Due Diligence Compliance Report 2022

Actor’s details

Section 1. Establish strong Company Management Systems

1.1 Has Umicore created a company policy regarding due diligence for its supply chains of cobalt?

‘The Umicore Way’ describes Umicore’s mission and its core values related to its business conduct. It is at the heart of Umicore’s culture. Umicore has adopted a set of policies to ensure its activities and those of its business partners are conducted in line with the principles outlined in ‘The Umicore Way’. These include the Umicore ‘Code of Conduct’ for Umicore employees and contractors, as well as the ‘Umicore Global Sustainable Sourcing Policy’, applicable to suppliers.

In our entire supply chain and in all areas of procurement – whether raw materials, energy, other goods or services - , we are committed to promoting fair and ethical business practices, ensure health and safety, and manage the impact on people, climate and environment. In order to do so, we ask all our suppliers to adhere to Umicore’s Global Sustainable Sourcing Policy, complemented by additional guidance for specific materials through a risk-based approach. 

Today, the additional guidance is formalized into two dedicated policies. First, Umicore has a policy on ‘Responsible Global Supply Chain of Minerals from Conflict-Affected and High-Risk Areas’. Second, bearing in mind the specific risks in the cobalt supply chain, Umicore has implemented a specific cobalt due diligence framework: Umicore’s ‘Sustainable Procurement Framework for Cobalt’ (hereafter referred to as “the Framework”). The Framework reflects Umicore’s commitment to strive for a sustainable and ethical cobalt supply chain. The Framework defines Umicore’s responsibility for conducting risk-based due diligence, screening and monitoring all its suppliers. The Framework outlines how due diligence is conducted and is publicly available on Umicore’s website. An internal procedure, including a process flow decision tree, has been developed to explain and document in detail the due diligence processes. As part of our continuous improvement, the Framework has been fully reviewed and updated in December 2022 (applicable as from 1 January 2023), introducing among others a wider scope of ESG risks to be assessed, guidance on performance expectations on ESG, as well as a requirement to get certified against a recognized due diligence and ESG standard.^[1] The current compliance report will evaluate Umicore’s due diligence processes against the old framework, as it was applicable throughout 2022. Umicore’s due diligence management system is set up in accordance with the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas (OECD, 2013). 

In addition to these policies, Umicore has formalized a public grievance mechanism (Umicore Integrity Line) since 2018.

The policies mentioned have a Umicore-wide coverage and are thus not site-specific. All cobalt sourced and processed within Umicore is covered by the Sustainable Procurement Framework for Cobalt, irrespective of location or flows. 

The following documents are available via Umicore’s website:

●       The Umicore Way

●       Code of Conduct

●       Umicore Global Sustainable Sourcing Policy

●       Umicore policy on Responsible Global Supply Chain of Minerals from Conflict-Affected and High-Risk Areas

●       Sustainable Procurement Framework for Cobalt

1.2 Has Umicore set up an internal management structure to support its supply chain due diligence?

The Umicore Sustainable Procurement Framework for Cobalt defines the governance for Umicore’s due diligence practices for the cobalt supply chain.

The Sustainable Value Chain team in the Environmental, Health and Safety department^[2] is responsible for the implementation of the Framework including the screening of risks in the affected cobalt sourcing and trading regions; and engagement with suppliers for the risk assessment and risk mitigation. In the execution of this task, the team is supported by the cobalt supply team and the Strategic Insights & Analysis team for additional intelligence, and also by the commercial back office teams for support in the processing of chain of custody documentation. The Umicore trade compliance team is responsible for sanctions screening and export control, and will flag if any of the suppliers are impacted. Similarly, the Corporate Security Office is responsible for checking ethical business behaviour of Umicore suppliers and will flag and advice in case of claims related to corruption, bribery, fraud or tax evasion.

A dedicated cobalt sustainability committee, referred to as the “Approval Committee”, ensures adherence to the principles and guidelines of the Framework. This Approval Committee has the responsibility to evaluate due diligence findings, mitigation actions and procurement decisions. The Approval Committee includes the Executive Vice-President of Umicore’s business group Energy & Surface Technologies, the Senior Vice-President Supply RBM, the Group Director Sustainable Value Chain, the Sustainable Value Chain manager and the Manager Sustainable Battery Value Chain.^[3] The Committee meets at least twice per year, and on ad-hoc basis as required. In 2022, two Approval Committee meetings were organized. The governance structure was effectively applied in the reporting year 2022.

As the Cobalt Framework has been fully reviewed in 2022 to make it more robust, efficient, and futureproof, 2022 should be considered a transition year in the management processes. In light of continuous improvement, the former Cobalt Framework (still applicable until 31/12/2022) was already adapted to improved practices of the updated Cobalt Framework (formally applicable as from 1/1/2023) and certain steps have not been applied as described in the Cobalt Framework and its internal procedure. Wherever that is the case, throughout this compliance report, specific mention will be made. Overall, through the new process, more risks are covered and we are confident that the outcome of our due diligence processes is more robust under the new practices.

Section 2: Identify and Assess Risks in the Cobalt Supply Chain

2.1 Supply Chain Traceability: Has Umicore established a system of controls in order to ensure transparency over its cobalt supply chain?

Umicore has a process in place that ensures that transactional details are recorded  and that relevant documents related to origin, transportation and tax payments can be obtained.

These procurement data provide information on the source and origin of the raw materials and allows Umicore to consolidate the incoming cobalt material into a “materiality overview” in order to provide a view of all the quantities of cobalt procured.

Umicore is able to identify the mines from which the procured cobalt material originates by means of chain of custody documentation and/or an additional confirmation of origin from suppliers that source from several mining locations (traders). 

The origin of incoming materials is guaranteed through dedicated material control procedures at Umicore’s facilities, such as sample testing and material fingerprinting.

Umicore maps its entire internal raw material flow, production processes and product flows for all cobalt products. As a result, Umicore has an overview for each end product, linked to the suppliers and mining locations. 

Umicore’s smelters in Olen, Belgium and Kokkola, Finland have been RMI conformant since 2019. Re-assessment RMAP audits have been conducted on both sites in November 2022. The main issues that were identified as points to improve in the future and that have been implemented already in the updated cobalt framework were the need to also do an in-depth risk assessment on traders and all potential sources in their supply; as well as the need to also assess risks in transit countries and not only countries of origin. The exact transportation routes and means of transport need to be identified for each shipment, while chain of custody documents need to be obtained with regard to transportation routes between the supplying crude refiner to the location of export. Furthermore, processes need to established and implemented to identify all taxes, fees and royalties paid to governments when sourcing from CAHRAS, as well as all other payments or compensations made to government agencies and officials, public or private security forces or other armed groups. The audit reports were received in February 2023 and the issues are currently being addressed through a CAP, which RMI will need to approve by May 2023.

2.2 Suppliers Research: Does Umicore perform research on its suppliers to identify risks in its cobalt supply chain?

As a preliminary step in the selection of a new supplier, Umicore performs a high-level check on the background of the potential business partner and only pursues a further business relationship if no indications of unsustainable business practices (such as inhumane treatment, forced labor, child labor, bribery, corruption, artisanal mining) have been identified. This screening is documented in a pre-sourcing due diligence check.

At the beginning of a business relationship with a new supplier, the due diligence and risk assessment procedures set out in the Framework are initiated by Umicore.

Umicore conducts a background check for all suppliers of raw materials of cobalt based on a desktop review, its knowledge of the market, stakeholder insights and engagement with the supplier. The background check includes several topics:

• Identification and screening of the supplier’s mother company (corporate and financial structure, ownership, policies, sustainability reporting…)
• Information about the mining site (general description, technology, certificates, local initiatives…)
• Information and screening of the shareholders
• Information gathered by Umicore’s supply team during local visits (environmental performance, technology, markets, cobalt volumes…)
• Media screening of sustainability issues including human rights violations, social issues, corruption, and health & safety issues.

A daily media monitoring of relevant topics related to cobalt sourcing and of Umicore’s suppliers is conducted by the Information Documentation department and informs (updates of) the background checks. The background checks are reassessed annually for all suppliers, including tollers and suppliers of recycling feed.

2.3 Risk Identification and Assessment: Does Umicore perform risk identification and assessment on suppliers in its cobalt supply chain?

Each supplier undergoes a risk assessment. The objective of the risk assessment is to identify and evaluate the risks of human rights issues, unethical business practices or contributions to harm to people, the environment or society of a specific supplier.

The risk assessment of a supplier takes into account the country in which the supplier is located and the country through which cobalt is transported (=country risk), as well as the policies, management system and practices the supplier has put in place or information collected through Internet screening, dedicated due diligence tools or commercial and sustainability insights (=supplier risk). The outcome of this assessment will determine whether additional due diligence screening are required.

For the risk assessment, the team is supported by the insights of the supply team (both in Europe and locally in the sourcing regions, including DRC) and Umicore’s Strategic Insights and Analysis team. In addition, for any issues related to bribery, corruption or fraud, Umicore’s Corporate Security team can be consulted.

In 2022 the Cobalt framework and its risk assessment procedures were fully reviewed and some changes were already implemented as they translated to some extent what had already become daily practice. That means, however, that 2022 was a transition year, where due diligence was carried out partly according to the old procedures, but to some extent already according to the new procedures. Below the actions taken in 2022 will be described in more detail, but the main differences in implementation are:

• The relevance of materiality 
  The 2012 Cobalt Framework prescribes a basic risk assessment for all suppliers that includes a ‘red flag check’ (= OECD Annex II risks). Only for those suppliers that are considered ‘material’ to Umicore (i.e. suppliers with more than 1% of total share of Umicore’s cobalt supply + total quantity covered must exceed 95% of total supply) will a further check of ‘orange flags’ be conducted. Orange flags include environmental protection or health & safety risks. The 2023 Framework no longer makes this distinction and any type of risk is being assessed for all suppliers. As from Q4 2022, all supplier checks have included a screening for red and orange flags.
  
  
• The order of the risk assessment process
  The 2012 Cobalt Framework prescribes the following process flow:
  • step 1: red flag check
  • step 2: material supplier: background check
  • step 3: commercial site visit
  • step 4: orange flag check
  • step 5: in case of indication of red/orange flags, self-assessment questionnaire
  • step 6: risk assessment scoring matrix
  • step 7: engage with supplier on high risks and assess evidence
  • step 8: sustainability visit; audit; disengagement
  • step 9: risk mitigation and follow up.

In the 2023 Framework the order has been adapted to make the process more efficient yet robust. Any risk trigger or alarm signal through information gaps or other indications will lead to the next step of the process.

• • step 1: self-assessment questionnaire (including questions on all zero-tolerance issues and issues of concern) combined with general screening of supplier
  • step 2: supplier and stakeholder engagement
  • step 3: risk mitigation
  • step 4: site visit and/or audit
  • step 5: risk mitigation and remedy

In the transition in 2022, the order has mainly been impacted in the timing of site visits (see description below) as well as the joint screening of a supplier background, red flags and orange flags. The screening findings are compiled in the ‘Extended Background Screening’ of suppliers. 

• Risk assessment scoring matrix
  For the 2012 Framework a risk matrix was developed to score a variety of criteria on likelihood and impact. To assess the likelihood dimension, risk criteria were scored along 4 categories: country risk assessment; supplier relationship (e.g. length of relationship, importance of cobalt business, but also the availability of policies on health & safety, environment, bribery etc.); regulatory environment  (e.g. company structure and Ultimate Beneficial Owner, regulatory infringements); and sustainability image of the supplier (through a media search, CSR reporting and other public sustainability commitments). During the review process of the Framework, practice and lessons learned show that the risk scoring matrix was no longer used in a useful manner: it was not updated regularly enough; aggregate scoring could lead to risk blind spots; the weighing of certain risks over others was determined overly complex and untransparent. It was therefore decided to no longer use this risk scoring matrix, given that all relevant elements were covered in the Extended Background Screenings of suppliers. The risk category of regulatory environment is mostly integrated in the new country risk assessment, which consider 25 risk indices compared to the previous 6 risk indices.
  
  To assess the impact dimension, companies were scored along 3 categories: production (volume bought from suppliers, dependency on supplier, supplier market position); financial (financial impact on Umicore); and image & reputation (including impact in media; customer complaints related to a supplier; impact on Umicore’s sustainable certificates). This impact dimension considers the impact, or materiality, to Umicore. However, as this dimension is not relevant for our due diligence practices, and any risk should consider the impact on people or environment (the saliency of risk), during the review of the Framework it was decided to no longer consider this part of the assessment.

In 2022, Umicore performed risk identification and assessments steps as described in Umicore’s Framework by applying the following steps:

• Country risk assessment
• Supplier risk assessment:
  • Red Flag Check
  • Materiality Testing
  • Site visits
  • Orange Flag Check

Country risk assessment

To determine whether a country or a region is identified as high-risk, countries are screened in a country risk assessment against a list of criteria. In addition to coverage by the EU CAHRA list, the US Dodd-Frank Act, the EU sanctions list, a risk score is given across categories (low/medium/high risk), including conflict, governance, human rights and environment. Suppliers sourcing from or transporting through high-risk countries are subject to enhanced due diligence under the supplier risk assessment. The country list structure was revised in Q2 2022, increasing the number of indices to include from 6 to 25. The final assessment for a country to be low/medium/risk will require a high risk scoring in at least 2 categories, unless in the case of CAHRA; Dodd-Frank; or sanctions, which will immediately lead to a high-risk qualification.

Supplier risk assessment

In principle, Umicore conducts due diligence on all suppliers. However, in the review process, small gaps were identified with regard to 8 small suppliers. For these suppliers, together covering 1,69% of cobalt in Umicore’s supply, traceability was established but no supplier risk assessment was carried out. One of these suppliers delivered more than 1% of Umicore’s cobalt supply in 2022, supplied as a by-product from another commodity. Given this volume, the supplier should have gone through an extensive risk assessment, including red and orange flag checks, and a site visit should be performed in principle every 2 years. As we started receiving material from this supplier in 2021 (volume 0,2% of supply), and the supplier only became material in 2022, a site visit was not yet due according to the framework. Depending on future volumes and/or due diligence screening, a site visit may take place in the future. 

RED FLAG CHECK
Umicore performs a red flag check (note: red flags within the context of the Framework are zero-tolerance issues as defined and listed in the Framework) on its suppliers based on the information collected in the background check, market and desktop research. Indications of red flags will lead to engagement and risk mitigation actions. Identified evidence of red flag issues will lead Umicore to disengage with the supplier. These decisions are taken by the Approval Committee. The Framework procedure provides dedicated questions and screening guidelines to facilitate this screening. The red flags are:

• any form of torture, cruel, inhuman and degrading treatment or punishment;
• any form of forced or compulsory labor;
• any form of child labor;
• any form of bribery and corruption linked to cobalt operations;
• hand-picking and/or artisanal mining (as primary source);
• supplier is not willing to accept the principles stated in the ‘Umicore Charter’ or does not have similar policies in place.

For new suppliers of cobalt raw materials, the red flag check occurs as the first step in the decision tree. For existing suppliers, the red flag checks are reassessed during the annual review, when new issues have come to our attention based on the continuous monitoring, through supplier engagement, a supplier SAQ, third party audit or site visits. 

An overview of the red flag indications and follow-up actions during the reporting year 2022 can be found in Annex to this report.

MATERIALITY TESTING
During materiality testing, the share of each supplier in the total supplied quantity is calculated. This analysis includes all the cobalt purchases for Umicore’s entities involved in cobalt processing. Based on this exercise, a first risk estimation is performed. All suppliers of cobalt with a share of more than 1% of the total supplied cobalt quantity (referred to as “material” suppliers) are further assessed in the decision tree. In addition, this analysis ensures that the sum of the cobalt coming from “material” suppliers exceeds 95% of Umicore’s total yearly cobalt supply. For suppliers assessed as “non-material”, the due diligence and risk assessment procedures stop at this stage of the decision tree. As indicated above, 1 supplier with a share exceeding 1% was not properly assessed in 2022.

In 2022, the suppliers that were considered as “material” to Umicore represented in total 95.40% of cobalt purchases. 

SITE VISITS
Site visits are performed to monitor and evaluate the practices of all “material” suppliers (except for non-recurrent suppliers and recyclers). During the site visits, a sustainable procurement checklist is filled out. The checklists and visit reports inform the suppliers’ screening. The frequency of the site visits depends on the country risk of the supplier. Suppliers in countries with a high or medium/high country risk score should be visited at least every two years. Suppliers in low/medium or low risk countries should be visited every five years.

Due to the extraordinary circumstances and travel restrictions related to COVID-19 in 2020-2021, a backlog for site visits was created. The execution of some in-person site visits is still delayed. Out of 15 site visits that needed to be done in 2022, there is currently 1 site visit in a high-risk country overdue (in 2022 no indication of red and/or orange flags were identified through the risk assessment procedure as described by the framework, including background screening and other forms of intelligence such as adverse media screening; peer learning groups; informal exchanges with the mine and stakeholders); as well as 4 visits in medium/low risk countries. In 2022 no indication of red and/or orange flags were identified for these suppliers through the risk assessment procedure as described by the framework, including background screening and other forms of intelligence such as adverse media screening; peer learning groups; informal exchanges with the mine and stakeholders – except for 1 supplier (medium/low risk country) where a potential orange flag was identified. Umicore is currently in engagement with that supplier to mitigate said risk. 1 supplier has several mine sites in the same country (low risk), and whereas one site was visited, the other one was not.

For the delayed site visits, no alternative measures - in addition to the annual screening - were taken in 2022 due to prioritization of other risks, which our assessments showed to have a greater likelihood of occurring and/or greater impact.  The overdue site visits are scheduled to be performed in 2023 if circumstances (including resources) allow for it, and where such visit will be required under the new Cobalt Framework (applicable as from 1/1/2023). Where a visit will not be possible before summer 2023, an online meeting will be set up with the suppliers to talk through developments and potential risks. 

In addition, 2 visits to sites in Russia were not performed, because the decision was taken in March 2022 to phase out sourcing from Russia. 

ORANGE FLAG CHECK
An orange flag screening is performed for “material” suppliers and suppliers in high-risk countries (note: orange flags within the context of the 2012 Framework are issues of concern as defined and listed in the 2023 Framework). Any indication or identified evidence of orange flags means Umicore will engage with the supplier and require mitigation actions. The Approval Committee will need to decide whether to continue the business relationship, temporarily suspend it or disengage. The orange flag check is completed based on the information collected through monitoring, engagement, third party audits, site visits and desktop research. Orange flag checks are re-assessed during the annual review, or when new indications come to our attention. The orange flags are:

• Hand-picking and/or artisanal mining (as a secondary source);
• Supplier does not have minimum required legal permits and certificates;
• Supplier does not have procedures in place to minimize environmental impacts;
• Supplier does not have procedures in place to ensure a healthy and safe working environment.

In 2022, Umicore performed the orange flag checks in line with its Framework. An overview of the orange flag indications and follow-up actions can be found in Annex to this report. 

2.4 Risk Mitigation: Does Umicore perform risk mitigation actions as described in its ‘Sustainable Procurement Framework for Cobalt’?

Based on the outcome of the country risk assessment and supplier risk assessment (background checks; red/orange flag screening), where required Umicore engages with the supplier on appropriate follow-up and, if required, an appropriate mitigation plan. Progress on the mitigation plan is closely monitored and, if necessary, checked during the next site visits and/or (targeted) supplier reviews.

In 2022, two Approval Committee meetings reviewed identified risks and subsequent follow-up measures related to them.

Section 3: Design and Implement a Strategy to respond to Identified Risks

3.1 Comments and Demonstration of Compliance

Umicore’s Framework ensures that identified risks are addressed, and that follow-up on red and orange flag indications is performed, including the investigation of the indications, outreach to stakeholders and discussion with the Approval Committee. All indications for red and orange flags that appeared in 2022 were investigated and evaluated by the Approval Committee. An overview of the indications and follow-up can be found in the Annex of this report.

Section 4: Independent Third-party Audit of Supply Chain Due Diligence

4.1 Comments and Demonstration of Compliance

PwC Bedrijfsrevisoren bcvba/PwC Reviseurs d’Entreprises sccrl^[3] provided their independent ISAE 3000 limited assurance report on this Compliance Report in respect of the activities undertaken by Umicore during the year 2022 to demonstrate compliance with Umicore’s ‘Sustainable Procurement Framework for Cobalt’. The limited assurance report is available to Umicore customers and stakeholders upon request.

Section 5: Report on Supply Chain Due Diligence

5.1 Comments and Demonstration of Compliance

The Compliance Report is Umicore’s report on the due diligence of its cobalt supply chain. The report will be available online as part of the company’s Annual Report for 2022. Relevant policies are publicly available, including ‘The Umicore Way’, ‘Code of Conduct’,  ‘Global Sustainable Sourcing Policy’, ‘Policy On Responsible Global Supply Chain Of Minerals From Conflict-Affected And High Risk Areas’ and ‘Sustainable Procurement Framework For Cobalt’.

Additionally, the limited assurance report by PwC Bedrijfsrevisoren bcvba/PwC Reviseurs d’Entreprises sccrl will be available on request to Umicore’s customers and stakeholders.

Management Conclusion on Compliance 

Umicore implemented effective management systems, procedures, processes and practices regarding its cobalt sourcing activities. As explained on p.10 of this report, for 1,69% of Umicore’s cobalt supply, small gaps were identified with regard to 8 small suppliers: traceability was established but no supplier risk assessment was carried out. One of these suppliers delivered more than 1% of Umicore’s cobalt supply in 2022, supplied as a by-product from another commodity. 

Due to a review of the Cobalt Framework in light of continuous improvement (applicable as from 1/1/2023), some steps of the Framework have already been applied in a manner that is different from what is outlined in the Framework. Umicore is confident that the changes have led to a more effective risk assessment and mitigation. 

Due to the challenges such as travel bans caused by COVID-19 in 2020-2021, a backlog has been created in the execution of site visits for several suppliers. Limited resources in the sustainable value chain team have led to additional delay in performing these visits. While several site visits were conducted in 2022, among which all active DRC suppliers, 5 site visits remain to be conducted (1 high risk country; 4 medium/low risk country). No new or increased risks were identified for these suppliers, except for 1 (medium/low risk country) where a potential orange flag was identified. Umicore is currently in engagement with that supplier to mitigate said risk. 1 of these suppliers has several mine sites in the same country (low risk), whereby one site was visited, but the other one was not. In addition, 2 visits to sites in Russia were not performed, because the decision was taken in March 2022 to phase out sourcing from Russia. 

Umicore’s management system is set up in accordance with the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas (OECD, 2013). By performing due diligence practices on its cobalt supply chain, receiving third-party assurance, and publicly reporting, Umicore adheres to the five steps for risk-based due diligence of the OECD Guidance.

Other Report Comments

If users of this report wish to provide any feedback to Umicore, they can contact Umicore’s responsible sourcing lead, Barbara Cooreman (Barbara.Cooreman@eu.umicore.com).

Annex: Flag Indications and Follow-up Actions

---

^[1] For the purpose of this report, all references to the Cobalt Framework refer to the former version of the Framework. As the compliance report covers reporting year 2022, it does not yet include the wider scope of the revised Cobalt Framework. 
^[2] As from 1 January 2023, the team and responsibilities have been transferred to the Responsible Sourcing team in the corporate ESG department.
^[3] As from 1 January 2023, the internal organization has been re-structured and titles no longer reflect the current situation. The same level of senior management representation is guaranteed in the Approval Committee.
^[4] PwC has performed the above mentioned engagement and report for the Umicore Sustainable Framework for Cobalt solely for use by Umicore CSM and RBM under a contract agreed upon with Umicore SA. PwC does not have any obligation towards any other person; PwC does not have nor accept any liability or responsibility (contractual, extra-contractual or otherwise) towards any such other person.