Whistleblowing Procedure
Reporting Violations System
Pursuant to the Protected Disclosures Act 2014, as amended by the Protected Disclosures (Amendment) Act 2022, and Directive (EU) 2019/1937
What Whistleblowing is and why it matters
Whistleblowing is the reporting, by a person —worker, collaborator, client or other party— of unlawful, irregular or non-compliant conduct of which they have become aware in the context of a work-related activity or a professional or business relationship.
Real Money Europe Limited (hereinafter «Real Money Europe» or «the Company»), as a Metals Bank, has adopted this Whistleblowing System in the belief that the timely reporting of any violations is a fundamental tool for:
- Preventing unlawful or non-compliant conduct before it causes harm;
- Protecting clients, workers and the integrity of the precious metals trading business;
- Promoting a corporate culture based on legality, fairness and transparency;
- Fulfilling the obligations set out in the Protected Disclosures Act 2014 (as amended in 2022) and Directive (EU) 2019/1937, as well as adopting international best practices in governance.
The System is based on tools that guarantee the utmost confidentiality of the reporting person's identity, the protection of personal data, and an absolute prohibition on retaliation of any kind against anyone making a report in good faith.
1.4 · Guiding principles
1.5 · Definitions
| Term | Definition |
|---|---|
| Reporting person | The natural person who reports or publicly discloses information on violations acquired in the context of their work. |
| Internal reports | Written or oral communication of information on violations, made through the Company's internal reporting channel. |
| External reports | Communication of information on violations through the external channels provided by law (prescribed persons and the Protected Disclosures Commissioner). |
| Public disclosure | Making information on violations public through the press or broadcast media, in the cases and under the conditions provided by law. |
| Retaliation | Any conduct, act or omission —even merely attempted or threatened— carried out as a result of the report and causing or capable of causing unjust harm to the reporting person. |
| Facilitator | The natural person who assists the reporting person in the reporting process, whose assistance must be kept confidential. |
| Report manager | The person designated with autonomy and independence, responsible for the internal channel: the Company's Regulatory Compliance Officer. |
Regulatory references
This procedure is adopted in accordance with European and Irish regulatory frameworks:
- Protected Disclosures Act 2014, as amended by the Protected Disclosures (Amendment) Act 2022;
- Directive (EU) 2019/1937 — protection of persons who report breaches of EU law;
- Regulation (EU) 2016/679 (GDPR) and the Data Protection Act 2018 (Ireland);
- Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, as amended;
- Any other provision of the competent Irish authorities applicable to the Company.
Who can submit a report?
The system is available to anyone who, in the work or professional context, becomes aware of violations.
3.1 · Internal reporting persons
- Permanent and fixed-term employees;
- Collaborators, consultants and self-employed professionals;
- Interns, trainees and temporary workers;
- Directors and members of corporate bodies;
- Agents and representatives of the sales network;
- Former employees or collaborators, and candidates in the selection phase.
3.2 · External reporting persons
Suppliers, business partners and third parties who operate or have operated on behalf of the Company, and other persons who have become aware of relevant violations in professional or business relationships.
3.3 · Conditions for protection
The protections apply provided that, at the time of the report, the reporting person has reasonable grounds to believe that the information is true and falls within the scope of material violations. The report must be based on information from the work context, with a reasonable belief in its truthfulness and without abusing the reporting tool.
What can be reported
4.1 · Anti-money laundering rules (AML/CFT)
- Failure to identify clients or to comply with customer due diligence obligations;
- Failure to report suspicious transactions to FIU Ireland and the Revenue Commissioners;
- Breaches of Real Money Europe's internal KYC procedures;
- Shortcomings in the prevention of money laundering and terrorist financing.
4.2 · Rules applicable to the Metals Bank
- Irregularities in the purchase and sale of investment gold or precious metals;
- Shortcomings in the traceability and recording of transactions;
- Failure to comply with reporting obligations to the relevant Irish authorities;
- Inappropriate conduct towards clients in the purchase and sale of investment gold.
4.3 · Governance and internal controls
- Shortcomings in corporate governance, internal controls or the management of conflicts of interest;
- Conduct that does not comply with the Code of Ethics;
- Breaches of IT security policies and data protection measures.
4.4 · Personal data protection
- Processing of data without a valid legal basis or in breach of the GDPR;
- Failure to adopt adequate security measures (unauthorised access, data loss);
- Failure to comply with data breach obligations, including notification to the DPC;
- Breaches of data subjects' rights.
4.5 · What CANNOT be reported through this channel
- Personal grievances related to employment (usual channels);
- Differences of opinion on management or strategic decisions;
- Knowingly false reports;
- Money laundering transactions (dedicated AML channel);
- Complaints about products or services (complaints procedure).
How to make a report: the three channels
Reports may also be submitted anonymously. The Company issues an acknowledgement of receipt within 7 days, with diligent follow-up and generally a response within 3 months.
5.1 · Official internal channel — MITWhistle platform
The official internal channel is the dedicated digital platform, which allows written and anonymous reports, confidential communication with the manager, data protection through encryption, and separation between the reporter's identity and the report content. The system is provided by a specialised external provider.
5.2 · Residual alternative channel
The reporting person may request a direct and confidential meeting with the Compliance Officer, or send a confidential written communication, with the same protections.
5.3 · External channel
Where the legal conditions are met, the reporting person may use the external channels (the prescribed person responsible or the Protected Disclosures Commissioner), in particular where they reasonably believe the violation falls within that entity's remit and that the information is substantially true.
5.4 · Public disclosure
In the cases provided by law, the reporting person may make information about a violation public (e.g. through the press), with legal protection if they have reasonable grounds to believe the information is substantially true and at least one condition is met: a prior report without adequate measures within the deadlines; imminent danger to the public interest; risk of retaliation from an external report; or little chance the violation would be effectively addressed.
Content of the report
To enable effective handling, it is useful —though not mandatory— to provide:
- Description of the facts (what happened, in what context and how often);
- Dates or period in which the events occurred;
- Place where the facts occurred;
- Persons involved, if known;
- Supporting documentation (emails, contracts, screenshots);
- How the facts became known.
The reporting person need not be absolutely certain that the violation occurred: it is sufficient to have reasonable grounds to believe the information tends to demonstrate a significant violation.
Protection measures for reporting persons
7.1 · Confidentiality of identity
The reporting person's identity is treated with the utmost confidentiality. Only the persons authorised to handle the report are aware of it, and it is not disclosed to third parties without explicit consent, unless required by law. All reports are prepared so as not to contain references that could allow the identification of the reporting person.
The Company prohibits any form of retaliation, discrimination or harmful conduct towards the reporting person, their colleagues or family members. This includes: dismissal, suspension or non-renewal; demotion, transfers or worsening of conditions; salary reduction; unjustified negative evaluations; failure to promote; harassment, isolation or undue pressure; or interruption of the business relationship (for third parties).
7.3 · Extended protection
Protections extend to facilitators (lawyers, trade union representatives), colleagues and family members of the reporting person, and legal entities connected to the reporting person.
7.4 · Processing of personal data
Data is processed in accordance with the GDPR and the Data Protection Act 2018, exclusively for handling the report. Data is retained for the necessary and proportionate period; Irish law requires records of reports to be kept, including anonymous ones.
How we handle reports
The Company adopts a structured six-phase process, with defined timeframes:
| Phase | Timing | Activity | Responsible |
|---|---|---|---|
| 1. Receipt | Day 0 | Receipt via MITWhistle, automatic confidential registration with separation of identity. | Compliance / MITWhistle |
| 2. Confirmation | Within 7 days | Acknowledgement of receipt to the reporting person with case code, date and time. | Compliance Officer |
| 3. Assessment | Within 30 days | Admissibility analysis, assessment of severity and urgency, possible request for further information. | Compliance Officer |
| 4. Investigation | Within 90 days | Collection of documentation, interviews, technical checks and regulatory analysis. | Compliance + consultant |
| 5. Resolution | Within 90 days | Report to the Board of Directors, deliberation on corrective and/or disciplinary measures. | Board of Directors |
| 6. Feedback | Within 90 days | Communication of the outcome to the reporting person and initiation of corrective actions. | Compliance Officer |
The Reporting Register is kept confidential and separate, with access restricted to the Compliance Officer and the parties expressly authorised.
Management of conflicts of interest
9.1 · Reports concerning the Compliance Officer
If a report concerns the Regulatory Compliance Officer, it is assigned directly to the Board of Directors, which handles the investigation. The Compliance Officer has no access to and cannot carry out any activity related to the report.
9.2 · Reports concerning directors
If the report concerns one or more directors, the company secretary is responsible for handling it, provided they are not involved. Otherwise, it is entrusted to a specifically appointed independent third party.
Relations with the competent authorities
| Protected Disclosures Commissioner | Receive and handle external reports in the cases provided by law and refer them to the competent body. |
| Persons prescribed by law | Receipt of external reports in matters within their respective competence. |
| Data Protection Commission (DPC) | Matters relating to the processing and protection of personal data. |
| Irish judicial and police authorities | Reports concerning possible offences, in accordance with applicable legislation. |
Training and communication
- Mandatory training for all staff upon hiring, with annual refresher courses;
- Communication of this Procedure to all collaborators and network agents;
- Publication of the procedure in the relevant section of the website;
- Making the reporting channel available.
Procedure updates
This procedure is subject to annual review by the Compliance Officer and the Board of Directors, or when significant regulatory changes occur. Any amendment is approved by the Board of Directors and communicated immediately. The updated version is always available in the Whistleblowing section of the website.
Whistleblowing Procedure · Version 4.1 — August 2026
