Anti-Bribery and Conflict of Interest Policy

• To establish FVR's anti-bribery and conflict-of-interest policy: which conducts it rejects, whom it binds — personnel, contractors, auditors, evaluators, committee members, shareholders and suppliers with access — and in which jurisdictions it applies. The policy itself is stated in §3.

• Internal personnel, contractors, internal auditors, subcontracted external auditors, evaluators, committee members, suppliers with access, shareholders. Applies in all jurisdictions where FVR operates.

• FVR rejects all forms of bribery, extortion and undue payment, and prevents and manages conflicts of interest in its activities.

• FVR undertakes to:
• 1. Tolerate no act of bribery, active or passive, direct or through an intermediary, regardless of its value or of market custom.
• 2. Keep the whistleblowing channel open and free of retaliation against anyone reporting in good faith, even where the report proves unfounded.
• 3. Declare conflicts of interest before each assignment, not afterwards: whoever has a relationship with the client declares it before accepting the work.
• 4. Reject or return any gift above the threshold set in §10 of this policy, and any hospitality not permitted there, leaving a record.
• 5. Investigate every report through someone independent of those involved, and document the conclusion even where it is one of no merit.
• 6. Submit to the Impartiality Committee any financial, ownership or family relationship with a client or candidate, in either service line.
• 7. Not condition the outcome of an audit, an examination, a finding or a certification decision on a payment, a commercial arrangement or a personal relationship.

• 1. Accept money, gifts, travel, hospitality, employment offers or any benefit exceeding symbolic value (USD 50 per gift).
• 2. Offer bribes or facilitation payments to public or private officials.
• 3. Accept commissions from consultants or suppliers.
• 4. Solicit preferential treatment for family or related parties.
• 5. Make political donations on behalf of FVR.
• 6. Accept sponsorships from clients for private personnel events.

• Executive Management — approves this policy and answers for there being budget and time to investigate a report. Stands aside when the report concerns them.
• Impartiality Safeguard Committee — assesses the relationships declared and decides the safeguards; authorises the exceptions §10 admits. It investigates reports concerning the General Director.
• Quality Manager (RC) — holds the conflict of interest declarations and the gift register, and verifies they are complete before each cycle.
• All personnel, internal and external — declare their conflict of interest before each assignment and report any offer received. This includes contracted auditors, examiners and evaluators, who sign the same obligation.
• Whoever investigates — is independent of those involved and documents the conclusion, whether or not the report has merit.

• The threats this policy prevents are identified in the management system risk register: 37 threats to impartiality — financial or ownership self-interest, self-review from prior consultancy, familiarity, intimidation — and 29 financial risks, among them dependence on a single client, which can turn into pressure on a decision.
• · Each threat has its safeguard and its owner in the register.
• · A report received is treated as a materialised risk: it opens a corrective action and the safeguard that failed is reviewed.
• · The associated opportunity is the trust of the market and of the accreditation body, which is supported by the formal recording and treatment of these cases.

• Mandatory:
• - Upon entry (FVR_IM-FO-03)
• - Every 3 years as renewal of the general declaration (FVR_IM-PR-01 §5)
• - Every four months, through a separate declaration of services rendered on the fixed cycle of 1 January, 1 May and 1 September; the ERP opens each cycle, sends the personal link, issues reminders and escalates overdue declarations
• - Before each assigned activity (event-specific mechanism)
• - Upon any change of circumstance (new family employment, investment, etc.)

• - Channel: the confidential email support@fidesveritasregister.com, the body's official mailbox (FVR_GD-POL-06 §16), or the report form on the website www.fidesveritasregister.com; subject «DENUNCIA», the same way complaints are marked «QUEJA». support@fvr.mx, where the report form on www.fvr.mx delivers, also receives reports. The channel is open to personnel, contractors, auditors, evaluators, committee members, clients, candidates and third parties. A report may be anonymous: the reporter's email is optional on the form. The form delivers the report to support@fidesveritasregister.com with the subject «DENUNCIA» and copies no one else; a reporter who leaves an email receives an acknowledgement that does not repeat what was reported, and an anonymous report receives no acknowledgement. The website does not store reports in a database of its own; the email delivery provider keeps a copy of the messages sent.
• - Confidentiality: the identity of the reporter, when given, is known only to whoever attends the mailbox and to whoever investigates; it is not written into the file.
• - Whistleblower protection: no labor or legal retaliation against anyone reporting in good faith, even where the report proves unfounded (§4, commitment 2 / compromiso 2).
• - Who investigates: the Impartiality Safeguard Committee (FVR_IM-PR-02), convened in extraordinary session (FVR_IM-PR-02 §4.4); whoever is implicated stands aside (§6).
• - File: every report opens a nonconformity in the ERP corrective-actions module with origin «Other» and the note «report», the same path as information-security incidents (FVR_IM-WI-01). A report sent through a website form opens it automatically, with the text of the report and never the reporter's email or IP, with the Technical Director as owner and an action due 30 calendar days after receipt (§11), notified only to the Technical Director; a report received by direct email is opened by whoever attends the mailbox. The nonconformity is visible to those who manage the management system; the nonconformity is recorded there (FVR_MC-PR-02 §5.1), its root cause is analysed (FVR_MC-PR-02 §5.3) and the action is closed with evidence (FVR_MC-PR-02 §5.8) and the report is treated as a materialised risk (§7).

• Gift > USD 50 — Reject or register + return
• Reasonable working meal paid by client — No formal registration required
• Travel paid by client — Only if Safeguard Committee approves and professional reason is documented
• Performance bonus — Only from CB, never from client

• Deadline: every report is investigated within 30 calendar days of receipt; the 30 days are entered as the committed date of the corrective action opened under §9, and the ERP sends an automated reminder of that date to the responsible person.
• Who: the Impartiality Safeguard Committee, through someone independent of those involved (§6).
• Conclusion: documented in the same nonconformity whether or not the report has merit; the results are presented to the Committee, the General Director and the Technical Director in a committee session with signed minutes; the General Director abstains when the report concerns them (§6).
• Consequences: disciplinary and/or legal actions according to severity, decided outside the ERP and attached as closing evidence of the action; the safeguard that failed is reviewed in the risk register (§7).

Approvals / Aprobaciones