CODE OF ETHICS AND CONDUCT

CODE OF ETHICS AND CONDUCT

Among the important innovations taking place in the Cepsa, the Executive Committee has approved a change to the Code of Ethics and Conduct, which has been in force since November 2012. The Cepsa has always been firmly committed to ethical behaviour in all the areas in which it operates. This commitment is set out in our Code of Ethics and Conduct, which clearly defines the most significant guidelines and conducts that govern everything that we do. By following this Code of Ethics at all times, we are all able to strengthen our identity as an upstanding company that is responsible to society. We are all committed to ensuring that our behaviour reflects the values and principles contained in this Code of Ethics and Conduct, thereby becoming an example of corporate ethics. This Code of Ethics and Conduct is ranked at the highest regulatory level, and it is hereinafter the general framework within the Cepsa that must apply to all our duties and responsibilities. To encourage its dissemination and understanding, this brochure contains all the most important aspects of this. This document also contains basic information on the new Internal Procedure for Management, Investigation and Response to Incidents and Reporting Irregularities relating to the Cepsa Code of Ethics and Conduct. We urge you take the time to read both documents carefully and expect your commitment to the behavioural guidelines it contains. 2

You are also reminded that the Ethics Channel in the Corporate Governance section of www.cepsa.com allows confidential communication about irregular, contrary behaviours to the rules of conduct contained in the Code of Ethics and Conduct that you consider necessary, as well as updating the code. Remember that we all have a duty to use this method to ensure compliance with the Code. I firmly believe that this change to the Code of Ethics and Conduct will help us to make the Cepsa even more committed and responsible to the society where we operate. Kind regards, Pedro Miró Vice-President & CEO 3

The Code of Ethics and Conduct, which sets out the values, principles and norms of conduct that govern the Cepsa s activities, has been in effect since October 2012. Along this code, an Ethics Committee and Ethics Channel were created in www.cepsa.com in order to ensure the correct application of the Code. You can find this Ethics Channel and Code at the Corporate Governance section of www.cepsa.com.

1 The Cepsa Code of Ethics and Conduct Purpose is to establish the values and principles that govern the actions of the Cepsa. This Code also establishes general standards of conduct that all persons affected 1 by the Code must follow when fulfilling their responsibilities, whatever their role, job or geographic location. Together with the Code, in force since October 2012, an Ethics Committee and an Ethics Channel have been created for communicating incidents and filing complaints in strict confidence, so that employees can meet ethics standards and inform the Cepsa of any practices that do not conform to the provisions of this Code. This Ethics Channel is open to Affected Persons and persons outside the Group. [1] We understand Affected Persons to mean all directors, managers and employees of the Cepsa, as well as other people whose activity is expressly subject to the Code of Ethics and Conduct. 5

With the Code we reinforce the commitment Cepsa professionals have always had to doing our work ethically and responsibly. The Code enjoys maximum statutory effect and is integrated within the guidelines and corporate governance policies of our organization.

1.1 Why is it important? With the Code of Ethics and Conduct we reinforce Cepsa s commitment to ethical behavior in each one of our areas of action. We value the way we work and relate to our stakeholders, reinforcing the commitment all Cepsa professionals have always had to doing our job responsibly. With this, we: Achieve the quality of the goods and services we provide to our customers. Create value and safeguard the interests of IPIC, our shareholder. Pay attention to the needs of our professionals to conduct our business properly. Align all our actions with the Group s mission, vision and values. Establish a framework of trust and cooperation with our suppliers. Improve the welfare of society and, in particular, the communities in which we operate. Promote maximum respect for the environment, minimal environmental impact and the highest standards of safety. 7

1.2 Vision and Mission The Code is guided and inspired by Cepsa s Vision and Mission, articulated as follows: VISION: To be a global energy company of choice. MISSION: To provide the energy that every reality needs. 8

1.3 Ethical values and principles The Code is based on the fundamental precepts contained in the Universal Declaration of Human Rightsand the Conventions of the International Labour Organization. Furthermore, the Cepsa s Codeof Ethics shares the guiding principles of the Organization for Economic Cooperation and Developmentand the fundamentals of the Global Compact of the United Nations. The ethical values set out in thecode are: SAFETY: Safety is the cornerstone of our activities; we make an unwavering commitment to protect the people we deal with on a daily basis our employees, business partners, contractors, suppliers, distributors, customers and neighbors and to ensure the operational integrity and reliability of our facilities and processes; we aim to meet the highest standards of operational excellence and best practices, relying on prevention as the key to eliminating risks and hazards and promoting a safety culture throughout our organization and beyond. Our commitment to safety means: Protecting the health and well-being of people. Safeguarding our worksites and processes. Placing a premium on excellence in everything we do, and doing whatever we can to keep our operations hazard and risk-free. Applying preventative measures and strategies as the preferred tool for achieving our target of zero incidents and injuries. Promoting safety as a value that transcends our business activities and defines who we are and what we stand for. 9

SUSTAINABILITY: We seek to contribute to economic prosperity through the long-term sustainable growth of our businesses in a way that is socially and environmentally responsible; we respect and care for the environment and the welfare of society as a whole, focusing particularly on the communities where we work and live; and we maintain relationships based on ethical conduct, trust and transparency with our stakeholders. We support the goal of sustainability through: Working to ensure the long-term growth and continuity of our activities in a safe and responsible manner. Strengthening our commitment to environmental stewardship. Making a lasting, positive impact on society and particularly on the communities where we operate. Building ethical, fair and transparent relationships with our stakeholders. CONTINUOUS IMPROVEMENT: We develop and retain talent and expertise, embedding a culture of excellence across the organization; we focus on consistently delivering operational reliability and efficiency; we rigorously comply with the law and implement effective measures and controls to prevent possible irregularities or misconduct. Our pursuit of continuous improvement relies on: Deploying innovations that enhance performance and results. Taking a proactive approach to issues and providing creative and dynamic solutions to problems. Seeking out and welcoming new challenges and opportunities. Striving to excel in all our initiatives. Exploring new and better ways of doing things and embracing change 10

LEADERSHIP: We conduct ourselves with honesty, integrity and respect for others; we work with care, take responsibility for our actions and follow through on our commitments; we help, drive, motivate and inspire one another as a basic key to our success and boldly, decisively and innovatively search for new ideas and opportunities. We demonstrate exemplary leadership by: Recognizing and rewarding outstanding work and a positive attitude. Communicating in a clear, straightforward and consistent manner. Vigorously upholding the interests of Cepsa. Encouraging the growth and development of our people and our businesses. Acting in a way that reflects the values of honesty, integrity and respect. SOLIDARITY: We uphold the value of teamwork, endeavoring to do what is best for the overall interest of the Group, through cooperation among our different areas and close and productive relationships with our customers and suppliers, always maintaining a positive and respectful attitude towards one another. Our emphasis on solidarity is reflected in: Working together as a team to promote the interests of Cepsa. Fostering a collaborative and supportive work environment and harnessing the power of our combined strengths and efforts. Being open to the diversity of opinions and sharing knowledge, ideas and perspectives. Creating value that serves our common goals. 11

From the above ethical values we can stress the following ethical principles: INTEGRITY: Act diligently, responsibly and efficiently, maintaining loyal, honest behaviour and good faith. COMPLIANCE WITH REGULATIONS: Both general and internal, and to design effective measures to prevent possible misconduct. TRANSPARENCY: Provide stakeholders with accurate, clear, accessible and comprehensive information about the activities, policies and management of the Cepsa. HONESTY: Reject corruption in all its forms, public and private, active and passive. RESPECT: For the diversity of people (culture, gender, age, race, religion and sexual orientation). ENVIRONMENTAL PROTECTION: Comply with the standards established in environmental legislation. 12

1.4 What are the basic rules of conduct for all professionals in the Cepsa? The Code incorporates the basic, but not all-inclusive, behaviour guidelines of the Cepsa. These apply to all employees who must incorporate and internalize them as their own, and ensure they are followed within the organization. 16 BASIC RULES OF CONDUCT Express our total commitment to human rights: The acts and practices of the Cepsa are carried out in compliance with the principles established in the Universal Declaration of Human Rights, the Declaration on Fundamental Principles and Rights at Work of the International Labour Organization (ILO) and the OECD Guidelines for Multinational Enterprises. Similarly, Group behaviour complies with the Ten Principles of the Global Compact of the United Nations relating to human rights, labour rights, environmental protection and the fight against corruption. 13

Ensure the safety and protection of the Environment: Closely follow the rules on health and safety at work to prevent occupational hazards. Comply with and enforce the rules, policies and procedures on environmental protection. Promote equal opportunities and non-discrimination: Reject any act or conduct of an intimidating nature. Reject any discrimination based on personal, physical or social conditions. Obligation to report any observed incident. Promote proper use and protection of the resources and social assets of the Company: Do not use company resources (brand, logo, communication systems, applications, and the like) for personal affairs, non-professional business or to perform any other activities not related to the interest of the Cepsa. Do not disclose, store, disseminate or download material contrary to the provisions of the Code of Ethics of the Cepsa, to good taste and/or that could adversely affect the reputation and good image of the Cepsa. 14

Avoid conflicts between personal and Cepsa interests: In the face of a potential conflict of interest, the People Affected by the Code must meet the following requirements: i. Independence: Persons Affected by this Code must avoid situations that could lead to a potential or actual conflict between their personal interests (whether economic or not) and the Cepsa s interests. ii. Abstention: Persons Affected by this Code shall refrain from participating in or influencing decision-making in matters where there may be a conflict of interest. iii. Communication: Persons Affected by this Code shall immediately communicate the existence of potential conflicts of interest to the Management of the respective business unit or area. All Persons Affected by this Code who have financial or asset relations, either directly or indirectly through a related person, with shareholders or partners in any business, suppliers, competitors or customers of the Cepsa with whom they have a professional relationship, must immediately communicate the fact to the management of the respective business unit or area. Do not perform professional activities outside the Cepsa that involve unfair competition with the organization: Dedicate to the company all the professional capacity and personal effort necessary to carry out their professional functions. 15

Strictly obey the law in all places where Cepsa is present: Strictly obey the law in all places where the Cepsa is present. Avoid any conduct that, even without violating the law, could harm the reputation of the Cepsa before the Authority, Government, Community Agency or country concerned. Do not accept gifts or courtesy services of unreasonable value or circumstances: This prohibition applies particularly when the position of the receiver might directly or indirectly influence corporate decisions. Persons Affected by this Code who receive gifts, donations, presents and offerings that exceed the limits suggested by prudence or local customs must inform the management of the relevant business unit or area. Accepting such gifts will be considered a cause for the recipient being excluded from any procedure, process, or decision that directly or indirectly affects the person giving or offering said gifts. Enhance the transparency of information: The information disclosed must be relevant, accurate, clear, complete and accessible to all audiences of the Cepsa, both externally and internally, based on our commitment to the principle of transparency. 16

Promote the protection of personal data in compliance with the law: Safeguard the information provided by employees, customers and suppliers, ensuring their privacy and rights. Do not reveal reserved and confidential information: Non-public information belonging the Cepsa, will, in general, be considered private and confidential. In the event of termination of employment, the employee must return this information to the Cepsa, including documents and media or storage devices. Remain impartial and objective when establishing relationships with customers, suppliers and contractors: Employees must extend the Cepsa s quality policy to external relations, on the basis of on a longterm relationship with customers and a commitment to honesty, respect, objectivity and professional responsibility. The provider and supplier selection process must be done impartially and objectively, avoiding conflicts of interest or favouritism. The established internal procedures for procurement processes must be followed. Respect fair competition and antitrust principles in all actions: Do not make misleading advertising, or advertising that denigrates competitors or third parties. Respect free competition, in strict compliance with antitrust rules. 17

Implement measures to prevent bribery and corruption: Do not offer or make any payment of any kind to any person or entity with the intention of obtaining an illegal advantage, for oneself or for a third person. Both natural and juridical persons belonging to the Cepsa must not misuse their real or apparent influence to illegally obtain business or advantages. Take part in training policies: The training programmes must uphold equal opportunities and employees career development. Keep knowledge and skills up to date in order to achieve the best performance when carrying out duties. Anti-money laundering and counter-terrorist financing: Cepsa takes all reasonable and appropriate measures to avoid doing any kind of business with persons and/or entities whose aim or purpose may involve or be supportive of money laundering or terrorist financing activities. Persons Subject to this Code shall not abet, encourage or facilitate Cepsa s involvement in any business, commercial or other types of transactions whenever they know or suspect that such transactions are intended to circulate cash or other assets derived from criminal activities that appear to be legitimate throughout the financial system. 18

2 The Cepsa Ethics Committee 20

2.1 What is it? The Cepsa has created an Ethics Committee that is responsible for promoting, monitoring and enforcing of the values, principles and standards of conduct set out in the Code of Ethics and Conduct. In addition, it resolves any ethical problems that arise and complaints received, as well as supporting the implementation of the corrective measures needed in each case, taking into account all stakeholders involved. The Committee meets regularly and its decisions are subject to the authority of the Cepsa Audit Committee to which it is subordinate although the Committee may report directly to the Board of Directors when it considers this necessary or when so requested by the Board. The Board of Directors determines the composition and changes in the Ethics Committee, the structure of which is as follows: President: Chief Executive Officer. Permanent Members (CEO, CFO, COO, Legal Director and Director of HR). Secretary (Representative of the Legal Department). 21

2.2 How does it work? The minimum frequency of Committee meetings is six monthly, although the President may convene meetings when, in his/her judgement, circumstances warrant it. The Ethics Committee is validly constituted when more than half of its members are present; its decisions shall be adopted by absolute majority. In the event of a tie, the President shall have the casting vote. The delegation of duties within the scope of the Ethics Committee must be agreed unanimously in ameeting of the Committee. 22

2.3 What procedures does it follow? The Internal Control and Compliance Unit is the recipient of all communications of incidents and allegations of irregularities and is responsible for managing them. Following receipt of an incident or irregularity, the system immediately acknowledges receipt. Based on the information and/or documentation received, the Internal Control and Compliance Unit will begin a preliminary analysis that will be identified by a unique procedure number. After analysing the information and/or documentation provided, the Internal Control and Compliance Unit may choose from among the following decisions: Admission of the communication or complaint and initiation of the appropriate investigation case related to the allegations. Admission of communication and immediate termination of the preliminary analysis when its content is seen to be irrelevant, when the information is insufficient to proceed with any further action, or when the facts reported are implausible or incomplete. Rejection of communication and immediate termination of the preliminary analysis when the facts reported do not constitute an infringement. Once the investigation file has been drafted, it will be immediately sent to the Ethics Committee who will proceed to analyse it and subsequently approve it. 23

The Internal Control and Compliance Unit, subordinate to the Ethics Committee, receives all communications of incidents and allegations of irregularities and is responsible for managing them accordingly. The Ethics Committee is responsible for promoting, monitoring and enforcing of the values, principles and standards of conduct set out in the Cepsa s Code of Ethics and Conduct.

3 Communication of incidents and reporting of irregularities: the Ethics Channel Any Persons Affected by the Cepsa s Code of Ethics and Conduct who learns of any incident or irregularity must immediately report it through the channels that Cepsa has provided for this purpose. These channels will be open to Persons Affected by the Cepsa s Code of Ethics and Conduct and to people or any stakeholder related to the Cepsa. 26

An incident is defined as any action of an affected person that raises doubts in the application or interpretation of the Cepsa s Code of Ethics and Conduct or that may be considered to create an ethical dilemma.

3.1 What can we consider to be an incident or irregularity? An incident is defined as any action by an affected person that raises doubts in the application orinterpretation of the Cepsa s Code of Ethics and Conduct or that may be considered to create an ethical dilemma. An irregularity is any action allegedly contrary to the general principles of conduct and ethical values or standards of conduct of the Affected Persons contained in the Code, such as corruption, misappropriation or accounting manipulation, among others. Any contingency that may pose a risk to the reputation and image of the Cepsa is also considered an irregularity. Knowingly false complaints or complaints made with reckless disregard for the truth could lead to criminal or civil liability as provided for in the legislation currently in force, as well as any disciplinary measures that may apply. 28

3.2 How can we report incidents and irregularities? Incidents and irregularities may be reported through two different channels: Through the Ethics Channel that the Cepsa has created for communicating incidents and reporting irregularities on Cepsa s website (www.cepsa.com) in the section on About Us/Ethical Conduct/ Corporate Governance section. This Ethics Channel will be managed by the Internal Control Unit under the authority of the Ethics Committee. By internally remitting any communications of incidents or reports of irregularities received by the various Business Units or areas of the Cepsa. The head of the respective Business Unit or Area who receives this information must immediately send it to the Internal Control Unit using the Ethics Channel. Furthermore, the Internal Control Unit may request from the heads of any of the Business Units or areas of the Cepsa that it deems appropriate, access to those channels of communication that they consider could be feasibly used for communicating incidents and/or reporting irregularities. 29

The Cepsa guarantees its commitment to the absolute confidentiality of the complainant s data and the total absence of retaliation. All persons 2 who, in order to correctly handle the incident or irregularity, need to know its contents but never its source are bound by a commitment to confidentiality. Notwithstanding the above, the details of a complainant may be provided to the administrative or judicial authorities, at their request and always in strict compliance with the legislation on protection of personal data. By communicating incidents and reporting irregularities, we all ensure that the Cepsa s ethical commitment is a reality. [2] Ethics Committee, Internal Control Unit and any other persons that the Ethics Committee considers appropriate. 30

You can find the Code of Ethics and access the Ethics Channel at: www.cepsa.com/who_we_are/corporate_governance/code_of_ethics_and_conduct/