Skip to main content

AI assistant

Sign in to chat with this filing

The assistant answers questions, extracts KPIs, and summarises risk factors directly from the filing text.

Unicredit Board/Management Information 2021

Mar 9, 2021

4272_rns_2021-03-09_ea6fcf38-829f-4854-8d06-9c9340b4ade2.pdf

Board/Management Information

Open in viewer

Opens in your device viewer

List no. 1 submitted by the Board of Directors of UniCredit S.p.A.

Publication of the documents concerning the list

April 15, 2021 Ordinary and Extraordinary Shareholders' Meeting

List no. 1 submitted by the Board of Directors of UniCredit S.p.A. – Publication of the documents concerning the list

With reference to point 8 on the Agenda of the Ordinary Shareholders' meeting of Unicredit S.p.A., convened on April 15, 2021, to complete the documentation concerning its own slte of candidates, marked as List no. 1, and that has been already made public to the market on March 3, 2021

Name
Pietro Carlo PADOAN
Designated Chairman
Andrea ORCEL
Designated Chief Executive Officer
Lamberto ANDREOTTI
Elena CARLETTI
Jayne-Anne GADHIA
Jeffrey HEDBERG
Beatriz LARA BARTOLOMÉ
Luca MOLINARI
Maria PIERDICCHI
Renate WAGNER
Alexander WOLFGRING

for each candidate the following documentation is published:

  • - statement of candidacy and possession of the necessary requirements;
  • - curriculum vitae and list of of the supervisory, managerial and controlling offices held in banks and other commercial companies.

Milan, March 8, 2021

The Board of Directors of UniCredit S.p.A.

STATEMENT OF CANDIDACY AND DECLARATION ATTESTING THE INEXISTENCE OF REASONS FOR INELIGIBILITY, FORFEITURE AND INCOMPATIBILITY, AS WELL AS THE MEETING OF THE REQUIREMENTS PROVIDED FOR BY CURRENT PROVISIONS

I, the undersigned Pietro Carlo PADOAN born in Rome (Italy) on 19 January 1950, fiscal code PDNPRC50A19H501D, resident in Rome (Italy), Italian nationality, in relation to the appointment as DIRECTOR/CHAIRMAN OF THE BOARD OF DIRECTORS of UniCredit S.p.A. ("UniCredit" or the "Bank") according to the Agenda of the Shareholders' Meeting convened for 15 April 2021, under my own responsibility,

taking into account the provisions of Section 91 of the Directive 2013/36/EU dated June 26, 2013, as subsequently amended ("CRD IV"), Articles 2382 and 2387 of the Italian Civil Code, Section 26 of Legislative Decree no. 385 dated September 1, 1993 ("TUB"), Sections 147-ter(4) and 147-quinquies of Legislative Decree no. 58 dated February 24, 1998 ("TUF") , the Treasury Decree no. 169 dated November 23, 2020 (the "Decree") and the Ministry of Justice Decree no. 162 dated March 30, 2000, Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code (the "Corporate Governance Code")

STATE THAT

there are no reasons for my ineligibility, forfeiture or incompatibility and that I meet the requirements provided for by current provisions, as well as by the UniCredit Articles of Association for the appointment as DIRECTOR/CHAIRMAN OF THE BOARD OF DIRECTORS; with specific reference to the experience and independence requirements

DECLARE THAT

I. EXPERIENCE REQUIREMENTS

  • 1) I possess the knowledge, skills and experience required by CRD IV, TUB and the Decree, and, in particular, that I have accrued overall experience of at least ten years1 through the exercise of:
    • a) activity of Professor in Economics 2 carried out at La Sapienza University of Rome from

2 Please, indicate:

1 Please, delete the reference period that does not interest, taking into account that: (i) the Chairman of the board of directors and the Chief Executive Officer must have accrued a professional experience of at least ten years; and (ii) the non-executive Directors must have accrued an experience of at least three years.

For the directors with executive posts:

management or control activities or managerial positions held in companies operating in the banking, financial, securities or insurance sectors; and/or

management or control activities or managerial positions held in listed companies or companies whose size and complexity are greater than, or equal to those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed); and

for the directors with non-executive posts, in alternative to the above-mentioned ones:

professional activities practiced in the fields relating to the banking, financial, securities, insurance sectors or anyhow instrumental for the activities of UniCredit; and/or

university teaching (first or second level) of legal or economics subjects, or other subjects instrumental for the banking, financial, securities or insurance sectors; and/or

managerial/executive functions in public organizations or public administration offices relating to the banking, financial, securities or insurance sectors provided that the entity where the corporate officers performed such activities has a size and complexity similar to those of UniCredit.

In addition to the above, the chief executive officer shall possess a specific experience in the fields of banking, financial, securities or insurance, gained through management or control activities or managerial positions held in

1974 to 2007;

  • b) activity of Executive Director carried out at the International Monetary Fund from 2001 to 2005;
  • c) Ministry of Economics and Finance of the Italian Government from 2014 to 2018;

as they result from both the attached curriculum vitae (see Annex 1) and the list of offices3 currently held in banks or other commercial companies4 (see Annex 2);

II. INDEPENDENCE REQUIREMENTS

I meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

OR

I DO NOT meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

***

I meet the independence requirements envisaged by Section 13 of the Decree;

OR

I DO NOT meet the independence requirements envisaged by Section 13 of the Decree;

***

I meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code;

OR

I DO NOT meet the independence requirements envisaged by Clause 20 of the

the banking, financial, securities and insurance sectors, or in listed companies or in companies whose size and complexity are greater than, or equal to, those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed).

3 "Offices" means those: i) held in the board of directors, supervisory board, management board; ii) held in the board of statutory auditors; iii) as general manager, however named; in foreign companies, the offices considered are those equivalent to the ones outlined in points i), ii) and iii) in accordance with the regulations applicable to such companies;

4 "Commercial companies" means: a company with registered office in Italy, established in the form of "società in nome collettivo, società in accomandita semplice, società per azioni, società in accomandita per azioni, società a responsabilità limitata", having as corporate purpose: 1) industrial activity producing goods or services; 2) intermediary activity in the circulation of goods; 3) land, water or air transportation activity; 4) banking or insurance activity; 5) auxiliary activities to the above-mentioned ones; or a company with registered office in a foreign country and qualifying as commercial company in accordance with the provisions of the relevant legislation of the Country where its registered office or head office is located.

UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code.

  • I, the undersigned, also:
  • STATE my candidacy the for election as member of the Board of Directors of UniCredit S.p.A. and, if elected, my willingness to accept my appointment as of now; - UNDERTAKE to promptly inform UniCredit of any changes in the above-mentioned
  • circumstances and, on request by the Company, to produce any documentation suitable to confirm the truthfulness of the facts declared;
  • having read Sections 13 and 14 of the del General Data Protection Regulation Reg.(UE) 2016/679 , and the information notice on the processing of personal data reported in attachment, AUTHORIZE the publication of the information above and the information on personal and professional characteristics mentioned in my curriculum vitae, in the socalled "profile form" and in the list of the offices currently held in banks or other commercial companies.

Date and place: Milan, 01 March 2021

Signed

[ANNEX 1 – CURRICULUM VITAE]

Pier Carlo Padoan has pursued a high standing academic and institutional career both in Italy and at an international level. He has assumed key roles at the service of the Italian State and as Minister of Economy and Finance - guiding the economic policy through structural reforms and stimulus measures that have recorded the Italian economy's highest growth rate in a decade.

Pier Carlo Padoan has taught Economics at the La Sapienza University of Rome, the College of Europe in Bruges and Warsaw, the Université Libre of Brussels, the University of Urbino, the University of La Plata and Tokyo.

Between 1998 and 2001, he was the economic advisor to the President of the Council of Ministers, responsible for coordinating the Italian position in the negotiations of the Agenda 2000 for the EU budget, the Lisbon Agenda, the European Council, bilateral meetings and the G8 meetings.

He lived and worked in Washington (United States) as Executive Director of the International Monetary Fund. As a member of the board, he was involved in the decision-making processes relating to interventions carried out in numerous countries. In 2007, he settled in Paris (France), where he assumed the post of Deputy Secretary General of the Organization for Economic Cooperation and Development (OECD), where he has also been chief economist since 2009.

In February 2014 he was appointed Minister of Economy and Finance of the Italian government, a post he held until May 2018 in two successive governments.

As independent he was elected in 2018 to the Chamber of Deputies of the Italian Republic and was a member of the Budget Commission. He remained in Parliament until 4 November 2020. He has been a member of the Board of Directors of UniCredit since October 2020.

On 25 January 2021 he was appointed member of the Board of the Institute of International Finance (IIF).

In 2017 he led the G7 of finance under the Italian presidency, with an articulated agenda that included the debate on the role of regional development banks and the analysis of the implications of economic policies for inequality and sustainability.

The direct contribution of the OECD to the work of the G20 highlights the significant experience in the coordination of international initiatives, the development of global policies and the management of complex groups made up of different stakeholders. All of which show a particular ability to resolve conflicts, carry out direct confrontation and orient the work towards a common goal.

Date and place, Milan, 1 March 2021
Signed ______

ANNEX 2 – LIST OF THE OFFICES CURRENTLY HELD IN BANKS OR OTHER COMMERCIAL COMPANIES

No administrative, managerial and control Offices held in any Italian or foreign companies.

Date and place, Milan, 1 March 2021

Signed ______________________________

ANNEX 3 - INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA BY UNICREDIT

The following information notice aims at providing you with an overview on the use of your personal data by UniCredit S.p.A. and of your rights pursuant to the General Data Protection Regulation - Regulation (EU) 2016/679 (hereinafter also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (UniCredit).

The Data Protection Officer (DPO) can be contacted at:

UniCredit S.p.A. Data Protection Office, Piazza Gae Aulenti n. 1, Tower B, 20154 Milano, E-mail: [email protected], PEC: [email protected].

2. PURPOSE AND LEGAL BASIS OF PROCESSING

UniCredit processes the personal data in its possession, that is collected directly from you, or from the relevant local administrations to verify, among others, their accuracy for the following purposes:

A. Need to fulfill legal obligations deriving from your candidacy as a Member of the UniCredit's Board of Directors.

These obligations imply, among others, verifying - both during the selection procedures and on an ongoing basis - the compliance: i) with the eligibility requirements for taking on and maintaining the role of Director as well as of specific positions (such as integrity requirements, criteria of correctness, professional experience requirements and competence, independence, time commitment, maximum number of offices covered, respect of the prohibition of interlocking) as required by applicable law, by UniCredit's Articles of Association and by the Corporate Governance Code (i.e. Codice di Corporate Governance) as well as with social security and fiscal obligations linked to the remuneration provided.

To comply with the above-mentioned obligations, in some cases, UniCredit is required to carry out analyses that concern also your relatives5 . For this reason, we kindly ask you to let them aware of this Information Notice.

These needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the obligations arising from your role of member of UniCredit's Board of Directors; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

5 The relatives scope is identified on the basis of the specific applicable regulations.

B. Fulfilment of legal obligations and requests from Public and Supervisory Authorities, concerning the process, communication and/or disclosure - also during the selection procedures - on the website www.unicreditgroup.eu and/ or on specific corporate documents (e.g. Prospectus / Corporate Governance Report, Financial Statements) of your data (such as data contained in your curriculum vitae and in the list of the tasks carried out by you in other banks and commercial companies, as required by the applicable law, and according to the Articles of Association and the Corporate Governance Code).

The needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the legal obligations, the requests from the Authorities, as well as to take on the role of member of the Board of Directors of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

3. CATEGORIES OF PERSONAL DATA PROCESSED

UniCredit processes personal data collected directly from you, or from third parties (e.g. relevant local administrations), which include, but are not limited to, personal data (e.g. name, surname, address, date and place of birth), banking data, information on the financial situation (e.g. patrimonial status, information on credit requests/relationships), positions held and related income, employment relationships, commercial/professional relationships.

This information may concern existing or past relationships with UniCredit as well as with Group Legal Entities or third parties.

3.1 JUDICIAL DATA

UniCredit may process judicial data (i.e. personal data relating to criminal convictions and offences or related security measures, including information on pending proceedings) referring to you, in order to verify the subjective and integrity requirements and/or conditions that prevent from being appointed as member of the Board of Directors of UniCredit.

In such cases, the processing is necessary to fulfill legal obligations as well as to comply with requests coming from Public or Supervisory Authorities (e.g. filling the questionnaire requested by the ECB). This need represents the legal basis that legitimizes the related data processing. Data provided by you is necessary to comply with the legal obligations; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your data may be communicated to the natural and legal persons that are acting as "Data Processors", listed in the UniCredit premises and on the website www.unicredit.it, as well as – in the quality of persons authorized to process personal data in relation to the data necessary for the performance of the duties they are assigned to – the natural persons belonging to the following categories:

  • employees or temporary employees or trainees assigned to the UniCredit HR, PL & BS Management Functions / IAD Budget & Administrative Support / Individual Reports, as well as the UniCredit Group Corporate Affairs, consultants and other natural persons occasionally assigned to these functions;
  • employees, temporary workers, interns and consultants of external companies appointed as Data Processors.

Your data may be communicated:

  • to those subjects to whom this communication must be carried out in compliance with an obligation established by law (e.g. Bank of Italy and ECB), by a regulation or by EU legislation. Further information can be found on the website www.unicredit.it in the "Privacy" section;
  • to Legal Entities belonging to the UniCredit Group (also foreign Legal Entities), subsidiaries or associates under the terms of article 2359 of the Italian Civil Code, when such communication is permitted on the basis of a Garante per la Protezione dei Dati Personali's measure or by a law provision.

The detailed list of subjects to whom the data can be communicated is available on the website www.unicredit.it, in the "Privacy" section.

5. DATA TRANSFER TO THIRD COUNTRIES

UniCredit informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called "Third Countries") if the EU Commission states that the Third Country ensures an adequate level of protection of personal data or in case of other appropriate safeguards, namely when the supplier of UniCredit located in the Third Country contractually ensures an appropriate level of personal data protection (e.g. through the signing of the standard contractual clauses provided by the European Commission), including enforceable and effective data subject rights. Further information can be requested by writing to [email protected].

6. DATA PROCESSING MODALITIES

The processing of personal data involves the usage of manual and IT instruments with modalities closely connected with the purposes defined above and, in any case, in such a way to guarantee the security and confidentiality of the data.

7. DATA SUBJECT' RIGHTS

GDPR grants and assures specific rights, including the right to know what data concerning you are held by UniCredit, as well as how they are used, and the right to obtain, under certain conditions, the copy, the erasure, the update, the rectification or, if interested, the integration of your data, as well as the right to data portability.

7.1 DATA RETENTION PERIOD AND RIGHT TO ERASURE

UniCredit processes and stores your personal data for all the time you keep the role of Director, to execute the related and connected obligations, to comply with the applicable legal, contractual and regulatory obligations, as well as for its own defensive purposes or those of third parties until the expiration of the longest mandatory retention period provided by the applicable law (i.e. 11 years) starting from the date of termination of the relationship with you. UniCredit processes and stores your personal data even after the expiry of the employment relationship when this is necessary for archiving purposes for historical research purposes, according, to the methods set out in the "Ethical rules of processing for archiving purposes in the public interest or historical research"6 .

At the end of the applicable mandatory retention period, your personal data will be erased

6 Record of the provisions 19th december 2018, n. 513

or kept in a form which does not permit your identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes: i) for resolution of pre-litigation and/or litigation, started before the expiration of the mandatory retention period; ii) to follow up with investigations/inspections by internal control functions and/or external authorities, started before the expiration of the mandatory retention period; iii) to follow up with requests from the Italian and/or foreign Public Authorities, received/notified to UniCredit before the expiration of the mandatory retention period.

8. PROCEDURE TO EXERCISE THE RIGHTS

The e-mail address which you can refer to for the exercise of your rights described in the paragraph 7 is the following one: [email protected].

The deadline for the reply is one (1) month, that may be extended for two (2) further months in cases of particular complexity; in these cases, UniCredit informs you about such extension within one (1) month from the receipt of the request.

The exercise of rights is, in principle, free of charge.

9. COMPLAINT OR REPORTING TO THE "GARANTE PER LA PROTEZIONE DEI DATI PERSONALI"

UniCredit informs you that you have the right to lodge a complaint with, or to report to the Garante per la Protezione dei Dati Personali, or else to appeal to the Judicial Authority. The contacts of the Garante per la Protezione dei Dati Personali can be consulted on the website http://www.garanteprivacy.it.

STATEMENT OF CANDIDACY AND DECLARATION ATTESTING THE INEXISTENCE OF REASONS FOR INELIGIBILITY, FORFEITURE AND INCOMPATIBILITY, AS WELL AS THE MEETING OF THE REQUIREMENTS PROVIDED FOR BY CURRENT PROVISIONS

I, the undersigned Mr. Andrea ORCEL born in Rome (Italy) on 14 May 1963, fiscal code RCLNDR63E14H501E, resident in Lisbon (Portugal), Italian nationality, in relation to the appointment to the office of DIRECTOR/CHIEF Executive OrFICER' in UniCredit S.p.A. ("UniCredit" or the "Bank") according to the Agenda of the Shareholders' Meeting convened for 15 April 2021, under my own responsibility,

taking into account the provisions of Section 91 of the Directive 2013/36/EU dated June 26, 2013, as subsequently amended ("CRD IV"), Articles 2382 and 2387 of the Italian Civil Code, Section 26 of Legislative Decree no. 385 dated September 1, 1993 ("TUB"), Sections 147-terf4) and 147-quinquis of Legislative Decree no. 58 dated February 24, 1998 ("TUF") , the Treasury Decree no. 169 dated November 23, 2020 (the "Decree") and the Ministry of Justice Decree no. 162 dated March 30, 2000, Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code (the "Corporate Governance Code")

STATE THAT

there are no reasons for my ineligibility, forfeiture or incompatibility and that I meet the requirements provided for by current provisions, as well as by the UniCredit Aricles of Association for the appointment as DIRECTOR/CHIEF ExECUTIVE OFFICER; with specific reference to the experience and independence requirements

DECLARE THAT

EXPERIENCE REQUIREMENTS I.

  • 1) I possess the knowledge, skills and experience required by CRD IV, TUB and the Decree, and in particular that I have accrued overall experience of at least ten years2 through the exercise of:
    • a) activity of Co-Head of Financial Institutions Group for Europe, Middle East & Africa'

3 Please, indicate:

  • management or control activities or managerial positions held in companies operating in the banking, financial, securities or insurance sectors; and/or
  • management or control activities or managerial positions held in listed companies or companies whose size and complexity are greater than, or equal to those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed); and

for the directors with non-executive posts, in alternative to the above-mentioned ones:

1 Please, indicate the post as: (i) Chairman of the board of directors; (i) Chief Executive Officer; or (iii) nonexecutive Director.

2 Please, delete the reference period that does not interest, taking into account that: (i) the Chairman of the board of directors and the Chief Executive Officer must have accuult that. 7/10 Charman of the board.
Gil the non-areautive Director and have accued a professional experience of at (ii) the non-executive Directors must have accrued an experience of at least three years.

For the directors with executive posts:

- professional activities practiced in the fields relating to the banking, financial, securities, insurance sectors or anyhow instrumental for the activities of UniCredit; and/or

university teaching (first or second level) of legal or economics subjects, or other subjects instrumental for the banking, financial, securities or insurance sectors; and/or

carried out at Merrill Lynch then Bank of America from 1999 to 2003;

  • b) activity of Head of Global Financial Institutions Group carried out at Merrill Lynch then Bank of America from 2003 to 2007;
  • c) activity of Head of Origination and Co-President of Global Markets and Investment Banking for Europe, Middle East & Africa carried out at Merrill Lynch then Bank of America from 2004 to 2007;
  • d) activity of Head of Global Origination, President of EMEA Global Markets & Investment Banking and member of Merrill Lynch Management Committee carried out at Merrill Lynch then Bank of America from 2007 to 2009;
  • e) activity of President of International Global Banking, Securities & Wealth Management; Head of International Corporate and Investment Banking carried out at Merrill Lynch then Bank of America in 2009;
  • f) activity of Executive Chairman of the Investment Bank and President of Emerging Markets ex Asia carried out at Merrill Lynch then Bank of America from 2009 to 2012:
  • g) activity of Member of Group Executive Board carried out at UBS in 2012 to 2012 to
  • h) activity of President, Investment Bank carried out at UBS from 2012 to 2012 10
  • i) activity of CEO, UBS Limited and UBS AG London Branch (UK SMF1) carried out at UBS from 2014 to 2018;
  • j) activity of Member of the Board of UBS Americas carried out at UBS from 2016 to 2018
  • k) activity of Senior Officer Outside of Australia (SOOA) from 2016 to 2018

as they result from both the attached curriculum vitae (see Annex 1) and the list of offices 4 currently held in banks or other commercial companies5 (see Annex 2);

II. INDEPENDENCE REQUIREMENTS

I meet the independence requirements envisaged by Section 147-ter (4) in conjunction with Section 148(3) of the TUF;

OR

- - managerial/executive functions in public organizations or public administration offices relating to the banking, financial, securities or insurance sectors provided that the entity where the corporate officers performed such activities has a size and complexity similar to those of UniCredit.

In addition to the above, the chief executive officer shall possess a specific experience in the fields of banking, financial, securities or insurance, gained through management or control activities or managerial positions held in the banking, financial, securities and insurance sectors, or in listed companies or in companies whose size and complexity are greater than, or equal to, those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed).

4 "Offices" means those: i) held in the board of directors, supervisory board, management board; if) held in the board of statutory auditors; iii) as general manager, however named; in foreign companies, the offices considered are those equivalent to the ones outlined in points i), ii) and iii) in accordance with the regulations applicable to such companies;

5 "Commercial companies" means: a company with registered office in Italy, established in the form of "socità in nome collettivo, società in acomandita semplia, società in acomanità per azioni, società a responsabità initità " having as corporate purpose: 1) industrial activity producing goods or services; 2) intermediary activity in the circulation of goods; 3) land, water or air transportation activity; 4) banking or insurance activity; 5) auxiliary activities to the above-mentioned ones; or a company with registered office in a foreign country and qualifying a commercial company in accordance with the provisions of the relevant legislation of the Country where its registered office or head office is located.

I DO NOT meet the independence requirements envisaged by Section 147-ter (4) in conjunction with Section 148(3) of the TUF;

***

I meet the independence requirements envisaged by Section 13 of the Decree;

OR

  • I DO NOT meet the independence requirements envisaged by Section 13 of the Decree;
  • I meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Conceedit Governance Code;

***

OR

I DO NOT meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code.

I, the undersigned, also:

  • STATE my candidacy the for election as member of the Board of Directors of UniCredit S.p.A. and, if elected, my willingness to accept my appointment as of ccov;
  • UNDERTAKE to promptly inform UniCredit of any changes in the above-mentioned circumstances and, on request by the Company, to produce any documentation suitable to confirm the truthfulness of the facts declared;
  • having read Sections 13 and 14 of the del General Data Protection Regulation Reg.(UE) 2016/679 , and the information notice on the processing of personal data reported in attachment, AUTHORIZE the publication of the information above and the information on personal and professional characteristics mentioned in my curreculum uitae, in the socalled "profile form" and in the list of the offices currently held in banks or other commercial companies.

March 4th, 20d1 Date and place, Signed

Annex 1 - Curriculum Vitae

Andrea Orcel

Senior Leader - Successfully managed diverse businesses and geographies. Most visible achievement is the design and execution of UBS Investment Bank turnaround, transforming it from an unfocused, inefficient, value destructive operation where culture was an after thought into one leading in selected businesses, highly efficient, consistently among the most profitable on the Street and where a distinctive high integrity winning culture was the foundation. The focused, capital-light, higher risk adjusted returns-profitable growth model as well as the culture transformation now serve as a blueprint for the industry.

Senior Investment Banker - Successfully designed and executed most of the most innovative and complex mergers & acquisition and capital market transactions in Europe, Middle East & Africa of the last 25 years. Developed superior ability to understand and communicate with top management teams, board of directors, investors and other stakeholders, design and execute successfully acquisition, defense and disposal strategies and prepare companies for IPOs, equity and debt raising in public and private markets.

Relationships - Maintains strong personal relationships of a "trusted advisor" nature with most European banks' top management as well as several corporates, sovereign wealth funds and private equity firms globally.

UBS (2012-2019)

Member of Group Executive Board (since July 2012)

President, Investment Bank (since July 2012)

  • Designed and led the Investment Bank restructuring, repositioning and turnaround. Led extensive use of AI, Data and other technology based solutions

CEO, UBS Limited and UBS AG London Branch (UK SMF1) (since December 2014) - Responsible for all UBS operations in the UK and senior contact for UK industry regulators

Member of the Board of UBS Americas Holding LLC and senior contact for US industry regulators (since 2016)

Senior Officer Outside of Australia and senior contact for Australia industry regulators (since January 2016)

Member of the Board of UBS Optimus Foundation, a grant-making foundation dedicated to improving the lives of children worldwide. This includes the world's first Development Impact Bond - Educate Girls - in India; and Last Mile Health, delivering lifesaving healthcare services to remote communities

Senior Sponsor and Leader for Diversity and Talent Development in the Investment Bank and the UK; key sponsor for UBS longstanding collaboration with the Bridge Academy in Hackney.

Merrill Lynch then Bank of America (1992-2012)

Executive Chairman of the Investment Bank and President of Emerging Markets ex Asia (Bank of America - 2009 )

President of International Global Banking, Securities & Wealth Management; Head of International Corporate and Investment Banking (Bank of America - 2009 )

Head of Global Origination, President of EMEA Global Markets & Investment Banking and member of Merrill Lynch Management Committee (Merrill Lynch – 2007)

Head of Origination and Co-President of Global Markets and Investment Banking for Europe, Middle East & Africa (Merrill Lynch – 2004)

Head of Global Financial Institutions Group (Merrill Lynch – 2003)

Co-Head of Financial Institutions Group for Europe, Middle East & Africa (Merrill Lynch – 1999)

Boston Consulting Group (1990-1992)

Consultant with focus on new strategies and restructuring

Goldman Sachs (1988-1989)

Associate Fixed Income division

Midland Montagu (1987-1988)

Associate Fixed Income division

Education

MBA, INSEAD (1990) B.A. Economics and Commerce, University of Rome (1986) Baccalauréat in Maths and Physics, Lycée Chateaubriand, Rome (1981)

Languages

Fluent in English, Italian, Spanish and French; working knowledge of Portuguese

Mergers & Acquisitions

  • 2018 Banca Intesa Sanpaolo combination of credit servicing activities with Intrum
  • 2016 Bank Pekao sale of 33% o to PZU/PFR for €2.4bn Banca Intesa Sanpaolo sale of Setefi to Bain/Advent/Clessidra €1.0bn
  • 2015 Unicredit sale of servicing platform (UCCMB) (incl. €2.4bn NPLs portfolio) to Fortress
  • 2014 Santander minority offer for Banco Santander Brazil €4.7bn
  • 2012 Kredyt Bank merger with BZ WBK, €5.0bn
  • 2011 KBC sale of Kredyt Bank to Santander Santander disposal of Santander Colombia to Corpbanca, \$1.2bn Iberdrola acquisition of 20% stake in Iberdrola Renovables, \$2bn Russian Federation, advisor for the privatization of VTB Bank, \$3.3bn Santander / Zurich Latin America banking and insurance partnership, \$2.1bn FROB disposal of Banco CAM, €5.2bn
  • 2010 Santander acquisition of 25% in Santnder Mexico from Bank of America Uralkali / Silvinit merger, \$10bn Qatar Holdings acquisition of 5% of Banco Santander Brazil, \$2.7bn Santander acquisition of BZWBK, \$5.8bn
  • 2009 Santander acquisition of Sovereign Bancorp, \$1.9bn
  • 2008 Sale of CR Firenze to Banca Intesa €4.0bn United Company Rusal acquisition of 25% of OJSC MMC Norilsk Nickel Santander acquisition of Alliance & Leicester, £1.3bn
  • 2007 Santander disposal of pension fund businesses in LatAm, \$1.3bn Spin-off of Bank BPH 285 branches to Bank Pekao and sale for €625m of residual Bank BPH to GE Money Monte dei Paschi Siena acquisition of Antonveneta, €9.0bn Delisting of Banca Fideuram RBS - Fortis - Santander Tender offer on ABN Amro, €71.1bn Endesa defence from various hostile bids, €42.5bn UniCredit merger with Capitalia, €22.0bn
  • 2006 Banca Intesa sale of Cariparma and Friuladria to Credit Agricole Creation of Natixis, €24bn RAS merger into Allianz, €5.7bn Banca Intesa merger with Sanpaolo IMI, €65.0bn
  • 2005 UniCredit tender offer on HVB, BACA and BPH €19.2bn Advisor to BBVA in its disposal of the stake in BNL, €1.4bn Santander, Endesa & Unión Fenosa sale of Amena & Auna to France Telecom & ONO, €12.8bn
  • 2004 Santander acquisition of Abbey National, €12.8bn

2003 Banco Santander Chile merger, \$1.8bn Acquisition of relevant stakes in Generali by major Italian financial institutions (including UniCredit, Capitalia, MPS, foundations, etc)

  • 2002 French Government sale of stake in Credit Lyonnais, €2.2bn Rolo Banca and other subsidiaries minorities buy out by UniCredit €4bn
  • 2001 Caisse d'Epargne merger with Caisse des Depots et Consignations, €8.2bn Banca Intesa acquisition of Banca Commerciale Italiana, €3.6bn BNP Paribas acquisition of BancWest, €4.7bn Société Générale acquisition of Komercni Banka (Czech), €1.2bn Société Générale acquisition of Gefa/ALD (Germany), €1.0bn
  • 2000 Sale of Pioneer to UniCredit, \$1.2bn Santander acquisition of Banespa, \$3.6bn

BBVA acquisition of Bancomer, \$2.5bn

BNP merger with Paribas, \$13.2bn

  • 1999 UniCredit acquisition of Bank Pekao in Poland, €1.0bn BBV merger with Argentaria to create BBVA, \$11.4bn
  • 1998 Combination of Credito Italiano and Unicredito to create UniCredit €10.9bn
  • 1995 BCP acquisition of BPA, \$2bn

Capital Raising / Financing

  • 2017 Unicredit €13.0bn largest ever Italian Rights Issue Structuring advisor and global coordinator
  • 2016 Banco Popular Rights Issue €2.5bn
  • 2015 Santander non pre-emptive capital increase €7.5bn, largest ever in EMEA MPS Rights Issue €3.0bn
  • 2014 MPS Rights issue €5.0bn Fineco IPO €774m subsequent ABBs for 30% (2016) Banco Popolare Rights Issue €1.5bn
  • 2013 Bank Zachodni WBK Re-IPO \$1.5bn Bank Pekao ABBs of 9% stake, subsequent ABB for 10% and equity-linked certificate exchangeable into 7% (2016)
  • 2012 UniCredit Rights Issue, €7.5bn Santander Mexico IPO \$4.1bn
  • 2011 Bankia IPO, \$4bn Glencore IPO, \$10bn Intesa Sanpaolo Rights Issue, €5bn VTB privatization, \$3.3bn Banco Popolare Rights Issue, €2bn Danske Bank Right Issue, \$3.7bn Santander 7.8% follow-on offering in Santander Chile, \$1.0bn
  • 2010 Bank of America sale of 24.9% stake in Serfin to Banco Santander, \$2.5bn Rusal IPO, \$2.5bn UniCredit Rights Issue, €4bn
  • 2009 Gartmore IPO, \$600m Société Générale Rights Issue, €4.8bn Santander Brazil IPO, €4.8bn Swedbank Rights Issue, \$1.5bn Mizuho Financial Group Global Add on Offering, \$6.0bn Caisse des Depots et Consignations Advisory & Capital injection to Dexia SA, \$3bn Nordea Ab Rights Issue, \$3.3bn UniCredit Rights Issue, €4bn UniCredit €3.0bn CASHES issuance – structuring advisor Iberdrola capital increase, €1.3bn
  • 2008 Fortis primary ABB €2.3bn Santander Rights Issue, €7.2bn GALP AGT by Iberdrola, €478m Dexia Reserved Capital Increase, €6.4bn Natixis Rights Issue, \$5.4bn RBS Rights Issue, £12.2bn / \$24.5bn Monte dei Paschi Siena Rights Issue, €5.0bn Rusal Acquisition Financing, \$13.1bn Société Générale Rights Issue, \$8.1bn BCP Rights Issue, €1.3bn MPS Rights Issue, €5bn
2007 Marfin IPO, €5.2bn
Fortis Rights Issue, €13.4bn
Iberdrola Renovables IPO, €4.5bn
OJSC Polymetal IPO, \$605m
2006 Société
Générale Rights Issue, \$3.0bn
BBVA capital increase, €3.0bn
Galp IPO, €1,091m
BME IPO, €779mn
CRF Rights Issue, €150m
2005 Santander / RBS: unwinding of cross-shareholding, €2.0bn
Novolipetsk Steel (NLMK) follow on \$609m
Banca Intesa AGT on BCP, €532m
Merrill Lynch acquisition of non-performing loans from Intesa, €9.1bn
2004 Azimut IPO, €380m
2003 BCP Rights Issue, €930mn
UniCredit exchangeable in Generali shares
2001 Santander AGT, €900mn
2000 Foundations AGT on BBV, €630m
Santander capital increase, €3.8bn
  • Foundation Cariverona AGT on UniCredito Italiano Shares, €250m
  • 1998 Carige Secondary Offering, €103m
  • 1993 Credito Italiano Privatization, €1.6bn BNP Privatization, €3.8bn

[ANNEX 2 – LIST OF THE OFFICES CURRENTLY HELD IN BANKS OR OTHER COMMERCIAL COMPANIES"]

Non Executive Director at EIS, California, USA.

Date and place, Mace, MACK 4 M
1 1
Signed

6 Please, indicate: the management or control or managerial positions held in banks or other commercial companies in Italy or abroad.

If negative, please indicares : "No management or control or managerial positions held in banks or other commercial companies in Italy or abroad".

ANNEX 3 - INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA BY UNICREDIT

The following information notice aims at providing you with an overview on the use of your personal data by UniCredit S.p.A. and of your rights pursuant to the General Data Prour Regulation - Regulation (EU) 2016/679 (hereinafter also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (UniCredit).

The Data Protection Officer (DPO) can be contacted at:

UniCredit S.p.A. Data Protection Office, Piazza Gae Aulenti n. 1, Tower B, 20154 Milano, E-mail: [email protected], PEC: [email protected].

2. PURPOSE AND LEGAL BASIS OF PROCESSING

UniCredit processes the personal data in its possession, that is collected directly from you, or from the relevant local administrations to verify, among others, their accuracy for the following purposes:

A. Need to fulfill legal obligations deriving from your candidacy as a Member of the UniCredit's Board of Directors.

These obligations imply, among others, verifying - both during the selection procedures and on an ongoing basis - the compliance: : i) with the eligibility requirements for taking on and maintaining the role of Director as well as of specific positions (such as integrity requirements, criteria of correctness, professional experience requirements and competence, independence, time commitment, maximum number of offices covered, respect of the prohibition of interlocking) as required by applicable law, by UniCerdit's Articles of Association and by the Corporate Governance Code (i.e. Codice di Corporate Governance) as well as with social security and fiscal obligations linked to the remuneration provided.

To comply with the above-mentioned obligations, in some cases, UniCredit is required to carry out analyses that concern also your relatives'. For this reason, we kindly ask you to let them aware of this Information Notice.

These needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the obligations arising from your role of member of UniCredit's Board of Directors; without your personal data, UniCredit would not be in a position to establish a relationship with your or to comply with

7 The relatives scope is identified on the basis of the specific applicable regulations.

the law obligations.

B. Fulfilment of legal obligations and requests from Public and Supervisory Authorities, concerning the process, communication and/or disclosure - also during the selection procedures - on the website www.unicreditgroup.eu and/ or on specific corporate documents (e.g. Prospectus / Corporate Governance Report, Financial Statements) of your data (such as data contained in your curriculum vitae and in the list of the tasks carried out by you in other banks and commercial companies, as required by the applicable law, and according to the Articles of Association and the Corporate Governon one adde.

The needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the legal obligations, the requests from the Authorities, as well as to take on the role of member of the Board of Directors of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

3. CATEGORIES OF PERSONAL DATA PROCESSED

Unic redit processes personal data collected directly from you, or from third parties (e.g. relevant local administrations), which include, but are not limited to, personal data (e.g. felevant address, date and place of birth), banking data, information on the financial situdio (6.9 patrimonial status, information on credit requests/relationships), positions held and related income, employment relationships, commercial/professional relationships.

This information may concern existing or past relationships with UniCredit as well as with Group Legal Entities or third parties.

3.1 JUDICIAL DATA

Unic redit may process judicial data (i.e. personal data relating to criminal convictions and offences or related security measures, including information on pending proceedings) referring to you, in order to verify the subjective and integrity requirements and/or conditions that prevent from being appointed as member of the Board of Directors of Uits redt.

In such cases, the processing is necessary to fulfill lagal obligations as well as to comply with requests coming from Public or Supervisory Authorities (e.g. filling the questionnaire requested by the ECB). This need represents the legal basis that legitimizes the related data processing. Data provided by you is necessary to comply with the legal obligations; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your data may be communicated to the natural and legal persons that are acting as "Data Processors", listed in the UniCredit premises and on the website www.unicredit.it, as well as - in the quality of persons authorized to process personal data in relation to the data necessary for the performance of the duties they are assigned to – the natural persons belonging to the following categories:

employees or temporary employees or trainees assigned to the UniCredit HR, PL & BS Management Functions / IAD Budget & Administrative Support / Individual Int, IT & B D as well as the UniCredit Group Corporate Affairs, consultants and other natural persons occasionally assigned to these functions;

employees, temporary workers, interns and consultants of external companies appointed as Data Processors.

Your data may be communicated:

  • · to those subjects to whom this communication must be carried out in compliance with an obligation established by law (e.g. Bank of Italy and ECB), by a regulation or by EU legislation. Further information can be found on the website www.unicredit.it in the "Privacy" section;
  • · to Legal Entities belonging to the UniCredit Group (also foreign Legal Entities), subsidiaries or associates under the terms of article 2359 of the Italian Civil Code, when such communication is permitted on the basis of a Garante per la Protezine dei Dati Personali's measure or by a law provision.

The detailed list of subjects to whom the data can be communicated is available on the website www.unicredit.it, in the "Privacy" section.

5. DATA TRANSFER TO THIRD COUNTRIES

UniCredit informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called "Third Countries") if the EU Commission states that the Third Country ensures an adequate level of protection of personal data or in case of other appropriate safeguards, namely when the supplier of UniCredit located in the Third Country contractually ensures an appropriate level of personal data protection (e.g. through the signing of the standard contractual clauses provided by the European Commission), including enforceable and effective data subject rights. Further information can be requested by writing to [email protected].

6. DATA PROCESSING MODALITIES

The processing of personal data involves the usage of manual and IT instruments with modalities closely connected with the purposes defined above and, in any case, in such a way to guarantee the security and confidentiality of the data.

7. DATA SUBJECT' RIGHTS

GDPR grants and assures specific rights, including the right to know what data concerning you are held by UniCredit, as well as how they are used, and the right to obtain, under certain conditions, the copy, the erasure, the update, the rectification or, if interested, the integration of your data, as well as the right to data portability.

7.1 DATA RETENTION PERIOD AND RIGHT TO ERASURE

Unicredit processes and stores your personal data for all the time you keep the role of Director, to execute the related and connected obligations, to comply with the applice ble of contractual and regulatory obligations, as well as for its own defensive purposes or those of third patties until the expiration of the longest mandatory retention period provided by the applicable law (i.e. 11 years) starting from the date of technon provided by you. UniCredit processes and stores your personal data even after the expiry of the employment

relationship when this is necessary for archiving purposes for historical research purposes, according, to the methods set out in the "Ethical rules of processing for archiving purposes in the purposes in the public interest or historical research's.

At the end of the applicable mandatory retention period, your personal data will be erased or kept in a form which does not permit your identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes: i) for resolution of pre-litigation and/or litigation, statted before the expiration of the mandatory retention period; ii) to follow up with investigations/inspections/inspections by internal control functions and/or external authorities, started before the expirations by mandatory retention period; iii) to follow up with requests from the Italian and/of foreign Public Authorities, received/notified to UniCredit before the expiration of the manan of retention period.

8. PROCEDURE TO EXERCISE THE RIGHTS

The e-mail address which you can refer to for the exercise of your rights described in the paragraph 7 is the following one: [email protected].

The deadline for the reply is one (1) month, that may be extended for two (2) further months in cases of particular complexity; in these cases, UniCredit informs you about such extension within one (1) month from the receipt of the request.

The exercise of rights is, in principle, free of charge.

9. COMPLAINT OR REPORTING TO THE "GARANTE PER LA PROTEZIONE DEI DATI PERSONALI'

UniCredit informs you that you have the right to lodge a complaint with, or to report to the Garante per la Protezione dei Dati Personali, or else to appeal to the Judicial Authority. The corrante of the Garante per la Protezione dei Dati Personali can be consulted on the website http://www.garanteprivacy.it.

8 Record of the provisions 19th december 2018, n. 513

STATEMENT OF CANDIDACY AND DECLARATION ATTESTING THE INEXISTENCE OF REASONS FOR INELIGIBILITY, FORFEITURE AND INCOMPATIBILITY, AS WELL AS THE MEETING OF THE REQUIREMENTS PROVIDED FOR BY CURRENT PROVISIONS

I, the undersigned Lamberto ANDREOTTI born in Rome (Italy) on 6 July 1950, fiscal code NDRLBR501H, resident in Milan (Italy), nationality Italian, in relation to the appointment to the Agenda of the Shart or in UniCredit S.p.A. ("UniCredit" or the "Bank") according to the Agenda of the Shareholders' Mecting convened for 15 April 2021, "Man").
own responsibility own responsibility,

taking into account the provisions of Section 91 of the Directive 2013/36/EU dated June 26, 2013, as subsequently amended ("CRD IV"), Articles 2382 and 2387 of the Italian Civil Code, Section 26 of Legislative Decree no. 35, dated September 1, 1993 ("TUB"), Sections 147-ter(4) and 147-quinquiss of Legislative Decree ano. 58 dated February 24, 1998 ("TUP"), Sections the Treasury Decree no. 169 dated November 23, 2020 (the "Decree") and the Ministry of Justice Decree no. 162 dated March 30, 2000, Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code (the "Corporate Governance Code")

STATE THAT

there are no reasons for my ineligibility, forfeiture or incompatibility and that I meet the Association for the appointment of Trivisions, as well as by the UniCredit Articles of Association for the appointment as DIRECTOR; with specific reference to the experience and independence requirements

DECLARE THAT

I. EXPERIENCE REQUIREMENTS

1) I possess the knowledge, skills and experience required by CRD IV, TUB and the Decree, and, in particulat, that I have accrued overall experience of at least three years through the exercise of:

EXECUTIVE ROLES AT BMS-Bristolmyer activity from 1998 to will be the find , Coalified ,
CEO (2010/15), CHAIRNAN (2010), Constitutions ,

1 Please, delete the reference period that does not interest, taking into account that: (6) the Chairman of the board of directors and the Chief Executive Offices must have accrued a professional experience of the years; and (fi) the non-executive Directors must have accued an experience of at least thece years.

  • 2 Please, indicate:
    • For the directors with executive posts:
    • management or control activities or managerial positions held in companies operating in the banking, financial, securities or insurance sectors; and/or
    • management or control activities or managerial positions held in listed companies or companies whose size and complexity are greater than, or equal to those of UniCredit (in terms of revenue, mature and complexity of the organization or activities performed); and
    • for the directors with non executive posts, in alternative to the above-mentioned ones:
    • professional activities practiced in the fields relating to the banking, financial, securities, insurance sectors or anyhow instrumental for the activities of UniCredit, and/or
    • university teaching (first or second level) of lages or economics subjects, or other subjects instrumental for the banking, financial, securities or insurance sectors; and/or
    • managerial/executive functions in public organizations or public administration offices relating to the banking, financial, securities or insurance sectors provided that the entity where the corporate offices
  • b) activity_carried out at____________________________________________________________________________________________________________________________________________________
  • c) activity __________________________________________________________________________________________________________________________________________________________________

as they result from both the attached curriculum vitae (see Annex 1) and the list of offices3 currently held in banks or other commercial companies 4 (see Annex 2);

II. INDEPENDENCE REQUIREMENTS

I meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

OR

I DO NOT meet the independence requirements envisaged by Section 147-w(4) in conjunction with Section 148(3) of the TUF;

***

I meet the independence requirements envisaged by Section 13 of the Decree;

OR

I DO NOT meet the independence requirements envisaged by Section 13 of the Decree;

***

I meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code;

OR

I DO NOT meet the independence requirements envisaged by Clause 20 of the

performed such activities has a size and complexity similar to those of UniCredit.

In addition to the above, the chief executive officer shall possess a specific experience in the fields of banking, financial, securities or insurance, gained through management or control activities or managerial positions held in the banking, financial, securities and insurance sectors, or in listed companies whose size and complexity are greater than, or equal to, those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed).

3 "Offices" means those: i) held in the board of directors, supervisory board, management board; ii) held in the board of statutory auditors; iii) as general manager, however named; in foreign companies, the offices considered are those equivalent to the ones outlined in points i), ii) and ii) in accordance with the regulations applicable to such companies;

4 "Commercial companies" means: a company with registered office in Italy, established in the form of "società in nome ollettivo, società in accomandita per azioni, società in acomandita per azioni, società a responsabilià linitata", having as corporate purpose: 1) industrial activity producing goods or services; 2) intermediary activity in the circulation of goods; 3) land, water or air transportation activity; 4) banking or insurance activity; 5) auxiliary activities to the above-mentioned ones; or a company with registered office in a foreign country and qualifying as commercial company in accordance with the provisions of the relevant legislation of the Country where its registered office or head office is located.

UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code.

I, the undersigned, also:

  • STATE my candidacy the for election as member of the Board of Directors of UniCredit S.p.A. and, if elected, my willingness to accept my appointment as of now;
  • UNDERTAKE to promptly inform UniCredit of any changes in the above-mentioned circumstances and, on request by the Company, to produce any documentation suitable to confirm the truthfulness of the facts declared;
  • Regulations 13 and 14 of the del General Data Protection Regulation -Reg.(UE) 2016/679 , and the information notice on the processing of personal data reported in attachment, AUTHORIZE the publication of the information above and the witar in the so celled "professional characteristics mentioned in my amiculum vitar, in the so-called "profile form" and in the list of the offices currently held in banks or other commercial companies.

h 1 25 202 Signed

Allegs to & Curriculum V. Tax

Lamberto Andreotti Former Chairman and CEO, Bristol-Myers Squibb

Lamberto Andreotti served as CEO of Bristol-Myers Squibb from May 2010 to May 2015 and as Chairman of the Board of Directors from May 2015 to May 2017.

Andreotti first joined BMS in 1998 as Vice President and General Manager of European Oncology and Italy, and advanced to President, Europe in 2000, President, International in 2002 and President, Pharmaceuticals in 2005. He became Chief Operating Officer in 2008 and was elected to the Board of Directors the following year.

Under Andreotti's leadership, Bristol-Myers Squibb transformed into a leader in the biopharma industry and pioneered the field of immuno-oncology. In fact, the company was the first to market with immuno-oncology medicines for metastatic melanoma and lung cancer -- two of the most common and deadly diseases.

Before joining Bristol Myers Squibb, Andreotti held senior roles in other pharmaceutical companies, including Recordati, Farmitalia Carlo Erba, Pharmacia and Pharmacia & Upjohn.

Andreotti earned his Bachelor's degree from the University of Rome and a Master of Science degree from MIT - Massachusetts Institute of Technology.

Andreotti is a Board member of Corteva Agriscience (ex-Dupont and DowDupont) and UniCredit. He also serves as a director for the American Italian Cancer Foundation and the Salzburg Festival Society and as a senior advisor to EW Healthcare.

sue, 2

both Coupon

ANNEX 2 – LIST OF THE OFFICES CURRENTLY HELD IN BANKS OR OTHER COMMERCIAL COMPANIES

On Director of Corteva Agriscience 6 Date and place, Signed

ANNEX 3 - INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA BY UNICREDIT

The following information notice aims at providing you with an overview on the use of your personal data by UniCredit S.p.A. and of your rights pursuant to the General Data Protection Regulation - Regulation (EU) 2016/679 (hereinafter also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (UniCredit).

The Data Protection Officer (DPO) can be contacted at:

UniCredit S.p.A. Data Protection Office, Piazza Gae Aulenti n. 1, Tower B, 20154 Milano, E-mail: [email protected], PEC: [email protected].

2. PURPOSE AND LEGAL BASIS OF PROCESSING

UniCredit processes the personal data in its possession, that is collected directly from you, or from the relevant local administrations to verify, among others, their accuracy for the following purposes:

A. Need to fulfill legal obligations deriving from your candidacy as a Member of the UniCredit's Board of Directors.

These obligations imply, among others, verifying - both during the selection procedures and on an ongoing basis - the compliance: i) with the eligibility requirements for taking on and maintaining the role of Director as well as of specific positions (such as integrity requirements, criteria of correctness, professional experience requirements and competence, independence, time commitment, maximum number of offices covered, respect of the prohibition of interlocking) as required by applicable law, by UniCredit's Articles of Association and by the Corporate Governance Code (i.e. Codice di Corporate Governance) as well as with social security and fiscal obligations linked to the remuneration provided.

To comply with the above-mentioned obligations, in some cases, UniCredit is required to carry out analyses that concern also your relatives5 . For this reason, we kindly ask you to let them aware of this Information Notice.

These needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the obligations arising from your role of member of UniCredit's Board of Directors; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

5 The relatives scope is identified on the basis of the specific applicable regulations.

B. Fulfilment of legal obligations and requests from Public and Supervisory Authorities, concerning the process, communication and/or disclosure - also during the selection procedures - on the website www.unicreditgroup.eu and/ or on specific corporate documents (e.g. Prospectus / Corporate Governance Report, Financial Statements) of your data (such as data contained in your curriculum vitae and in the list of the tasks carried out by you in other banks and commercial companies, as required by the applicable law, and according to the Articles of Association and the Corporate Governance Code).

The needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the legal obligations, the requests from the Authorities, as well as to take on the role of member of the Board of Directors of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

3. CATEGORIES OF PERSONAL DATA PROCESSED

UniCredit processes personal data collected directly from you, or from third parties (e.g. relevant local administrations), which include, but are not limited to, personal data (e.g. name, surname, address, date and place of birth), banking data, information on the financial situation (e.g. patrimonial status, information on credit requests/relationships), positions held and related income, employment relationships, commercial/professional relationships.

This information may concern existing or past relationships with UniCredit as well as with Group Legal Entities or third parties.

3.1 JUDICIAL DATA

UniCredit may process judicial data (i.e. personal data relating to criminal convictions and offences or related security measures, including information on pending proceedings) referring to you, in order to verify the subjective and integrity requirements and/or conditions that prevent from being appointed as member of the Board of Directors of UniCredit.

In such cases, the processing is necessary to fulfill legal obligations as well as to comply with requests coming from Public or Supervisory Authorities (e.g. filling the questionnaire requested by the ECB). This need represents the legal basis that legitimizes the related data processing. Data provided by you is necessary to comply with the legal obligations; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your data may be communicated to the natural and legal persons that are acting as "Data Processors", listed in the UniCredit premises and on the website www.unicredit.it, as well as – in the quality of persons authorized to process personal data in relation to the data necessary for the performance of the duties they are assigned to – the natural persons belonging to the following categories:

employees or temporary employees or trainees assigned to the UniCredit HR, PL & BS Management Functions / IAD Budget & Administrative Support / Individual Reports, as well as the UniCredit Group Corporate Affairs, consultants and other natural persons occasionally assigned to these functions;

employees, temporary workers, interns and consultants of external companies appointed as Data Processors.

Your data may be communicated:

  • to those subjects to whom this communication must be carried out in compliance with an obligation established by law (e.g. Bank of Italy and ECB), by a regulation or by EU legislation. Further information can be found on the website www.unicredit.it in the "Privacy" section;
  • to Legal Entities belonging to the UniCredit Group (also foreign Legal Entities), subsidiaries or associates under the terms of article 2359 of the Italian Civil Code, when such communication is permitted on the basis of a Garante per la Protezione dei Dati Personali's measure or by a law provision.

The detailed list of subjects to whom the data can be communicated is available on the website www.unicredit.it, in the "Privacy" section.

5. DATA TRANSFER TO THIRD COUNTRIES

UniCredit informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called "Third Countries") if the EU Commission states that the Third Country ensures an adequate level of protection of personal data or in case of other appropriate safeguards, namely when the supplier of UniCredit located in the Third Country contractually ensures an appropriate level of personal data protection (e.g. through the signing of the standard contractual clauses provided by the European Commission), including enforceable and effective data subject rights. Further information can be requested by writing to [email protected].

6. DATA PROCESSING MODALITIES

The processing of personal data involves the usage of manual and IT instruments with modalities closely connected with the purposes defined above and, in any case, in such a way to guarantee the security and confidentiality of the data.

7. DATA SUBJECT' RIGHTS

GDPR grants and assures specific rights, including the right to know what data concerning you are held by UniCredit, as well as how they are used, and the right to obtain, under certain conditions, the copy, the erasure, the update, the rectification or, if interested, the integration of your data, as well as the right to data portability.

7.1 DATA RETENTION PERIOD AND RIGHT TO ERASURE

UniCredit processes and stores your personal data for all the time you keep the role of Director, to execute the related and connected obligations, to comply with the applicable legal, contractual and regulatory obligations, as well as for its own defensive purposes or those of third parties until the expiration of the longest mandatory retention period provided by the applicable law (i.e. 11 years) starting from the date of termination of the relationship with you. UniCredit processes and stores your personal data even after the expiry of the employment relationship when this is necessary for archiving purposes for historical research purposes, according, to the methods set out in the "Ethical rules of processing for archiving purposes in the public interest or historical research"6 .

At the end of the applicable mandatory retention period, your personal data will be erased or kept in a form which does not permit your identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes: i) for resolution of pre-litigation and/or litigation, started before the expiration of the mandatory retention period; ii) to follow up with investigations/inspections by internal control functions and/or external authorities, started before the expiration of the mandatory retention period; iii) to follow up with requests from the Italian and/or foreign Public Authorities, received/notified to UniCredit before the expiration of the mandatory retention period.

8. PROCEDURE TO EXERCISE THE RIGHTS

The e-mail address which you can refer to for the exercise of your rights described in the paragraph 7 is the following one: [email protected].

The deadline for the reply is one (1) month, that may be extended for two (2) further months in cases of particular complexity; in these cases, UniCredit informs you about such extension within one (1) month from the receipt of the request.

The exercise of rights is, in principle, free of charge.

9. COMPLAINT OR REPORTING TO THE "GARANTE PER LA PROTEZIONE DEI DATI PERSONALI"

UniCredit informs you that you have the right to lodge a complaint with, or to report to the Garante per la Protezione dei Dati Personali, or else to appeal to the Judicial Authority. The contacts of the Garante per la Protezione dei Dati Personali can be consulted on the website http://www.garanteprivacy.it.

6 Record of the provisions 19th december 2018, n. 513

STATEMENT OF CANDIDACY AND DECLARATION ATTESTING THE INEXISTENCE OF REASONS FOR INELIGIBILITY, FORFEITURE AND INCOMPATIBILITY, AS WELL AS THE MEETING OF THE REQUIREMENTS PROVIDED FOR BY CURRENT PROVISIONS

I, the undersigned Elena CARLETTI born in La Spezia (Italy) on 8 September 1969, fiscal code CRLLNE69P48E463H, resident in Milan (Italy), nationality Italian, in relation to the appointment to the office of DIRECTOR in UniCredit S.p.A. ("UniCredit" or the "Bank") according to the Agenda of the Shareholders' Meeting convened for 15 April 2021, under my own responsibility,

taking into account the provisions of Section 91 of the Directive 2013/36/EU dated June 26, 2013, as subsequently amended ("CRD IV"), Articles 2382 and 2387 of the Italian Civil Code, Section 26 of Legislative Decree no. 385 dated September 1, 1993 ("TUB"), Sections 147-ter(4) and 147-quinquies of Legislative Decree no. 58 dated February 24, 1998 ("TUF") , the Treasury Decree no. 169 dated November 23, 2020 (the "Decree") and the Ministry of Justice Decree no. 162 dated March 30, 2000, Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code (the "Corporate Governance Code")

STATE THAT

there are no reasons for my ineligibility, forfeiture or incompatibility and that I meet the requirements provided for by current provisions, as well as by the UniCredit Articles of Association for the appointment as DIRECTOR; with specific reference to the experience and independence requirements

DECLARE THAT

I. EXPERIENCE REQUIREMENTS

  • 1) I possess the knowledge, skills and experience required by CRD IV, TUB and the Decree, and, in particular, that I have accrued overall experience of at least three years1 through the exercise of:
    • a) activity _Non-executive dirctor2 carried out at_Unicredit from_February 2019___ to

1 Please, delete the reference period that does not interest, taking into account that: (i) the Chairman of the board of directors and the Chief Executive Officer must have accrued a professional experience of at least ten years; and (ii) the non-executive Directors must have accrued an experience of at least three years.

2 Please, indicate:

For the directors with executive posts:

management or control activities or managerial positions held in companies operating in the banking, financial, securities or insurance sectors; and/or

management or control activities or managerial positions held in listed companies or companies whose size and complexity are greater than, or equal to those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed); and

for the directors with non-executive posts, in alternative to the above-mentioned ones:

professional activities practiced in the fields relating to the banking, financial, securities, insurance sectors or anyhow instrumental for the activities of UniCredit; and/or

university teaching (first or second level) of legal or economics subjects, or other subjects instrumental for the banking, financial, securities or insurance sectors; and/or

managerial/executive functions in public organizations or public administration offices relating to the banking, financial, securities or insurance sectors provided that the entity where the corporate officers

current

  • b) activity _Full Professor of Finance carried out at Bocconi University_from_2013_ to current:
  • c) activity Founding Director and Advisor carried out at European Univeristy Institute, Florence School of Banking and Finance from_2016__ to current;
  • d) activity Member of the Advisory Scientific Committee (ASC) carried out at European Systemic Risk Board (ESRB) from 2015
  • e) activity Member of Expert Panel on Banking Supervision carried out at European Parliament from 2016
  • f) activity Board Member carried out at Fondazione Cassa di Risparmio di La Spezia from April 2016 to February 2019

as they result from both the attached curriculum vitae (see Annex 1) and the list of offices3 currently held in banks or other commercial companies 4 (see Annex 2);

II. INDEPENDENCE REQUIREMENTS

I I meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

OR

I DO NOT meet the independence requirements envisaged by Section 147-tor(4) in conjunction with Section 148(3) of the TUF;

***

I meet the independence requirements envisaged by Section 13 of the Decree;

OR

I DO NOT meet the independence requirements envisaged by Section 13 of the Decree;

performed such activities has a size and complexity similar to those of UniCredit.

In addition to the above, the chief executive officer shall possess a specific experience in the fields of banking, financial, securities or insurance, gained through management or control activities or managerial positions held in the banking, financial, securities and insurance sectors, or in listed companies whose size and complexity are greater than, or equal to, those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed).

3 "Offices" means those: i) held in the board of directors, supervisory board, management board; ii) held in the board of statutory auditors; iii) as general manager, however named; in foreign companies, the offices considered are those equivalent to the ones outlined in points i), il) and ii) in accordance with the regulations applicable to such companies;

4 "Commercial companies" means: a company with registered office in the form of "società in nome ollettivo, società in acomandita società per azioni, società in acomandita per azioni, società a responsabilità linitado', having as corporate purpose: 1) industrial activity producing goods or services; 2) intermediary activity in the circulation of goods; 3) land, water or air transportation activity; 4) banking or insurance activity; 5) auxiliary activities to the above-mentioned ones; or a company with registered office in a foreign country and qualifying as commercial company in accordance with the provisions of the relevant legislation of the Country where its registered office or head office is located.

  • ***
  • I meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code;

OR

I DO NOT meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code.

I, the undersigned, also:

  • STATE my candidacy the for election as member of the Board of Directors of UniCredit S.p.A. and, if elected, my willingness to accept my appointment as of now;
  • UNDERTAKE to promptly inform UniCredit of any changes in the above-mentioned circumstances and, on request by the Company, to produce any documentation suitable to confirm the truthfulness of the facts declared;
  • having read Sections 13 and 14 of the del General Data Protection Regulation Reg.(UE) 2016/679 , and the information notice on the processing of personal data reported in attachment, AUTHORIZE the publication of the information above and the information on personal and professional characteristics mentioned in my curriculum vitae, in the socalled "profile form" and in the list of the offices currently held in banks or other commercial companies.

Date and place, ___1 March 2021, Milano_________

Signed ___ ___________________________

ELENA CARLETTI

March 2021

Bocconi University – Department of Finance

PERSONAL INFORMATION

  • Italian citizenship, female, married, one child
  • Mother tongue Italian, Fluent in English and German

ACADEMIC POSITIONS

  • Full Professor of Finance, Bocconi University, Department of Finance, since October 2013
  • Full Professor of Economics, European University Institute, Joint Chair Economics Department and Robert Schuman Centre for Advanced Studies, 2008-2013
  • Associate Professor,Goethe University of Frankfurt, Department of Finance, 2008-2013 (on leave parte del periodo)
  • Senior Researcher, Center for Financial Studies, University of Frankfurt, 2004–2008
  • Assistant Professor of Economics, University of Mannheim, 2000–2004
  • Tutorial Fellow in Finance, London School of Economics, 1999–2000

EDUCATION

  • Habilitation in Economics, University of Mannheim, 2007
  • Ph.D. in Economics, London School of Economics, 2000
  • Doctorate in Economics, University of Bologna, 1998
  • Master in Economics (with distinction and best student award), Bocconi University, 1994
  • Laurea in Economics (110/110 and Summa cum laude), Bocconi University, 1993

CURRENT PROFESSIONAL ACTIVITIES

  • Unicredit, Member of the Board of Directors, since February 2019
    • o Member of the Internal Controls and Risk Committee, and of the Remuneration Committee
  • European Finance Association, Vice-president, since Septermber 2020
  • European University Institute, Florence School of Banking and Finance (FBF), Founding Director and Advisor
    • o The FBF is a European platform bringing together practitioners and academics from the Banking and Finance sector to develop a common culture of regulation and supervision in the European Union. It does so through training and policy debate. It has provided training to more than 2000 professionals from 68 countries and 280+ institutions
    • o Responsibilities: Supervision of all activities of the School involving the organization of policy dialogues, the supervision of the training activities, fund raising and management of the staff of the School as well as of its Advisory Council
  • European Systemic Risk Board (ESRB) European System of Financial Supervision, Member of the Advisory Scientific Committee (ASC), since 2015
  • European Parliament, Expert Panel on banking supervision, Member, since 2016
    • o Responsibilities: Providing support to the Economic and Monetary Affairs Committee (ECON) and the Banking Union Working Group (BUWG) with the critical and independent expert advice in monitoring the implementation of the Single Supervisory Mechanism (SSM)
  • European Finance Association, Member of Executive Committee, since 2019
  • Bank of Italy, Scientic Committee "Paolo Baffi Lecture", since 2015
  • Fondazione Cassa di Risparmio di La Spezia, Board Member, since April 20161
  • Bruegel, Member of the Scientific Committee, since 2017

1 Available to resign in case of appointment.

• Bocconi University, Baffi Carefin Center for Applied Research, Director of Unit "Banking, Finance and Regulation", since 2015

PREVIOUS PROFESSIONAL ACTIVITIES

  • Economic Policy (Oxford Academic Journal providing analyses for policymakers), Panel Member, 2016-2018
  • Confindustria, Scientific Committee Member, 2014-2016
  • Riksbank (Swedish Central Bank), Review Panel Member, 2014
  • Central Bank of Ireland, Review Panel Member, 2011
  • Bangor University, Research Professor, 2013-2015
  • Financial Intermediation Research Society (FIRS), Board Director, 2010- 2013
  • Vinnova Review Panel Financial Market Research Centres, Member, Stockholm, 2010
  • Consultant, OECD, 2009, 2010, 2017
  • Consultant, World Bank, 2008
  • Economist, Italian Antitrust Authority, Rome, 1997–1998

ACADEMIC AFFILIATIONS

  • Finance Theory Group, United States, member, since 2014
  • Wharton Financial Institutions Center, Philadelphia, Fellow, since 2006
  • Centre for Economic European Research (CEPR), London, Research Fellow in Financial Economics, since 2011
  • IGIER, Bocconi University, Fellow, since 2013
  • CESifo, Munich, Fellow, since 2011
  • Center for Financial Studies (CFS), Frankfurt, Fellow, since 2008
  • Tilburg Law and Economic Center (TILEC), Tilburg, Extramural Fellow, since 2008
  • Federal Deposit Insurance Corporation (FDIC), Washington DC, Center for Financial Research (CFR), Fellow, 2004
  • European Central Bank–Center for Financial Studies Research Network Contributor, 2003-2007

AREAS OF INTEREST

• Financial Intermediation, Financial Crises and Regulation, Financial Markets, Competition Policy, Corporate Governance, Financial Development and Access, Sovereign Debt

MAJOR PUBLICATIONS

    1. "The Price of Law: The Case of the Eurozone Collective Action Clauses" (with Paolo Colla, Mitu Gulati and Steven Ongena), Review of Financial Studies, forthcoming
    1. "Improving Access to Banking: Evidence from Kenya" (with Franklin Allen, Robert Cull, Jun Qian, Lemma Senbet, and Patricio Valenzuela), Review of Finance, forthcoming
    1. "Banks as Patient Lenders: Evidence from an Italian Tax Reform" (with Filippo De Marco, Vasso Ioannidou and Enrico Sette), Journal of Financial Economics, forthcoming
    1. "The Covid-19 Shock and Equity Shortfall: Firm-level Evidence from Italy" (with Tommaso Oliviero, Marco Pagano, Loriana Pelizzon and Marti G. Subrahmanyam), Review of Corporate Finance Studies, forthcoming
    1. "Supervisory Incentives in a Banking Union" (with Giovanni Dell'Ariccia and Robert Marquez), Management Science, forthcoming
    1. "The Impact of Merger Legislation on Bank Mergers" (with Steven Ongena, Jan-Peter Siedlarek and Giancarlo Spagnolo), Journal of Financial Intermediation, forthcoming
    1. "The Redistributive Effects of Bank Capital Regulation" (with Robert Marquez and Silvio Petriconi), Journal of Financial Economics, 2020, 136(3), 743-759
  • 8. "Credit Market Competition and Liquidity Crises" (with Agnese Leonello), forthcoming, Review of Finance
    1. "Government Guarantees and Financial Stability" (with Franklin Allen, Itay Goldstein and Agnese Leonello), Journal of Economic Theory, 2018
    1. "Deposits and Bank Capital Structure" (with Franklin Allen and Robert Marquez), Journal of Financial Economics, 2015
  • 11."Asset Commonality, Debt Maturity and Systemic Risk" (with Franklin Allen and Ana Babus), Journal of Financial Economics, 2012
  • 12."Credit Market Competition and Capital Regulation" (with Franklin Allen and Robert Marquez), Review of Financial Studies, 2011
    1. "An Overview of the Crisis: Causes, Consequences and Solutions" (with Franklin Allen), International Review of Finance, 2010
  • 14.Interbank Market Liquidity and Central Bank Intervention" (with Franklin Allen and Douglas Gale), Journal of Monetary Economics, 2009
  • 15."Mark-to-Market Accounting and Liquidity Pricing" (with Franklin Allen), Journal of Accounting and Economics, 2008
  • 16."Credit Risk Transfer and Contagion" (with Franklin Allen), Journal of Monetary Economics, 2006

TEACHING EXPERIENCE

  • Bocconi University, SDA Bocconi, International Financial Systems, Master in Corporate Finance, since 2016
  • Bocconi University, SDA Bocconi, Unicredit "Strategic Finance Lab", November 2017 and 2018
  • Bocconi University, International Banking, elective course, undergraduate, since 2013
  • Bocconi University, Corporate Finance IVFinancial Crises, Ph.D. level, since 2013
  • European University Institute, Financial Crises, Ph.D. level, 2009 2013
  • University of Frankfurt, Seminar on Economics of Banks (Master level), 2008
  • University of Frankfurt, Seminar on Financial Crises: Theory and Cases (Master level), 2007
  • Tor Vergata University, Rome, Microeconomics of Banking (Master level), 2006
  • University of Mannheim, Chair of Economic Theory of Professor Martin Hellwig, Assistant Professor for the courses (Master level): Financial Markets with Imperfect Information (in German); Financial Institutions with Imperfect Information (in German); Seminar on Banking Stability (in German); Seminar on Financial Crises (in German), 2000–2004
  • London School of Economics, Principles of Finance (Undergraduate level), Teaching Assistant, 1999– 2000
  • London School of Economics, Intermediate Economics (Undergraduate level), Teaching Assistant, 1995 1997
  • Bocconi University, Macroeconomics (Master level), Teaching Assistant, 1994–1995
  • Bocconi University, Economics I (Undergraduate level), Teaching Assistant, 1994–1995

OTHER TEACHING EXPERIENCE

  • Banca of Italy, Training course on Financial Stability and Regulation, 2016
  • European Commission, Training course on Current Issues in Banking, October 2015
  • European Central Bank, Training course in Banking, Financial Research Division, March 2015
  • Bundesbank, Financial Crises, training course, 2011

Milan, 1 Marzo 2021

Elena Carletti

ANNEX 2 – LIST OF THE OFFICES CURRENTLY HELD IN BANKS OR OTHER COMMERCIAL COMPANIES

No administrative, managerial and control Offices held in any Italian or foreign Companies

Date and place: 1st March 2021, Milan

Signed _______ _______________________

ANNEX 3 - INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA BY UNICREDIT

The following information notice aims at providing you with an overview on the use of your personal data by UniCredit S.p.A. and of your rights pursuant to the General Data Protection Regulation - Regulation (EU) 2016/679 (hereinafter also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (UniCredit).

The Data Protection Officer (DPO) can be contacted at:

UniCredit S.p.A. Data Protection Office, Piazza Gae Aulenti n. 1, Tower B, 20154 Milano, E-mail: [email protected], PEC: [email protected].

2. PURPOSE AND LEGAL BASIS OF PROCESSING

UniCredit processes the personal data in its possession, that is collected directly from you, or from the relevant local administrations to verify, among others, their accuracy for the following purposes:

A. Need to fulfill legal obligations deriving from your candidacy as a Member of the UniCredit's Board of Directors.

These obligations imply, among others, verifying - both during the selection procedures and on an ongoing basis - the compliance: i) with the eligibility requirements for taking on and maintaining the role of Director as well as of specific positions (such as integrity requirements, criteria of correctness, professional experience requirements and competence, independence, time commitment, maximum number of offices covered, respect of the prohibition of interlocking) as required by applicable law, by UniCredit's Articles of Association and by the Corporate Governance Code (i.e. Codice di Corporate Governance) as well as with social security and fiscal obligations linked to the remuneration provided.

To comply with the above-mentioned obligations, in some cases, UniCredit is required to carry out analyses that concern also your relatives5 . For this reason, we kindly ask you to let them aware of this Information Notice.

These needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the obligations arising from your role of member of UniCredit's Board of Directors; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

5 The relatives scope is identified on the basis of the specific applicable regulations.

B. Fulfilment of legal obligations and requests from Public and Supervisory Authorities, concerning the process, communication and/or disclosure - also during the selection procedures - on the website www.unicreditgroup.eu and/ or on specific corporate documents (e.g. Prospectus / Corporate Governance Report, Financial Statements) of your data (such as data contained in your curriculum vitae and in the list of the tasks carried out by you in other banks and commercial companies, as required by the applicable law, and according to the Articles of Association and the Corporate Governance Code).

The needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the legal obligations, the requests from the Authorities, as well as to take on the role of member of the Board of Directors of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

3. CATEGORIES OF PERSONAL DATA PROCESSED

UniCredit processes personal data collected directly from you, or from third parties (e.g. relevant local administrations), which include, but are not limited to, personal data (e.g. name, surname, address, date and place of birth), banking data, information on the financial situation (e.g. patrimonial status, information on credit requests/relationships), positions held and related income, employment relationships, commercial/professional relationships.

This information may concern existing or past relationships with UniCredit as well as with Group Legal Entities or third parties.

3.1 JUDICIAL DATA

UniCredit may process judicial data (i.e. personal data relating to criminal convictions and offences or related security measures, including information on pending proceedings) referring to you, in order to verify the subjective and integrity requirements and/or conditions that prevent from being appointed as member of the Board of Directors of UniCredit.

In such cases, the processing is necessary to fulfill legal obligations as well as to comply with requests coming from Public or Supervisory Authorities (e.g. filling the questionnaire requested by the ECB). This need represents the legal basis that legitimizes the related data processing. Data provided by you is necessary to comply with the legal obligations; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your data may be communicated to the natural and legal persons that are acting as "Data Processors", listed in the UniCredit premises and on the website www.unicredit.it, as well as – in the quality of persons authorized to process personal data in relation to the data necessary for the performance of the duties they are assigned to – the natural persons belonging to the following categories:

employees or temporary employees or trainees assigned to the UniCredit HR, PL & BS Management Functions / IAD Budget & Administrative Support / Individual Reports, as well as the UniCredit Group Corporate Affairs, consultants and other natural persons occasionally assigned to these functions;

employees, temporary workers, interns and consultants of external companies appointed as Data Processors.

Your data may be communicated:

  • to those subjects to whom this communication must be carried out in compliance with an obligation established by law (e.g. Bank of Italy and ECB), by a regulation or by EU legislation. Further information can be found on the website www.unicredit.it in the "Privacy" section;
  • to Legal Entities belonging to the UniCredit Group (also foreign Legal Entities), subsidiaries or associates under the terms of article 2359 of the Italian Civil Code, when such communication is permitted on the basis of a Garante per la Protezione dei Dati Personali's measure or by a law provision.

The detailed list of subjects to whom the data can be communicated is available on the website www.unicredit.it, in the "Privacy" section.

5. DATA TRANSFER TO THIRD COUNTRIES

UniCredit informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called "Third Countries") if the EU Commission states that the Third Country ensures an adequate level of protection of personal data or in case of other appropriate safeguards, namely when the supplier of UniCredit located in the Third Country contractually ensures an appropriate level of personal data protection (e.g. through the signing of the standard contractual clauses provided by the European Commission), including enforceable and effective data subject rights. Further information can be requested by writing to [email protected].

6. DATA PROCESSING MODALITIES

The processing of personal data involves the usage of manual and IT instruments with modalities closely connected with the purposes defined above and, in any case, in such a way to guarantee the security and confidentiality of the data.

7. DATA SUBJECT' RIGHTS

GDPR grants and assures specific rights, including the right to know what data concerning you are held by UniCredit, as well as how they are used, and the right to obtain, under certain conditions, the copy, the erasure, the update, the rectification or, if interested, the integration of your data, as well as the right to data portability.

7.1 DATA RETENTION PERIOD AND RIGHT TO ERASURE

UniCredit processes and stores your personal data for all the time you keep the role of Director, to execute the related and connected obligations, to comply with the applicable legal, contractual and regulatory obligations, as well as for its own defensive purposes or those of third parties until the expiration of the longest mandatory retention period provided by the applicable law (i.e. 11 years) starting from the date of termination of the relationship with you. UniCredit processes and stores your personal data even after the expiry of the employment relationship when this is necessary for archiving purposes for historical research purposes, according, to the methods set out in the "Ethical rules of processing for archiving purposes in the public interest or historical research"6 .

At the end of the applicable mandatory retention period, your personal data will be erased or kept in a form which does not permit your identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes: i) for resolution of pre-litigation and/or litigation, started before the expiration of the mandatory retention period; ii) to follow up with investigations/inspections by internal control functions and/or external authorities, started before the expiration of the mandatory retention period; iii) to follow up with requests from the Italian and/or foreign Public Authorities, received/notified to UniCredit before the expiration of the mandatory retention period.

8. PROCEDURE TO EXERCISE THE RIGHTS

The e-mail address which you can refer to for the exercise of your rights described in the paragraph 7 is the following one: [email protected].

The deadline for the reply is one (1) month, that may be extended for two (2) further months in cases of particular complexity; in these cases, UniCredit informs you about such extension within one (1) month from the receipt of the request.

The exercise of rights is, in principle, free of charge.

9. COMPLAINT OR REPORTING TO THE "GARANTE PER LA PROTEZIONE DEI DATI PERSONALI"

UniCredit informs you that you have the right to lodge a complaint with, or to report to the Garante per la Protezione dei Dati Personali, or else to appeal to the Judicial Authority. The contacts of the Garante per la Protezione dei Dati Personali can be consulted on the website http://www.garanteprivacy.it.

6 Record of the provisions 19th december 2018, n. 513

STATEMENT OF CANDIDACY AND DECLARATION ATTESTING THE INEXISTENCE OF REASONS FOR INELIGIBILITY, FORFEITURE AND INCOMPATIBILITY, AS WELL AS THE MEETING OF THE REQUIREMENTS PROVIDED FOR BY CURRENT PROVISIONS

I, the undersigned Jayne-Anne Gadhia born in Stourbridge (UK) on 19/10/1961, fiscal code NB538878C, resident in England, nationality British, in relation to the appointment to the office of Non Executive Director 1 in UniCredit S.p.A. ("UniCredit" or the "Bank") according to the Agenda of the Shareholders' Meeting convened for 15 April 2021, under my own responsibility,

taking into account the provisions of Section 91 of the Directive 2013/36/EU dated June 26, 2013, as subsequently amended ("CRD IV"), Articles 2382 and 2387 of the Italian Civil Code, Section 26 of Legislative Decree no. 385 dated September 1, 1993 ("TUB"), Sections 147-ter(4) and 147-quinquies of Legislative Decree no. 58 dated February 24, 1998 ("TUF") , the Treasury Decree no. 169 dated November 23, 2020 (the "Decree") and the Ministry of Justice Decree no. 162 dated March 30, 2000, Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code (the "Corporate Governance Code")

STATE THAT

there are no reasons for my ineligibility, forfeiture or incompatibility and that I meet the requirements provided for by current provisions, as well as by the UniCredit Articles of Association for the appointment as Non Executoive Director1 ; with specific reference to the experience and independence requirements

DECLARE THAT

I. EXPERIENCE REQUIREMENTS

  • 1) I possess the knowledge, skills and experience required by CRD IV, TUB and the Decree, and, in particular, that I have accrued overall experience of at least three years2 through the exercise of:

    • a) activity as CEO 3 of a Regulated Bank carried out at Virgin Money from 2007 to 2018
  • management or control activities or managerial positions held in companies operating in the banking, financial, securities or insurance sectors; and/or

  • management or control activities or managerial positions held in listed companies or companies whose size and complexity are greater than, or equal to those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed); and

1 Please, indicate the post as: (i) Chairman of the board of directors; (ii) Chief Executive Officer; or (iii) nonexecutive Director.

2 Please, delete the reference period that does not interest, taking into account that: (i) the Chairman of the board of directors and the Chief Executive Officer must have accrued a professional experience of at least ten years; and (ii) the non-executive Directors must have accrued an experience of at least three years.

3 Please, indicate:

For the directors with executive posts:

for the directors with non-executive posts, in alternative to the above-mentioned ones:

professional activities practiced in the fields relating to the banking, financial, securities, insurance sectors or anyhow instrumental for the activities of UniCredit; and/or

university teaching (first or second level) of legal or economics subjects, or other subjects instrumental for the banking, financial, securities or insurance sectors; and/or

managerial/executive functions in public organizations or public administration offices relating to the

b) activity as Member of the FCA Practitioner Panel in London from 2016 to 2019

as they result from both the attached curriculum vitae (see Annex 1) and the list of offices4 currently held in banks or other commercial companies5 (see Annex 2);

II. INDEPENDENCE REQUIREMENTS

I meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

OR

I DO NOT meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

***

I meet the independence requirements envisaged by Section 13 of the Decree;

OR

I DO NOT meet the independence requirements envisaged by Section 13 of the Decree;

***

I meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code;

OR

banking, financial, securities or insurance sectors provided that the entity where the corporate officers performed such activities has a size and complexity similar to those of UniCredit.

In addition to the above, the chief executive officer shall possess a specific experience in the fields of banking, financial, securities or insurance, gained through management or control activities or managerial positions held in the banking, financial, securities and insurance sectors, or in listed companies or in companies whose size and complexity are greater than, or equal to, those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed).

4 "Offices" means those: i) held in the board of directors, supervisory board, management board; ii) held in the board of statutory auditors; iii) as general manager, however named; in foreign companies, the offices considered are those equivalent to the ones outlined in points i), ii) and iii) in accordance with the regulations applicable to such companies;

5 "Commercial companies" means: a company with registered office in Italy, established in the form of "società in nome collettivo, società in accomandita semplice, società per azioni, società in accomandita per azioni, società a responsabilità limitata", having as corporate purpose: 1) industrial activity producing goods or services; 2) intermediary activity in the circulation of goods; 3) land, water or air transportation activity; 4) banking or insurance activity; 5) auxiliary activities to the above-mentioned ones; or a company with registered office in a foreign country and qualifying as commercial company in accordance with the provisions of the relevant legislation of the Country where its registered office or head office is located.

I DO NOT meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code.

I, the undersigned, also:

  • STATE my candidacy the for election as member of the Board of Directors of UniCredit S.p.A. and, if elected, my willingness to accept my appointment as of now;
  • UNDERTAKE to promptly inform UniCredit of any changes in the above-mentioned circumstances and, on request by the Company, to produce any documentation suitable to confirm the truthfulness of the facts declared;
  • having read Sections 13 and 14 of the del General Data Protection Regulation Reg.(UE) 2016/679 , and the information notice on the processing of personal data reported in attachment, AUTHORIZE the publication of the information above and the information on personal and professional characteristics mentioned in my curriculum vitae, in the socalled "profile form" and in the list of the offices currently held in banks or other commercial companies.
nd March 2021, England _____
Date and place, __2
Signed ______

Dame Jayne-Anne Gadhia, CBE

Resident in London, United Kingdom

Born in Stourbridge on 19th October 1961

Executive Career Summary

2019 –
present
Snoop, Founder and Executive Chair
2019 -
2020
Salesforce, Chief Executive Officer UK&I
2007 -
2018
Virgin Money, Chief Executive Officer
2001 -
2007
RBS Group, Retail Managing Director
1998 -
2001
Virgin One Account, Managing Director
1994 -
1998
Virgin Direct, Founder and Chief Operating Officer
1987 -
1994
Norwich Union,
Senior Manager
1982 -
1987
Ernst and Young, Chartered Accountant

Other Board Memberships / External Roles

Active Board Roles

2019 -
present
Snoop

Founder and Executive Chair
2020 –
present
HMRC –
Chair (Non-Commercial
role)
2020 –
present
Goldacre –
Non-Executive
Chair
(Advisory)
2019 –
present
Salesforce Advisory Board –
Member
2016 -
present
Tate Board of Trustees

Senior Independent Director
/ Chair of Audit
Committee and Finance and Operations Committee
(Non-Commercial
role)
2015 -
present
The Prince's Foundation

Chair of Trustees
(stepping down upon
appointment of UniCredit)

External Roles – Global

2018 - present CASS Global Advisory Board – Member

External Roles – UK

2020 –
present
Lloyds Culture Advisory Group –
Member
2016 -
present
HM Treasury: Women in Finance Champion
2016 -
present
Mayor of London: Business Advisory Board

Member
Dame Jayne-Anne Gadhia, CBE ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 1

  • 2015 2019 FCA Practitioner Panel Member
  • 2017 2018 UK Finance Board Member
  • 2015 2016 UK Government: Prime Minister's Business Advisory Group
  • 2014 2017 Business in the Community Board of Trustee Director

External roles – Scotland

2016 –
2019
Scottish Government: International Council of Education Advisers

Member
2016 –
2017
Scottish Government: Student Support Review

Independent Chair
2015 –
2019
Scottish Government: Financial Services Advisory Board

Member
2013 –
2017
Scottish
Business in the Community
-
Chair
2013 –
2015
Prince's Ambassador for Scotland
(Business in the Community)

Professional Experience

2019 –
Present
Snoop: Founder and Executive Chair
-
Snoop is an award-winning Fintech, established in 2019 by
Dame Jayne-Anne Gadhia and 10 former colleagues from
Virgin Money.
-
Snoop uses Open Banking and Open Data to help customers
manage their finances efficiently and to save themselves money.
-
Launched to the public in early 2020, Snoop continues to grow
very strongly, and undertook Europe's second largest
crowdfund of 2020.
-
The role of Founder and Executive Chair is responsible for
setting the overall vision and strategy for Snoop, and building
a
Board and executive team to execute on delivery of the plan.
2019 -
2020
Salesforce: Chief Executive Officer UK&I
-
Salesforce is a global cloud-based software company which is
listed on the New York Stock Exchange. The Company has
over 35,000 employees and was ranked #1 in Fortune's 100 Best
Companies to Work For in 2018.
-
The role of Chief Executive Officer UK&I is responsible for the
strategy, operation and sales performance of the region, while
managing relationships with the Company's headquarters in San
Francisco and the other regions around the world.
2007 –
Oct 2018
Virgin Money: Chief Executive Officer and Executive Director
-
Virgin Money is a UK retail bank which serves almost 3.4
million customers, employs over 3,000 people and which
produced a return on tangible equity of 14% on earnings of
£666 million in 2017.
  • In October 2018, CYBG plc acquired Virgin Money in an all share deal which valued the bank at around £1.7bn. In June 2019 it was announced that CYBG's listed entity and operating divisions would be renamed to Virgin Money.

Achievements:

  • Grew Virgin Money from a negative asset position in 2007 to a business valued at approximately £1.7bn on acquisition.
  • In 2017 Virgin Money made the highest returns of any UK retail bank with a reported ROTE of 14%.
  • Led the listing of the Company on the London Stock Exchange in November 2014 since when total shareholder return on the completion of the CYBG deal was approximately 37%.
  • Led the successful acquisition of Northern Rock from HMG in 2012 since which total assets have more than doubled and a loss-making bank has been restored to strong profitability through low risk revenue growth and a strict focus on cost management.
  • Created a strong and unifying corporate purpose through an ambition 'to make everyone better off'. This led to market leading staff engagement scores of over 75%.
  • Led the development of a digital transformation such that over three quarters of business is transacted through digital and online channels.
  • Enhanced and maintained open, constructive and collaborative regulatory relationships, especially with the Bank of England, the PRA and the FCA.
  • Worked closely with Sir Richard Branson and United States Secretary of Commerce, Wilbur Ross prior to listing as well as with golden circle firms, including Goldman Sachs, in a number of M&A transactions.
  • Led a broad initiative across the City to achieve greater diversity in business through the Women in Finance Charter and ensured that Virgin Money operates as a diverse business with equality at its heart.
  • Established a broad social enterprise programme at Virgin Money including the launch of Virgin Money Giving and the Virgin Money Foundation, amongst other programmes, which have enhanced our brand and created a solid and broad network of support from companies and communities nationwide.

2001 - 2007 Royal Bank of Scotland Group: Managing Director and member of the Retail Bank Executive Committee


Key Responsibilities / Achievements:

- Led the RBS retail mortgage portfolio to balances of over £60
billion and contribution of more than £350 million per annum.
  • Ran non-core loan portfolios for both Direct Line and Lombard brands and discovered material issues with PPI. Importantly this informed the decision never to offer PPI on any products at Virgin Money.
  • As a member of the Retail Direct Management team ran and grew each of the Direct Line, Lombard, First Active and One Account brands.
  • Successfully integrated the Virgin One Account into the RBS Group.

1998 - 2001 Virgin One Account: Managing Director

Key Responsibilities / Achievements:

  • Created the innovative Virgin One Account from scratch through leading a joint venture between Virgin Direct and RBS.
  • Grew the One Account business to outstanding balances of around £15bn, making the business a top ten UK lender within three years of launch.
  • Managed the successful acquisition of the entire share capital of the business by RBS in 2001.

1994 - 1998 Virgin Direct (subsequently renamed Virgin Money): Joint Founder, Executive Director, Chief Operating Officer & Compliance Officer

Key Responsibilities / Achievements:

  • Established the business from a standing start in 1994 from an equity base of £4m.
  • Responsible for the launch, marketing, build, regulatory approval and ongoing operations of directly distributed investment, pensions, life insurance and critical illness products.

1987 – 1994 Norwich Union (Aviva): Business & Finance Manager (Direct Sales)

Key Responsibilities / Achievements:

  • Led the rescue of the direct sales business from regulatory censure in 1994.
  • Transformed the Unit Trust business in 1993, increasing year on year sales by 800%.

  • Unit Trust accountant, responsible for the financial control of ten Unit Trust funds.

1982 – 1987 Ernst and Young (now EY): Chartered Accountant

Major Honours

2019 Dame Commander of the Order of the British Empire (DBE)

For
services to Financial Services and Women in the Financial Industry
2013 Commander of the Order of the British Empire (CBE)

For
services to banking and voluntary services to the community

Other Honours & Qualifications

2019 Honorary Doctor of Civil Law

University of East Anglia
2019 Honorary Doctor of the University

University of Glasgow
2018 Fellow of The Royal Society of Edinburgh
2018 Honorary Doctor of Science (Economics) -
Royal Holloway,
University of London
2016 Honorary Doctor of Civil Law
-
Northumbria University
2016 Prince's National Ambassador
(Business in the Community)
1989 Chartered Accountant –
ICAEW
1982 Bachelor of Arts (Honours), University of London

Personal

Married with one daughter. Primarily based in London.

2 nd March 2021

[ANNEX 2 – LIST OF THE OFFICES CURRENTLY HELD IN BANKS OR OTHER COMMERCIAL COMPANIES1 ]

I, the undersigned Jayne-Anne Gadhia born in Stourbridge on 19/10/1961, fiscal code NB538878C, declare that I currently hold the following office:

Executive Chairman of SNOOP

In addition I declare to hold the following additional offices (no profit) :

  • Her Majesty's Revenue & Customs Chairman
  • Tate Trustee
  • Mayor of London's Advisory Board Member
  • Industrial Strategy Council -Member
  • Financial Inclusion Policy Forum Member
  • Commission for Smart Government Member

Date and place, …2 nd March 2021 ………..

Signed ______________________________

1 Please, indicate: the management or control or managerial positions held in banks or other commercial companies in Italy or abroad.

If negative, please indicate: "No management or control or managerial positions held in banks or other commercial companies in Italy or abroad".

ANNEX 3 - INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA BY UNICREDIT

The following information notice aims at providing you with an overview on the use of your personal data by UniCredit S.p.A. and of your rights pursuant to the General Data Protection Regulation - Regulation (EU) 2016/679 (hereinafter also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (UniCredit).

The Data Protection Officer (DPO) can be contacted at:

UniCredit S.p.A. Data Protection Office, Piazza Gae Aulenti n. 1, Tower B, 20154 Milano, E-mail: [email protected], PEC: [email protected].

2. PURPOSE AND LEGAL BASIS OF PROCESSING

UniCredit processes the personal data in its possession, that is collected directly from you, or from the relevant local administrations to verify, among others, their accuracy for the following purposes:

A. Need to fulfill legal obligations deriving from your candidacy as a Member of the UniCredit's Board of Directors.

These obligations imply, among others, verifying - both during the selection procedures and on an ongoing basis - the compliance: i) with the eligibility requirements for taking on and maintaining the role of Director as well as of specific positions (such as integrity requirements, criteria of correctness, professional experience requirements and competence, independence, time commitment, maximum number of offices covered, respect of the prohibition of interlocking) as required by applicable law, by UniCredit's Articles of Association and by the Corporate Governance Code (i.e. Codice di Corporate Governance) as well as with social security and fiscal obligations linked to the remuneration provided.

To comply with the above-mentioned obligations, in some cases, UniCredit is required to

6 Please, indicate: the management or control or managerial positions held in banks or other commercial companies in Italy or abroad.

If negative, please indicate: "No management or control or managerial positions held in banks or other commercial companies in Italy or abroad".

carry out analyses that concern also your relatives7 . For this reason, we kindly ask you to let them aware of this Information Notice.

These needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the obligations arising from your role of member of UniCredit's Board of Directors; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

B. Fulfilment of legal obligations and requests from Public and Supervisory Authorities, concerning the process, communication and/or disclosure - also during the selection procedures - on the website www.unicreditgroup.eu and/ or on specific corporate documents (e.g. Prospectus / Corporate Governance Report, Financial Statements) of your data (such as data contained in your curriculum vitae and in the list of the tasks carried out by you in other banks and commercial companies, as required by the applicable law, and according to the Articles of Association and the Corporate Governance Code).

The needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the legal obligations, the requests from the Authorities, as well as to take on the role of member of the Board of Directors of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

3. CATEGORIES OF PERSONAL DATA PROCESSED

UniCredit processes personal data collected directly from you, or from third parties (e.g. relevant local administrations), which include, but are not limited to, personal data (e.g. name, surname, address, date and place of birth), banking data, information on the financial situation (e.g. patrimonial status, information on credit requests/relationships), positions held and related income, employment relationships, commercial/professional relationships.

This information may concern existing or past relationships with UniCredit as well as with Group Legal Entities or third parties.

3.1 JUDICIAL DATA

UniCredit may process judicial data (i.e. personal data relating to criminal convictions and offences or related security measures, including information on pending proceedings) referring to you, in order to verify the subjective and integrity requirements and/or conditions that prevent from being appointed as member of the Board of Directors of UniCredit.

In such cases, the processing is necessary to fulfill legal obligations as well as to comply with requests coming from Public or Supervisory Authorities (e.g. filling the questionnaire requested by the ECB). This need represents the legal basis that legitimizes the related data processing. Data provided by you is necessary to comply with the legal obligations; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

7 The relatives scope is identified on the basis of the specific applicable regulations.

Your data may be communicated to the natural and legal persons that are acting as "Data Processors", listed in the UniCredit premises and on the website www.unicredit.it, as well as – in the quality of persons authorized to process personal data in relation to the data necessary for the performance of the duties they are assigned to – the natural persons belonging to the following categories:

  • employees or temporary employees or trainees assigned to the UniCredit HR, PL & BS Management Functions / IAD Budget & Administrative Support / Individual Reports, as well as the UniCredit Group Corporate Affairs, consultants and other natural persons occasionally assigned to these functions;
  • employees, temporary workers, interns and consultants of external companies appointed as Data Processors.

Your data may be communicated:

  • to those subjects to whom this communication must be carried out in compliance with an obligation established by law (e.g. Bank of Italy and ECB), by a regulation or by EU legislation. Further information can be found on the website www.unicredit.it in the "Privacy" section;
  • to Legal Entities belonging to the UniCredit Group (also foreign Legal Entities), subsidiaries or associates under the terms of article 2359 of the Italian Civil Code, when such communication is permitted on the basis of a Garante per la Protezione dei Dati Personali's measure or by a law provision.

The detailed list of subjects to whom the data can be communicated is available on the website www.unicredit.it, in the "Privacy" section.

5. DATA TRANSFER TO THIRD COUNTRIES

UniCredit informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called "Third Countries") if the EU Commission states that the Third Country ensures an adequate level of protection of personal data or in case of other appropriate safeguards, namely when the supplier of UniCredit located in the Third Country contractually ensures an appropriate level of personal data protection (e.g. through the signing of the standard contractual clauses provided by the European Commission), including enforceable and effective data subject rights. Further information can be requested by writing to [email protected].

6. DATA PROCESSING MODALITIES

The processing of personal data involves the usage of manual and IT instruments with modalities closely connected with the purposes defined above and, in any case, in such a way to guarantee the security and confidentiality of the data.

7. DATA SUBJECT' RIGHTS

GDPR grants and assures specific rights, including the right to know what data concerning you are held by UniCredit, as well as how they are used, and the right to obtain, under certain conditions, the copy, the erasure, the update, the rectification or, if interested, the integration of your data, as well as the right to data portability.

7.1 DATA RETENTION PERIOD AND RIGHT TO ERASURE

UniCredit processes and stores your personal data for all the time you keep the role of Director, to execute the related and connected obligations, to comply with the applicable legal, contractual and regulatory obligations, as well as for its own defensive purposes or those of third parties until the expiration of the longest mandatory retention period provided by the applicable law (i.e. 11 years) starting from the date of termination of the relationship with you. UniCredit processes and stores your personal data even after the expiry of the employment relationship when this is necessary for archiving purposes for historical research purposes, according, to the methods set out in the "Ethical rules of processing for archiving purposes in the public interest or historical research"8 .

At the end of the applicable mandatory retention period, your personal data will be erased or kept in a form which does not permit your identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes: i) for resolution of pre-litigation and/or litigation, started before the expiration of the mandatory retention period; ii) to follow up with investigations/inspections by internal control functions and/or external authorities, started before the expiration of the mandatory retention period; iii) to follow up with requests from the Italian and/or foreign Public Authorities, received/notified to UniCredit before the expiration of the mandatory retention period.

8. PROCEDURE TO EXERCISE THE RIGHTS

The e-mail address which you can refer to for the exercise of your rights described in the paragraph 7 is the following one: [email protected].

The deadline for the reply is one (1) month, that may be extended for two (2) further months in cases of particular complexity; in these cases, UniCredit informs you about such extension within one (1) month from the receipt of the request.

The exercise of rights is, in principle, free of charge.

9. COMPLAINT OR REPORTING TO THE "GARANTE PER LA PROTEZIONE DEI DATI PERSONALI"

UniCredit informs you that you have the right to lodge a complaint with, or to report to the Garante per la Protezione dei Dati Personali, or else to appeal to the Judicial Authority. The contacts of the Garante per la Protezione dei Dati Personali can be consulted on the website http://www.garanteprivacy.it.

8 Record of the provisions 19th december 2018, n. 513

STATEMENT OF CANDIDACY AND DECLARATION ATTESTING THE INEXISTENCE OF REASONS FOR INELIGIBILITY, FORFEITURE AND INCOMPATIBILITY, AS WELL AS THE MEETING OF THE REQUIREMENTS PROVIDED FOR BY CURRENT PROVISIONS

I, the undersigned Jeffrey Alan Hedberg born in Philadelphia – Pensylvania (USA) on 29/10/1961, fiscal code HDBJFR61R29Z404T, resident in Laglio (CO), , nationality US, in relation to the appointment to the office of Non -Executive Director 1 in UniCredit S.p.A. ("UniCredit" or the "Bank") according to the Agenda of the Shareholders' Meeting convened for 15 April 2021, under my own responsibility,

taking into account the provisions of Section 91 of the Directive 2013/36/EU dated June 26, 2013, as subsequently amended ("CRD IV"), Articles 2382 and 2387 of the Italian Civil Code, Section 26 of Legislative Decree no. 385 dated September 1, 1993 ("TUB"), Sections 147-ter(4) and 147-quinquies of Legislative Decree no. 58 dated February 24, 1998 ("TUF") , the Treasury Decree no. 169 dated November 23, 2020 (the "Decree") and the Ministry of Justice Decree no. 162 dated March 30, 2000, Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code (the "Corporate Governance Code")

STATE THAT

there are no reasons for my ineligibility, forfeiture or incompatibility and that I meet the requirements provided for by current provisions, as well as by the UniCredit Articles of Association for the appointment as Non -Executive Director 1 ; with specific reference to the experience and independence requirements

DECLARE THAT

I. EXPERIENCE REQUIREMENTS

  • 1) I possess the knowledge, skills and experience required by CRD IV, TUB and the Decree, and, in particular, that I have accrued overall experience of at least three years 2 through the exercise of:
    • a) activity CEO3 carried out at Wind Tre S.p.A. from June 2017 to present;

3 Please, indicate:

For the directors with executive posts:

  • management or control activities or managerial positions held in companies operating in the banking, financial, securities or insurance sectors; and/or
  • management or control activities or managerial positions held in listed companies or companies whose size and complexity are greater than, or equal to those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed); and

for the directors with non-executive posts, in alternative to the above-mentioned ones:

  • professional activities practiced in the fields relating to the banking, financial, securities, insurance sectors or anyhow instrumental for the activities of UniCredit; and/or
  • university teaching (first or second level) of legal or economics subjects, or other subjects instrumental for the banking, financial, securities or insurance sectors; and/or

1 Please, indicate the post as: (i) Chairman of the board of directors; (ii) Chief Executive Officer; or (iii) nonexecutive Director.

2 Please, delete the reference period that does not interest, taking into account that: (i) the Chairman of the board of directors and the Chief Executive Officer must have accrued a professional experience of at least ten years; and (ii) the non-executive Directors must have accrued an experience of at least three years.

  • b) activity President & CEO carried out at Mobilink - Pakistan from 2014 to 2016;
  • c) activity CEO carried out at Cell C – South Africa from 2006 to 2009

as they result from both the attached curriculum vitae (see Annex 1) and the list of offices4 currently held in banks or other commercial companies5 (see Annex 2);

II. INDEPENDENCE REQUIREMENTS

X I meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

OR

I DO NOT meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

***

X I meet the independence requirements envisaged by Section 13 of the Decree;

OR

I DO NOT meet the independence requirements envisaged by Section 13 of the Decree;

***

managerial/executive functions in public organizations or public administration offices relating to the banking, financial, securities or insurance sectors provided that the entity where the corporate officers performed such activities has a size and complexity similar to those of UniCredit.

In addition to the above, the chief executive officer shall possess a specific experience in the fields of banking, financial, securities or insurance, gained through management or control activities or managerial positions held in the banking, financial, securities and insurance sectors, or in listed companies or in companies whose size and complexity are greater than, or equal to, those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed).

4 "Offices" means those: i) held in the board of directors, supervisory board, management board; ii) held in the board of statutory auditors; iii) as general manager, however named; in foreign companies, the offices considered are those equivalent to the ones outlined in points i), ii) and iii) in accordance with the regulations applicable to such companies;

5 "Commercial companies" means: a company with registered office in Italy, established in the form of "società in nome collettivo, società in accomandita semplice, società per azioni, società in accomandita per azioni, società a responsabilità limitata", having as corporate purpose: 1) industrial activity producing goods or services; 2) intermediary activity in the circulation of goods; 3) land, water or air transportation activity; 4) banking or insurance activity; 5) auxiliary activities to the above-mentioned ones; or a company with registered office in a foreign country and qualifying as commercial company in accordance with the provisions of the relevant legislation of the Country where its registered office or head office is located.

X I meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code;

OR

I DO NOT meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code.

I, the undersigned, also:

  • STATE my candidacy the for election as member of the Board of Directors of UniCredit S.p.A. and, if elected, my willingness to accept my appointment as of now;
  • UNDERTAKE to promptly inform UniCredit of any changes in the above-mentioned circumstances and, on request by the Company, to produce any documentation suitable to confirm the truthfulness of the facts declared;
  • having read Sections 13 and 14 of the del General Data Protection Regulation Reg.(UE) 2016/679 , and the information notice on the processing of personal data reported in attachment, AUTHORIZE the publication of the information above and the information on personal and professional characteristics mentioned in my curriculum vitae, in the socalled "profile form" and in the list of the offices currently held in banks or other commercial companies.
Date and place, Milan, 28/02/2021
Signed
______

Jeffrey Alan Hedberg

Residence Como, Italy Born in Philadelphia – Pennsylvania (USA) on 29/10/1961

Education

1992- University of Denver, MA in International Management with a focus on International Policy and International Law (upon graduation, he was voted Student of the Year) 1988 - Northeastern University, BS in Business Administration

Current Affiliations

  • ASSTEL Vice President
  • Università Luigi Bocconi Member of the Advisory Board of SDA Bocconi, School of Management.

Professional experience

WIND TRE, Milan – Italy since 2017 – today

Wind Tre is the Italian communications and technology company providing more than 32 million customers with voice, fixed broadband, data and digital services. It generated a total revenue of €4.6 billion in 2017. The company has been formed by a merger between Wind (owned by VEON) and Tre (owned by Hutchison).

Chief Executive Officer

PMCL-Mobilink July 14 – July 16

Mobilink is Pakistan's leading telecom provider of voice and data services with more than 38 million subscribers.

President & Chief Executive Officer

As the President & CEO of Mobilink, Mr. Hedberg played a monumental role in turning around the business through a major strategic shift by focusing on customer excellence, growth in data and mobile financial services. Under his leadership Mobilink substantially improved its margin and cash flow since his arrival. Along with his Mobilink team, Mr. Hedberg is also responsible for the first and largest M&A in Pakistan's Telecom industry by merging the businesses of Mobilink and Warid Tel.

and concurrently,

Chairman & Member Board of Directors LINKDotNet Telecom Limited

CEO, Chairman & Member Board of Directors Mobilink Foundation

Chairman & Member Board of Directors Business Communication & Systems Limited.

Boston Consulting Group March 2013 – July 2014

Advisory role to BCG's South African Office and Managing Director of the Technology, Media and Telecommunications Practice Area based in Munich, Germany.

Private Equity Advisor March 2013 – July 2014

Advisory role to Carlyle South Africa and other private equity companies who are seeking to invest in the sub-Saharan region.

Telkom South Africa December 09–
June 11
Telkom South Africa, acting CEO July 2010 –
June 2011
Mr. Hedberg was appointed as the Acting CEO of Telkom South Africa, the incumbent operator with a
49% direct and indirect government ownership, in July 2010.

Multi-links Nigeria, Chief Executive Office December 2009 – June 2010 Mr. Hedberg led the strategic review of a 100% CDMA wireless and fixed line subsidiary of Telkom South Africa

Cell C May 2006 – November 2009 3rd Mobile operator in South Africa. Cell C was a Rand 10 billion company Chief Executive Officer

Mr. Hedberg led the turnaround of the company.

Deutsche Telekom AG January 1999 - 2004

CEO / Chairman of Deutsche Telekom, USA 2003 – 2004 Mr. Hedberg managed a \$2 billion budget while directing the financial and operational performance of the US operation, including governance of US subsidiaries T-Mobile and T-Systems. He developed comprehensive strategic plans, identified and executed mergers and acquisitions, and restructured and streamlined operations.

He served as Chairman of the Audit Committee and Chairman of the Compensation Committee for T-Mobile USA. His Supervisory Board Memberships included: T-Mobile USA, T-Systems USA, AICGS.

Executive Vice President / Member of Board of Management 1999 – 2002

As Executive Vice President and Member of the Board of Management, he developed the strategy for the International Division with over Euro 15 billion in annual revenues and 20,000 employees worldwide. Has responsible for driving strategic and operational alignment across the multiple geographies in which Deutsche Telkom operated through leadership, communication and an aligned incentive system.

His Supervisory Board Memberships included T-Mobile International, T-Systems International, T-Online International and T-Mobile USA.

Swisscom, Bern 1994 - 1998

Executive Vice President / Management Board Member 1997 – 1998

As Executive Vice President of Swisscom International and Management Board Member, he managed operations, a \$500 million budget and 120 employees. He held complete P&L responsibility for the

performance of the company's international investment portfolio valued at over SFR 2 billion. He was responsible for M&A within the Company.

Mr. Hedberg held the following Supervisory Board Memberships; Cesky Telcom, Mutiara / Swisscom in Malaysia, UTA in Osterreich, Tesion in Baden-Wiirttemberg and Swisscom Italia

Deputy Director, Swisscom International, Vice President for Strategy Acquisitions 1996 – 1997 Mr. Hedberg built and led an international team of over 25, responsible for the development and implementation of the international strategy. He held CEO responsibility, directing the integration of acquisitions including wireless in Malaysia and wire-line home extensions into Baden-Wuertemmberg and Alsace-Lorraine.

Director for the Unisource Alliance 1994 – 1996 In his role as Director, Mr. Hedberg developed the strategy and implemented the integration of Unisource Voice Services and Carrier Services from their parent organizations. In addition, he acted as Director of Marketing until the completion of the Teaming Agreement between AT&T and Unisource. He led the Teaming Agreement within Unisource, as well as between Unisource and AT&T for Carrier Services

Senior Associate Telecommunication Industries, Coopers & Lybrand, London 1992 – 1994 As a Senior Associate at Coopers & Lybrand, Mr. Hedberg handled key accounts in the telecommunication industry.

Corporate Strategy / Strategic Marketing Manager International, US-West, Inc. 1990 – 1992 At US West, Mr. Hedberg developed and implemented international market entry strategies for the company's investments in Europe.

Venture Capital Analyst, TVM Techno Venture Management, Boston 1988 – 1989 As an analyst, Mr. Hedberg performed strategic market analysis and provided management support for portfolio companies. He performed financial analysis and recommended venture capital opportunities in the US, UK and Germany. He also coordinated US venture capital deal flow between TVM and Matuschka in Germany.

Venture Capital / Corporate Finance Analyst, TVM/Matuschka Group, Munchen 1985 – 1987 Mr. Hedberg began his career his career performing strategic and financial analysis of venture capital opportunities for German, US, UK and Japanese funds.

Date and place, Milan, 28/02/2021

Signed ______________________________

[ANNEX 2 – LIST OF THE OFFICES CURRENTLY HELD IN BANKS OR OTHER COMMERCIAL COMPANIES1 ]

I, the undersigned Jeffrey Alan Hedberg born in Philadelphia – Pensylvania (USA) on 29/10/1961, fiscal code HDBJFR61R29Z404T, declare that I currently hold the following office:

Chief Executive Officer of Wind Tre S.p.A.

In addition I declare to hold the following additional offices (no profit):

  • ASSTEL Vice President
  • Università Luigi Bocconi Member of the Advisory Board of SDA Bocconi, School of Management.

Date and place, Milan, 28/02/2021 Signed ______________________________

1 Please, indicate: the management or control or managerial positions held in banks or other commercial companies in Italy or abroad.

If negative, please indicate: "No management or control or managerial positions held in banks or other commercial companies in Italy or abroad".

ANNEX 3 - INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA BY UNICREDIT

The following information notice aims at providing you with an overview on the use of your personal data by UniCredit S.p.A. and of your rights pursuant to the General Data Protection Regulation - Regulation (EU) 2016/679 (hereinafter also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (UniCredit).

The Data Protection Officer (DPO) can be contacted at:

UniCredit S.p.A. Data Protection Office, Piazza Gae Aulenti n. 1, Tower B, 20154 Milano, E-mail: [email protected], PEC: [email protected].

2. PURPOSE AND LEGAL BASIS OF PROCESSING

UniCredit processes the personal data in its possession, that is collected directly from you, or from the relevant local administrations to verify, among others, their accuracy for the following purposes:

A. Need to fulfill legal obligations deriving from your candidacy as a Member of the UniCredit's Board of Directors.

These obligations imply, among others, verifying - both during the selection procedures and on an ongoing basis - the compliance: i) with the eligibility requirements for taking on and maintaining the role of Director as well as of specific positions (such as integrity requirements, criteria of correctness, professional experience requirements and competence, independence, time commitment, maximum number of offices covered, respect of the prohibition of interlocking) as required by applicable law, by UniCredit's Articles of Association and by the Corporate Governance Code (i.e. Codice di Corporate Governance) as well as with social security and fiscal obligations linked to the remuneration provided.

To comply with the above-mentioned obligations, in some cases, UniCredit is required to carry out analyses that concern also your relatives7 . For this reason, we kindly ask you to let them aware of this Information Notice.

These needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the obligations arising from your role of member of UniCredit's Board of Directors; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

7 The relatives scope is identified on the basis of the specific applicable regulations.

B. Fulfilment of legal obligations and requests from Public and Supervisory Authorities, concerning the process, communication and/or disclosure - also during the selection procedures - on the website www.unicreditgroup.eu and/ or on specific corporate documents (e.g. Prospectus / Corporate Governance Report, Financial Statements) of your data (such as data contained in your curriculum vitae and in the list of the tasks carried out by you in other banks and commercial companies, as required by the applicable law, and according to the Articles of Association and the Corporate Governance Code).

The needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the legal obligations, the requests from the Authorities, as well as to take on the role of member of the Board of Directors of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

3. CATEGORIES OF PERSONAL DATA PROCESSED

UniCredit processes personal data collected directly from you, or from third parties (e.g. relevant local administrations), which include, but are not limited to, personal data (e.g. name, surname, address, date and place of birth), banking data, information on the financial situation (e.g. patrimonial status, information on credit requests/relationships), positions held and related income, employment relationships, commercial/professional relationships.

This information may concern existing or past relationships with UniCredit as well as with Group Legal Entities or third parties.

3.1 JUDICIAL DATA

UniCredit may process judicial data (i.e. personal data relating to criminal convictions and offences or related security measures, including information on pending proceedings) referring to you, in order to verify the subjective and integrity requirements and/or conditions that prevent from being appointed as member of the Board of Directors of UniCredit.

In such cases, the processing is necessary to fulfill legal obligations as well as to comply with requests coming from Public or Supervisory Authorities (e.g. filling the questionnaire requested by the ECB). This need represents the legal basis that legitimizes the related data processing. Data provided by you is necessary to comply with the legal obligations; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your data may be communicated to the natural and legal persons that are acting as "Data Processors", listed in the UniCredit premises and on the website www.unicredit.it, as well as – in the quality of persons authorized to process personal data in relation to the data necessary for the performance of the duties they are assigned to – the natural persons belonging to the following categories:

employees or temporary employees or trainees assigned to the UniCredit HR, PL & BS Management Functions / IAD Budget & Administrative Support / Individual Reports, as well as the UniCredit Group Corporate Affairs, consultants and other natural persons occasionally assigned to these functions;

employees, temporary workers, interns and consultants of external companies appointed as Data Processors.

Your data may be communicated:

  • to those subjects to whom this communication must be carried out in compliance with an obligation established by law (e.g. Bank of Italy and ECB), by a regulation or by EU legislation. Further information can be found on the website www.unicredit.it in the "Privacy" section;
  • to Legal Entities belonging to the UniCredit Group (also foreign Legal Entities), subsidiaries or associates under the terms of article 2359 of the Italian Civil Code, when such communication is permitted on the basis of a Garante per la Protezione dei Dati Personali's measure or by a law provision.

The detailed list of subjects to whom the data can be communicated is available on the website www.unicredit.it, in the "Privacy" section.

5. DATA TRANSFER TO THIRD COUNTRIES

UniCredit informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called "Third Countries") if the EU Commission states that the Third Country ensures an adequate level of protection of personal data or in case of other appropriate safeguards, namely when the supplier of UniCredit located in the Third Country contractually ensures an appropriate level of personal data protection (e.g. through the signing of the standard contractual clauses provided by the European Commission), including enforceable and effective data subject rights. Further information can be requested by writing to [email protected].

6. DATA PROCESSING MODALITIES

The processing of personal data involves the usage of manual and IT instruments with modalities closely connected with the purposes defined above and, in any case, in such a way to guarantee the security and confidentiality of the data.

7. DATA SUBJECT' RIGHTS

GDPR grants and assures specific rights, including the right to know what data concerning you are held by UniCredit, as well as how they are used, and the right to obtain, under certain conditions, the copy, the erasure, the update, the rectification or, if interested, the integration of your data, as well as the right to data portability.

7.1 DATA RETENTION PERIOD AND RIGHT TO ERASURE

UniCredit processes and stores your personal data for all the time you keep the role of Director, to execute the related and connected obligations, to comply with the applicable legal, contractual and regulatory obligations, as well as for its own defensive purposes or those of third parties until the expiration of the longest mandatory retention period provided by the applicable law (i.e. 11 years) starting from the date of termination of the relationship with you. UniCredit processes and stores your personal data even after the expiry of the employment relationship when this is necessary for archiving purposes for historical research purposes, according, to the methods set out in the "Ethical rules of processing for archiving purposes in the public interest or historical research"8 .

At the end of the applicable mandatory retention period, your personal data will be erased or kept in a form which does not permit your identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes: i) for resolution of pre-litigation and/or litigation, started before the expiration of the mandatory retention period; ii) to follow up with investigations/inspections by internal control functions and/or external authorities, started before the expiration of the mandatory retention period; iii) to follow up with requests from the Italian and/or foreign Public Authorities, received/notified to UniCredit before the expiration of the mandatory retention period.

8. PROCEDURE TO EXERCISE THE RIGHTS

The e-mail address which you can refer to for the exercise of your rights described in the paragraph 7 is the following one: [email protected].

The deadline for the reply is one (1) month, that may be extended for two (2) further months in cases of particular complexity; in these cases, UniCredit informs you about such extension within one (1) month from the receipt of the request.

The exercise of rights is, in principle, free of charge.

9. COMPLAINT OR REPORTING TO THE "GARANTE PER LA PROTEZIONE DEI DATI PERSONALI"

UniCredit informs you that you have the right to lodge a complaint with, or to report to the Garante per la Protezione dei Dati Personali, or else to appeal to the Judicial Authority. The contacts of the Garante per la Protezione dei Dati Personali can be consulted on the website http://www.garanteprivacy.it.

Date and place, Milan, 28/02/2021
Signed ______

8 Record of the provisions 19th december 2018, n. 513

STATEMENT OF CANDIDACY AND DECLARATION ATTESTING THE INEXISTENCE OF REASONS FOR INELIGIBILITY, FORFEITURE AND INCOMPATIBILITY, AS WELL AS THE MEETING OF THE REQUIREMENTS PROVIDED FOR BY CURRENT PROVISIONS

I, the undersigned Beatriz Angela LARA BARTOLOMÉ born in Buenos Aires (Argentina) on 30 November 1962, fiscal code LBRBRZ62S70Z600D, resident in Madrid (Spain), nationality Spanish, in relation to the appointment to the office of DIRECTOR in UniCredit S.p.A. ("UniCredit" or the "Bank") according to the Agenda of the Shareholders' Meeting convened for 15 April 2021, under my own responsibility,

taking into account the provisions of Section 91 of the Directive 2013/36/EU dated June 26, 2013, as subsequently amended ("CRD IV"), Articles 2382 and 2387 of the Italian Civil Code, Section 26 of Legislative Decree no. 385 dated September 1, 1993 ("TUB"), Sections 147-ter(4) and 147-quinquies of Legislative Decree no. 58 dated February 24, 1998 ("TUF") , the Treasury Decree no. 169 dated November 23, 2020 (the "Decree") and the Ministry of Justice Decree no. 162 dated March 30, 2000, Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code (the "Corporate Governance Code")

STATE THAT

there are no reasons for my ineligibility, forfeiture or incompatibility and that I meet the requirements provided for by current provisions, as well as by the UniCredit Articles of Association for the appointment as DIRECTOR; with specific reference to the experience and independence requirements

DECLARE THAT

I. EXPERIENCE REQUIREMENTS

1) I possess the knowledge, skills and experience required by CRD IV, TUB and the Decree, and, in particular, that I have accrued overall experience of at least three years through the exercise of:

A) ADMINISTRATIVE OR CONTROL ACTIVITIES, OR MANAGEMENT DUTIES IN OTHER COMPANIES:

November 2015 - present: AHAOW MOMENT S. L.

  • · Founder & CEO. AHAOW is my own innovation agency, which invests in startups such as OPINNO and ZELEROS Hyperloop and provides consultancy services to large companies, business schools and public organisms in Europe and Latin America.
  • · My position as an advisor on PROSEGUR's Innovation Board and as mentor and lecturer at IE Business School are governed by mercantile contracts.

March 2015 - April 2019: Investor, Board Member and CEO of IMERSIVO.

· The aim of Imersivo was to create a new type of shopping experience. Its platform incorporated emerging technologies such as gestures for interacting with window displays and using artificial intelligence to recognize customers in context and place produgt recommendations according to their lifestyles.

· I invested in Imersivo in March 2014 and entered the board in November 2015. I acted as CEO from November 2015 to July 2017. As the last investor round was not fully covered, in May 2017, Imersivo's board approved a pre-insolvency communication under article 5 bis of the Spanish Insolvency Law. Since April 2019, Imersivo has been under the administration of the Spanish court. Its assets liquidation process is still ongoing. The process is much longer tan initially expected due to COVID19 pandernia.

June 2006 - July 2015: BBVA (Please see details below, in section B).

June 2003 - June 2006: ALCATEL (formerly Alcatel-Lucent, now Nokia)

  • · In 2003, Director of Mobile Markets and Applications. Responsible for marketing and sales for the entire Alcatel portfolio of mobile operators in Spain and LatAm.
  • · I led the Global Competence Centre of Alcatel for Mobile Application based on the Intelligent Network Platform.
  • · When I joined, Alcatel had a minimal presence in mobile operators. I set in place a strategy to rebuild the company from the inside out, with the support of a team located in 24 countries. Even though local sales teams reported to me, it was my job to close negotiations and sign contract guarantees.

June 1997 - May 2003: ERICSSON

  • · Business Development Manager for the third GSM mobile license in Spain. I worked for all bidders and designed a total solution that included a complete GSM 1800 network, a turnkey project and customized venture projects related to network deployment to boost the Spanish GDP. In 1998, the AMENA Consortium, with Telecom Italia as technological partner, won the license. We signed a supply contract for hundreds of millions of euros per year.
  • · Ericsson have partnered with Movistar to work on the tenders for GSM networks in Morocco and Turkey. Movistar won the license in Morocco, and Ericsson won the contract to supply Movistar with a turnkey GSM 1800 Network nationwide. I led the winning proposal.
  • · In 1999, Executive Director of New Market Operators Unit. I built lasting commercial relationships with new telecom operators that emerged as a consequence of Spanish telecom liberalization. Leader of a "tiger team" of pioneers in three GSMs.
  • · We also won the contract for the deployment of the fourth mobile license in Spain, Xfera Consortium, with Telia-Sonera as technological partner.
  • · 2000-2002, Director of Strategic Marketing Division. I created Ericsson COMCENTER in Madrid, the first innovation centre outside Sweden to build application prototypes and share the 3G experience with operators and enterprises. I managed the prospects and deals of Ericsson INNOVA, a seed capital company.
  • · 2003, Business Development Director of Global Services. I developed the Ericsson Business Partnership Program to build a Networked Society.

1990 - 1997: AT&T NETWORK SYSTEMS (now Nokia)

  • · Computer Integrated Manufacturing Manager. I was responsible for implementing a complete information system for the company's switching factory in Tres Cantos, Madrid. It was compliant with 'just in time' philosophy and ISO 9000 standards.
  • · In 1993, I was promoted to Network Development Manager for the AT&T Wireless Business Unit, to implement and test the first GSM System of AT&T for Telefónica Móviles (MOVISTAR, first mobile operator in Spain.)
  • · In 1994, as GSM Business Development Manager, I provided technical support to all bidders for the Spanish telecom liberalization.
  • · Eventually, Airtel Consortium (now Vodafone) won the tender in June 1995. My last position was as Account Director for New Mobile & Private Operators.

B) PROFESSIONAL ACTIVITIES IN FIELDS OF CREDIT, FINANCE, SECURITIES, INSURANCE OR ANYWAY FUNCTIONAL TO THE ACTIVITIES OF THE BANK:

October 2012 - July 2015: BBVA, Global Director of Corporate Transformation.

· My tole was to lead BBVA's internal transformation into a digital company by promoting collaborative work and providing new technological training for employees worldwide.

· The design and execution of a new employee working experience at the physical, technological, and cultural levels, known as the 3B Strategy (Brick, Bytes and Behaviour).

"Bytes in the bricks":

  • · To ensure "one" common corporate language and seamless technological experience worldwide, the specifications of the required technical infrastructure included an exhaustive description of all of its components. We created an internal standards handbook to facilitate the homogeneous implementation of technological solutions in all geographical locations.
  • · I led a centralized team to monitor the technological rollout in BBVA HQ Buildings in all operating countries: the USA, Chile, Spain, Mexico, Peru, Argentina, etc. These projects involved more than one thousand professionals, with a budget of some hundred million euros. By the end of 2014, 33,000 employees (including the main trading floor) were moved smoothly to the new smart buildings we designed. In July 2015, all employees were established in their modernized workplaces.
  • · Cutting-edge technologies were implemented at this time; for example, in telecommunications we deployed 3G & 4G indoor coverage, seamless WiFi interconnection, and near field communications services. We also revolutionized the workplace with mobile equipment for all, a "bring your own device" policy, digitization procedures for tonnes of documents, a digital content management system and the highest standards of security.

"Bytes Disruption":

  • · Design, development, deployment & maintenance of a collaborative digital environment. With the support of BBVA's highest management levels, I took the strategic decision to migrate 110,000 employees to this open cloud-based application system. BBVA was the first bank worldwide to implement a secure public cloud service system, and the news of this had a global impact. It signified not only an operational shift in the industry's perception of cloud computing and the value it brings to banks.
  • · It also included the design and development of a suite of mobile & web applications: locationbased services, Personal Assistant, Meeting Room Booking, Directory, My Tasks, My Projects, Mobile Printing, My Drive and others. The specialized press took notice of BBVA's endeavour to become a networked enterprise, with regard to future workstations.

"Influence of bytes in behaviors":

  • · Design and execution of a change management strategy to facilitate employee adoption of our new ways of working' based on digitization, mobility, simplicity, security and collaboration. I designed a six-stage digital transformation path to achieve the 'new normality' of working collaboratively.
  • · We designed and built the first collaborative meeting room with touch-screen walls for agile and design thinking projects. It allows seamless virtual and in-person collaboration workshops.

March 2010 - September 2012: BBVA, Chief Innovation Officer.

  • · My objective when inaugurating the first Innovation Center (2010) in Spain was: (i) to define and execute a global innovation plan for delivering the highest customer experience with superior value for BBVA; (ii) to look toward the future, identify focuses of interest, develop the most convenient solutions and boost the evolution of BBVA's strategic intent in the years 2010-15.
  • · To articulate innovation within the bank worldwide, I developed a variety of strategic actions. I created the Innovation Partner Unit to boost innovative thinking, conduct innovation workshops with specific methodologies and toolkits, and generate project ideas for the innovation funnel together with the BUs. I also created a community of beta-testers and the magazine 'Innovation Edge'.
  • As a result, BBVA launched new digital products in all markets and built an international network of Innovation Centres outside Spain as well. In March 2012, I opened an Innovation Centre in Colombia.
  • · I created the Business Discovery Organizational Unit. We used future thinking methodologies to identify the possible future scenarios for the roaring 2020s. Aligned with these, we defined

a holistic vision of the future of banking. From this vision, we backcasted the desired position for 2015. This resulted in a dozen disruptive projects such as Banking the Unbanked' in Latin America, health services in the US, gamification for retail banking customers in Spain and Mexico, branchless banking, a social payments platform (SUMA), the foundations of BBVA Data & Analytics and a new platform to provide banking as a service.

  • · My innovation portfolio included projects that were pioneering initiatives at that time:
      1. Lola. The design and development of the Internet Bank of the Future involved big data and artificial intelligence, and Lola, an online virtual banking assistant, was born. The presentation took place in July 2012, with significant repercussions in the technical community. Today, Lola is Kasisto, and this joint venture (SRI-BBVA) is servicing the entire banking industry.
      1. The Customer-Centric Bank project included the transformation of all channels to provide a consistent customer experience. We designed and built several pilot branches in different countries to test the design principles of the Bank of the Future.
      1. Openmind Community: We developed the OpenMind_App and boosted the online community to make accessible to the general public topics of the utmost relevance and interest, written by world-class experts.

June 2006 - March 2010: BBVA, Director of Strategy & Innovation, IT & Operations BU.

  • · Delivery of the strategic plan for IT & Operations for the period 2006-2010. This plan impacted 8,000 IT employees worldwide and had a budget of 1 billion euros per year.
  • · Creation of the Technological Observatory to promptly identify new technologies with impact in the banking sector.
  • · Development of an international innovation network. In 2007, I signed the first International Liaison Program between a Spanish company and MTT. Since then, I have strengthened the relationship through specific agreements with MIT research consortiums such as Media Labs, CSAIL, CSIR, Senseable Cities Labs, Open Innovation Think Tank and Cyber Security.
  • · Creation of the Technological Laboratory to test emerging technologies and incorporate them at their early stages of maturity. Creation of a matrix of technology maturity and impact in business to best identify and put our findings into action.
  • · I defined, designed and led the construction of an Innovation Center to allocate there both the Observatory and Laboratory.
  • · The innovation projects developed during this time included:
      1. Speech analytics: Analyzing and digitizing conversations on the trading floor to be able to search and find needed information and make a speech-to-text transcription with the highest level of quality used in international courts. This project was a pioneer in banking and generated a shift in the financial industry.
      1. Future of Self-Service Banking: Design and construction of a human-centred Automatic Teller Machine (the ABIL project), adapted to the specific needs of blind, deaf and smaller people. For more details about its revolutionary design, please click 'The future of self-service banking by IDEO BBVA'. Later, as CIO, I produced a more robust version for emerging countries and a drive-thru version for the US market, BBVA Compass LiveLink.
      1. NUCA Innovation: The technological innovation outcome of BBVA Corporate Social Responsibility. During the Observatory's work scouting for new technologies, we discovered PARO in Japan. PARO is an advanced interactive therapeutic robot designed to stimulate patients with dementia, Alzheimer's and other cognitive disorders.

II. INDEPENDENCE REQUIREMENTS

I meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

I DO NOT meet the independence requirements envisaged by Section 147ter(4) in conjunction with Section 148(3) of the TUF;

  • I meet the independence requirements envisaged by Section 13 of the Decree; OR
  • ـــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــ I DO NOT meet the independence requirements envisaged by Section 13 of the Decree; ***
  • I meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code;
  • I DO NOT meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code.

OR

I, the undersigned, also:

  • STATE my candidacy for the election as member of the Board of Directors of UniCredit S.p.A. and, if elected, my willingness to accept my appointment as of now:
  • UNDERTAKE to promptly inform UniCredit of any changes in the above-mentioned circumstances and, on request by the Company, to produce any documentation suitable to confirm the truthfulness of the facts declared;
  • having read Sections 13 and 14 of the del General Data Protection Regulation -Reg.(UE) 2016/679 , and the information notice on the processing of personal data reported in attachment, AUTHORIZE the publication of the information above and the information on personal and professional characteristics mentioned in my curriculum vitae, in the so-called "profile form" and in the list of the offices currently held in banks or other commercial companies.

Date and place: Madrid, Spain, March 1st, 2021.

eatriz A. Lara Bartolomé Signed -

ANNEX 1 - CURRICULUM VITAE BEATRIZ ÁNGELA LARA BARTOLOMÉ

SUMMARY

In the corporate world and beyond, Beatriz is considered a true visionary, and a pioneer of innovation, digital transformation and collaborative work. She has a deep understanding of the current technological panorama, its evolutionary processes and its impact on people and businesses.

She has demonstrated repeatedly her ability to identify trends and factors of change in order to define future scenarios. She possesses the strategic clarity needed to build the future from the present, and international expertise in implementing new approaches for creating and capturing value in a variety of temporal frameworks.

She is currently a member of the Board of Directors of UNICREDIT S. p. A. She is also a senior advisor on complex projects of innovation and digital transformation for leading global companies such as PROSEGUR. In the entrepreneurial world, she is a business angel and investor of companies specializing in emerging technologies and digital talents, such as OPINNO and ZELEROS HYPERLOOP and a mentor at the IE Startup Lab.

After receiving a master degree in Physical Sciences from Madrid's Complutense University and a PDG from IESE Business School, she would go on to complete her management and leadership training through specialized programs at such prestigious business schools as MIT Management Sloan School.

For nearly a decade, Beatriz held the position of Chief Innovation Officer, and later Global Director of Corporate Transformation, at BBVA. During that time, she was also appointed Enterprise Advisor at MIT MediaLabs and sat on the Customer Advisory Board Google Enterprise Inc., the Board of Trustees of IMDEA Networks, and the Board of Directors of GlobalNet.

At BBVA, she was responsible for incorporating new digital age technologies such as Artificial Intelligence and Big Data into the banking business, as well as creating the first banking research centres in Madrid, Bogotá and Birmingham. She was also a pioneer in the use of Design Thinking to create an omnichannel banking model based on customer experience and to re-design the most usual points of contact: ATMs (ABIL, Drive-Thru), branches and virtual assistants. She laid the foundations for a new level of collaborative work at all of BBVA's workplaces with the migration to Google's cloud services, an important international milestone.

Before her involvement with banking, she worked for 16 years in Telecommunications, a sector well known for its focus on technology and innovation. In this area, she contributed directly to the development of GSM and 3G mobile telecom in Spain and Europe and held a number of managerial posts at ITT-Nokia, AT&T Network Systems, Ericsson and Alcatel.

She is the author of many publications and a frequent speaker at national and international conferences. She is also the owner of several patents and has received important awards and honours in all of the sectors in which she has worked.

PROFESSIONAL EXPERIENCE

Advisor and/or Director on several Boards:

  • · February 2020 Present: Board of Directors of UNICREDIT.
  • · October 2019 Present: Innovation & Digital Transformation Board at PROSEGUR.
  • · September 2017 Present: Seed Investor & Strategic Advisor at ZELEROS Hyperloop.
  • May 2014 Present: Financial Investor & Senior Advisor at OPINNO.
  • January 2018 March 2020: EMEA Advisory Board at GLOBANT
  • · March 2015 April 2019: Board Director at IMERSIVO, and investor (present).
  • February 2016 Marzo 2017: Industry Advisor at GLOBANT
  • · March 2013 September 2014: Member of Customer Advisory Board of former Google Enterprise.
  • July 2009 November 2012: BBVA Executive Sponsor of MIT Media Lab.
  • November 2008 March 2011: IMDEA Networks, Elective Trustee & Designed Representative.
  • March 2007 February 2015: BBVA Next Technologies (former GlobalNet), . 2 Nominee Director.

Other collaborations during the last years:

  • · May 2019 present, Mentor at Startup Lab, International MBA, IE Business School.
  • · November 2019, Lecturer and mentor of Digital Journey, IPADE in San Francisco.
  • · June 2014 present, Promoter of Innovation Center for Collaborative Intelligence.
  • · September 2014 November 2016, Master Lecturer at Istituto Europeo di Design.

Retail, IMERSIVO (1,5 years):

· November 2015 - July 2017, Chief Executive Officer Imersivo.

Banking, BBVA (9 years):

  • · October 2012 July 2015: Global Director of Corporate Transformation
  • March 2010 October 2012: Chief Innovation Officer
  • · June 2006 March 2010: Director of Strategy & Innovation, IT & Operations

Telecommunication, Mobile (16 years):

  • · June 2003 June 2006: ALCATEL, Director of Mobile Markets and Applications.
  • · June 1997 May 2003: ERICSSON, Executive Director in several positions.
  • · June 1990 May 1997: AT&T NETWORK SYSTEMS, Account Director.

Manufacturing (3 years):

  • · 1989 1990. ELECTRONICS & TELECOMMUNICATIONS (Civil & military projects)
  • · 1987 1989. IT&T-NOKIA Supervisor of product development & quality

Research (2 years):

  • · Summer of 1986. Research internship at KFKI, CERN's Project.
  • · 1985 1986. Universidad Complutense de Madrid. Meteorology Project.

EDUCATION

July 2018, Advanced Leadership Foundation: "Cumbre de Innovación y Economía Circular."

Feb - May 2018, IESE Business School, Madrid & Barcelona Campus. Corporate Governance Program, promoted by KPMG and AED, Spanish Association of Executives: "From Executive Officer to Member of Board"

Nov 2015, MIT ILP, Boston, MA.: "Research & Development Conference: Leading Disruption"

March 2015, MIT ILP, Vienna, Austria: "Minds, Machines & Management".

June 2013, MIT Sloan School of Management, Madrid, Spain: "Perspectives on Organizations," MIT in company Executive Program, by Roberto Fernandez, PhD.

February 2013. Long Beach, LA. TED 2013: "The Young. The Wise. The Undiscovered."

September 2010. IMD & MIT Sloan School of Management, Strategic Alliance. MIT Endicott House, Dedham, MA, USA. Executive Program, "Driving Strategic Innovation".

October 2007. IC-A, Institute of Directors. Responsibilities of Board Directors.

2002-2003. IESE Business School, University of Navarra. PDG, MBA for Senior Executives.

  1. Harvard Business School for AT&T, in company programs: "Strategic Selling for profitability", and "Mobile Business: Accounting and financing."

  2. New Jersey University. Bell Labs, Murray Hill, New Jersey, USA, 1993. GSM System.

1990-1991. AT&T Corporate Training Center, Technical and industrial seminars about logistics, project management, ABC costing, Manufacturing, Just in Time, total quality, and theory of constraints.

1984-1986. Universidad Complutense de Madrid. Master's Degree, Physics Science. Minor in Electronics. 1981-1984. Universidad Autónoma de Madrid - Bachelor's Degree, Physics.

CONFERENCES AND PUBLICATIONS

From 1997 to 2006, her presentations and publications dealt largely with the future of mobile telephony and other aspects of telecommunications which today have become a reality.

From 2006 to 2012, her talks delved deeper into key aspects of innovation and digital transformation in banking. Highlights of this period were her participation in the July 2012 edition of TEDx Cibeles, with the presentation Banking the unbanked, and in El Ser Creativo in 2011 and 2012.

Since 2013, she has been a noted guest speaker at national and international conferences, where has addressed the topics of cultural transformation, collaborative work and intra-entrepreneurship in large organizations. These have included:

· Conferences about the Future of Work such as Smart Conversations y Beyond 2020 in España, Portugal, Italia, Chile, Colombia, Panamá, México, Argentina Perú.

  • · Intercorp Innovation Fest, keynote speaker of Digital Transformation at large scale. Lima, Perú, Octubre 2016,
  • · "Disruptive leadership: building the new normality", ESADE, Disruptive Management Master. Barcelona, Abril, 2015.
  • · MIT CSIR International Executive Forum, Key Speaker, Digital Transformation Showcase. MIT Melbourne, Australia, Diciembre 2013.

Currently, she is presenting her personal vision of possible trends and scenarios for the decade 2020-2030, and the keys to leadership in the digital age and a world of sustainable growth. She also participates as a Business Angel on a number of entrepreneurial forums.

In addition to the publication of her own "Vision 2020+", she has contributed to works such as: "New Workplaces for Promoting a Culture of Collaborative Work", "Transformations: 7 roles to Drive Change by Design" and "Outside In: The Power of Putting Customers at the Center."

PATENTS, HONORS & AWARDS

Patents as inventor: Three patents for three different Automatic Tellers' designs and configurations (patent number D603124, D603125, and D678651), and the patent of an Interactive Advertising Display (Patent number D624127).

January 2012, Apple Inc. recognition of BBVA's innovation model. BBVA Apple iPad in business

THE BANKER Awards 2012, Capital Markets Technology Project of the Year. Speech analytics technology implementation in electronic trading, Innovation in Technology Award.

July-November, 2011. New York, USA. MOMA, Museum of Modern Art, "Talk to me" exhibition about the communication between people and objects. MoMA Talk to ME Exhibition Catalogue. Visitors uploaded videos.

THE BANKER Awards 2010, Innovation in Banking Technology. Innovation in Delivery Channel Technology: BBVA ABIL, ATM Transformation.

World´s Alzheimer Day, 2009 - Audience with the Queen Mother of Spain, HRH Queen Sofia, to donate PARO therapeutic robot for the Alzheimer Foundation.

Telecom sector recognition as a GSM Pioneer in Spain and Europe: Profile of Beatriz Lara.

Date and place: Madrid, Spain, March 1st, 2021.

Signed Beatriz A. Lara Bartolomé

ANNEX 2

LIST OF THE OFFICES CURRENTLY HELD IN BANKS OR OTHER COMMERCIAL COMPANIES

Sole Director of AHAOW Moment S.L.

Date and place: Madrid, Spain, March 1st, 2021.

Signed _ Beatrız A Lara Bartolomé

ANNEX 3

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA BY UNICREDIT

The following information notice aims at providing you with an overview on the use of your personal data by UniCredit S.p.A. and of your rights pursuant to the General Dota Protection Regulation - Regulation (EU) 2016/679 (hereinafter also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (UniCredit).

The Data Protection Officer (DPO) can be contacted at:

UniCredit S.p.A. Data Protection Office, Piazza Gae Aulenti n. 1, Tower B, 20154 Milano, E-mail: [email protected], PEC: [email protected].

2. PURPOSE AND LEGAL BASIS OF PROCESSING

UniCredit processes the personal data in its possession, that is collected directly from you, or from the relevant local administrations to verify, among others, their accuracy for the following purposes:

A. Need to fulfill legal obligations deriving from your candidacy as a Member of the UniCredit's Board of Directors.

These obligations imply, among others, verifying - both during the selection procedures and on an ongoing basis - the compliance: i) with the eligibility requirements for taking on and maintaining the role of Director as well as of specific positions (such as integrity requirements, criteria of correctness, professional experience requirements and competence, independence, time commitment, maximum number of offices covered, respect of the prohibition of interlocking) as required by applicable law, by UniCredit's Articles of Association and by the Corporate Governance Code (i.e. Codice di Corporate Governance) as well as with social security and fiscal obligations linked to the remuneration provided.

To comply with the above-mentioned obligations, in some cases, UniCredit is required to carry out analyses that concern also your relatives2. For this reason, we kindly ask you to let them aware of this Information Notice.

These needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the obligations arising from your role of member of UniCredit's Board of Directors, without your personal data, UniCredit would not be in a position to establish a relationship with you or top comply with the law obligations.

2 The relatives scope is identified on the basis of the specific applicable regulations.

B. Fulfilment of legal obligations and requests from Public and Supervisory Authorities, concerning the process, communication and/or disclosure - also during the selection procedures - on the website www.unicreditgroup.eu and/ or on specific corporate documents (e.g. Prospectus / Corporate Governance Report, Financial Statements) of your data (such as data contained in your curriculum vitae and in the list of the tasks carried out by you in other banks and commercial companies, as required by the applicable law, and according to the Articles of Association and the Corporate Governance Code).

The needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the legal obligations, the requests from the Authorities, as well as to take on the role of member of the Board of Directors of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

3. CATEGORIES OF PERSONAL DATA PROCESSED

UniCredit processes personal data collected directly from you, or from third parties (e.g. relevant local administrations), which include, but are not limited to, personal data (e.g. name, surname, address, date and place of birth), banking data, information on the financial situation (e.g. patrimonial status, information on credit requests/relationships), positions held and related income, employment relationships, commercial/professional relationships.

This information may concern existing or past relationships with UniCredit as well as with Group Legal Entities or third parties.

3.1 JUDICIAL DATA

UniCredit may process judicial data (i.e. personal data relating to criminal convictions and offences or related security measures, including information on pending proceedings) referring to you, in order to verify the subjective and integrity requirements and/or conditions that prevent from being appointed as member of the Board of Directors of UniCredit

In such cases, the processing is necessary to fulfill legal obligations as well as to comply with requests coming from Public or Supervisory Authorities (e.g. filling the questionnaire requested by the ECB). This need represents the legal basis that legitimizes the related data processing. Data provided by you is necessary to comply with the legal obligations; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your data may be communicated to the natural and legal persons that are acting as "Data Processors", listed in the UniCredit premises and on the website www.unicredit.it, as well as – in the quality of persons authorized to process personal data in relation to the data necessary for the performance of the duties they are assigned to - the natural persons belonging to the following categories:

  • · employees of temporary employees or trainees assigned to the UniCredit HR, PL & BS Management Functions / IAD Budget & Administrative Support / Individual Reports, as well as the UniCredit Group Corporate Affairs, consultants and other natural persons occasionally assigned to these functions;
  • · employees, temporary workers, interns and consultants of external companies appointed as Data Processors.

Your data may be communicated:

  • · to those subjects to whom this communication must be carried out in compliance with an obligation established by law (e.g. Bank of Italy and ECB), by a regulation or by EU legislation. Further information can be found on the website www.unicredit.it in the "Privacy" section;
  • · to Legal Entities belonging to the UniCredit Group (also foreign Legal Entities), subsidiaries or associates under the terms of article 2359 of the Italian Civil Code, when such communication is permitted on the basis of a Garante per la Protezione dei Dati Personali's measure or by a law provision.

The detailed list of subjects to whom the data can be communicated is available on the website www.unicredit.it, in the "Privacy" section.

5. DATA TRANSFER TO THIRD COUNTRIES

UniCredit informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called "Third Countries") if the EU Commission states that the Third Country ensures an adequate level of protection of personal data or in case of other appropriate safeguards, namely when the supplier of UniCredit located in the Third Country contractually ensures an appropriate level of personal data protection (e.g. through the signing of the standard contractual clauses provided by the European Commission), including enforceable and effective data subject rights. Further information can be requested by writing to [email protected].

6. DATA PROCESSING MODALITIES

The processing of personal data involves the usage of manual and IT instruments with modalities closely connected with the purposes defined above and, in any case, in such a way to guarantee the security and confidentiality of the data.

7. DATA SUBJECT' RIGHTS

GDPR grants and assures specific rights, including the right to know what data concerning you are held by UniCredit, as well as how they are used, and the right to obtain, under certain conditions, the copy, the erasure, the update, the rectification or, if interested, the integration of your data, as well as the right to data portability.

7.1 DATA RETENTION PERIOD AND RIGHT TO ERASURE

UniCredit processes and stores your personal data for all the time you keep the role of Director, to execute the related and connected obligations, to comply with the applicable

legal, contractual and regulatory obligations, as well as for its own defensive purposes or those of third parties until the expiration of the longest mandatory retention period provided by the applicable law (i.e. 11 years) starting from the date of termination of the relationship with you. UniCredit processes and stores your personal data even after the expiry of the employment relationship when this is necessary for archiving purposes for historical research purposes, according, to the methods set out in the "Ethical rules of processing for archiving purposes in the public interest or historical research "3.

At the end of the applicable mandatory retention period, your personal data will be erased or kept in a form which does not permit your identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes: i) for resolution of pre-litigation and/or litigation, started before the expiration of the mandatory retention period; ii) to follow up with investigations/inspections by internal control functions and/or external authorities, started before the expiration of the mandatory retention period; iii) to follow up with requests from the Italian and/or foreign Public Authorities, received/notified to UniCredit before the expiration of the mandatory retention period.

8. PROCEDURE TO EXERCISE THE RIGHTS

The e-mail address which you can refer to for the exercise of your rights described in the paragraph 7 is the following one: [email protected].

The deadline for the reply is one (1) month, that may be extended for two (2) further months in cases of particular complexity; in these cases, UniCredit informs you about such extension within one (1) month from the receipt of the request.

The exercise of rights is, in principle, free of charge.

9. COMPLAINT OR REPORTING TO THE "GARANTE PER LA PROTEZIONE DEI DATI PERSONALI"

UniCredit informs you that you have the right to lodge a complaint with, or to report to the Garante per la Protezione dei Dati Personali, or else to appeal to the Judicial Authority. The contacts of the Garante per la Protezione dei Dati Personali can be consulted on the website http://www.garanteprivacy.it.

3 Record of the provisions 19th december 2018, n. 513

STATEMENT OF CANDIDACY AND DECLARATION ATTESTING THE INEXISTENCE OF REASONS FOR INELIGIBILITY, FORFEITURE AND INCOMPATIBILITY, AS WELL AS THE MEETING OF THE REQUIREMENTS PROVIDED FOR BY CURRENT PROVISIONS

I, the undersigned Luca Molinari born in Atessa (Italy) on 15 May 1973, fiscal code MLN LCU 73E15 A485C, resident in Abu Dhabi (UAE), Italian nationality, in relation to the appointment to the office of non-executive Director1 in UniCredit S.p.A. ("UniCredit" or the "Bank") according to the Agenda of the Shareholders' Meeting convened for 15 April 2021, under my own responsibility,

taking into account the provisions of Section 91 of the Directive 2013/36/EU dated June 26, 2013, as subsequently amended ("CRD IV"), Articles 2382 and 2387 of the Italian Civil Code, Section 26 of Legislative Decree no. 385 dated September 1, 1993 ("TUB"), Sections 147-tv(4) and 147-quinquies of Legislative Decree no. 58 dated February 24, 1998 ("TUF") , the Treasury Decree no. 169 dated November 23, 2020 (the "Decree") and the Ministry of Justice Decree no. 162 dated March 30, 2000, Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code (the "Corporate Governance Code")

STATE THAT

there are no reasons for my ineligibility, forfeiture or incompatibility and that I meet the requirements provided for by current provisions, as well as by the UniCredit Articles of Association for the appointment as non-executive Director'; with specific reference to the experience and independence requirements

DECLARE THAT

I. EXPERIENCE REQUIREMENTS

  • 1) I possess the knowledge, skills and experience required by CRD IV, TUB and the Decree, and, in particular, that I have accrued overall experience of at least three2 through the exercise of:

    • a) Private equity investment activity carried out as Head of Financial Services 3 at
  • management or control activities or managerial positions held in companies operating in the banking, financial, securities or insurance sectors; and/or

  • management or control activities or managerial positions held in listed companies or companies whose size and complexity are greater than, or equal to those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed); and

1 Please, indicate the post as: (i) Chairman of the board of directors; (i) Chief Executive Officer; or (iii) nonexecutive Director.

2 Please, delete the reference period that does not interest, taking into account that: (i) the Chairman of the board of directors and the Chief Executive Officer must have accrued a professional experience of at least ten years; and (ii) the non-executive Directors must have accrued an experience of at least three years.

3 Please, indicate:

For the directors with executive posts:

for the directors with non-executive posts, in alternative to the above-mentioned ones:

professional activities practiced in the fields relating to the banking, financial, securities, insurance sectors or anyhow instrumental for the activities of UniCredit; and/or

university teaching (first or second level) of legal or economics subjects, or other subjects instrumental for the banking, financial, securities or insurance sectors; and/or

Mubadala Investment Company from January 2021;

  • b) Private equity investment activity carried out as Executive Director in the Mergers & Acquisitions department at Mubadala Investment Company from March 2016 to December 2020;
  • c) Private equity investment activity carried out as Managing Director at Warburg Pincus from February 2001 to September 2014;
  • d) Investment banking activity carried out as Associate at Goldman Sachs from April 1997 to January 2001.

as they result from both the attached curriculum vitae (see Annex 1) and the list of offices t currently held in banks or other commercial companies5 (see Annex 2);

II. INDEPENDENCE REQUIREMENTS

I meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

OR

I DO NOT meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

***

I meet the independence requirements envisaged by Section 13 of the Decree;

OR

I DO NOT meet the independence requirements envisaged by Section 13 of the

- managerial/executive functions in public organizations or public administration offices relating to the banking, financial, securities or insurance sectors provided that the entity where the corporate officers performed such activities has a size and complexity similar to those of UniCredit.

In addition to the above, the chief executive officer shall possess a specific experience in the fields of banking, financial, securities or insurance, gained through management or control activities or managerial positions held in the banking, financial, securities and insurance sectors, or in listed companies whose size and complexity are greater than, or equal to, those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed).

4 "Offices" means those: i) held in the board of directors, supervisory board, management board; ii) held in the board of statutory auditors; ii) as general manager, however named; in foreign companies, the offices considered are those equivalent to the ones outlined in points i), ii) and iii) in accordance with the regulations applicable to such companies;

5 "Commercial companies" means: a company with registered office in Italy, established in the form of "sointà in nome collettivo, società in accomandita, società per azioni, società in acomandita per azioni, sostetà a responsabilità limitala", having as corporate purpose: 1) industrial activity producing goods or services; 2) intermediary activity in the circulation of goods; 3) land, water or air transportation activity; 4) banking or insurance activity; 5) auxiliary activities to the above-mentioned ones; or a company with registered office in a foreign country and qualifying as commercial company in accordance with the provisions of the relevant legislation of the Country where its registered office or head office is located.

Decree;

***

I meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code;

OR

I DO NOT meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code.

I, the undersigned, also:

  • STATE my candidacy the for election as member of the Board of Directors of UniCredit S.p.A. and, if elected, my willingness to accept my appointment as of now;
  • UNDERTAKE to promptly inform UniCredit of any changes in the above-mentioned circumstances and, on request by the Company, to produce any documentation suitable to confirm the truthfulness of the facts declared;
  • having read Sections 13 and 14 of the del General Data Protection Regulation Reg.(UE) 2016/679 , and the information notice on the processing of personal data reported in attachment, AUTHORIZE the publication of the information above and the information on personal and professional characteristics mentioned in my curriculum vitae, in the socalled "profile form" and in the list of the offices currently held in banks or other commercial companies.

Date and place: Abu Dhabi, 25 February 2021

Signed

3

LUCA MOLINARI Date of birth: 15 May 1973 Located in Abu Dhabi since March 2016 Married with 3 children Italian mother tongue, fluent in English and Portuguese

WORK EXPERIENCE

Head of Financial Services at Mubadala Investment Company in Abu Dhabi, UAE (January 2021 - current)

Following the announcement of a reorganization at Mubadala, a new Financial Services investment team has been created under my responsibility, with the mandate of identifying and executing investments in the international financial services industry

Executive Director at Mubadala Investment Company, Mergers & Acquisitions in Abu Dhabi, UAE (March 2016 - December 2020)

Responsibilities included transaction and business development across a wide range of investments and sectors, as well mentoring and development of junior resources in the team

Notable Transaction Activity

Represented Mubadala's interest in the merger between Abu Dhabi Commercial Bank and Union National Bank and concurrent acquisition of Al Hilal Bank, creating the third largest bank in the UAE with \$115bn combined assets

Sale of 40% equity interest in Tabreed to Engie, generating AED 2.8bn proceeds to Mubadala Sale of 80% equity interest in SR Technics to HNA

Managing Director at Warburg Pincus in São Paulo, Brazil (March 2010 - September 2014)

Warburg Pincus is a global private equity firm with approximately \$50bn assets under management, investing through an established diversified strategy across regions, sectors and stage of development (early stage, growth and late stage investing)

Relocated to Brazil from London upon the opening of the São Paulo office

Responsibilities included:

  • · Hiring a team of local professionals and managing the team on the day to day
  • · Developing sector/theme driven investment theses
  • Active monitoring of portfolio companies .
  • · Origination of new investment opportunities
  • · Close supervision and ultimate responsibility for transaction execution

Transaction Activity

Approximately \$500 million invested in four transactions:

  • · Omega Energia (developer of renewable energy assets, minority investment)
  • · Banco Indusval (mid-market corporate bank, minority investment)
  • · Petz (pet retailer, control investment)
  • · Dudalina (manufacturer of high end clothing apparel, joint control investment)

Managing Director at Warburg Pincus in London, UK (February 2001 - March 2010)

Joined the European team of Warburg Pincus in February 2001. Became part of a newly formed Consumer and Industrial team in early 2003, responsible for all the large, leveraged transactions of Warburg Pincus in Europe. Promoted to Managing Director and invited to join the partnership on 01/01/2008.

Transaction Activity Participated to all the LBO investments of Warburg Pincus in Europe, including: Clondalkin (packaging business, €630 million EV) Ideal Stelrad (heating products business, £227 million EV) Euromedic International (healthcare services buy & build roll up) MACH (telecom services business, €607 million EV) Buyouts of Multikabel, Casema and Essent Kablecom, subsequently merged into Ziggo, now one of the largest media companies in the Netherlands (aggregate €5.2 billion EV) SafetyKleen Europe (industrial services business, £565 million EV) Led the LBO investment in Survitec (safety and survival equipment business, £280 million EV)

Associate at Goldman Sachs in London, UK (April 1997 - January 2001)

Joined Goldman Sachs in London as an Analyst in April 1997. Worked in the Principal Investment Area, responsible for making principal investments through the Goldman Sachs Capital Partners and GS Mezzanine Partners funds, until July 1999.

Thereafter, worked in the Leveraged Finance team, underwriting acquisition financing to support investments from private equity clients of the bank.

EDUCATION

Bocconi University in Milan, Italy (September 1992 - October 1996) Summa cum laude M.S. in Economics and Business Administration

INTERESTS

Reading (biographies, current affairs, history, investing), sport, traveling

[ANNEX 2 – LIST OF THE OFFICES CURRENTLY HELD IN BANKS OR OTHER COMMERCIAL COMPANIES ]

Head of Financial Services carried out at Mubadala Investment Company

Non-executive Director at Sanad Group, a company with registered office in Abu Dhabi 100% held by the Mubadala Investment Company group

Date and place: Abu Dhabi, 25 February 2021

Signed

6 Please, indicate: the management or control or managerial positions held in banks or other commercial companies in Italy or abroad.

If negative, please indicate: "No management or control or managerial positions held in banks or other commercial companies in Italy or abroad".

ANNEX 3 - INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA BY UNICREDIT

The following information notice aims at providing you with an overview on the use of your personal data by UniCredit S.p.A. and of your rights pursuant to the General Data Protection Regulation - Regulation (EU) 2016/679 (hereinafter also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (UniCredit).

The Data Protection Officer (DPO) can be contacted at:

UniCredit S.p.A. Data Protection Office, Piazza Gae Aulenti n. 1, Tower B, 20154 Milano, E-mail: [email protected], PEC: [email protected].

2. PURPOSE AND LEGAL BASIS OF PROCESSING

UniCredit processes the personal data in its possession, that is collected directly from you, or from the relevant local administrations to verify, among others, their accuracy for the following purposes:

A. Need to fulfill legal obligations deriving from your candidacy as a Member of the UniCredit's Board of Directors.

These obligations imply, among others, verifying - both during the selection procedures and on an ongoing basis - the compliance: i) with the eligibility requirements for taking on and maintaining the role of Director as well as of specific positions (such as integrity requirements, criteria of correctness, professional experience requirements and competence, independence, time commitment, maximum number of offices covered, respect of the prohibition of interlocking) as required by applicable law, by UniCredit's Articles of Association and by the Corporate Governance Code (i.e. Codice di Corporate Governance) as well as with social security and fiscal obligations linked to the remuneration provided.

To comply with the above-mentioned obligations, in some cases, UniCredit is required to carry out analyses that concern also your relatives'. For this reason, we kindly ask you to let them aware of this Information Notice.

These needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the obligations arising from your role of member of UniCredit's Board of Directors; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

7 The relatives scope is identified on the basis of the specific applicable regulations.

B. Fulfilment of legal obligations and requests from Public and Supervisory Authorities, concerning the process, communication and/or disclosure - also during the selection procedures - on the website www.unicreditgroup.eu and/ or on specific corporate documents (e.g. Prospectus / Corporate Governance Report, Financial Statements) of your data (such as data contained in your curriculum vitae and in the list of the tasks carried out by you in other banks and commercial companies, as required by the applicable law, and according to the Articles of Association and the Corporate Governance Code).

The needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the legal obligations, the requests from the Authorities, as well as to take on the role of member of the Board of Directors of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

3. CATEGORIES OF PERSONAL DATA PROCESSED

UniCredit processes personal data collected directly from you, or from third parties (e.g. relevant local administrations), which include, but are not limited to, personal data (e.g. name, surname, address, date and place of birth), banking data, information on the financial situation (e.g. patrimonial status, information on credit requests/relationships), positions held and telated income, employment relationships, commercial/professional relationships.

This information may concern existing or past relationships with UniCredit as well as with Group Legal Entities or third parties.

JUDICIAL DATA 3.1

UniCredit may process judicial data (i.e. personal data relating to criminal convictions and offences or related security measures, including information on pending proceedings) referring to you, in order to verify the subjective and integrity requirements and/or conditions that prevent from being appointed as member of the Board of Directors of UniCredit.

In such cases, the processing is necessary to fulfill legal obligations as well as to comply with requests coming from Public or Supervisory Authorities (e.g. filling the questionnaire requested by the ECB). This need represents the legal basis that legitimizes the related data processing. Data provided by you is necessary to comply with the legal obligations; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your data may be communicated to the natural and legal persons that are acting as "Data Processors", listed in the UniCredit premises and on the website www.unicredit.it, as well as - in the quality of persons authorized to process personal data in relation to the data necessary for the performance of the duties they are assigned to - the natural persons belonging to the following categories:

· employees or temporary employees or trainees assigned to the UniCredit HR, PL & BS Management Functions / IAD Budget & Administrative Support / Individual Reports, as well as the UniCredit Group Corporate Affairs, consultants and other natural persons occasionally assigned to these functions;

employees, temporary workers, interns and consultants of external companies appointed as Data Processors.

Your data may be communicated:

  • · to those subjects to whom this communication must be carried out in compliance with an obligation established by law (e.g. Bank of Italy and ECB), by a regulation or by EU legislation. Further information can be found on the website www.unicredit.it in the "Privacy" section;
  • · to Legal Entities belonging to the UniCredit Group (also foreign Legal Entites), subsidiaries or associates under the terms of article 2359 of the Italian Civil Code, when such communication is permitted on the basis of a Garante per la Protezione dei Dati Personal's measure or by a law provision.

The detailed list of subjects to whom the data can be communicated is available on the website www.unicredit.it, in the "Privacy" section.

5. DATA TRANSFER TO THIRD COUNTRIES

UniCredit informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called "Third Countries") if the EU Commission states that the Third Country ensures an adequate level of protection of personal data or in case of other appropriate safeguards, namely when the supplier of UniCredit located in the Third Country contractually ensures an appropriate level of personal data protection (e.g. through the signing of the standard contractual clauses provided by the European Commission), including enforceable and effective data subject rights. Further information can be requested by writing to [email protected].

6. DATA PROCESSING MODALITIES

The processing of personal data involves the usage of manual and IT instruments with modalities closely connected with the purposes defined above and, in any case, in such a way to guarantee the security and confidentiality of the data.

7. DATA SUBJECT' RIGHTS

GDPR grants and assures specific rights, including the right to know what data concerning you are held by UniCredit, as well as how they are used, and the right to obtain, under certain conditions, the copy, the erasure, the update, the rectification or, if interested, the integration of your data, as well as the right to data portability.

7.1 DATA RETENTION PERIOD AND RIGHT TO ERASURE

UniCredit processes and stores your personal data for all the time you keep the role of Director, to execute the related and connected obligations, to comply with the applicable legal, contractual and regulatory obligations, as well as for its own defensive purposes or those of third parties until the expiration of the longest mandatory retention period provided by the applicable law (i.e. 11 years) starting from the date of termination of the relationship with you. UniCredit processes and stores your personal data even after the expiry of the employment relationship when this is necessary for archiving purposes for historical research purposes, according, to the methods set out in the "Ethical rules of processing for archiving purposes in the public interest or historical research' 8.

At the end of the applicable mandatory retention period, your personal data will be erased or kept in a form which does not permit your identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes: i) for resolution of pre-litigation and/or litigation, started before the expiration of the mandatory retention period; ii) to follow up with investigations/inspections by internal control functions and/or external authorities, started before the expiration of the mandatory retention period; iii) to follow up with requests from the Italian and/or foreign Public Authorities, received/notified to UniCredit before the expiration of the mandatory retention period.

8. PROCEDURE TO EXERCISE THE RIGHTS

The e-mail address which you can refer to for the exercise of your rights described in the paragraph 7 is the following one: corporate.law(a)pec.unicredit.eu.

The deadline for the reply is one (1) month, that may be extended for two (2) further months in cases of particular complexity; in these cases, UniCredit informs you about such extension within one (1) month from the receipt of the request.

The exercise of rights is, in principle, free of charge.

9. COMPLAINT OR REPORTING TO THE "GARANTE PER LA PROTEZIONE DEI DATI PERSONALI'

UniCredit informs you that you have the right to lodge a complaint with, or to report to the Garante per la Protezione dei Dati Personali, or else to appeal to the Judicial Authority. The contacts of the Garante per la Protezione dei Dati Personali can be consulted on the website http://www.garanteprivacy.it.

8 Record of the provisions 19th december 2018, n. 513

STATEMENT OF CANDIDACY AND DECLARATION ATTESTING THE INEXISTENCE OF REASONS FOR INELIGIBILITY, FORFEITURE AND INCOMPATIBILITY, AS WELL AS THE MEETING OF THE REQUIREMENTS PROVIDED FOR BY CURRENT PROVISIONS

I, the undersigned Maria PIERDICCHI born in Schio (Italy) on 8 September 1957, fiscal code PRDMRA57P58I531O, resident in Milano (Italy), nationality Italian, in relation to the appointment to the office of DIRECTOR in UniCredit S.p.A. ("UniCredit" or the "Bank") according to the Agenda of the Shareholders' Meeting convened for 15 April 2021, under my own responsibility,

taking into account the provisions of Section 91 of the Directive 2013/36/EU dated June 26, 2013, as subsequently amended ("CRD IV"), Articles 2382 and 2387 of the Italian Civil Code, Section 26 of Legislative Decree no. 385 dated September 1, 1993 ("TUB"), Sections 147-tot(4) and 147-quinquies of Legislative Decree no. 58 dated February 24, 1998 ("TUF"), the Treasury Decree no. 169 dated November 23, 2020 (the "Decree") and the Ministry of Justice Decree no. 162 dated March 30, 2000, Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code (the "Corporate Governance Code")

STATE THAT

there are no reasons for my ineligibility, forfeiture or incompatibility and that I meet the requirements provided for by current provisions, as well as by the UniCredit Articles of Association for the appointment as DIRECTOR; with specific reference to the experience and independence requirements

DECLARE THAT

I. EXPERIENCE REQUIREMENTS

1) I possess the knowledge, skills and experience required by CRD IV, TUB and the Decree, and, in particular, that I have accrued overall experience of at least three years' through the exercise of:

1 Please, delete the reference period that does not interest, taking into account that: (i) the Chairman of the board of directors and the Chief Exccutive Officer must have accrued a professional experience of at least ten years; and (ii) the non-executive Directors must have accrued an experience of at least three years.

2 Please, indicate:

For the directors with executive posts

  • management or control activities or managerial positions held in companies operating in the banking, financial, securities or insurance sectors; and/ or
  • management or control activities or managerial positions held in listed companies or companies whose size and complexity are greater than, or equal to those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed); and

for the directors with non-executive posts, in alternative to the above-mentioned ones:

  • professional activities practiced in the fields relating to the banking, financial, securities, insurance sectors or anyhow instrumental for the activities of UniCredit, and/or
  • university teaching (first or second level) of legal or economics subjects, or other subjects instrumental for the banking, financial, securities or insurance sectors; and/or
  • managerial/executive functions in public organizations or public administration offices relating to the banking, financial, securities or insurance sectors provided that the entity where the corporate officers performed such activities has a size and complexity similar to those of UniCredit.

In addition to the above, the chief executive officer shall possess a specific experience in the fields of banking,

as they result from both the attached curriculum vitar (see Annex 1) and the list of offices' currently held in banks or other commercial companies' (see Annex 2);

II. INDEPENDENCE REQUIREMENTS

I meet the independence requirements envisaged by Section 147-fer(4) in conjunction with Section 148(3) of the TUF;

OR

I DO NOT meet the independence requirements envisaged by Section 147-1r(4) in conjunction with Section 148(3) of the TUF;

I meet the independence requirements envisaged by Section 13 of the Decree;

OR

I DO NOT meet the independence requirements envisaged by Section 13 of the Decree;

来源:

I meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Secuon 2, recommendation 7, of the Corporate Governance Code:

OR

I DO NOT meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the

financial, securities or insurance, gained through management or control activities or managerial possions held in the banking, financial, securities and insurance sectors, or in listed companies whose are and complexity ace greater than, or equal to, those of UniCredit (in terms of tevenue, nature and complexity of the organization or activities performed).

" "Offices" means those: i) held in the board of directors, supervisory board, management board; u) held in the board of statutory auditors, iii) as general manager, however named; in foreign companies, the offices considered are those equivalent to the ones outlined in points i), in accordance with the regulations applicable to such companies,

" "Commercial company a company with regultered office to Italy, established in the form of "morel in mone sollettivo, società in acomondata socetà per azone, socoto sa acomandata per commendata per conselvador Imitald', having as corporate purpose: 1) industrial activity producing goods or services; 2) intermediaty activity in the circulation of goods, 3) land, water or air transportation activity, 4) banking or insurance activity, 5) auxiliary activities to the above mentioned ones, or a company with registered office in a foreign country and qualifying as commercial company in accordance with the provisions of the relevant legislation of the County where its registered office or head office is located.

Corporate Governance Code.

I, the undersigned, also:

  • STATE my candidacy the for election as member of the Board of Directors of UniCredit S.p.A. and, if elected, my willingness to accept my appointment as of now;
  • UNDERTAKE to promptly inform UniCredit of any changes in the above-mentioned circumstances and, on request by the Company, to produce any documentation suitable to confirm the truthfulness of the facts declared;
  • having read Sections 13 and 14 of the del General Data Protection Regulation -Reg.(UE) 2016/679 , and the information notice on the processing of personal data reported in attachment, AUTHORIZE the publication of the information above and the information on personal and professional characteristics mentioned in my curriculum vitae, in the so-called "profile form" and in the list of the offices currently held in banks or other commercial companies.

Signed House

MARIA PIERDICCHI

EDUCATION

New York University, Stern Graduate School of Business Administration, New York . M.B.A. Finance With Honors, 1988. Visiting Scholar, PhD Program in Finance, 1986.

Università Commerciale Luigi Bocconi, Milano

BA Economics (Laurea in Economia Politica), Summa cum Laude, 1982. Awarded 2 graduate assistantships

In the Boardroom, Professional Program for NED offered by Linklaters and Egon Zehnder in collaboration with Valore D. 2015.

Several Professional courses in financial markets and leadership (INSEAD, Columbia University, S&P Global)

PRESENT APPOINTMENTS

UniCredit Group, 10th largest banking group in Europe. Non Executive Director, member of the Internal Controls and Risk Committee and President of Related Parties Committee , since April 2018

AUTOGRILL SPA, Global leader in food and beverage for travelers . Non Executive Director, Member of Human Resources Committee, since May 2017

LUXOTTICA GROUP , Global leader in eyewear, since 2019 part of the group ESSILOR LUXOTTICA. Non Executive Director, 2015-2020.

NEDCOMMUNITY, Italian association of non executive directors and statutory auditors President , since May 2019

PRIOR APPOINTMENTS

LUXOTTICA GROUP , Global leader in eyewear, since 2019 part of the group ESSILOR LUXOTTICA . Non Executive Director, 2015-2020

S&P GLOBAL Ratings Italy (Italian legal entity S&P Global Ratings), Non Executive Director, April 2015-April 2018 . Consultant April 2018/March 2019.

Nuova Banca delle Marche, Nuova Banca Popolare dell'Etruria e del Lazio, Nuova Cassa di Risparmio della Provincia di Chieti, Nuova Cassa di Risparmio di Ferrara, Non Executive Director , 2015-2018. Appointed by the Resolution Unit of Bank of Italy as the sole Independent board member , to implement the first resolution and sale plan of the four regional banks , as per Decree 180 November 16, 2015 and in line with the BRRD EU Directive. The role has been

maintained within the UBI Group for three of the four banks following UBI's acquisition until the final merger into the group in 2018.

PROFESSIONAL EXPERIENCE

STANDARD & POOR'S, McGraw Hill Financial Group, Rating Services. Managing Director and Country Head Italy and Head of Southern Europe, 2003 /2015. Responsible for managing and developing S&P activities and franchise in Italy and Iberia.

  • · Managed the rating activity in the region , achieving significant growth and building leadership positions among rating agencies. Coordinated two offices with approximately 70 professionals based in Milan and Madrid, supporting the expansion of the rating services in all practices and implementing all new policies and regulations . Responsible for strategic plans for the region in coordination with all the business units and their execution through team work combining regional capabilities with product expertise and local client knowledge.
  • · Responsible for the overall regional franchise, establishing senior relationships with market participants and leading communication plans and outreach programs with investors. regulators, policy makers and key stakeholders, domestically and at European level. Key spoke person for the region.
  • · Participated to EU public affairs programs to monitor implementation of specific regulations affecting S&P role in the financial markets and established long term dialogue with all major stakeholders, networks and business associations.

BORSA ITALIANA SPA (Italian Stock Exchange) , Senior Director Head of New Market, 1998-2003

Designed, launched and developed the equity market for high growth companies in coordination with other major European exchanges. Nuovo Mercato became in few months the second high growth European market for capitalization and market volumes , with 45 listings companies in two years and a strong domestic and international recognition among issuers, investors and intermediaries. Designed and managed research effort and marketing campaigns to identify candidates for listings and to promote the market to institutional investors. Managed investors outreach programs in USA, Israel, UK also in association with Italian diplomatic delegations and local associations. Managed communications activities on the market and other SMEs related projects for Borsa Italiana. Participated to international programs with stock exchanges and other stakeholders to develop new platforms and common initiatives to improve primary and secondary markets.

PREMAFIN SPA (Italian listed conglomerate), Milano 1991-1998

Director of strategic planning and control . Managed investments in industrial companies controlled by the holding in the area of construction, motorways and insurance. Monitored financial performance and implemented plans for recommendations to shareholders. Member of the Board of Autostrade Torino Milano. Conducted restructuring , M&A , debt renegotiations and other activities to streamline the business and assure execution of strategic plans of the subs. Set up and managed the Investor relation function for the Group .

CITIBANK N.A., Milano, 1988-1991

Resident Vice President, Senior Financial Analyst.

Conducted M&A activity and financial strategic analysis for the corporate clients of the bank. including origination and execution in corporate finance products and services. Developed strategic target market for Citibank in Italy and related segmentation of products and services offered.

THE WORLD BANK, Washington D.C., 1985-1986

Consultant on debt rescheduling packages for Latin America countries .

UNIVERSITA' COMMERCIALE L. BOCCONI, Milano 1981-1985

Research Assistant in banking and international financial institutions. Assistant Professor of international banking for the University and SDA Business School.

AWARDS & RECOGNITIONS

Marisa Bellisario Award for Women in Finance , 2001 International Leadership Award by The McGraw Hill Companies /Standard & Poor's, 2004 Career Award. Sponsored by Italian Minister for Equal Opportunities, 2001. International Corporate Finance Award for best global transactions, Citibank, New York, 1991

OTHER

  • · Member of the Board and Vice Chairman of the Italian American Chamber of Commerce, 2009/2017
  • · Founding member of the Executive Board of Valore D, association for the promotion of women leadership in Italian corporations comprising 150 major corporations
  • · Member of the Board of Collegio San Carlo, 2011-2018
  • · Member of the Scientific Committee of Collegio Internazionale Ca' Foscari in Venice , 2014-2018
  • · Member of the Advisory Board, Accenture Foundation , 2007/2012

Published several articles on financial topics in Italian and English.

Teaching activity conducted for several Italian universities. Runner with significant track record in half and full marathons.

Born 09/18/1957, Italian citizen. Fluent in English, working knowledge of French and Spanish.

ANNEX 2- LIST OF THE OFFICES CURRENTLY HELD IN BANKS OR OTHER COMMERCIAL COMPANIES

MENBER

Non-Executive Director and-Chair of Human Resources Committee of Gruppo Autogrill

Director of PBI S.p.A.

Date and place, Hilou Rond, 1, 2021

ANNEX 3 - INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA BY UNICREDIT

The following information notice aims at providing you with an overview on the use of your personal data by UniCredit S.p.A. and of your rights pursuant to the General Data Protection Regulation - Regulation (EU) 2016/679 (hereinafter also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (UniCredit).

The Data Protection Officer (DPO) can be contacted at:

UniCredit S.p.A. Data Protection Office, Piazza Gae Aulenti n. 1, Tower B, 20154 Milano, E-mail: [email protected], PEC: [email protected].

2. PURPOSE AND LEGAL BASIS OF PROCESSING

UniCredit processes the personal data in its possession, that is collected directly from you, or from the relevant local administrations to verify, among others, their accuracy for the following purposes:

A. Need to fulfill legal obligations deriving from your candidacy as a Member of the UniCredit's Board of Directors.

These obligations imply, among others, verifying - both during the selection procedures and on an ongoing basis - the compliance: i) with the eligibility requirements for taking on and maintaining the role of Director as well as of specific positions (such as integrity requirements, criteria of correctness, professional experience requirements and competence, independence, time commitment, maximum number of offices covered, respect of the prohibition of interlocking) as required by applicable law, by UniCredit's Articles of Association and by the Corporate Governance Code (i.e. Codice di Corporate Governance) as well as with social security and fiscal obligations linked to the remuneration provided.

To comply with the above-mentioned obligations, in some cases, UniCredit is required to carry out analyses that concern also your relatives7 . For this reason, we kindly ask you to let them aware of this Information Notice.

These needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the obligations arising from your role of member of UniCredit's Board of Directors; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

B. Fulfilment of legal obligations and requests from Public and Supervisory Authorities, concerning the process, communication and/or disclosure - also during the selection procedures - on the website www.unicreditgroup.eu and/ or on specific corporate

7 The relatives scope is identified on the basis of the specific applicable regulations.

documents (e.g. Prospectus / Corporate Governance Report, Financial Statements) of your data (such as data contained in your curriculum vitae and in the list of the tasks carried out by you in other banks and commercial companies, as required by the applicable law, and according to the Articles of Association and the Corporate Governance Code).

The needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the legal obligations, the requests from the Authorities, as well as to take on the role of member of the Board of Directors of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

3. CATEGORIES OF PERSONAL DATA PROCESSED

UniCredit processes personal data collected directly from you, or from third parties (e.g. relevant local administrations), which include, but are not limited to, personal data (e.g. name, surname, address, date and place of birth), banking data, information on the financial situation (e.g. patrimonial status, information on credit requests/relationships), positions held and related income, employment relationships, commercial/professional relationships.

This information may concern existing or past relationships with UniCredit as well as with Group Legal Entities or third parties.

3.1 JUDICIAL DATA

UniCredit may process judicial data (i.e. personal data relating to criminal convictions and offences or related security measures, including information on pending proceedings) referring to you, in order to verify the subjective and integrity requirements and/or conditions that prevent from being appointed as member of the Board of Directors of UniCredit.

In such cases, the processing is necessary to fulfill legal obligations as well as to comply with requests coming from Public or Supervisory Authorities (e.g. filling the questionnaire requested by the ECB). This need represents the legal basis that legitimizes the related data processing. Data provided by you is necessary to comply with the legal obligations; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your data may be communicated to the natural and legal persons that are acting as "Data Processors", listed in the UniCredit premises and on the website www.unicredit.it, as well as – in the quality of persons authorized to process personal data in relation to the data necessary for the performance of the duties they are assigned to – the natural persons belonging to the following categories:

  • employees or temporary employees or trainees assigned to the UniCredit HR, PL & BS Management Functions / IAD Budget & Administrative Support / Individual Reports, as well as the UniCredit Group Corporate Affairs, consultants and other natural persons occasionally assigned to these functions;
  • employees, temporary workers, interns and consultants of external companies appointed as Data Processors.

Your data may be communicated:

  • to those subjects to whom this communication must be carried out in compliance with an obligation established by law (e.g. Bank of Italy and ECB), by a regulation or by EU legislation. Further information can be found on the website www.unicredit.it in the "Privacy" section;
  • to Legal Entities belonging to the UniCredit Group (also foreign Legal Entities), subsidiaries or associates under the terms of article 2359 of the Italian Civil Code, when such communication is permitted on the basis of a Garante per la Protezione dei Dati Personali's measure or by a law provision.

The detailed list of subjects to whom the data can be communicated is available on the website www.unicredit.it, in the "Privacy" section.

5. DATA TRANSFER TO THIRD COUNTRIES

UniCredit informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called "Third Countries") if the EU Commission states that the Third Country ensures an adequate level of protection of personal data or in case of other appropriate safeguards, namely when the supplier of UniCredit located in the Third Country contractually ensures an appropriate level of personal data protection (e.g. through the signing of the standard contractual clauses provided by the European Commission), including enforceable and effective data subject rights. Further information can be requested by writing to [email protected].

6. DATA PROCESSING MODALITIES

The processing of personal data involves the usage of manual and IT instruments with modalities closely connected with the purposes defined above and, in any case, in such a way to guarantee the security and confidentiality of the data.

7. DATA SUBJECT' RIGHTS

GDPR grants and assures specific rights, including the right to know what data concerning you are held by UniCredit, as well as how they are used, and the right to obtain, under certain conditions, the copy, the erasure, the update, the rectification or, if interested, the integration of your data, as well as the right to data portability.

7.1 DATA RETENTION PERIOD AND RIGHT TO ERASURE

UniCredit processes and stores your personal data for all the time you keep the role of Director, to execute the related and connected obligations, to comply with the applicable legal, contractual and regulatory obligations, as well as for its own defensive purposes or those of third parties until the expiration of the longest mandatory retention period provided by the applicable law (i.e. 11 years) starting from the date of termination of the relationship with you. UniCredit processes and stores your personal data even after the expiry of the employment relationship when this is necessary for archiving purposes for historical research purposes, according, to the methods set out in the "Ethical rules of processing for archiving purposes in the public interest or historical research"8 .

8 Record of the provisions 19th december 2018, n. 513

At the end of the applicable mandatory retention period, your personal data will be erased or kept in a form which does not permit your identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes: i) for resolution of pre-litigation and/or litigation, started before the expiration of the mandatory retention period; ii) to follow up with investigations/inspections by internal control functions and/or external authorities, started before the expiration of the mandatory retention period; iii) to follow up with requests from the Italian and/or foreign Public Authorities, received/notified to UniCredit before the expiration of the mandatory retention period.

8. PROCEDURE TO EXERCISE THE RIGHTS

The e-mail address which you can refer to for the exercise of your rights described in the paragraph 7 is the following one: [email protected].

The deadline for the reply is one (1) month, that may be extended for two (2) further months in cases of particular complexity; in these cases, UniCredit informs you about such extension within one (1) month from the receipt of the request.

The exercise of rights is, in principle, free of charge.

9. COMPLAINT OR REPORTING TO THE "GARANTE PER LA PROTEZIONE DEI DATI PERSONALI"

UniCredit informs you that you have the right to lodge a complaint with, or to report to the Garante per la Protezione dei Dati Personali, or else to appeal to the Judicial Authority. The contacts of the Garante per la Protezione dei Dati Personali can be consulted on the website http://www.garanteprivacy.it.

STATEMENT OF CANDIDACY AND DECLARATION ATTESTING THE INEXISTENCE OF REASONS FOR INELIGIBILITY, FORFEITURE AND INCOMPATIBILITY, AS WELL AS THE MEETING OF THE REQUIREMENTS PROVIDED FOR BY CURRENT PROVISIONS

I, the undersigned Renate Wagner born in Heltau (Romania) on 29.09.1974, fiscal code 72 096 459 137, resident in Hechendorf, Germany, nationality German, in relation to the appointment to the office of non-executive member of the board of directors 1 in UniCredit S.p.A. ("UniCredit" or the "Bank") according to the Agenda of the Shareholders' Meeting convened for 15 April 2021, under my own responsibility,

taking into account the provisions of Section 91 of the Directive 2013/36/EU dated June 26, 2013, as subsequently amended ("CRD IV"), Articles 2382 and 2387 of the Italian Civil Code, Section 26 of Legislative Decree no. 385 dated September 1, 1993 ("TUB"), Sections 147-ter(4) and 147-quinquies of Legislative Decree no. 58 dated February 24, 1998 ("TUF") , the Treasury Decree no. 169 dated November 23, 2020 (the "Decree") and the Ministry of Justice Decree no. 162 dated March 30, 2000, Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code (the "Corporate Governance Code")

STATE THAT

there are no reasons for my ineligibility, forfeiture or incompatibility and that I meet the requirements provided for by current provisions, as well as by the UniCredit Articles of Association for the appointment as non-executive member of the board of directors 1 ; with specific reference to the experience and independence requirements

DECLARE THAT

I. EXPERIENCE REQUIREMENTS

1) I possess the knowledge, skills and experience required by CRD IV, TUB and the Decree, and, in particular, that I have accrued overall experience of at least three years2 through the exercise of:

a) Member of the Board of Management3 carried out at Allianz Deutschland AG

3 Please, indicate:

  • management or control activities or managerial positions held in companies operating in the banking, financial, securities or insurance sectors; and/or
  • management or control activities or managerial positions held in listed companies or companies whose size and complexity are greater than, or equal to those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed); and

for the directors with non-executive posts, in alternative to the above-mentioned ones:

  • professional activities practiced in the fields relating to the banking, financial, securities, insurance sectors or anyhow instrumental for the activities of UniCredit; and/or
  • university teaching (first or second level) of legal or economics subjects, or other subjects instrumental for the banking, financial, securities or insurance sectors; and/or

1 Please, indicate the post as: (i) Chairman of the board of directors; (ii) Chief Executive Officer; or (iii) nonexecutive Director.

2 Please, delete the reference period that does not interest, taking into account that: (i) the Chairman of the board of directors and the Chief Executive Officer must have accrued a professional experience of at least ten years; and (ii) the non-executive Directors must have accrued an experience of at least three years.

For the directors with executive posts:

from 2020 to today;

  • b) Member of the Board of Management at Allianz SE from 2020 to today;
  • c) Chief Human Resources Officer at Allianz SE from 2019 to 2020;
  • d) Regional CEO Life and Health at Allianz Asia Pacific in 2019;
  • e) Regional CFO and Head of Life and Health at Allianz Asia Pacific from 2015 to 2018;

as they result from both the attached curriculum vitae (see Annex 1) and the list of offices4 currently held in banks or other commercial companies5 (see Annex 2);

II. INDEPENDENCE REQUIREMENTS

I meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

OR

I DO NOT meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

***

I meet the independence requirements envisaged by Section 13 of the Decree;

OR

I DO NOT meet the independence requirements envisaged by Section 13 of the Decree;

managerial/executive functions in public organizations or public administration offices relating to the banking, financial, securities or insurance sectors provided that the entity where the corporate officers performed such activities has a size and complexity similar to those of UniCredit.

In addition to the above, the chief executive officer shall possess a specific experience in the fields of banking, financial, securities or insurance, gained through management or control activities or managerial positions held in the banking, financial, securities and insurance sectors, or in listed companies or in companies whose size and complexity are greater than, or equal to, those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed).

4 "Offices" means those: i) held in the board of directors, supervisory board, management board; ii) held in the board of statutory auditors; iii) as general manager, however named; in foreign companies, the offices considered are those equivalent to the ones outlined in points i), ii) and iii) in accordance with the regulations applicable to such companies;

5 "Commercial companies" means: a company with registered office in Italy, established in the form of "società in nome collettivo, società in accomandita semplice, società per azioni, società in accomandita per azioni, società a responsabilità limitata", having as corporate purpose: 1) industrial activity producing goods or services; 2) intermediary activity in the circulation of goods; 3) land, water or air transportation activity; 4) banking or insurance activity; 5) auxiliary activities to the above-mentioned ones; or a company with registered office in a foreign country and qualifying as commercial company in accordance with the provisions of the relevant legislation of the Country where its registered office or head office is located.

I meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code;

OR

I DO NOT meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code.

I, the undersigned, also:

  • STATE my candidacy the for election as member of the Board of Directors of UniCredit S.p.A. and, if elected, my willingness to accept my appointment as of now;
  • UNDERTAKE to promptly inform UniCredit of any changes in the above-mentioned circumstances and, on request by the Company, to produce any documentation suitable to confirm the truthfulness of the facts declared;
  • having read Sections 13 and 14 of the del General Data Protection Regulation Reg.(UE) 2016/679 , and the information notice on the processing of personal data reported in attachment, AUTHORIZE the publication of the information above and the information on personal and professional characteristics mentioned in my curriculum vitae, in the socalled "profile form" and in the list of the offices currently held in banks or other commercial companies.

Munich, March 2 nd, 2021

Signed

***

Annex 1 - Curriculum Vitae

Status 02/2021

Short Curriculum Vitae

Renate Wagner, Member of the Board of Management of Allianz SE, Mergers & Acquisitions, Human Resources, Legal, Compliance, Data Privacy

Personal
details
Date of birth
September 29, 1974
Place of birth
Heltau, Romania
Education Master in Mathematics, University of Paderborn,
Germany

Master of Business Administration, Heriot-Watt
University, Edinburgh, United Kingdom
Professional
career
1998 - 2000
Risk Analyst, Westdeutsche Landesbank, Germany
2001-2005
Senior Consultant, Manager and Senior Manager,
KPMG AG Wirtschaftsprüfungsgesellschaft, Germany
2005-2006
Head of Accounting, Risk Control and Regulatory
Reporting, dab bank, Germany
2006-2008
Head of Change Management, Zurich Financial
Services, Switzerland
2008-2010
Head of Capital & Liquidity Management and Risk
Based Capital, Zurich Financial Services, Switzerland
2010-2013
Head of Business Performance Management, Strategic
Finance and Divisional Treasurer, Global Life, Zurich
Financial Services, Switzerland
2013-2014
Head of CFO Office, Allianz SE, Germany
2014-2015
Head of CEO Office, Allianz SE, Germany

2015-2018
Regional Chief Financial Officer and Head of Life &
Health, Allianz Asia Pacific, Singapore
2019-2019
Regional Chief Executive Officer Life & Health, Allianz
Asia Pacific, Singapore
2019 - 2020
Chief Human Resources Officer, Allianz SE, Germany
Since 01/2020
Member of the Board of Management Allianz SE,
Germany
and
Since 07/2020
Member of the Board of Management Allianz
Deutschland AG, Germany

February 26th, 2021

Remak Wagner

[ANNEX 2 – LIST OF THE OFFICES CURRENTLY HELD IN BANKS OR OTHER COMMERCIAL COMPANIES6 ]

  • 1.) Member of the Board of Management7 carried out at Allianz Deutschland AG from 2020 to today;
  • 2.) Member of the Board of Management at Allianz SE from 2020 to today;

I hereby declare that there are no further offices held in banks or other commercial companies beyond the positions mentioned above.

Munich, March 2 nd, 2021

Signed

  • management or control activities or managerial positions held in companies operating in the banking, financial, securities or insurance sectors; and/or
  • management or control activities or managerial positions held in listed companies or companies whose size and complexity are greater than, or equal to those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed); and

– professional activities practiced in the fields relating to the banking, financial, securities, insurance sectors or anyhow instrumental for the activities of UniCredit; and/or

6 Please, indicate: the management or control or managerial positions held in banks or other commercial companies in Italy or abroad.

If negative, please indicate: "No management or control or managerial positions held in banks or other commercial companies in Italy or abroad".

7 Please, indicate:

For the directors with executive posts:

for the directors with non-executive posts, in alternative to the above-mentioned ones:

university teaching (first or second level) of legal or economics subjects, or other subjects instrumental for the banking, financial, securities or insurance sectors; and/or

managerial/executive functions in public organizations or public administration offices relating to the banking, financial, securities or insurance sectors provided that the entity where the corporate officers performed such activities has a size and complexity similar to those of UniCredit.

In addition to the above, the chief executive officer shall possess a specific experience in the fields of banking, financial, securities or insurance, gained through management or control activities or managerial positions held in the banking, financial, securities and insurance sectors, or in listed companies or in companies whose size and complexity are greater than, or equal to, those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed).

ANNEX 3 - INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA BY UNICREDIT

The following information notice aims at providing you with an overview on the use of your personal data by UniCredit S.p.A. and of your rights pursuant to the General Data Protection Regulation - Regulation (EU) 2016/679 (hereinafter also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (UniCredit).

The Data Protection Officer (DPO) can be contacted at:

UniCredit S.p.A. Data Protection Office, Piazza Gae Aulenti n. 1, Tower B, 20154 Milano, E-mail: [email protected], PEC: [email protected].

2. PURPOSE AND LEGAL BASIS OF PROCESSING

UniCredit processes the personal data in its possession, that is collected directly from you, or from the relevant local administrations to verify, among others, their accuracy for the following purposes:

A. Need to fulfill legal obligations deriving from your candidacy as a Member of the UniCredit's Board of Directors.

These obligations imply, among others, verifying - both during the selection procedures and on an ongoing basis - the compliance: i) with the eligibility requirements for taking on and maintaining the role of Director as well as of specific positions (such as integrity requirements, criteria of correctness, professional experience requirements and competence, independence, time commitment, maximum number of offices covered, respect of the prohibition of interlocking) as required by applicable law, by UniCredit's Articles of Association and by the Corporate Governance Code (i.e. Codice di Corporate Governance) as well as with social security and fiscal obligations linked to the remuneration provided.

To comply with the above-mentioned obligations, in some cases, UniCredit is required to carry out analyses that concern also your relatives8 . For this reason, we kindly ask you to let them aware of this Information Notice.

These needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the obligations arising from your role of member of UniCredit's Board of Directors; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

8 The relatives scope is identified on the basis of the specific applicable regulations.

B. Fulfilment of legal obligations and requests from Public and Supervisory Authorities, concerning the process, communication and/or disclosure - also during the selection procedures - on the website www.unicreditgroup.eu and/ or on specific corporate documents (e.g. Prospectus / Corporate Governance Report, Financial Statements) of your data (such as data contained in your curriculum vitae and in the list of the tasks carried out by you in other banks and commercial companies, as required by the applicable law, and according to the Articles of Association and the Corporate Governance Code).

The needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the legal obligations, the requests from the Authorities, as well as to take on the role of member of the Board of Directors of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

3. CATEGORIES OF PERSONAL DATA PROCESSED

UniCredit processes personal data collected directly from you, or from third parties (e.g. relevant local administrations), which include, but are not limited to, personal data (e.g. name, surname, address, date and place of birth), banking data, information on the financial situation (e.g. patrimonial status, information on credit requests/relationships), positions held and related income, employment relationships, commercial/professional relationships.

This information may concern existing or past relationships with UniCredit as well as with Group Legal Entities or third parties.

3.1 JUDICIAL DATA

UniCredit may process judicial data (i.e. personal data relating to criminal convictions and offences or related security measures, including information on pending proceedings) referring to you, in order to verify the subjective and integrity requirements and/or conditions that prevent from being appointed as member of the Board of Directors of UniCredit.

In such cases, the processing is necessary to fulfill legal obligations as well as to comply with requests coming from Public or Supervisory Authorities (e.g. filling the questionnaire requested by the ECB). This need represents the legal basis that legitimizes the related data processing. Data provided by you is necessary to comply with the legal obligations; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your data may be communicated to the natural and legal persons that are acting as "Data Processors", listed in the UniCredit premises and on the website www.unicredit.it, as well as – in the quality of persons authorized to process personal data in relation to the data necessary for the performance of the duties they are assigned to – the natural persons belonging to the following categories:

employees or temporary employees or trainees assigned to the UniCredit HR, PL & BS Management Functions / IAD Budget & Administrative Support / Individual Reports, as well as the UniCredit Group Corporate Affairs, consultants and other natural persons occasionally assigned to these functions;

employees, temporary workers, interns and consultants of external companies appointed as Data Processors.

Your data may be communicated:

  • to those subjects to whom this communication must be carried out in compliance with an obligation established by law (e.g. Bank of Italy and ECB), by a regulation or by EU legislation. Further information can be found on the website www.unicredit.it in the "Privacy" section;
  • to Legal Entities belonging to the UniCredit Group (also foreign Legal Entities), subsidiaries or associates under the terms of article 2359 of the Italian Civil Code, when such communication is permitted on the basis of a Garante per la Protezione dei Dati Personali's measure or by a law provision.

The detailed list of subjects to whom the data can be communicated is available on the website www.unicredit.it, in the "Privacy" section.

5. DATA TRANSFER TO THIRD COUNTRIES

UniCredit informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called "Third Countries") if the EU Commission states that the Third Country ensures an adequate level of protection of personal data or in case of other appropriate safeguards, namely when the supplier of UniCredit located in the Third Country contractually ensures an appropriate level of personal data protection (e.g. through the signing of the standard contractual clauses provided by the European Commission), including enforceable and effective data subject rights. Further information can be requested by writing to [email protected].

6. DATA PROCESSING MODALITIES

The processing of personal data involves the usage of manual and IT instruments with modalities closely connected with the purposes defined above and, in any case, in such a way to guarantee the security and confidentiality of the data.

7. DATA SUBJECT' RIGHTS

GDPR grants and assures specific rights, including the right to know what data concerning you are held by UniCredit, as well as how they are used, and the right to obtain, under certain conditions, the copy, the erasure, the update, the rectification or, if interested, the integration of your data, as well as the right to data portability.

7.1 DATA RETENTION PERIOD AND RIGHT TO ERASURE

UniCredit processes and stores your personal data for all the time you keep the role of Director, to execute the related and connected obligations, to comply with the applicable legal, contractual and regulatory obligations, as well as for its own defensive purposes or those of third parties until the expiration of the longest mandatory retention period provided by the applicable law (i.e. 11 years) starting from the date of termination of the relationship with you. UniCredit processes and stores your personal data even after the expiry of the employment relationship when this is necessary for archiving purposes for historical research purposes, according, to the methods set out in the "Ethical rules of processing for archiving purposes in the public

interest or historical research"9 .

At the end of the applicable mandatory retention period, your personal data will be erased or kept in a form which does not permit your identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes: i) for resolution of pre-litigation and/or litigation, started before the expiration of the mandatory retention period; ii) to follow up with investigations/inspections by internal control functions and/or external authorities, started before the expiration of the mandatory retention period; iii) to follow up with requests from the Italian and/or foreign Public Authorities, received/notified to UniCredit before the expiration of the mandatory retention period.

8. PROCEDURE TO EXERCISE THE RIGHTS

The e-mail address which you can refer to for the exercise of your rights described in the paragraph 7 is the following one: [email protected].

The deadline for the reply is one (1) month, that may be extended for two (2) further months in cases of particular complexity; in these cases, UniCredit informs you about such extension within one (1) month from the receipt of the request.

The exercise of rights is, in principle, free of charge.

9. COMPLAINT OR REPORTING TO THE "GARANTE PER LA PROTEZIONE DEI DATI PERSONALI"

UniCredit informs you that you have the right to lodge a complaint with, or to report to the Garante per la Protezione dei Dati Personali, or else to appeal to the Judicial Authority. The contacts of the Garante per la Protezione dei Dati Personali can be consulted on the website http://www.garanteprivacy.it.

9 Record of the provisions 19th december 2018, n. 513

STATEMENT OF CANDIDACY AND DECLARATION ATTESTING THE INEXISTENCE OF REASONS FOR INELIGIBILITY, FORFEITURE AND INCOMPATIBILITY, AS WELL AS THE MEETING OF THE REQUIREMENTS PROVIDED FOR BY CURRENT PROVISIONS

I, the undersigned Alexander WOLFGRING born in Vienna (Austria) on 17 September 1962, fiscal code WLFLND62P17Z102S, resident in Vienna (Austria), nationality Austrian, in relation to the appointment to the office of DIRECTOR in UniCredit S.p.A. ("UniCredit" or the "Bank") according to the Agenda of the Shareholders' Meeting convened for 15 April 2021, under my own responsibility,

taking into account the provisions of Section 91 of the Directive 2013/36/EU dated June 26, 2013, as subsequently amended ("CRD IV"), Articles 2382 and 2387 of the Italian Civil Code, Section 26 of Legislative Decree no. 385 dated September 1, 1993 ("TUB"), Sections 147-ter(4) and 147-quinquies of Legislative Decree no. 58 dated February 24, 1998 ("TUF") , the Treasury Decree no. 169 dated November 23, 2020 (the "Decree") and the Ministry of Justice Decree no. 162 dated March 30, 2000, Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code (the "Corporate Governance Code")

STATE THAT

there are no reasons for my ineligibility, forfeiture or incompatibility and that I meet the requirements provided for by current provisions, as well as by the UniCredit Articles of Association for the appointment as DIRECTOR; with specific reference to the experience and independence requirements

DECLARE THAT

I. EXPERIENCE REQUIREMENTS

  • 1) I possess the knowledge, skills and experience required by CRD IV, TUB and the Decree, and, in particular, that I have accrued overall experience of at least three years1 through the exercise of:
    • a) activity managerial positions in banking2 carried out at Zentralsparkasse, Vienna from

1 Please, delete the reference period that does not interest, taking into account that: (i) the Chairman of the board of directors and the Chief Executive Officer must have accrued a professional experience of at least ten years; and (ii) the non-executive Directors must have accrued an experience of at least three years.

2 Please, indicate:

For the directors with executive posts:

management or control activities or managerial positions held in companies operating in the banking, financial, securities or insurance sectors; and/or

management or control activities or managerial positions held in listed companies or companies whose size and complexity are greater than, or equal to those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed); and

for the directors with non-executive posts, in alternative to the above-mentioned ones:

professional activities practiced in the fields relating to the banking, financial, securities, insurance sectors or anyhow instrumental for the activities of UniCredit; and/or

university teaching (first or second level) of legal or economics subjects, or other subjects instrumental for the banking, financial, securities or insurance sectors; and/or

managerial/executive functions in public organizations or public administration offices relating to the banking, financial, securities or insurance sectors provided that the entity where the corporate officers

1987 to 1994;

  • b) activity Head of Risk Management carried out at Bank Austria, Vienna from 1994 to 2005;
  • c) activity Board Member carried out at HVB Bank Slovakia a.s., Bratislava from 2005 to 2006;
  • d) activity Board Member carried out at UniCredit S.p.A., Genova/Milan from 2013 to present;

as they result from both the attached curriculum vitae (see Annex 1) and the list of officess currently held in banks or other commercial companies4 (see Annex 2);

II. INDEPENDENCE REQUIREMENTS

I meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

OR

I DO NOT meet the independence requirements envisaged by Section 147-ter(4) in conjunction with Section 148(3) of the TUF;

***

ﻳ I meet the independence requirements envisaged by Section 13 of the Decree;

OR

I DO NOT meet the independence requirements envisaged by Section 13 of the Decree;

***

performed such activities has a size and complexity similar to those of UniCredit.

In addition to the above, the chief executive officer shall possess a specific experience in the fields of basking, financial, securities or insurance, gained through management or control activities or managerial positions held in the banking, financial, securities and insurance sectors, or in listed companies whose size and complexity are greater than, or equal to, those of UniCredit (in terms of revenue, nature and complexity of the organization or activities performed).

3 "Offices" means those: i) held in the board of directors, supervisory board, management board; ii) held in the board of statutory auditors; iii) as general manager, however named; in foreign companies, the offices considered are those equivalent to the ones outlined in points i), il) and ii) in accordance with the regulations applicable to such companies;

4 "Commercial companies" means: a company with registered office in Italy, established in the form of "società in nome ollettivo, società in accomandita società per azioni, società in acomandita per azioni, società a responsabilità limitatà ", having as corporate purpose: 1) industrial activity producing goods or services; 2) intermediary activity in the circulation of goods; 3) land, water or air transportation activity; 4) banking or insurance activity; 5) auxiliary activities to the above-mentioned ones; or a company with registered office in a foreign country and qualifying as commercial company in accordance with the provisions of the relevant legislation of the Country where its registered office or head office is located.

I meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code;

OR

I DO NOT meet the independence requirements envisaged by Clause 20 of the UniCredit Articles of Association and Section 2, recommendation 7, of the Corporate Governance Code.

I, the undersigned, also:

  • STATE my candidacy the for election as member of the Board of Directors of UniCredit S.p.A. and, if elected, my willingness to accept my appointment as of now;
  • UNDERTAKE to promptly inform UniCredit of any changes in the above-mentioned circumstances and, on request by the Company, to produce any documentation suitable to confirm the truthfulness of the facts declared;
  • having read Sections 13 and 14 of the del General Data Protection Regulation Reg.(UE) 2016/679 , and the information notice on the processing of personal data reported in attachment, AUTHORIZE the publication of the information above and the information on personal and professional characteristics mentioned in my curriculum vitae, in the socalled "profile form" and in the list of the offices currently held in banks or other commercial companies.

Date and place, Vienna 28th February 2021

Signed ______________________________

[ANNEX 1 – CURRICULUM VITAE]

Alexander WOLFGRING

Age: 58, born in Vienna, Austria Nationality: Austria Status: married, son Erik

PROFESSIONAL EXPERIENCE

2013 – Pres.: UniCredit S.p.A., Milan
--------------- -------------------------

Position: Board member, chair of the Risk and Audit Committee (since 2015, 2013 – 2015 member), member of the Remuneration Committees (2013 – 2018), member of the Corporate Governance, Nomination and Sustainability Committee (since 2018)

  • 2005 2006: HVB Bank Slovakia a.s., Bratislava Position: Board Member [risk management]
  • 1994 2005: Bank Austria, Vienna Position: Head of Risk Management, Member of the Risk Committee, Member of the Asset & Liability Committee

1987 – 1994: Zentralsparkasse, Vienna [savings bank of the City of Vienna] Position: various position, e.g. accounting, planning & controlling, strategic planning, project management

POSTS CURRENTLY HELD IN AVZ GROUP

2012 – Pres.: Privatstiftung zur Verwaltung von
Anteilsrechten, Vienna
Position: Board Member [Executive Director]
2010 – Pres.: Österreichisches Verkehrsbüro
Aktiengesellschaft, Vienna
Supervisory Board) Position: Chair of the Supervisory Board (2010 – 2019: member of the
2005 – Pres.: AVZ GmbH, Vienna

Position: Board Member

OTHER POSTS CURRENTLY HELD

  • 2015 Pres.: Mischek Privatstiftung, Vienna Position: Board Member
  • 2012 Pres.: API Besitz GmbH, Vienna Position: Board Member, consultant to Stiftung Anton Proksch-Institut
  • 2007 Pres.: AVB Holding GmbH, Vienna Position: Board Member

POSTS PREVIOUSLY HELD

2011 – 2013: SBV Social Business GmbH, Vienna
Position: Board Member
  • 2010 2020: Verkehrsbüro Touristik GmbH, Vienna Position: Chair of the Supervisory Board
  • 2006 2009: AV-Z Holding S.p.A., Milan Position: Chair of the Management Board
  • 2005 2011: AV-Z Kapitalgesellschaft GmbH, Grünwald Position: Board Member

EDUCATION

Degree in Economics and Business Administration – Vienna University of Economics and Business

OTHER INFORMATION

Publications, e.g. "Risikomanagement für Finanz und Kapitalmärkte", Vienna 2008 / Various lectures in the field of risk management Consultancy

Date and place, Vienna 28th February 2021 Signed _________________________

ANNEX 2 – LIST OF THE OFFICES CURRENTLY HELD IN BANKS OR OTHER COMMERCIAL COMPANIES

Chair of the Supervisory Board of Österreichisches Verkehrsbüro AG Director of AVZ GmbH Director of Privatstiftung zur Verwaltung von Anteilsrechten

Date and place, Vienna 28th February 2021 Signed ______________________________

ANNEX 3 - INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA BY UNICREDIT

The following information notice aims at providing you with an overview on the use of your personal data by UniCredit S.p.A. and of your rights pursuant to the General Data Protection Regulation - Regulation (EU) 2016/679 (hereinafter also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (UniCredit).

The Data Protection Officer (DPO) can be contacted at:

UniCredit S.p.A. Data Protection Office, Piazza Gae Aulenti n. 1, Tower B, 20154 Milano, E-mail: [email protected], PEC: [email protected].

2. PURPOSE AND LEGAL BASIS OF PROCESSING

UniCredit processes the personal data in its possession, that is collected directly from you, or from the relevant local administrations to verify, among others, their accuracy for the following purposes:

A. Need to fulfill legal obligations deriving from your candidacy as a Member of the UniCredit's Board of Directors.

These obligations imply, among others, verifying - both during the selection procedures and on an ongoing basis - the compliance: i) with the eligibility requirements for taking on and maintaining the role of Director as well as of specific positions (such as integrity requirements, criteria of correctness, professional experience requirements and competence, independence, time commitment, maximum number of offices covered, respect of the prohibition of interlocking) as required by applicable law, by UniCredit's Articles of Association and by the Corporate Governance Code (i.e. Codice di Corporate Governance) as well as with social security and fiscal obligations linked to the remuneration provided.

To comply with the above-mentioned obligations, in some cases, UniCredit is required to carry out analyses that concern also your relatives5 . For this reason, we kindly ask you to let them aware of this Information Notice.

These needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the obligations arising from your role of member of UniCredit's Board of Directors; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

5 The relatives scope is identified on the basis of the specific applicable regulations.

B. Fulfilment of legal obligations and requests from Public and Supervisory Authorities, concerning the process, communication and/or disclosure - also during the selection procedures - on the website www.unicreditgroup.eu and/ or on specific corporate documents (e.g. Prospectus / Corporate Governance Report, Financial Statements) of your data (such as data contained in your curriculum vitae and in the list of the tasks carried out by you in other banks and commercial companies, as required by the applicable law, and according to the Articles of Association and the Corporate Governance Code).

The needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the legal obligations, the requests from the Authorities, as well as to take on the role of member of the Board of Directors of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

3. CATEGORIES OF PERSONAL DATA PROCESSED

UniCredit processes personal data collected directly from you, or from third parties (e.g. relevant local administrations), which include, but are not limited to, personal data (e.g. name, surname, address, date and place of birth), banking data, information on the financial situation (e.g. patrimonial status, information on credit requests/relationships), positions held and related income, employment relationships, commercial/professional relationships.

This information may concern existing or past relationships with UniCredit as well as with Group Legal Entities or third parties.

3.1 JUDICIAL DATA

UniCredit may process judicial data (i.e. personal data relating to criminal convictions and offences or related security measures, including information on pending proceedings) referring to you, in order to verify the subjective and integrity requirements and/or conditions that prevent from being appointed as member of the Board of Directors of UniCredit.

In such cases, the processing is necessary to fulfill legal obligations as well as to comply with requests coming from Public or Supervisory Authorities (e.g. filling the questionnaire requested by the ECB). This need represents the legal basis that legitimizes the related data processing. Data provided by you is necessary to comply with the legal obligations; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your data may be communicated to the natural and legal persons that are acting as "Data Processors", listed in the UniCredit premises and on the website www.unicredit.it, as well as – in the quality of persons authorized to process personal data in relation to the data necessary for the performance of the duties they are assigned to – the natural persons belonging to the following categories:

employees or temporary employees or trainees assigned to the UniCredit HR, PL & BS Management Functions / IAD Budget & Administrative Support / Individual Reports, as well as the UniCredit Group Corporate Affairs, consultants and other natural persons occasionally assigned to these functions;

employees, temporary workers, interns and consultants of external companies appointed as Data Processors.

Your data may be communicated:

  • to those subjects to whom this communication must be carried out in compliance with an obligation established by law (e.g. Bank of Italy and ECB), by a regulation or by EU legislation. Further information can be found on the website www.unicredit.it in the "Privacy" section;
  • to Legal Entities belonging to the UniCredit Group (also foreign Legal Entities), subsidiaries or associates under the terms of article 2359 of the Italian Civil Code, when such communication is permitted on the basis of a Garante per la Protezione dei Dati Personali's measure or by a law provision.

The detailed list of subjects to whom the data can be communicated is available on the website www.unicredit.it, in the "Privacy" section.

5. DATA TRANSFER TO THIRD COUNTRIES

UniCredit informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called "Third Countries") if the EU Commission states that the Third Country ensures an adequate level of protection of personal data or in case of other appropriate safeguards, namely when the supplier of UniCredit located in the Third Country contractually ensures an appropriate level of personal data protection (e.g. through the signing of the standard contractual clauses provided by the European Commission), including enforceable and effective data subject rights. Further information can be requested by writing to [email protected].

6. DATA PROCESSING MODALITIES

The processing of personal data involves the usage of manual and IT instruments with modalities closely connected with the purposes defined above and, in any case, in such a way to guarantee the security and confidentiality of the data.

7. DATA SUBJECT' RIGHTS

GDPR grants and assures specific rights, including the right to know what data concerning you are held by UniCredit, as well as how they are used, and the right to obtain, under certain conditions, the copy, the erasure, the update, the rectification or, if interested, the integration of your data, as well as the right to data portability.

7.1 DATA RETENTION PERIOD AND RIGHT TO ERASURE

UniCredit processes and stores your personal data for all the time you keep the role of Director, to execute the related and connected obligations, to comply with the applicable legal, contractual and regulatory obligations, as well as for its own defensive purposes or those of third parties until the expiration of the longest mandatory retention period provided by the applicable law (i.e. 11 years) starting from the date of termination of the relationship with you. UniCredit processes and stores your personal data even after the expiry of the employment relationship when this is necessary for archiving purposes for historical research purposes, according, to the methods set out in the "Ethical rules of processing for archiving purposes in the public interest or historical research"6 .

At the end of the applicable mandatory retention period, your personal data will be erased or kept in a form which does not permit your identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes: i) for resolution of pre-litigation and/or litigation, started before the expiration of the mandatory retention period; ii) to follow up with investigations/inspections by internal control functions and/or external authorities, started before the expiration of the mandatory retention period; iii) to follow up with requests from the Italian and/or foreign Public Authorities, received/notified to UniCredit before the expiration of the mandatory retention period.

8. PROCEDURE TO EXERCISE THE RIGHTS

The e-mail address which you can refer to for the exercise of your rights described in the paragraph 7 is the following one: [email protected].

The deadline for the reply is one (1) month, that may be extended for two (2) further months in cases of particular complexity; in these cases, UniCredit informs you about such extension within one (1) month from the receipt of the request.

The exercise of rights is, in principle, free of charge.

9. COMPLAINT OR REPORTING TO THE "GARANTE PER LA PROTEZIONE DEI DATI PERSONALI"

UniCredit informs you that you have the right to lodge a complaint with, or to report to the Garante per la Protezione dei Dati Personali, or else to appeal to the Judicial Authority. The contacts of the Garante per la Protezione dei Dati Personali can be consulted on the website http://www.garanteprivacy.it.

6 Record of the provisions 19th december 2018, n. 513