CORPORATE GOVERNANCE CONTROL SYSTEM

Governance & Policies

Governance is the operating structure behind how Finder & Partners handles every appointed account — from information access and customer engagement to escalation, review and resolution.

Our governance model combines defined client mandates, authorised human oversight, controlled information access and traceable operational processes.

Registered Corporate Entity

Finder & Partners Sdn Bhd

Digital Operating Identity

UnitKredit

MANDATE: DEFINED

OVERSIGHT: SUPERVISED

DATA: CONTROLLED

AUDIT: TRACEABLE

CLIENT MANDATE

DEFINED MANDATE

HUMAN ACCOUNTABILITY

OVERSIGHT RETAINED

DATA GOVERNANCE

ACCESS CONTROLLED

AUDITABILITY

TRACE VERIFIED

01 — GOVERNANCE CHAIN

Control from mandate to review

Recovery activity begins with an authorised client mandate and moves through governed operational controls designed to preserve human accountability at each material decision point.

Active Control State

Mandate Scope

Defines the authorised scope, account context and applicable client requirements.

01 — CLIENT MANDATE

Mandate Scope

Defines the authorised scope, account context and applicable client requirements.

DEFINED MANDATE

02 — AUTHORISED WORKFLOW

Controlled Workflow

Information and activity move through defined operational processes and access controls.

CONTROLLED WORKFLOW

03 — HUMAN REVIEW

Human Oversight Gate

Authorised personnel assess material customer-impacting decisions within the applicable mandate.

AUTHORISATION GATE

04 — CONTROLLED ACTION

Mandated Action

Approved activity proceeds through authorised operational workflows.

EXECUTED WITHIN CONTROL

05 — AUDIT EVIDENCE

Audit & Traceability

Relevant activity and approvals are recorded to support traceability, management oversight and client review.

TRACE RECORDED

02 — ACCOUNTABILITY BOUNDARIES

Accountability Boundaries

A clear definition of what the system can and cannot do, ensuring responsible use within authorised limits.

CONTROL OVERSIGHT LIMITS

DEFINED SYSTEM AUTHORITY

organise approved information;

support workflow coordination;

surface relevant decision-support information;

assist authorised personnel with prioritisation;

support reporting and review.

Enables Responsible Action// 01

System May

— BOUNDARIES —— BOUNDARIES —

independently expand a client mandate;

independently initiate legal proceedings;

independently make material customer-impacting decisions outside authorised controls;

bypass required human oversight;

bypass information-access controls.

Prevents Unauthorised Action// 02

System Must Not

CLEAR AUTHORITY. CONTROLLED OPERATIONS.UNITKREDIT —

03 — RESPONSIBLE TECHNOLOGY

Technology within defined boundaries

Finder & Partners uses technology to improve information organisation, workflow coordination, decision support, compliance monitoring and reporting.

Workflow Support Layer

Technology Supports

INFORMATION ORGANISATIONSystem Advisory

WORKFLOW COORDINATIONSystem Advisory

PRIORITISATION & DECISION SUPPORTSystem Advisory

COMPLIANCE MONITORINGSystem Advisory

REPORTINGSystem Advisory

Accountability Layer

Human Authority Remains Central

MATERIAL CUSTOMER-IMPACTING DECISIONSHuman Decision

ESCALATION DECISIONSHuman Decision

RESOLUTION DECISIONSHuman Decision

ACTIVITY GOVERNED BY CLIENT MANDATEHuman Decision

Explore our Responsible AI framework

04 — PROTECTION BY DESIGN

Protection is built into every governed interaction.

Customer treatment, client mandate, data handling and recorded evidence work together as a controlled protection perimeter around governed recovery activity.

PROTECTION
BY DESIGN

Controlled Operating Perimeter

CUSTOMER

Respectful Engagement

Professional, respectful and governed engagement with clear boundaries around authorised recovery activity.

CLIENT MANDATE

Mandated Boundaries

Activity remains within the scope of the appointing client's authorised mandate and applicable operating requirements.

DATA

Purpose-Bound Info

Information is handled according to its purpose, sensitivity and authorised access level.

EVIDENCE

Recorded Actions

Relevant operational records support traceability, management oversight and client review.

PROTECTION BY DESIGN

Controlled Operating Perimeter

CUSTOMER

Respectful Engagement

Professional, respectful and governed engagement with clear boundaries around authorised recovery activity.

CLIENT MANDATE

Mandated Boundaries

Activity remains within the scope of the appointing client's authorised mandate and applicable operating requirements.

DATA

Purpose-Bound Info

Information is handled according to its purpose, sensitivity and authorised access level.

EVIDENCE

Recorded Actions

Relevant operational records support traceability, management oversight and client review.

05 — INFORMATION GOVERNANCE

Access follows purpose and authority

Not all information is treated the same. Finder & Partners applies different access boundaries according to the purpose, sensitivity and authorised audience of the information.

L0PUBLIC

Approved information intended for public access, including general company, governance and service guidance.

L1QUALIFIED CORPORATE

Approved capability information intended for appropriately qualified corporate or panel enquiries.

L2VERIFIED CORPORATE

Controlled information requiring stronger business verification and specific disclosure approval.

L3INTERNAL RESTRICTED

Internal operational, governance or commercial information available only to authorised personnel and services.

L4OPERATIONAL ISOLATED

Customer- and account-specific operational information maintained within a separate authorised operational security boundary.

Account-specific operational information remains separated from public and corporate knowledge-access pathways.

PUBLIC

QUALIFIED CORPORATE

VERIFIED CORPORATE

INTERNAL RESTRICTED

Separate Operational Boundary

Operational Isolated

L0PUBLIC

Approved information intended for public access, including general company, governance and service guidance.

L1QUALIFIED CORPORATE

Approved capability information intended for appropriately qualified corporate or panel enquiries.

L2VERIFIED CORPORATE

Controlled information requiring stronger business verification and specific disclosure approval.

L3INTERNAL RESTRICTED

Internal operational, governance or commercial information available only to authorised personnel and services.

Separate Operational Boundary

L4OPERATIONAL ISOLATED

Customer- and account-specific operational information maintained within a separate authorised operational security boundary.

Account-specific operational information remains separated from public and corporate knowledge-access pathways.

06 — GOVERNED ENQUIRIES

A clear route for questions and concerns

If you wish to raise a concern, dispute an account, ask about personal-data handling, or make a governance enquiry, Naya can guide you to the appropriate governed process and, where required, authorised human review.

01ACCOUNT / NOTICE

Questions about your account, notices or general enquiries.

02DISPUTE / CONCERN

Raise a dispute or concern about a decision or process.

03DATA & PRIVACY

Enquiries about personal data handling, privacy and your rights.

04GOVERNANCE

Governance, compliance or regulatory related enquiries.

05CORPORATE / PANEL ENQUIRY

Enquiries from corporate clients, panels or authorised organisations.

NAYA

Governed Routing

Knowledge / Process Router

APPROPRIATE GOVERNED PROCESS

Naya guides you to the relevant governed process, policies and guidance.

AUTHORISED HUMAN REVIEW

Where required, your enquiry is escalated for authorised human review.

L4ACCOUNT DATA ISOLATED

Account-specific operational data is isolated from public and corporate knowledge routing.

01ACCOUNT / NOTICE

Questions about your account, notices or general enquiries.

02DISPUTE / CONCERN

Raise a dispute or concern about a decision or process.

03DATA & PRIVACY

Enquiries about personal data handling, privacy and your rights.

04GOVERNANCE

Governance, compliance or regulatory related enquiries.

05CORPORATE / PANEL ENQUIRY

Enquiries from corporate clients, panels or authorised organisations.

NAYA

Governed Routing

Knowledge / process routing into the appropriate governed path.

APPROPRIATE GOVERNED PROCESS

Naya guides you to the relevant governed process, policies and guidance.

AUTHORISED HUMAN REVIEW

Where required, your enquiry is escalated for authorised human review.

L4 — Account Data Isolated

Account-specific operational data is isolated from public and corporate knowledge routing.

Payment Handling Safety Boundary

Finder & Partners does not receive, collect, hold or process customer payments. Payments must be made directly through the authorised payment channels of the appointing client.

OUR GOVERNANCE COMMITMENT

Human accountability remains at the centre of every governed recovery process.

Finder & Partners operates within client appointment mandates, applies controlled access to information, and uses technology to support — not replace — accountable human judgement.

Governance is not an additional layer around our operations. It is part of how those operations are designed.