1.2. Identification and assessment of mineral supply chain risks

The first step in mineral supplier due diligence is identifying risk indicators in the mineral supply chain. These indicators highlight potential risks associated with mineral extraction, transportation, and production. If the first step identifies risk indicators, the Company conducts enhanced due diligence of the supplier to identify and confirm risks (if any). If the risk is confirmed, the Company assesses its exposure and cooperates with the supplier to develop risk mitigants. Once these have been implemented, the Company decides whether to continue working with the supplier.

Each step of due diligence relies on the specifically designed tools described below.

Identification of risk indicators in the mineral supply chain

Under the System, the key risk indicator relates to minerals originating from or being transported via a CAHRA area, those originating from a country that has limited known mineral reserves, as well as counterparties being financially or legally connected to supplies from a CAHRA area. The supplier’s failure to formally accept the Code, or a set of submitted documents that does not allow for an assessment of the supplier’s compliance with the Code, are also considered risk indicators.

To identify risk indicators, Nornickel first identifies suppliers, the minerals supplied, and all the elements of the supply chain, and then assesses compliance with the Code.

To identify risk indicators, the Group uses the following tools:

• Know Your Supplier Questionnaire;
• Supplier Code of Conduct Compliance Questionnaire;
• Supply Chain Mapping Questionnaire;
• CAHRA Assessment Tool.

Know Your Supplier Questionnaire

To identify risk indicators, Nornickel distributes Know Your Supplier Questionnaires among its suppliers. In addition to collecting up‑to‑date information about the owners of mineral suppliers, the Know Your Supplier Questionnaire covers the following:

• Nature of the counterparty’s core business and geography;
• Minerals supplied;
• Applicable licences (if any);
• Key sub‑suppliers;
• Supply chain management approach.

Supplier Code of Conduct Compliance Questionnaire

As part of mineral supplier due diligence, Nornickel also assesses how well they comply with Nornickel’s Code based on the completed Supplier Code of Conduct Compliance Questionnaire and a package of supporting documents confirming the degree of compliance.

The form is structured to incorporate the Code’s requirements and determine the current status of the supplier’s ESG practices, including as regards responsible supply chains. Based on the completed questionnaires, Nornickel gains a better understanding of its supply chain and helps promote ESG practices among suppliers.

Supply Chain Mapping Questionnaire

This tool is a form used to provide more details on the mineral supply chain, specifically the Group’s direct suppliers and sub‑suppliers. The form shows the existing mineral supply chain for the specific division entity with details on material sources broken down by supplier. The data collected through this Questionnaire help establish the number of suppliers, whether they are part of the Group, the type, volume, and origin of minerals delivered in the selected period, as well as potential supplier risks under the OECD Guidance.

The Questionnaire enables Nornickel to map the mineral supply chain in a holistic way and to identify inherent potential risks.

CAHRA Assessment Tool

The CAHRA Assessment Tool reviews more than 150 countries for corrupt practices, money laundering, political instability or repression, institutional weakness, insecurity, collapse of civil infrastructure, widespread violence, human rights violations, and violations of national or international law. The tool uses 12 indices and indicators (including those recommended by the RMI) to determine whether a country is on the CAHRA list.

Assessment of mineral supply chain risks

If risk indicators are identified, the Company performs enhanced risk‑based due diligence on the supplier.

Nornickel’s internal mineral supplier due diligence standards, developed in line with the OECD Guidance, determine the following potential risks that may arise in the supply chain:

• Serious human rights violations, including cruel, inhuman, or degrading treatment, any forms of torture and forced labour, the worst forms of child labour, other gross human rights violations, war crimes or other serious violations of international humanitarian law, crimes against humanity, or genocide;
• Direct or indirect support to non‑state armed groups;
• Direct or indirect support to security forces who illegally control, tax, or extort money or minerals at points of access to mine sites, along transportation routes, or at points where minerals are traded, as well as in favour of second‑ and higher tier mineral suppliers relative to Nornickel;
• Bribery and fraudulent misrepresentation of the origin of minerals;
• Money laundering;
• Non‑payment of taxes, fees, and royalties to governments.

If a risk is identified and confirmed, the Company assesses its exposure and cooperates with the supplier to develop a risk mitigation plan. In some cases, if a confirmed risk is deemed unacceptable to the Group, the relationship with the supplier may be reconsidered.

Nornickel also conducts monitoring of those suppliers that were subject to an enhanced due diligence (due to risk indicators identified previously). This monitoring procedure includes gathering data on the suppliers’ operations and conducting on‑site audits (if necessary), including where minerals are actually mined, transported, and processed.

To perform enhanced due diligence, Nornickel has designed dedicated tools and procedures based on industry best practices and considering their applicability in the Russian Federation:

• Supplier Risk Assessment Tool;
• Gathering information from public sources;
• Third‑party verifications and audits commissioned by the Company.

Supplier Risk Assessment Tool

An enhanced due diligence includes assessing the supplier for risk exposure (if any) and the level of risks. The System’s risk‑based approach relies on the risks identified under the OECD Guidance.

This assessment is conducted using a supply chain risk assessment tool, which contains a list of risks and corresponding assessment criteria used to determine the level of risk exposure. This procedure enables the Company to develop and implement the respective risk mitigants.

Gathering information from public sources

To obtain more detailed information about suppliers, the Company gathers and analyses data on their operations from public sources. To this end, the Company additionally studies audit reports and reports from public organisations and government agencies relating to suppliers’ operations, as well as industry publications, news articles, and information from counterparties. In addition to reviewing documentary evidence, the Company also engages with representatives of local communities and organisations.

Independent verification of suppliers

Nornickel may initiate independent verification involving third‑parties to gain insight into how its suppliers actually mine, transport, process, and export minerals. Such audits seek to identify and assess adverse consequences arising from both potential and actual risks.

Risk assessment frequency

Given the changing geopolitical landscape and the need to update its counterparty requirements in a timely manner, the Group conducts mineral supplier risk assessments, including checks on whether an area is on the CAHRA list, on an annual basis or whenever material changes occur in the supply chain.

Divisions are responsible for producing internal reports on mineral supply chain due diligence, including performance assessment and risk management results. The Sustainable Development Department at Nornickel’s Head Office produces Group‑level due diligence and monitoring reports.

Supplier due diligence in 2024

Nornickel’s mineral supply chain due diligence involves assessing any and all suppliers, whether internal or external External suppliers are those that are not part of the Group. . The key distinctive feature of the Company’s mineral supply chain is that most of its mineral suppliers are internal (part of the Group).

In 2024, due diligence checks were conducted on 12 mineral suppliers The Trans‑Baikal Division entity did not conduct due diligence, as it has no mineral suppliers. of entities at the Polar Division’s Norilsk and Kola sites, including four external suppliers. Among the external suppliers, two that underwent assessment were transportation service providers, one was a mining company, and one was engaged in processing (crushing) operations.