1.2. Identification and assessment of mineral supply chain risks

The process of identifying mineral supply chain risks includes several steps.

The first step of mineral suppliers due diligence focuses on identifying risk indicators in the mineral supply chain. Risk indicators show potential risks associated with mineral extraction, transportation and production. If the first step identifies risk indicators, the Company carries out enhanced due diligence of the supplier to identify and confirm risks (if any). If the risk is confirmed, the Company assesses its exposure and cooperates with the supplier to develop risk mitigants, following which it makes a final decision whether to cooperate with the respective counterparty going forward.

Each step of due diligence relies on the specifically designed tools explained below.

Identification of risk indicators in the mineral supply chain

Under the System, the key risk indicator relates to minerals originating from or being transported via a CAHRA area, those originating from a country that has limited known reserves, as well as counterparties being financially or legally connected to supplies from a CAHRA area. The supplier’s failure to formally confirm its consent to the Code or a set of submitted documents that does not allow assessing supplier’s compliance with the Code are also considered risk indicators.

To identify risk indicators, Nornickel first identifies suppliers and minerals supplied, and all the elements of the supply chain. To this end, the supplier fills out a questionnaire describing its supply chain. Such questionnaire is a separate tool used to map mineral supply chains and get an insight into the supplier’s interactions with sub‑suppliers (second and higher tier suppliers relative to Nornickel). The data is then analysed by the relevant departments of the Company’s Head Office and divisions, followed by supplier assessment.

To identify risk indicators, the Group uses the following tools compliant with the best industry practices:

• Know Your Supplier Questionnaire;
• Supplier Code of Conduct Compliance Questionnaire;
• Supply Chain Mapping Questionnaire;
• CAHRA Assessment Tool.

Know Your Supplier Questionnaire

To identify risk indicators early in the game, the Company distributes Know Your Supplier Questionnaires among its suppliers.

In addition to up‑to‑date information about mineral suppliers’ owners, the Know Your Supplier Questionnaire includes the following:

• nature of the counterpart's core business and geography;
• minerals supplied;
• applicable licences (if any);
• key sub‑suppliers;
• supply chain management approach and the maturity of relevant practices.

Supplier Code of Conduct Compliance Questionnaire

As part of mineral suppliers due diligence, Nornickel also assesses how well they comply with Nornickel’s Code based on the completed Supplier Code of Conduct Compliance Questionnaire and the supporting documents confirming the degree of compliance.

The form is structured to factor in the Code’s requirements and determine the current status of the supplier’s ESG practices, including as regards responsible supply chains. Upon review of questionnaires, Nornickel gains a better understanding of its supply chain and develops its suppliers’ ESG practices.

Supply Chain Mapping Questionnaire

This tool is a form to be filled out to provide more details on the mineral supply chain, specifically the Group’s direct suppliers and sub‑suppliers. The form shows the existing mineral supply chain for the specific division with details on material sources broken down by supplier. The data sourced from this Questionnaire helps establish the number of suppliers, whether they are part of the Group, the type, volume and origin of minerals delivered in the selected period, as well as potential supplier risks under the OECD Guidance.

The Questionnaire enables Nornickel to map the mineral supply chain in a holistic way and to identify inherent potential risks.

CAHRA Assessment Tool

The CAHRA Assessment Tool reviews more than 150 countries for corrupt practices, money laundering, political instability or repression, institutional weakness, insecurity, collapse of civil infrastructure, widespread violence, human rights violations and violations of national or international law. To determine whether a country is on the CAHRA list, this tool relies on the following sources:

• 10 indices and metrics recommended by the RMI;
• CAHRAs under Section 1502 of the Dodd–Frank Act (US);
• CAHRAs under Regulation (EU) 2017/821.

Assessment of mineral supply chain risks

If risk indicators are identified, the Company performs enhanced risk‑based due diligence of the supplier.

The OECD Guidance determines the following potential risks that may arise in the supply chain:

• serious human rights violations, including cruel, inhuman or degrading treatment, any forms of torture and forced labour, the worst forms of child labour, other gross human rights violations, war crimes or other serious violations of international humanitarian law, crimes against humanity or genocide;
• direct or indirect support to non‑state armed groups;
• direct or indirect support to public or private security forces who illegally control, tax or extort money or mineralsAt points of access to mine sites, along transportation routes or at points where minerals are traded, as well as in favour of second and higher tier suppliers relative to Nornickel. ;
• bribery and fraudulent misrepresentation of the origin of minerals;
• money laundering;
• non‑payment of taxes, fees and royalties to governments.

If the risk is identified and confirmed, the Company assesses its exposure and cooperates with the supplier to develop a risk management plan. In some cases where a risk unacceptable to the Group is confirmed, the Company may terminate its relationship with the respective supplier going forward.

The Company also conducts monitoring of those suppliers that were subject to an enhanced due diligence (due to risk indicators identified previously). This monitoring procedure includes gathering data on suppliers’ operations and conducting on‑site audits (if necessary), including where minerals are actually mined, transported and processed.

To perform enhanced due diligence, Nornickel designed special tools and procedures based on the best industry practices considering their applicability in the Russian Federation:

• Supplier Risk Assessment Tool;
• gathering information from public sources;
• third‑party verifications and audits ordered by the Company.

Supplier Risk Assessment Tool

An enhanced due diligence includes assessing the supplier for risk exposure (if any) and the level of risks. The System relies on a risk‑based approach to the risks identified under the OECD Guidance.

To this end, the Company uses a supply chain risk assessment tool, which contains the list of risks and the criteria to assess the same with a view to determining the risk exposure. This procedure enables the Company to develop and implement the respective risk mitigants.

Gathering information from public sources

To obtain more details on suppliers, the Company procures to gather and analyse data on suppliers’ operations from public sources. To this end, the Company follows up on audit reports and reports from public organisations and government agencies relating to suppliers’ operations, as well as industry publications, news articles, and information from counterparties. In addition to documentary evidence, the Company also liaises with representatives of local communities and organisations.

Independent verification of suppliers

Nornickel may initiate independent verification involving third‑parties to get an insight into how its suppliers actually mine, transport, process, and export minerals. Such audits seek to identify and assess adverse consequences should the risks occur either potentially or actually.

Risk assessment frequency

Given the changing geopolitical landscape and the need to update its counterparty requirements in a timely manner, the Group performs mineral supplier risk assessment, including whether an area is on the CAHRA list, on an annual basis or sooner in case of material changes in the supply chain.

Divisions are responsible for producing internal reports on mineral supply chain due diligence, including performance assessment and risk management results. The Sustainable Development Department at Nornickel’s Head Office produces Group level due diligence and monitoring reports.

Suppliers due diligence in 2023

The Company’s mineral supply chain due diligence involves assessing any and all suppliers, whether internal or externalExternal suppliers are those that are not part of the Group.. The key distinctive feature of the Company’s mineral supply chain is that most of its mineral suppliers are internal (part of the Group).

In 2023, Nornickel conducted due diligence on eleven mineral suppliersNo due diligence took place at GRK Bystrinskoye LLC as it does not have any mineral suppliers., including three external ones.

In 2023, mineral suppliers due diligence identified no risk indicators or risks.