruction (CLCP/FT/FSWMD)

Intellectual Property Risk Management System / IP Compliance

Each compliance area is assigned to the relevant mentor functional units, each of which implements its compliance program and risk minimization system. Coordination of the UCS implementation and operation is entrusted to the MTS PJSC Ethics & Compliance Department.

MTS confirmed compliance of the Unified Compliance System with the requirements of ISO 37301:2021 “Compliance Management Systems” and ISO 37001:2016 “Anti-Corruption Compliance Management System” based on the results of an audit conducted by the new certifying bodies. The MTS team is the winner in the nomination “Best Comprehensive Compliance Program” according to the results of the XI Compliance Case Forum 2023 Award.

Much attention was paid to activities aimed at improving the level of compliance culture of employees. On the corporate portal, the UCS blog regularly posted publications on the most significant events of the program. Annual compliance culture assessment was conducted. The overall level of compliance culture was 91.5 points, which is 0.4 points higher than 2022 results.

Compliance Committee

Since 2016, there the Compliance Committee under the President of MTS PJSC has operated in the Company. This Committee consists of the President and managers directly subordinate to the President. The Committee is chaired by the Vice President for Business Ethics and Compliance.

The Committee was established to make decisions on the setting-up and implementation of compliance programs. The main tasks of the Committee are to implement a policy in compliance risk management and to make proposals on the directions for the MTS Group development in this area.

Day of Ethics and Compliance

In 2023, the Day of Ethics was held under the slogan “Communicate with Care: Polite to Everyone, Ethical in Everything”. A message on the importance of a respectful and positive work environment was issued by the Vice President for Business Ethics and Compliance. Involving events were held as well: the Compliance Cup game among the MTS Group employees, creative competitions, video messages from employees, managers and their children about respectful environment, exchange of stickers on the corporate portal and in the Telegram messenger, communication about communication with care, as well as other events prepared by the coordinators of compliance programs of the MTS Unified Compliance System.

Unified Hotline

Information on violations of business ethics and compliance standards by MTS employees can be reported to the Unified Hotline (unified hotline).

The Company provides an independent and comprehensive investigation of all requests. Inspections are conducted regarding all requests received to the Unified Hotline in accordance with the local regulation that defines the procedure for addressing such requests.

The Unified Hotline is receiving proposals to improve anti-corruption procedures and other internal control procedures.

A person who has submitted relevant information is protected from any forms of pressure (including from dismissal, persecution, and any forms of discrimination). MTS PJSC maintains a non-retaliation policy and prohibits any form of adverse influence against the informers.

Press releases on the Unified Hotline operation are posted on the corporate MTS information portal on a quarterly basis to inform the MTS Group employees about the Unified Hotline operation results.

At the beginning of 2023, the responsibility for conducting inspections of the Unified Hotline messages containing information about violations of the Code of Business Conduct and Ethics was transferred to the Business Ethics & Compliance Department.

Number of Messages Received by the MTS Group Unified Hotline

MTS Group companies2021Share, %2022Share, %2023Share, %
RTC JSC53441%46251%43948%
MTS PJSC64750%30734%32435%
MGTS PJSC383%344%435%
MTS Digital LLC151%313%364%
MTS Bank PJSC131%172%182%
MTS Armenia CJSC141%152%111%
Mobile TeleSystems JLLC161%142%81%
Other181%273%394%
Total1,295100%907100%918100%

All situations of conflict of interest, violation of the provisions of the Code of Business Conduct and Ethics, risks of violation of anti-corruption legislation were settled in accordance with the Code of Business Conduct and Ethics, the Conflict of Interest Management Policy and the Anti-Corruption Law Compliance Policy approved by the Company, with the participation of the Business Ethics & Compliance Department.

The Company provides an independent and comprehensive investigation of all possible reports of violations. The MTS Discipline Committee operates on a constant basis in MTS that reviews cases of compliance requirements violations and other significant violations, ensuring the observance of the principles of legality, justice, uniformity, and reasonableness when making decisions on the application of disciplinary sanctions to employees, and develops corrective measures in support of sustainable management. Moreover, the Company has developed and uses compliance KPIs and compliance triggers that maintain the commitment of all employees to the business ethics and compliance standards.

The employees who committed violations of the Company’s internal regulations were informed of the necessity to remedy violations and prevent the repetition of similar situations in the future in accordance with the legislation.

“The Unified Hotline is an essential tool for promoting honest and ethical business, as well as preventing violations of the Code of Business Conduct and Ethics, in-house Company policies and procedures. This is an indicator of trust of employees and third parties who are ready to report violations in the Company and thereby contribute to their elimination.

Commitment to the principles of transparency will help us to develop and maintain an atmosphere of trust and comfortable working environment, where employees will perform their duties in good faith, without being afraid of getting involved in any unfavorable situation.”

Director for Internal Audit

Anti-Corruption Compliance

The MTS PJSC anti-corruption compliance program establishes measures to control regulatory risks, to protect the Company from any manifestations of corruption (both within the Company and attempts to involve the Company in corrupt activity from the outside), to enhance the corporate culture, introduce and develop the best corporate governance practices in the Company, as well as standards of responsible and ethical behavior.

Results of Independent Appraisal of the 2023 Compliance Culture Level

General results of the survey

Overall indicator of culture in the MTS Group in 2021

Overall indicator of culture in the MTS Group in 2022

91,5

Overall indicator of culture in the MTS Group in 2023

+ 2.5 points to the 2021 results in the MTS Group
+ 0.4 points to the 2022 results in the MTS Group

Survey results by each principle

Projects and Initiatives in the Development of the Anti-Corruption Compliance Program and Strengthening of the Compliance Culture in 2023

In 2023, a number of initiatives were implemented to enhance the compliance culture:

Most of the IT compliance solutions under development have the potential to be scaled to the MTS Group, which makes it possible to extend the beneficial automation effects to the entire MTS ecosystem.

Inside Compliance

MTS PJSC, as a company with its financial instruments traded on the Moscow Exchange, pays great attention to maintaining an efficient system of misuse of insider information and market manipulation.

The prevention system for breaches legislation on use of insider information that is built considering best Russian and international practices and based on the two underlying documents: Regulation on Principles and Procedures for Preventing Transactions using MTS Insider Information, Policy “On Countering the Misuse of Insider Information and Market Manipulation”, and “Conditions for Transactions with Financial Instruments of the MTS Group Companies by Individuals Specified in Clauses 7 and 13 of Article 4 of the Law on Insider Information1, who are included in the list of MTS insiders, and persons associated therewith”.

1 Federal Law dated 27.07.2010 No. 224-FZ “On Countering the Misuse of Insider Information and Market Manipulation and on Amending Certain Legislative Acts of the Russian Federation”.

MTS PJSC local regulatory acts define the procedure for using insider information, rules for protecting its confidentiality and control over compliance with the requirements of law on the use of insider information. Control procedures ensure fair price setting of financial instruments, protection of the rights and property interests of all MTS shareholders and equality of other investors in terms of the timing and volume of information received, strengthening investor confidence, and curbing abuse in the form of misuse of insider information and market manipulation.

The Company maintains a list of its insiders. It includes individuals and legal entities. Since 2014, the Company has operated a full-time education system for all insiders who are the Company’s employees. When hiring, each employee shall read the Company’s regulations aimed at preventing violations of insider laws. An interactive course dedicated to the basics of insider law shall be held for all employees of the Company.

Risks related to the violation of insider legislation shall be recorded in a specialized automated system and reassessed every six months.

Pursuant to the requirements of the Law on Insider Information, MTS approved Internal Control Rules to prevent, identify and suppress the misuse of insider information and/or market manipulation. The internal control rules establish the goals, objectives and methods of internal control over compliance by MTS with the requirements of the insider information law, the procedure and timing of disclosure of MTS insider information, the procedure for access to insider information and the rules for protecting its confidentiality. Control over MTS compliance with the requirements of insider information law is part of the official duties of the Vice President for Corporate and Legal Affairs of the MTS Group CC (Management Board Member), who is accountable to the President of MTS.

In order to maintain an efficient insider compliance program, the Company audits the program controls as necessary (using the risk-based approach) — by the internal audit unit headed by a person accountable to the Board of Directors.

Personal Data Processing Organization

In 2023, the Information Security Department continued its activities within the pre-defined areas — Customer-Oriented Approach (Customer Centricity), Continuous Involvement, Assistance to Product Teams, Simplicity and Speed, Interaction with Product Teams at All Stages of Product Life Cycle.

As part of adhering to the principles of transparency and accountability when processing personal data, as well as in order to comply with the adopted and planned amendments to the legislation of the Russian Federation in personal data and information security, the Company made corresponding changes to local regulations, including the documents subject to mandatory publication (MTS PJSC Personal Data Processing Policy). The information contained in the Register of Personal Data Processing Operators is kept up to date, and the issue of notifying the authorized body for the protection of the rights of personal data subjects about the cross-border transfer of personal data is subject to special control.

Risks associated with violation of the legislation on personal data are taken into account in the Company’s risk management system and are reassessed on a regular basis.

In order to increase the level of awareness of the Company’s employees on the issues of organizing the 2023 personal data processing and data privacy, MTS PJSC conducted training for more than 36,000 Company’s employees.

Antitrust Compliance

In 2023, the Company went on providing continuous antitrust training in MTS PJSC and its subsidiaries. The Company also finalized the methodology for antitrust risk assessment considering the likelihood and features of the risk portfolio in subsidiaries.

Due to the entry into force of the “fifth antitrust package”, an audit of risks and controls was conducted to verify compliance of the group activities with the regulation changes; procedures and training materials were adapted.

Occupational Health and Safety Management System1

1 The section “Our Employees” contains detailed information on the program.

The Company operates a two-tier H & S management system focused on creating a safe working environment, prevention of occupational injuries and personnel training in occupational safety rules.

In 2023, as part of the compliance program, the following activities were carried out:

The costs of organizing occupational safety measures increase annually due to the expansion of the staff and the list of implemented measures.

Human Rights at the Workplace1

1 Detailed information is set out in the ESG and Sustainable Development section, as well as in the MTS Sustainable Development Report for 2023 at: Sustainable Development Report — Moscow (mts.ru)

MTS recognizes that a person, his life and health are the highest value. MTS services assist to provide equal opportunities for education, development, and self-realization of each stakeholder, regardless of individual features and needs.

MTS accepts no discrimination in any form or manifestation, it creates an inclusive and diverse environment and adheres to the best global practices in the field of DEI (diversity, equity, and inclusion).

Therefore, in 2023:

In 2023, the MTS Group Unified Hotline received 193 messages containing the signs of violation of the Code of Business Conduct and Ethics. However, only six messages were in regard of discrimination and observance of human rights. Inspections were carried out in relation to these messages, and following their results, information about the facts of discrimination was confirmed in three cases only. Required corrective measures were taken for the cases detected.

Risks in inclusive culture and observance of human rights are regularly digitized according to the recommendations following the external annual audit of compliance programs and assessment of compliance risks at the level of business processes.

MTS adopted local regulations governing the main issues of observance of human rights regarding diversity, equity, and inclusion. The documents consolidate key principles of respect for human rights and conduct of the Company’s employees.

Environment1

2 Detailed information about the Company’s approaches to managing its own environmental impact is provided in the “Caring for the Environment” section of this report, as well as in the MTS Group Report on Sustainable Development for 2023.

The MTS approach is based on efficient management of regulatory environmental and climate risks. In 2023, the Company went on implementing the program to ensure environmental safety at MTS facilities, strategic projects on environmental responsibility targeted at the widespread introduction of circular economy principles into the MTS Group business processes. ESG Strategy of the MTS Group was approved.

Employees are regularly notified about legal requirements in environmental protection on the MTS Blog platform.

Combating the Legalization (Laundering) of Criminal Proceeds, Financing of Terrorism and Financing Dissemination of Weapons of Mass Destruction (CLCP/FT/FSWMD)

The CLCP/FT/FSWMD program has been developed pursuant to the requirements of the applicable law, which changes are monitored on a regular basis. The Center for Comprehensive Security Development conducts a daily audit of all MTS subscribers to check whether some of the subscribers are included in the list of Rosfinmonitoring. When the Company’s subscribers carry out high-risk transactions on personal accounts, an additional check is initiated against the database of invalid passports. The Company also daily monitors termination of contracts for the provision of communication services with the return of the balance of the advance, as well as other transactions of subscribers.

In 2023, the Company:

Intellectual Property Risk Management System

In 2023, the compliance program “Intellectual Property Risk Management System” successfully confirmed compliance with the new standard “Compliance Management Systems” (ISO 37301:2021, formerly ISO 19600:2014) and continued its development.

In order to manage the risks associated with intellectual property, changes were made to internal documents that optimize the processes in terms of concluding contracts with intellectual property items and checking the rights of the counterparty to intellectual property items.

In order to minimize the risks in terms of violating the rights of third parties and protecting the trademarks, a unique “Trademark Lifecycle Management” project was implemented using an automated program. This project allowed not only to improve the Company processes, but also became the winner of IP Russia Awards 2023, Russian award in intellectual property, in the nomination of “Automation of Handling IP Items”.

An automated service for issuing service tasks and reports on creating utility software was launched to manage the risks in terms of creating utility Programs for computers.

In 2023, more than 44,000 MTS Group employees passed the updated mandatory remote training course “Rules for Using Intellectual Property”.

Also, the Company held training events on the issues of risks in procurement and conclusion of contracts in intellectual property, use and protection of creative content, a webinar dedicated to the International Intellectual Property Day.

Compliance Training for the MTS PJSC Board of Directors Members

In 2023, trainings on the anti-corruption compliance system were conducted for the MTS PJSC Board of Directors members, the Management Board and the Board of Directors Committees’ members. The training was attended by 100% of the Board of Directors members, the Management Board and the Board of Directors committees’ members.

Complex Security System

In 2023, activities to ensure the corporate security and access control were conducted in accordance with the Functional Strategy of MTS PJSC in Ensuring Complex Security for 2023 and the Action Plan for Ensuring Integrated Security of MTS PJSC for 2023.

Within the implementation of the requirements of Federal Law No. 115-FZ dated August 07, 2001, “On Combating the Legalization (Laundering) of Criminal Proceeds and Financing of Terrorism”, the Security Block employees set up and are operating a system for detecting and blocking personal accounts registered in the names of persons on the List of Terrorists/Extremists. Dozens of such personal accounts are detected and blocked weekly.

Information Security

The architecture of the corporate information security system was developed considering the best global practices, based on national and applicable international standards. The continuity of functioning of all corporate processes and information security tools is provided. The level of maturity of the information security management and assurance system guarantees sustainable operation and development of the business and product ecosystem, as well as the achievement of the MTS Group strategic goals.

In 2023, the MTS PJSC information security management system was certified for compliance with ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements. An international certification body issued the certificate.

The processes for designing secure architecture and ensuring security during software production (Secure Software Development Lifecycle) were introduced and improved. Product teams are provided with services for designing the architecture of information security tools, developing information security requirements, calculating the costs of information security measures, assessing the compliance of digital products with corporate software security requirements, analyzing the source code and app builds. Software products with information security requirements is monitored for compliance at all stages of manufacturing ecosystem digital products and integration of the assets acquired into the ecosystem.

In 2023, the policy of import substitution of information security equipment from unfriendly countries was further implemented. Tenders for procurement of software and hardware, as well as reengineering of the corporate architecture of the critical information infrastructure protection system, were conducted.

A project to upgrade the system for preventing loss of restricted access information (Data Loss Prevention, DLP) was implemented, a system of protection against targeted attacks on corporate resources, Anti-APT and a system for automatically responding to information security incidents were introduced. Protection of internal information infrastructure from DDoS attacks has been implemented on the corporate service introduced in 2023. The process of replacing the internal SIEM with a Russian solution was launched.

Compliance with licensing requirements regarding the operation of CIPF, technical protection of confidential information and monitoring of the state of information security of information technology tools and systems was ensured. There were no comments from regulatory authorities.

In 2023, 26.5 million incidents of information security were recorded and addressed successfully

Conflict of Interest Management

The Policy “Conflict of Interest Management”, as well as the reminder on the conflict of interest management in the Company are posted on the MTS external website, the corporate portal, and also in the My MTS mobile application. When being hired, all employees familiarize themselves with this Policy, shall fill in the form “Disclosure of Information about the Conflict of Interests”. A survey is conducted twice a year for members of MTS PJSC management bodies. During 2023, information in regard of 661 situations was inspected to identify the presence of the conflict of interest. 334 situations were resolved, 327 situations — the conflicts were not confirmed.

SORM (Law Enforcement Support System)

In order to ensure the failure-proof operation of special complexes installed on MTS PJSC network, actions were organized and held on a permanent basis to maintain and support the equipment and software.

Special complexes were installed on the MTS PJSC communication networks, the presence of which makes it possible to provide communication services using 2G/3G/4G/5G, IMS (VoLTE, Wi-Fi Calling, “My Connect”), eSIM, RCS, NB IoT technologies, M2M, Wi-Fi, BBA, as well as convergent services (“Virtual PBX”) and MVNO services (“Tinkoff Mobile”). Work on the modernization of the special equipment supporting the activities of authorized state bodies was carried out on a scheduled basis, in accordance with the approved investment program and the requirements of L&R (laws and regulations). Scheduled events were held in full.

Economic Security and Anti-Corruption

Primary attention was paid to mitigating financial and economic risks and preventing material damage to the Company. In 2023, 95 internal inspections/official investigations were carried out, more than 10.8 thousand procurement procedures were reviewed, more than 60 thousand inspections of counterparties, as well as inspections of 56 thousand candidates and employees of the MTS Group, were carried out. By year-end, the economic effect from the activities of the Anti-Corruption and Economic Security Department, including reimbursed and prevented damage, amounted to RUB 3.1 billion. HR issues were addressed systematically. Within the performance of its principal functions and powers, the counterparty verification system was improved further:

Business processes for monitoring procurement were supplemented with two new functions — approval of simplified procurement to solve urgent and/or priority tasks and monthly procurement monitoring for subsidiaries and affiliates within the MTS Group.

Security of Personnel and Facilities

The anti-terrorist protection and facility security was provided in accordance with the MTS Group Strategy for the integrated security assurance for 2022–2023.

In 2023, fire-fighting and anti-terrorist training were conducted on a regular basis. In order to increase the level of anti-terrorist security, persons who are admitted to critical information infrastructure facilities are checked.

During the preparation and holding of significant socio-political events and public holidays, enhanced measures were taken to protect the Company’s facilities, ensure intra-facility and access control. No incidents and violations at facilities.

In order to fulfill the requirements of the Decree of the Government of the Russian Federation dated June 08, 2023, No. 944 “On Approval of Requirements for Anti-Terrorist Protection of Objects (Territories) of the Ministry for Digital Development, Communications and Mass Media of the Russian Federation, the Federal Service for Supervision of Communications, Information Technology, and Mass Media and Its Territorial Bodies, as well as Subordinate Entities and Entities Related to Their Area of Activity”, systematic work to categorize and certify the MTS PJSC facilities was carried out.

Antifraud

Within the implementation of the Decrees of the Government of the Russian Federation dated November 03, 2022, No. 1978 and No. 1979, the Antifraud Department carried out work to connect to the Unified Call Verification System, the operator of which is GRChTS, in accordance with current technical conditions, verification is performed in real time with all participants connected to the System. In 2023, the verification node of MTS PJSC blocked 146.7 million calls.

In 2023, 2.6 million facts of fraud were detected; the amount of prevented losses was RUB 763.38 million. In 2023, 93.2 billion calls were processed by antifraud systems on the MTS PJSC network, of which 2.9 billion were blocked.

Regional Management

In 2023, regional security units continuously ensured the implementation of measures in terms of security of personnel and facilities, information and economic security in accordance with the approved plans to ensure comprehensive security of MTS PJSC in the corresponding branch.

In order to comply with the Legislation of the Russian Federation, MTS PJSC duly organized and carries out interaction with law enforcement agencies, courts, and supervisory authorities.

In order to ensure the Company’s assets safety, as well as considering the current geopolitical situation and the position of vendors regarding equipment supply to the territory of the Russian Federation, regional security services monitor the safety and return of MTS PJSC equipment dismantled by contractors on a regular basis. In 2023, 8.7 thousand equipment items worth RUB 436 million were returned under the supervision of security workers in the regions, it is planned to reuse 3.9 thousand equipment items from this equipment worth RUB 153 million, the rest of the equipment will be partially used as spare parts, tools and accessories.

In order to identify and prevent economic risks for MTS PJSC, employees of the security unit centrally inspected in 2023 the reliability of 16 thousand new counterparties, with which MTS PJSC entered into agreements within its operating activities, as well as 40 thousand counterparties under existing agreements.

Responsible Supply Chain

The Company’s purchases are carried out in accordance with the MTS Procurement Rules developed in accordance with the legal requirements. The MTS PJSC Counterparty Code of Business Conduct contains recommended standards, compliance with which is expected from counterparties, and applies in all subsidiaries and affiliates of MTS PJSC. In addition to good faith and honesty, the Code notes the importance of compliance by vendors with environmental laws and human rights. Equal access to procurement procedures is ensured by the establishment of equal competitive opportunities and uniform rules for all participants of the procurement procedure prior to its implementation.

In 2023, procedures aimed at increasing the transparency of procurement activities were maintained, namely:

Capabilities of the 3Click Independent Procurement system, where the MTS Group employees may independently carry out a small purchase with a digital footprint, but with a simplified design, were expanded. In 2023, the 3Click system became available to some of the MTS Group subsidiaries.

Increasing the Transparency of Procurement Procedures

In order to comply with the requirements of applicable anti-corruption legislation, a risk-based approach is used to conduct an anti-corruption audit of counterparties and third parties. The procedure suggests the involvement of employees of procurement departments and business customers at the stage of the procurement procedure or the conclusion of the contract and the provision of relevant information about the counterparty and the third parties involved thereby to the economic security unit to verify their reliability.

In 2023, mandatory anti-corruption training of counterparties was held, as well as compliance verification of sub-counterparties.

100%

The Company makes 100% of purchasing procedure in electronic form1

1 MTS purchasing procedures are made in electronic form through the EDM module (electronic document management) of the Oracle Sourcing IT system (among contractors who have the relevant IT systems).