Unicredit — Board/Management Information 2020

Mar 10, 2020

One Bank, One Team, One UniCredit.

Information on the integration of the Board of Directors

April 9, 2020 Ordinary and Extraordinary Shareholders' Meeting

APRIL 9, 2020, ORDINARY SHAREHOLDERS' MEETING

UniCredit Group - Internal Use Only

Agenda item no. 5: Integration of the Board of Directors

Documents to be filed for possible candidacies

The Shareholders who wish to file resolution proposals on candidacies for the integration of the Board of Directors must give the Company the following documents – in English and in Italian – duly signed and dated:

1) a declaration regarding the candidacy and a statement concerning his/her possessing the requirements necessary to take on the office (see below - annex 1, together with the information notice on the processing and protection of personal data, which the candidate must be aware of);

2) a detailed curriculum vitae;

3) a list of offices held in other companies; and

4) a statement giving analytical evidence of the expertise acquired in the areas of competency envisaged by the Quali-quantitative Profile approved by the Board of Directors and published on the Governance/board of directors section of the Company web-site (see below - annex 2).

The Shareholders must give the Company the above documents, in one of the following modalities:

• (i) until the day before the Shareholders' Meeting, at the its Registered Office "to the attention of the Group Corporate Affairs Department" by any of the following means: a) by hand delivery, during office times (h 8.30-13:00/14:00-17:00); b) through the post, by means of a registered letter with recorded delivery; c) through certified e-mail addressed to corporate.law@pec.unicredit.eu;

• (ii) in the day of the Shareholders' Meeting, during the and at the place of the meeting itself, by hands of Notary or of any Company's personnel.

UniCredit S.p.A.

Milan, March 9, 2020

ATTENTION

The contents of this document are put at the UniCredit Shareholders' disposal merely for information purposes and, as such, are not to be taken as in any way replacing or supplementing the current statutory, regulatory and by-laws provisions with regard to the Directors' appointment, that Shareholders must refer to.

ANNEX 1 - STATEMENT OF CANDIDACY AND DECLARATION ATTESTING THE INEXISTENCE OF REASONS FOR INELIGIBILITY, FORFEITURE AND INCOMPATIBILITY, AS WELL AS REGARDING THE MEETING OF THE REQUIREMENTS PROVIDED FOR BY CURRENT PROVISIONS, ALSO BY REGULATORY ONES.

UniCredit Group - Internal Use Only

I, the undersigned _________________________________ (fiscal code ___________________) born in ______________________________________on (date)______________, nationality __________________________, in relation to the appointment to the office of Director of UniCredit S.p.A., under my own responsibility:

STATE THAT

I accept my candidacy as member of the Board of Directors of UniCredit S.p.A. and I irrevocably accept my possible appointment as Director.

In view of the provisions, inter alia, contained in: Sections 2382 and 2387 of the Italian Civil Code, Section 26 of the Legislative Decree no. 385 dated September 1, 1993, Section 147 quinquies of the Legislative Decree no. 58 dated February 24, 1998 (the "TUF"), the Treasury Decree no. 161 dated 18 March 1998 and the Ministry of Justice Decree no. 162 dated March 30, 2000,

CERTIFY THAT

there are no reasons for my ineligibility, forfeiture or incompatibility and that I meet the requirements provided for by current regulations and other provisions, as well as by the Articles of Association of UniCredit S.p.A., for the appointment as Director and

DECLARE

that I possess the experience requirements referred to in Section 1 of the Ministerial Decree 161, in particular having matured a total experience of minimum three years in one or more of the following activities:

• a) administrative or control activities, or management duties in other companies:

[indicate the activities carried out, the company where such activities took place and the time period]

__________________________________________________________________________________

__________________________________________________________________________________

__________________________________________________________________________________

__________________________________________________________________________________

• b) professional activities in fields of credit, finance, securities, insurance or anyway functional to the activities of the bank:

[indicate the Firm and the time period]

• c) University teachings in the fields of Economy or Law:

[indicate the subject taught, the University and the time period]

• d) administrative or managerial functions in public bodies related with the credit, finance, securities or insurance sectors, otherwise in public bodies that do not have relevance with the aforementioned sectors provided that the tasks pertained the management of economic-financial resources.

[indicate the role, the public body and the time period]

With reference to Clause 20 of the UniCredit Articles of Association, to Sec. 3 of the Corporate Governance Code approved by the Corporate Governance Committee ("Corporate Governance Code for listed companies"), as well as to Sec.s 147-ter, sub-sec. 4, and 148, sub-sec. 3, of the TUF,

UniCredit Group - Internal Use Only

STATE THAT

I meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Sec. 3 of the Corporate Governance Code for listed companies

I DO NOT meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Sec. 3 of the Corporate Governance Code for listed companies

I meet the independence requirements envisaged by Sec. 148(3), of the TUF

I DO NOT meet the independence requirements envisaged by Sec. 148(3), of the TUF

I, the undersigned, also:

• UNDERTAKE, if appointed:
  • to dedicate the time necessary to carry out effectively the office, also taking into account the indications contained in the document "Qualitative and Quantitative Composition of the UniCredit S.p.A. Board of Directors"
  • not to take on administration and control positions within other companies beyond the limits established by the current provisions;
  • to promptly inform UniCredit S.p.A. of any change in the above mentioned circumstances and, on request by the Company, to produce any documentation suitable to confirm the truthfulness of the facts declared;
• - DECLARES to have read the information notice herewith attached concerning the use of personal data from UniCredit S.p.A. and the rights pursuant to the articles 13 and 14 General Data Protection Regulation – GDPR (EU) 2016/679.

Date, _________________ Signed ______________________

Annexes:

• Curriculum vitae
• List of offices held in other companies
• Profile form
• Information notice on the processing and protection of personal data

INFORMATION NOTICE ON THE PROCESSING AND PROTECTION OF PERSONAL DATA¹

UniCredit Group - Internal Use Only

The following information notice aims at providing you with an overview on the use of your personal data by UniCredit S.p.A. and of your rights pursuant to the articles 13 and 14 of the General Data Protection Regulation - Regulation (EU) 2016/679 (hereinafter also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (UniCredit).

The Data Protection Officer (DPO) can be contacted at:

UniCredit S.p.A. Data Protection Office, Piazza Gae Aulenti n. 3, Tower A, 20154 Milano, E-mail: Group.DPO@unicredit.eu, PEC: Group.DPO@pec.unicredit.eu.

2. PURPOSE AND LEGAL BASIS OF PROCESSING

UniCredit processes the personal data in its possession, that is collected directly from you, or from the relevant local administrations to verify, among others, their accuracy for the following purposes:

A. Need to fulfill legal obligations deriving from your role as a Member of the UniCredit's Board of Directors.

These obligations imply, among others, verifying - both during the selection procedures and on an ongoing basis - the compliance: i) with the eligibility requirements for taking on and maintaining the role of Director as well as of specific positions (such as integrity requirements, criteria of correctness, professional experience requirements and competence, independence, time commitment, maximum number of offices covered, respect of the prohibition of interlocking) as required by applicable law, by UniCredit's Articles of Association and by the Corporate Governance Code for listed companies (i.e. Codice di Autodisciplina delle società quotate) as well as ii) with the regulations on the transaction with related parties, and iii) with social security and fiscal obligations linked to the remuneration provided.

To comply with the above-mentioned obligations, in some cases, UniCredit is required to carry out analyses that concern also your relatives² . For this reason, we kindly ask you to let them aware of this Information Notice.

These needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the obligations arising from your role of Director; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

B. Fulfilment of legal obligations and requests from Public and Supervisory Authorities, concerning the process, communication and/or disclosure - also during the selection procedures - on the website www.unicreditgroup.eu and/ or on specific corporate documents (e.g. Prospectus / Corporate Governance Report, Financial Statements) of your data (such as data contained in your curriculum vitae and in the list of the tasks carried out by you, as required by the applicable law, and according to the Articles of Association and the Corporate Governance Code for listed companies).

¹ Directors and related relatives.

²The relatives scope is identified on the basis of the specific applicable regulations.

The needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the legal obligations, the requests from the Authorities, as well as to take on the role of Director of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

UniCredit Group - Internal Use Only

3. CATEGORIES OF PERSONAL DATA PROCESSED

UniCredit processes personal data collected directly from you, or from third parties (e.g. relevant local administrations), which include, but are not limited to, personal data (e.g. name, surname, address, date and place of birth), banking data, information on the financial situation (e.g. patrimonial status, information on credit requests/relationships), positions held and related income, employment relationships, commercial/professional relationships.

This information may concern existing or past relationships with UniCredit as well as with Group Legal Entities or third parties.

3.1 JUDICIAL DATA

UniCredit may process judicial data (i.e. personal data relating to criminal convictions and offences or related security measures, including information on pending proceedings) referring to you, in order to verify the subjective and integrity requirements and/or conditions that prevent from being appointed as Director. In such cases, the processing is necessary to fulfill legal obligations as well as to comply with requests coming from Public or Supervisory Authorities (e.g. filling the questionnaire requested by the ECB). This need represents the legal basis that legitimizes the related data processing. Data provided by you is necessary to comply with the legal obligations; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your data may be communicated to the natural and legal persons that are acting as "Data Processors", listed in the UniCredit premises and on the website www.unicredit.it, as well as – in the quality of persons authorized to process personal data in relation to the data necessary for the performance of the duties they are assigned to – the natural persons belonging to the following categories:

• employees or temporary employees or trainees assigned to the UniCredit HR, PL & BS Management Functions / IAD Budget & Administrative Support / Individual Reports, as well as the UniCredit Group Corporate Affairs, consultants and other natural persons occasionally assigned to these functions;
• employees, temporary workers, interns and consultants of external companies appointed as Data Processors.

Your data may be communicated:

• to those subjects to whom this communication must be carried out in compliance with an obligation established by law (e.g. Bank of Italy and ECB), by a regulation or by EU legislation. Further information can be found on the website www.unicredit.it in the "Privacy" section;
• to Legal Entities belonging to the UniCredit Group (also foreign Legal Entities), subsidiaries or associates under the terms of article 2359 of the Italian Civil Code, when such communication is permitted on the basis of a Garante per la Protezione dei Dati Personali's measure or by a law provision.

The detailed list of subjects to whom the data can be communicated is available on the website www.unicredit.it, in the "Privacy" section.

5. DATA TRANSFER TO THIRD COUNTRIES

UniCredit informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called "Third Countries") if the EU Commission states that the Third Country ensures an adequate level of protection of personal data or in case of other appropriate safeguards, namely when the supplier of UniCredit located in the Third Country contractually ensures an appropriate level of personal data protection (e.g. through the signing of the standard contractual clauses provided by the European Commission), including enforceable and effective data subject rights. Further information can be requested by writing to Group.DPO@unicredit.eu.

UniCredit Group - Internal Use Only

6. DATA PROCESSING MODALITIES

The processing of personal data involves the usage of manual and IT instruments with modalities closely connected with the purposes defined above and, in any case, in such a way to guarantee the security and confidentiality of the data.

7. DATA SUBJECT RIGHTS

GDPR grants and assures specific rights, including the right to know what data concerning you are held by UniCredit, as well as how they are used, and the right to obtain, under certain conditions, the copy, the erasure, the update, the rectification or, if interested, the integration of your data, as well as the right to data portability.

7.1 DATA RETENTION PERIOD AND RIGHT TO ERASURE

UniCredit processes and stores your personal data for all the time you keep the role of Director, to execute the related and connected obligations, to comply with the applicable legal, contractual and regulatory obligations, as well as for its own defensive purposes or those of third parties until the expiration of the longest mandatory retention period provided by the applicable law (i.e. 11 years) starting from the date of termination of the relationship with you.

At the end of the applicable mandatory retention period, your personal data will be erased or kept in a form which does not permit your identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes: i) for resolution of pre-litigation and/or litigation, started before the expiration of the mandatory retention period; ii) to follow up with investigations/inspections by internal control functions and/or external authorities, started before the expiration of the mandatory retention period; iii) to follow up with requests from the Italian and/or foreign Public Authorities, received/notified to UniCredit before the expiration of the mandatory retention period.

8. PROCEDURE TO EXERCISE THE RIGHTS

The e-mail address which you can refer to for the exercise of your rights described in the paragraph 7 is the following one: boardlegaladv@unicredit.eu.

The deadline for the reply is one (1) month, that may be extended for two (2) further months in cases of particular complexity; in these cases, UniCredit informs you about such extension within one (1) month from the receipt of the request.

The exercise of rights is, in principle, free of charge.

9. COMPLAINT OR REPORTING TO THE "GARANTE PER LA PROTEZIONE DEI DATI PERSONALI"

UniCredit informs you that you have the right to lodge a complaint with, or to report to the Garante per la Protezione dei Dati Personali, or else to appeal to the Judicial Authority. The contacts of the Garante per la Protezione dei Dati Personali can be consulted on the website http://www.garanteprivacy.it.

ANNEX 2 - STATEMENT CONCERNING THE KNOWLEDGE/ EXPERTISE ACCRUED IN THE AREAS OF COMPETENCY ENVISAGED BY THE DOCUMENT "QUALITATIVE AND QUANTITATIVE PROFILE OF THE UNICREDIT S.P.A. BOARD OF DIRECTORS"

UniCredit Group - Internal Use Only

I, the undersigned ____________________ (fiscal code ________________) born in ________________ (__________) on the (date) ____________resident in ____________, ________________ nationality_______________, in relation to the appointment to the office of Director of UniCredit S.p.A. – without prejudice to the professional requirements set out by the current regulations - hereby state to possess adequate knowledge of and experience in two or more of the following areas of competency:

(**IMPORTANT** Selecting one or more of the following competencies indicates that you possess it. For your own judgement we include for each competency a description of different occupations and ask you to select one or more. You can specify company name, job titles and period in time that is relevant to support your experience)

- Banking Governance

• Relevant experience achieved through an appropriate number of years (at least 3 years, dating back no more than 10 years) in top executive roles (CEO, General Managers and CEO/GM – 1 level) in a credit institution; • functions such as Legal, Audit and Compliance are considered particularly relevant; • former (or current) mandate as Board Chairman or Committee Chairman in a significant banking group is also relevant; • experience gained in the public sector or in the advisory sector/academia is relevant only if closely related to the credit industry. • All the above criteria are met only where roles have included responsibilities within the geographical remit of the ECB. _______ _____ _______ _____

- Banking Business

• Relevant experience achieved through an appropriate number of years (at least 3 years, dating back no more than 10 years) in top executive roles (CEO, General Managers and CEO/GM – 1 level) relevant to the key business priorities for a credit institution; • former (or current) mandate as Board Chairman or Committee Chairman in a significant banking group is also relevant; • experience gained in the public sector or in the advisory sector is relevant only if closely related to the credit industry. _______ ______ _______ _______

- Risk and Control	• Relevant experience achieved through an appropriate number of years (at least 3 years, dating back no more than 10 years) in top executive roles (CEO, General Managers and CEO/GM – 1 level) in a financial services institution; • all Control functions (Risk, Audit, Compliance) are considered relevant; • former(or current) mandate as Board Chairman or Risk/Audit/Control Committee Chairman in a listed financial service institution is also relevant. • experience gained in the public sector or in the advisory sector/academia is relevant only if acquired in specific subjects related to risk management within the financial services industry. • All the above criteria are met only where roles have included responsibilities within the geographical remit of the ECB. _______ _______ _________
- Legal/ Regulatory	• Relevant experience achieved through an appropriate number of years (at least 3 years, dating back no more than 10 years) in top executive roles (CEO, General Managers and CEO/GM – 1 level) in a financial services institution; • former (or current) mandate as Board Chairman or Committee Chairman in a listed financial service institution is also relevant; • experience gained in the public sector or in the advisory sector/academia is relevant only if acquired in specific subjects related to regulatory and legal framework in connection with banking and financial fields. • All the above criteria are met only where roles have included responsibilities within the geographical remit of the ECB. _______ _____ _______ _____
- Strategic Planning	• Relevant experience achieved through an appropriate number of years (at least 3 years, dating back no more than 10 years) in top executive roles (CEO, General Managers and CEO/GM – 1 level) in large international corporations across industries; • functions such as Finance and Business areas are relevant; • experience gained in the advisory sector is relevant only if acquired in the specific subject. _______ _______ _______ _______

UniCredit Group - Internal Use Only

- Accounting & Audit

• Relevant experience achieved through an appropriate number of years (at least 3 years, dating back no more than 10 years) in top executive roles (CEO, General Managers and CEO/GM – 1 level) in a financial services institution; • functions such as Finance, Accounting and Audit are relevant; former (or current) mandate as Board Chairman or Risk/Audit/Control Committee Chairman in a listed financial service institution is also relevant; • experience gained in the public sector or in the advisory sector/ academia is relevant only if acquired in specific subjects related to accounting and audit. _______ _______ _______ _______

- Financial and International Markets

• Relevant experience achieved through an appropriate number of years (at least 3 years, dating back no more than 10 years) in top executive roles (CEO, General Managers and CEO/GM – 1 level) in large industrial group and/or international corporations across various business areas; • experience gained in the advisory sector/academia is relevant only if directly related to the specific subject. _______ _____ _______ _____

UniCredit Group - Internal Use Only

In addition, please indicate if you possess any experience or exposure to the following areas which are highly considered:

• Sustainability ___________________________________________________ ___________________________________________________ ___________________________________________________ _______________________________

Finally, indicate your international experience and knowledge of specific international markets:

-	_______ _______
International Experience	_________ _______

I undertake to promptly inform UniCredit S.p.A. of any changes in the above status of mine.