LBMA Responsible Gold Guidance, Version 9 (November 2021)

## 1.1. Adopt and commit to a policy for gold supply chain due diligence Refiners must adopt a gold supply chain policy that incorporates the risks and risk management measures outlined in Annex II of the OECD Due Diligence Guidance (OECD Annex II) and extends to addressing adverse ESG factors in the Refiner’s primary gold supply chain. Threat financing (includes conflict risks as per the OECD Annex II) Systematic or widespread human rights abuses associated with the extraction, transport or trade of gold, including: • Any forms of torture, or inhuman and degrading treatment • Forced or compulsory labour • Worst forms of child labour • Widespread sexual violence or other gross human rights violations • War crimes, crimes against humanity or genocide. Direct or indirect support to illegitimate non-state armed groups, or public or private security forces (“illegitimate non-state armed groups, public or private security forces”)7 which: • Illegally control mines, sites, traders or other intermediaries, and transport routes through the supply chains; or • Illegally tax or extort money or minerals through the supply chains. Bribery and fraudulent misrepresentation of the origin of gold. Non-compliance with taxes, fees and royalties due to governments related to mineral extraction, trade and export from Conflict-Affected and High-Risk Areas (CAHRAs). Money laundering or terrorism financing. Contribution to conflict. 7 UN Office of the High Commissioner on Human Rights: http://www2.ohchr.org/english/law/ <!-- page 16 --> RESPONSIBLE GOLD GUIDANCE V.9 16 Refiners are expected to address the ESG factors in their primary gold supply chain by making enquiries on policies and practices for the ESG factors noted below, and by using the Refiners Toolkit. ESG considerations are risk based to reflect the nature, size and complexity of the counterparty. ESG Factors Compliance with environmental, health, safety and labour regulation in country of operation and/or company policy. Environmental management, including: • Air, water, land pollution and incident management plans • Water stewardship, especially in water scarce and stressed areas • Unauthorised sourcing from World Heritage Sites and Protected Areas. Storage, handling, and disposal of hazardous chemicals, including mercury and cyanide. Note: LBMA recognises that mercury is used mainly in Artisanal and Small-Scale Mining (ASM) sources and therefore does not ban such supply chains. Instead, LBMA requires Refiners working with such artisanal supply chains to assist them in establishing processes to use mercury in a safe manner and to limit negative impacts on the environment and health and safety, and to find alternative solutions to mercury. Refiners should engage with upstream producers to encourage them to comply with the International Cyanide Management Code. Management of labour issues, including remuneration, working hours, collective bargaining, discrimination, diversity, disputes and safeguarding of workers. Community engagement and management programmes (land acquisition and community resettlement, cultural heritage sites and indigenous people, closure planning and safeguarding of vulnerable populations). Management of business integrity and ethical conduct, and supporting the implementation of relevant initiatives such as the Extractive Industry Transparency Initiative (EITI). The policy (or supporting process documentation) should include sufficient details on the gold supply chain due diligence. Refiners may, however, choose to publish a concise policy commitment document. Minimum criteria for internal (or external) supply chain policy document: • Scope • Organisation and responsibilities • Identification and assessment of threat finance risks and consideration of ESG factors, including all those defined above <!-- page 17 --> RESPONSIBLE GOLD GUIDANCE V.9 17 • Detailed and meaningful Know Your Counterparty (KYC) and supply chain due diligence processes that, at a minimum, meet RGG Step 2.1 requirements • Transaction monitoring processes that, at a minimum, meet RGG Step 2.1 requirements • Criteria for high-risk supply chains that, at a minimum, meet RGG Step 2.2 requirements • KYC and supply chain due diligence record maintenance requirements • Employee training programme.

## 1.2. Establish management structures to support supply chain due diligence Refiners must establish internal governance structures to provide effective oversight of the implementation and continuous improvement of the supply chain due diligence programme. Board level oversight As a minimum, the Refiner must assign authority and accountability to the Board, or a committee appointed by the Board (and for the purposes of this Guidance, both the Board, and/or Board Committee are referred to as the Board Committee). Board accountability should include, but is not limited to: • Having the necessary competence, knowledge and experience, or utilising external expert advisors to provide oversight of the supply chain due diligence framework and outcomes. • Ensuring internal accountability for the effectiveness of the supply chain due diligence policies and processes. • Assessing whether effective structures and communication processes are in place for critical information, including the company policy, to reach relevant employees and gold-supplying counterparties. • Regularly, and at a minimum annually, assessing the effectiveness of supply chain due diligence policies and processes to drive continuous improvement. • Assessing whether an appropriate Compliance Officer has been appointed to take responsibility for all matters regarding the gold supply chain. • Assessing whether the Compliance Officer has sufficient support in terms of the availability of resources necessary to support the operation and monitoring of the supply chain due diligence processes and systems. Compliance Officer The Refiner must appoint a Compliance Officer, who must be a senior person in the organisation, reporting directly to the CEO (or equivalent) and/or the Board. Compliance Officer’s responsibilities should include, but are not limited to: • Reviewing the gold supply chain due diligence processes and systems to meet the objectives of the RGG and the Refiner’s risk management appetite. <!-- page 18 --> RESPONSIBLE GOLD GUIDANCE V.9 18 • Ensuring effective structures and communication processes are in place for critical information, including the company policy, to reach relevant employees and gold-supplying counterparties. • Ensuring the availability of sufficient resources (including capacity and experience) necessary to support the operation and monitoring of the supply chain due diligence processes and systems. • Training employees with respect to supply chain risks (including threat finance and ESG) and preparing and updating of the Refiner’s gold Supply Chain Policy and procedures. • Reviewing Know Your Customer (KYC) files and risk classifications, and requesting additional documentation or information, as necessary. • Ensuring that appropriate measures are executed in the case of high-risk supply chains or transactions. • Providing proper and timely information for the Board to perform its duties. Training Refiners must develop an ongoing gold supply chain training programme for all staff involved in the gold supply chain. Details of this activity should be recorded, with appropriate monitoring of attendance and understanding of the supply chain risks and due diligence processes. Payment through official banking channels For transactions over $10,000 in value, Refiners must make and receive payments for gold through official banking channels and should not undertake any cash-based transactions. The only permissible exceptions to this rule include: • Cash purchases above the threshold with suppliers with records of government-issued identification and a purchase receipt which can be used for income tax purposes, where applicable. • Cash purchases of legitimate ASM gold, as long as all transactions involving legitimate ASM gold are made through formal channels from the point of export in the country of production to any onward counterparty. These ASM practices and/or cash transactions below the stipulated threshold should be supported by verifiable information and approved by the Compliance Officer. Cooperation with government authorities Refiners must cooperate fully and transparently with government authorities and provide full access to records and information, as appropriate. Authorities include national or international law enforcement agencies and customs officials. Maintaining records Refiners must maintain adequate records to demonstrate appropriate and ongoing risk identification, due diligence and traceability. Records are required to be maintained for at least five years, or the minimum timeframe stipulated by local regulatory requirements, following the end of the Refiner’s reporting year. <!-- page 19 --> RESPONSIBLE GOLD GUIDANCE V.9 19

## 1.3 Establish a gold traceability system The Refiner must establish a system of controls for visibility and transparency over the supply chain. This includes a chain of custody or traceability system that identifies the origin of the gold and the upstream partners involved in the supply chain, and a mechanism to trace the input of each lot refined and the first destination of each product shipment. Material segregation is not required. Supply chain traceability system The traceability system should collect and maintain supply chain information for each lot of Mined Gold, Recycled Gold or other feedstock refined. The traceability information should include, but is not limited to: • Proof of mining origin for primary product (e.g., official government-issued certificate of origin, audited chain of custody documentation, blockchain traceability records, formal packing list). • Proof of origin for Recycled Gold and Grandfathered Stocks (e.g., audited chain of custody information, blockchain traceability records, formal invoices or packing lists). • A unique reference number assigned to each input and output in order for any tampering to be evident. • Type of gold received (including source): o Mined Gold: LSM, ASM, Mining By-product or gold sourced from owned mines. o Recycled Gold: unprocessed, melted, Industrial By-product. o Grandfathered Stocks. • Weight and assay: declared and processed. • Export and import form for high-risk transactions, if applicable. • Shipping/transportation documents (waybill/airway bill, pro forma invoice, if applicable) to establish chain of custody from origin to refinery. • Date of arrival at the refinery and date of assay finalisation. LBMA encourages Refiners to consider technology solutions (e.g., blockchain, machine learning or artificial intelligence), where feasible, to enhance transparency and efficiency in supply chain traceability.

## 1.4 Strengthen company engagement with gold-supplying counterparties Refiners should build long-term relationships based on trust and mutual recognition with suppliers. Refiner’s responsibilities include, but are not limited to: Policy Refiners should require the gold-supplying counterparty to commit to either: • the Refiner’s gold Supply Chain Policy; or • the counterparty’s own gold supply chain policy, which at a minimum should be consistent with the OECD Annex II. <!-- page 20 --> RESPONSIBLE GOLD GUIDANCE V.9 20 Contracts The Refiner’s gold Supply Chain Policy or its requirements, or the counterparties’ own OECD Annex II aligned gold supply chain policies or requirements, must be incorporated into contracts and/or agreements between the Refiner and its gold-supplying counterparties. Capacity building Where appropriate, Refiners should assist in establishing processes to promote responsible mining and sourcing practices throughout the supply chain and assist gold-supplying counterparties or prospective suppliers, including legitimate ASM and local traders, in improving their supply chain practices. For example, Refiners should communicate their expectation and provide guidance or share good practices during on-site visits. Refiners may also consult and work together with national and industry authorities, local NGOs, human rights institutions, donor agencies and large-scale mining, etc., to support gold-supplying counterparties.

## 1.5 Establish a confidential grievance mechanism Refiners must develop a mechanism that allows any employee or external stakeholder (intended user) to voice concerns over the gold supply chain or any newly identified risk. Such mechanisms may be provided directly or through collaborative arrangements with other companies or organisations such as an Industry Programme or Institutionalised Mechanism.8 The grievance mechanism should be based on, but not limited to, the following principles: • Accessible: The mechanism should be known and usable by all intended users without fear of reprisal, and should include considerations for language, literacy, costs, physical location and technology. • Independent: The mechanism should have a formal and independent oversight structure (e.g., the Refiner’s Compliance Department) that ensures parties cannot interfere with fair conduct. • Respectful: All complaints should be treated seriously and with respect. • Transparent: The mechanism should have procedures to keep parties informed about the progress of their grievances through each stage and should provide sufficient information to build confidence in its effectiveness and meet any public interest reporting requirements. • Contribute to continuous learning: The mechanism should provide a source for identifying lessons for improving both the mechanism and preventing future grievance and harm. 8 LBMA, the RMI and the RJC have collaborated to develop an online cross-industry platform to screen and address grievances linked to smelters and refiners present in global supply chains. It can be accessed at www.mineralsgrievanceplatform.org <!-- page 21 --> RESPONSIBLE GOLD GUIDANCE V.9 21 ## Step 2. Identify and Assess Supply Chain Risks The objective of Step 2 is to identify actual and potential adverse impacts with respect to OECD Annex II and consider adverse ESG factors in the Refiner’s gold supply chain. Due diligence is expected to be proportional to the business activities of each Refiner and its supply chains. An integrated due diligence process that considers sourcing from Conflict-Affected and High-Risk Areas (CAHRAs) as well as additional location-, supplier- or type of material-based high risks is considered most effective.

## 2.1 Conduct supply chain due diligence to identify potential risks Refiners must perform supply chain due diligence following a risk-based approach. This includes mapping the supply chain to identify and assess risks effectively. Due diligence must be undertaken before entering a new business relationship with a gold-supplying counterparty and must continue throughout the relationship. Supply chain due diligence A risk-based due diligence approach requires an assessment of the location and the supply chain that the gold-bearing material is sourced from as well as the type of gold-bearing material sourced. To identify high-risk supply chains, Refiners should undertake the following measures as a minimum. Location risk identification should include, but is not limited to: • Determination of the origin of the gold source: o Mined Gold: The location of the mine (LSM and ASM). o Recycled Gold: The point in the gold supply chain where the gold is returned to the Refiner or other downstream intermediate processor or recycler. o Mining By-product: The point of separation of gold from the mineral base, as provided under the World Customs Organization’s Revised Kyoto Convention Annex K.9 o Grandfathered Stocks: The determination of origin is not required for stocks with a Verifiable Date prior to 1 January 2012, otherwise origin is the location of the gold-supplying counterparty. • Determination of the general transportation routing of the gold source from origin to refinery. • Verification that sourcing from the Country of Origin is not in breach of any international sanctions. • Verification that the mine site is not located in a World Heritage Site. 9 World Customs Organization’s Revised Kyoto Convention Annex K. E3. / F1.: “… substantial transformation criterion” means the criterion according to which origin is determined by regarding as the country of origin the country in which the last substantial manufacturing or processing, deemed sufficient to give the commodity its essential character, has been carried out.” <!-- page 22 --> RESPONSIBLE GOLD GUIDANCE V.9 22 Location risk identification should include, but is not limited to: This location-based risk identification process must include an integrated assessment of all risks outlined in Step 1.1. Sources of such an integrated assessment must include, but are not limited to: • Sanctions lists (US, UK, EU, UN, and relevant sanctions lists) • Dodd Frank s. 1502 • EU CAHRA list • Heidelberg Barometer • Fragile States Index or equivalent • UN Human Rights Office of the High Commissioner or equivalent • Reports (including relevant country reports) by the Financial Action Task Force (FATF) • Credible market intelligence on high-risk gold centres/transit hubs and on countries where there is a high risk of money laundering. Refiners should also consider credible market intelligence to cover the risk factors included in Step 1.1, as relevant. Supplier risk identification should include, but is not limited to: Using the KYC Questionnaire in the Refiners Toolkit: • Identification and verification of the gold-supplying counterparty’s name, physical address, corporate registration and licence information, using reliable, independent source documents, data or information. • Identification and verification of Ultimate Beneficial Owners (UBOs) (defined as 10% or more ownership) and authorised signatories 10 of the gold-supplying counterparty, using reliable and current government-issued photo identity documents. • Confirmation that the gold-supplying counterparty and its UBOs are not named on any government lists as wanted money launderers, or as known fraudsters or terrorists. • Obtaining the gold-supplying counterparty’s business and financial details, and information on the purpose and intended nature of the business relationship. 10 Ultimate Beneficial Owners with significant influence over the gold-supplying counterparty and authorised signatories. Not required in the case of companies that are part of a group listed on a stock exchange or for banks with appropriate AML-CFT policies, or governmental authorities. <!-- page 23 --> RESPONSIBLE GOLD GUIDANCE V.9 23 Type of material risk identification Sections below detail additional due diligence measures specific to various types of sourced material and scale of sourcing operations. Refiners should use reasonable and good faith efforts to apply each of the measures described but may determine the extent of such measures on a risk-sensitivity basis depending on the location of the company and transit zones, and the type of company, business relationship or transaction. Refiners may use independent audit, assurance or certification reports of conformance with recognised responsible sourcing standards (other initiatives) as supporting evidence for all or part of the requirements outlined below. The onus is on the Refiner to determine which aspects of the RGG are being addressed through other initiatives and to ensure residual RGG requirements are appropriately met. Note 1: Risk identification for gold sourced from owned mines Where Refiners are sourcing from mines within the same corporate group as the Refiner, i.e., owned mines, it is expected that risk-based due diligence is still performed on applicable risks, e.g., management of third-party stock and ESG factors. Risk identification for Mined Gold from LSM should include, but is not limited to: Using the KYC Questionnaire for Mined Material in the Refiners Toolkit, identification of risks by obtaining, assessing and, where possible, verifying against publicly available information: • Import/export gold licence for gold supplying counterparty, if applicable • Mining practice, including processing and transportation method • Production data and processing capacity, if available • Sources of any third-party stock, including that from ASM, on the mine site and controls to appropriately manage these • Anti-money laundering and terrorist financing policies and practices, where relevant • Bribery and corruption policies and practices, including payment to government • Human rights policies and practices • Environmental policies and practices • Health and safety policies and practices • Labour policies and practices, if not already covered through other policies collected • Community engagement programmes • Ethics and business integrity policies and practices. <!-- page 24 --> RESPONSIBLE GOLD GUIDANCE V.9 24 Note 2: Risk identification for gold sourced from Mining By-Products Where Refiners source gold as a Mining By-product, a risk identification assessment should be undertaken along the supply chain up to the smelter where the gold is separated from the base or other metal. The Refiner will be expected to conduct due diligence on the responsible sourcing policies and practices of the by-product supplying counterparty and assess whether the counterparty has appropriately identified and managed its high-risk supply chains in relation to threat financing risks, at a minimum. The Refiner may adapt the KYC Questionnaire for Recycled Material to assess the smelter supplying the by-product, or use audits, assurance or certification reports for other recognised responsible sourcing initiatives (see Recognised Responsible Sourcing Standards), as supporting evidence. A Refiner that only sources Mining By-product is still subject to an RGG assurance over its policies, processes and systems to manage the risk of false misrepresentations of origin. Risk identification for Mined Gold from ASM should include, but is not limited to: Using the KYC Questionnaire in the Refiners Toolkit, identification of risks by obtaining, assessing and, where possible, verifying against publicly available information: • Suppliers of ASM gold sources, including: o local artisanal mining team, association or cooperatives (it is not necessary to identify individual diggers) o ore processing plant o aggregators and traders o local gold exporter • Whether the mining project can be considered legitimate ASM (i.e., legally registered, cooperative-based and/or government-recognised, or central bank supported initiative) • Mining practice, including extraction, processing and transportation method • Use, storage and recovery of mercury, and if applicable, impact on the environment and the health of those involved in the production, handling and processing of gold • Human rights practices and policies to the extent available • Environmental practices and policies to the extent available • Health and safety practices and policies to the extent available • Labour practices and policies to the extent available • Community engagement practices and policies to the extent available • Payments to government practices and policies to the extent available. Risk identification for Recycled Gold should include, but is not limited to: Using the KYC Questionnaire for Recycled Material in the Refiners Toolkit, identification of risks by obtaining, assessing and, where possible, verifying against publicly available information: • Main markets, products and customer segments of the counterparty • Profiles of the counterparty’s gold and precious metals suppliers • Types and forms of precious metals sourced by the counterparty <!-- page 25 --> RESPONSIBLE GOLD GUIDANCE V.9 25 • Country of Origin of gold and precious metals processed by the facility • Type and location of facilities operated by the counterparty (refining, manufacturing, jewellery production, pawn shops, etc.) • Import/export licences, if applicable • Anti-money laundering and terrorist financing policies and practices • Anti-bribery and corruption policies and practices • Responsible sourcing policies and processes . Monitoring of transactions The Refiner should conduct appropriate scrutiny and monitoring of transactions undertaken through the course of the relationship to ensure that the transactions are consistent with the Refiner’s knowledge of the supply chain and risk profile. The monitoring of transactions should be undertaken by applying a risk-based approach. Transactions monitoring should include, but is not limited to: • Checking volumes, types and concentrations of gold-bearing material for consistency with previous shipments • Monitoring the actual transportation routing for each shipment • Verifying physical shipment against shipping/transportation documents (assays, weights, serial numbers) • Confirming that documents and materials are consistent with each other (purchase order, goods receipt, invoice) and with the KYC information (mine capacity, origin, sources). Where material inconsistencies or suspicions are identified: • The gold should be physically segregated and secured (until the inconsistencies are resolved) • An investigation should be undertaken and documented • Findings should be reported to the Compliance Officer, Board and appropriate authorities, as applicable.

## 2.2 Classify supply chains based on risk profiles Refiners must determine their own criteria to classify supply chains based on the risk profiles determined during the initial due diligence. Risk classification criteria are expected to incorporate the threat finance and ESG factors stipulated in Step 1.1, and should be regularly reviewed and updated. The following minimum criteria must be considered to determine zero-tolerance and high-risk supply chains. Zero-tolerance supply chains Where zero-tolerance issues are identified, the Refiner must not enter a business relationship with a gold-supplying counterparty or must terminate an existing relationship immediately. The Refiner must notify LBMA immediately as outlined in Step 5.1.3. Zero-tolerance issues include, but are not limited to: <!-- page 26 --> RESPONSIBLE GOLD GUIDANCE V.9 26 • The Mined Gold is known to originate from areas designated as World Heritage Sites • The Mined or Recycled Gold is known to be sourced in breach of international sanctions (including but not limited to those of the UN, EU, UK and US) • The Mined or Recycled Gold supplying counterparty, other known upstream companies or their UBOs are known money launderers, fraudsters or terrorists, or have been implicit in serious human rights abuses, or in direct or indirect support to illegitimate non-state armed groups. High-risk supply chains Supply chains classified as high risk will trigger Enhanced Due Diligence (EDD). Mined Gold risk classification High-risk issues for Mined Gold should include, but are not limited to: For location-based high risks, the Mined Gold: • Originates from, has transited or has been transported via a Conflict-Affected and High-Risk Area (CAHRA) • Is claimed to originate from a country through which gold from CAHRAs is known, or reasonably suspected, to transit • Is claimed to have originated from a country that has limited known reserves, likely resources or expected production levels. For supplier-based high risks, the gold-supplying counterparty or other known upstream companies: • Have shareholders, or UBOs, or other gold supplying interests in one of the location-based high-risk criteria • Have UBOs that are Politically Exposed Persons (PEPs) • Have activities in a higher-risk business activity such as arms, gaming and casino industry, antiques and art, and sects and their leaders • Have been known to have sourced gold from a high-risk country in the last 12 months • Have material discrepancies/inconsistencies in the documentation provided or have refused to provide requested documentation. For type of material-based high risks, the Mined Gold is: • Sourced from ASM • Produced with the use of mercury • Contributing to catastrophic harm or highly adverse ESG factors, to the extent that the Refiner is able to identify this (e.g., through a record in the public domain or in the Refiner’s due diligence file). Recycled Gold risk classification Risk classification of Recycled Material should be proportionate to the risks identified, with priority given to persons, place and transactions that present higher risk. <!-- page 27 --> RESPONSIBLE GOLD GUIDANCE V.9 27 High-risk issues for Recycled Gold should include, but are not limited to: For location-based high risks, the Recycled Gold: • Originates from, has transited or has been transported via a CAHRA as defined by the Refiner in Step 2.1 • Is claimed to originate from a country through which gold from CAHRAs is known, or reasonably suspected, to transit, and/or is unjustifiably claimed to have originated from a country that has limited exports of gold. For supplier-based high risks, the gold-supplying counterparty or other known upstream companies: • Operate in a money laundering high-risk country • Have shareholders, or UBOs, or other gold-supplying interests in one of the location-based high-risk criteria • Have UBOs who are Politically Exposed Persons (PEPs) • Have activities in a higher-risk business activity such as arms, gaming and casino industry, antiques and art, and sects and their leaders • Have been known to have sourced gold from a high-risk country in the last 12 months • Have significant unexplained geographic routing from their supplier or counterparty in the supply chain. For type of material-based high risks, the Recycled Gold is: • From an Intermediate Refinery or trader with a high-risk supply chain or a trading counterparty sourcing from an Intermediate Refinery with a high-risk supply chain.

## 2.3 Undertake Enhanced Due Diligence measures for high-risk supply chains Where EDD is triggered, Refiners must undertake an on-site investigation/visit at the location of the gold origin (i.e., mine sites for Mined Gold and the gold-supplying counterparty office for Recycled Gold). The on-site visit should be, at a minimum, but not limited to: • Aimed at substantiating the documented KYC information • Focused on investigating threat financing risks, as defined under Step 1.1, and the specific supply chain due diligence findings • Conducted before any transactions occur or, at the least, within six months of the business relationship commencing • Conducted by competent employees or independent third-party consultants, who are free of any conflict of interest with the supplier. Everyone conducting an on-site visit must commit to reporting truthfully and accurately • Consult relevant internal and external stakeholders (for example, local or central authorities, upstream companies, international or civil society organisations, or affected third parties), where applicable <!-- page 28 --> RESPONSIBLE GOLD GUIDANCE V.9 28 • Fully and accurately documented in the Site Visit Report templates included in the Refiners Toolkit. Refiners choosing to not use the template will be required to justify their position • Followed up, depending on the number and severity of issues identified and documented in the improvement plans. Additionally, EDD measures should comprise the following steps based on the type of gold-bearing material received. These measures may be conducted during the on-site visit or remotely, as appropriate. EDD measures for high-risk LSM gold supply chains should include, but are not limited to: • Proportionate KYC on each company involved in the conflict location-based high-risk supply chain from the mine to the refinery (including gold producers, intermediaries, gold traders and exporters, and transporters). • Understanding the nature of public or private security services provided at the mine sites and through the supply chain (including the screening and training of security personnel in line with the Voluntary Principles on Security and Human Rights). • Considering the risks of militarisation of mine sites and transportation routes, and direct or indirect support to illegitimate non-state armed group, or public or private security forces. • Determination of the risk of any serious human rights abuses committed by any party at mine sites, transportation routes and points where gold is traded and/or exported. • Estimating the number of Artisanal and Small-Scale Miners (if any) on the producer’s concession, and: o confirming their status as legitimate ASM o considering risks of gold from third-party sources unknowingly being introduced into the producer’s operations o considering the relationship between producer and ASM actors to identify instances of conflict or tension. • Complete self-declaration of taxes and royalties compliance, as applicable. • Understanding payments or compensation made to government agencies and officials, public or private security forces, or other armed groups at all points in the supply chain from extraction onwards, unless prohibited by law. • Considering compliance with environmental, health, safety, labour, community, business integrity regulations, policies and good practices for issues identified in the initial due diligence. EDD measures for high-risk ASM gold supply chains should include, but are not limited to: • Proportionate KYC on each company involved in the location-based high-risk supply chain from the ore processing plant or gold aggregator to the Refiner (including cooperatives, gold traders and exporters, and transporters). • Collecting information on the government, political or military affiliations of ASM suppliers, including any reported instances of affiliation with non-state armed group, or public or private security forces. <!-- page 29 --> RESPONSIBLE GOLD GUIDANCE V.9 29 • Collecting evidence of any serious human rights abuses committed by any party at mine sites, transportation routes and points where gold is traded and/or exported. • Considering the militarisation of mine sites and transportation routes, and the risk of direct or indirect support to illegitimate non-state armed group, or public or private security forces. • Considering any conflict or tensions in the relationship between LSM and ASM. • Considering the risk, suspicions or reports that gold from other sources is being unknowingly introduced into the gold supply chain and/or fraudulently represented. • Considering the storage, handling and usage of mercury, and the impacts on the environment and workers’ health. • Evaluating the appropriateness of other ESG risk management practices pertaining to issues identified in the initial due diligence. • Understanding payments or compensation made to government agencies and officials, public or private security forces, or other armed groups at all points in the supply chain from extraction onwards, unless prohibited by law. EDD measures for high-risk Recycled Gold from Intermediate Refiners should include, but are not limited to: • An independent Assurance Report on the Intermediate Refiners’ responsible sourcing practices on a comply or explain basis. The assurance should: o include conformance with an OECD aligned responsible sourcing scheme o be commissioned by the Intermediate Refiner o be completed before the start of a new business relationship or within a reasonable timeframe 11 of the Refiner implementing this Guidance • The identity of the UBOs of the Intermediate Refiners. 11 Existing suppliers will have until July 2023 to commission the assurance. <!-- page 30 --> RESPONSIBLE GOLD GUIDANCE V.9 30 Note 3: EDD measures for gold sourced indirectly from Intermediate Refiners Refiners sourcing Recycled Gold indirectly from Intermediate Refiners (e.g., through trading companies) should: • use best efforts to identify the Intermediate Refiners; and • review the due diligence to check whether red flags have, or reasonably should have been, identified in the Intermediate Refiners’ supply chains. Where high risks are identified, the Refiner should: • determine whether the Intermediate Refiner’s due diligence processes are audited against an OECD aligned responsible sourcing scheme; and • apply risk management strategies in accordance with Step 3, where the Intermediate Refiner’s due diligence practices have not been audited or where any medium-risk or high-risk audit non-conformances have been identified. Where no high risks have been identified, no additional due diligence is required on the material. If the Refiner is unable to identify the Intermediate Refiners, risk management procedures should be applied. EDD measures for high-risk Recycled Gold from other sources should include, but are not limited to: • Checking government watchlist information for each company located in high-risk locations for Recycled Gold and involved in the supply chain from the counterparty to the refinery (including transporters). • Interviews with select management and site personnel to determine and corroborate the supply chain due diligence practices, purchasing, and anti-money laundering and counter-terrorist financing procedures. • Considering the counterparty’s competence and capacity for supply chain due diligence proportionate to risk. • Considering the appropriateness of the counterparty’s risk classification methodology. • Assessment of due diligence records to confirm that procedures are being undertaken as per the counterparty’s supply chain due diligence policy with due considerations for commercially sensitive information. • Assessment of on-site visit methodology to the counterparty’s high-risk supply chains, with due consideration for commercially sensitive information. The Compliance Officer and/or the Board Committee should approve each new supply chain initially assessed as high-risk and should revisit each year the decision whether to continue with these business relationships or not. <!-- page 31 --> RESPONSIBLE GOLD GUIDANCE V.9 31 ## Step 3. Design and Implement a Management Strategy to Respond to Identified Risks The objective of Step 3 is to evaluate and respond to the identified risks in Step 2 to prevent or mitigate adverse impacts. Where appropriate, Refiners should seek to exercise leverage and enhance supplier engagement to address the risk most effectively. Refiners should also enhance their own systems of information collection and transparency. Where known risks or founded suspicion of upstream suppliers sourcing from or linked to any party committing zero-tolerance or high-risk abuses are identified, the Refiner must immediately cease or suspend engagement with the counterparty.

## 3.1 Devise a risk management strategy for the identified risk Refiners must determine their own risk management strategies based on internal risk appetite and processes. However, the following minimum criteria must be considered for risk management. Terminate relationship The Refiner should immediately stop refining gold where its EDD concludes that there are known instances of: • Money laundering • Terrorist financing • Serious human rights abuses • Direct or indirect support to illegitimate non-state armed groups • Fraudulent misrepresentation of the origin of minerals. The Refiner should report such instances to the appropriate authorities and to LBMA, where applicable, and in accordance with local and international legal requirements. Suspend relationship The Refiner should suspend refining gold where its EDD concludes that: • There is a founded suspicion of: o money laundering o terrorist financing o serious human rights abuses o direct or indirect support to illegitimate non-state armed groups o fraudulent misrepresentation of the origin of minerals • There are reported catastrophic ESG impacts as defined in the Refiner’s classification criteria. Refining may resume once additional information/data refuting the preliminary suspicions or a timely and appropriate response to addressing the ESG impacts has been obtained from the supplier. This should be approved by the Compliance Officer and/or the Board Committee. <!-- page 32 --> RESPONSIBLE GOLD GUIDANCE V.9 32 Continue relationship with improvement plan Refiners may continue to refine gold where the EDD is not fully satisfactory, or where it concludes that the counterparty is using reasonable and good faith efforts despite instances of: • Bribery • Non-fraudulent misrepresentation of the origin of minerals • Non-compliance with taxes, fees and royalties due to government • Material breaches of environmental, health, safety, labour and community-related local legislation, and/or ESG risks that have the high likelihood to result in highly adverse impacts. In this case, the Refiner should require the counterparty to adopt an improvement plan which is: • Devised with the Refiner’s input and engagement • Clearly documented, including performance objectives and quantitative and/or qualitative performance measurement indicators • Approved by the Compliance Officer and/or the Board Committee.

## 3.2 Monitor the improvement plan Where Refiners decide to continue relationships as counterparties implement an improvement plan, the principles of good faith efforts to make meaningful improvements in the supply chain must be adopted. The risk management strategies must include measurable steps to be taken by the counterparty, performance monitoring, periodic reassessment of risk and regular reporting to the Board Committee, as applicable. Improvement plan monitoring The risk monitoring strategy should at a minimum: • Identify significant and measurable improvements towards eliminating the risk within six months from the adoption of the improvement plan. • Define additional measures in a revised improvement plan based on the progress achieved within the first six months. • Formally assess performance to determine that measures have been properly undertaken by the deadline (e.g., through independent audits, a follow-up on-site visit or remote review, as appropriate). To facilitate monitoring activities, Refiners should, as appropriate: • Consult relevant stakeholders such as local or central authorities, upstream companies, international or civil society organisations, and affected third parties. After the six-month time frame, Refiners should consider: • Suspending the relationship where limited or no measurable improvement can be demonstrated, until the supplier responds to the improvement plan; or • Terminating the relationship after failed attempts at risk mitigation and performance improvement. <!-- page 33 --> RESPONSIBLE GOLD GUIDANCE V.9 33 The Compliance Officer and/or the Board Committee should frequently revisit the decision to continue with business relationships under the risk mitigation strategy (i.e. annually, at a minimum).

## 3.3 Report findings to the Board Committee The Board retains ultimate control and accountability for the gold supply chain. Actual and potential risks identified in the supply chains and proposed risk management strategies must be communicated to the Board Committee. The Board should at a minimum receive information on the following: • Relevant statistics on high-risk supply chains • Counterparty under risk mitigation strategies and status of risk mitigation strategies • Reports on the progress and effectiveness of improvement plans.

## 3.4 Continuously monitor adequacy of risk management strategies Supply chain due diligence is a dynamic process and requires ongoing risk monitoring. After implementing a risk management strategy, Refiners should assess if Step 2 of this Guidance should be repeated or, for instance, if another on-site visit is required. Any changes in the supply chain may require the Refiner to repeat some due diligence steps to ensure effective management of risk. <!-- page 34 --> RESPONSIBLE GOLD GUIDANCE V.9 34 ## Step 4. Obtain Independent Third-Party Assurance on Supply Chain Due Diligence Practices The objective of Step 4 is for Refiners to have their supply chain due diligence policies and processes, applicable to each gold refinery, independently assured by an LBMA approved Assurance Provider. The independent assurance provides the Board, LBMA and external stakeholders with the comfort that the Refiner’s supply chain due diligence policies and processes are appropriately designed, and are effectively operating to meet the objectives of the RGG and to protect gold supply chains against the material threat of finance risks and ESG factors.

## 4.1 Assurance requirements Assurance Provider independence and competency The Board Committee is responsible for the approval of a third-party Assurance Provider, and must ensure that it is independent of the organisation and has the requisite competencies, experience and capacity to carry out the engagement. LBMA has aligned assurance independence requirements to the EU mandatory audit firm rotation 12 and Refiners must rotate Assurance Providers every ten years on a comply or explain basis, subject to LBMA approval. Where audit firm rotation is not a viable option, the Refiner should at a minimum rotate the Assurance Partner responsible for signing off on the engagement.13 LBMA undertakes a rigorous Assurance Provider approval and monitoring process, and Refiners must select an Assurance Provider from the Approved Service Providers List (available on www.lbma.org.uk). Assurance objective The Assurance Provider is expected to express a conclusion on whether the Refiner’s annual reporting (refer to Step 5 of this Guidance) fairly describes the Refiner’s activities and on the Refiner’s management’s overall conclusion on meeting the objectives of the RGG. It is designed to enhance the intended users’ degree of confidence in the Refiner’s public Compliance Report and the confidential Country of Origin Annex. Refiners must grant Assurance Providers the requisite access to relevant sites, personnel, documentation (including previous years’ management reports) and data in order for them to perform their duties. Assurance standards. LBMA will only accept an assurance engagement performed in accordance with the ISAE 3000 revised assurance standard. A reasonable level of assurance should be carried out in year one of implementation or appointment of new Assurance Provider. Refiners may select a limited level of assurance for the next two years only if medium-risk or high-risk, or indeed zero-tolerance non-conformances are not identified during the reasonable or limited assurance engagements. Reasonable assurance is mandated every three years; however, Refiners may choose this level of assurance each year. The required assurance frequency 12 EU Statutory Audit Reform Directive 2014/56/EU3 and Regulation 537/2014 13 The ten-year audit period begins on 1 January 2022. Rotated assurance firm or partner may be re-engaged after a period of ten years. <!-- page 35 --> RESPONSIBLE GOLD GUIDANCE V.9 35 should increase if instances of non-conformance are identified or if there is a significant change of circumstance in the Refiner’s supply chain. LBMA has prepared detailed Third-Party Assurance Guidance for the application of ISAE 3000 to this type of engagement (which is available on www.lbma.org.uk). Refiners should consult this document to support their preparation for the assurance engagements. Assurance period Assurance of the Refiner’s conformance to the RGG is required on an annual basis (in accordance with the assurance standards section above) within three months of its financial year end and should cover the supply chain due diligence activities over a 12-month reporting period. Assurance deliverables The assurance deliverables should include three key reports, as described below: 1. Independent Assurance Report on the Refiner’s Compliance Report (Public) This report is addressed to the Refiner’s Board of Directors and states the Assurance Provider’s conclusion on the Refiner’s Compliance Report. This Assurance Report must be publicly disclosed alongside the Refiner’s Compliance Report, or it should be made clear how it can be accessed by intended users. 2. Independent Assurance Report on the Refiner’s Country of Origin Annex (Confidential) This report is also addressed to the Refiner’s Board of Directors and states the Assurance Provider’s conclusion on the information included in the Country of Origin Annex. As the Country of Origin Annex is a private document, the corresponding Assurance Report will also be a private report for the Refiner and LBMA. It may be shared with other stakeholders at the Refiner’s discretion. 3. Report to Refinery Management (Confidential) A report issued by the Assurance Provider to the Refiner’s management is the formal mechanism for communicating the detailed findings of the assurance engagement to the Refiner. This is a private document for the Refiner and LBMA. It may be shared with other stakeholders at the Refiner’s discretion. Note 4: Consistency in assurance deliverables Assurance Providers are expected to ensure sufficient transparency and consistency in the information presented in both the Refiner’s reporting and the assurance deliverables to meet the users’ needs. For example: • For an unqualified Assurance Report, the Compliance Report cannot conclude full compliance with the RGG when medium-risk and high-risk assurance non-conformances have been raised <!-- page 36 --> RESPONSIBLE GOLD GUIDANCE V.9 36 • The Assurance Report should draw attention to the medium-risk and high-risk assurance non-conformances identified (either in the Assurance Report itself or in disclosures in the Refiner’s Compliance Report). Further detail is provided in the Third-Party Assurance Guidance. Submission of assurance deliverables to LBMA Copies of all three deliverables should be submitted by the Refiner, or the Assurance Provider as designated by the Refiner, to the LBMA Chief Executive via email on an annual basis and within three months of the financial year end. Assurance Providers and/or Refiners may apply for an extension should this not be feasible due to unforeseen circumstances. Multi-site assurance and standards equivalence Where Refiners source multiple metals that are covered under LBMA’s and LPPM’s Responsible Sourcing Programmes and are required to conform to the RGG, Responsible Silver Guidance (RSG) and the Responsible Platinum and Palladium Guidance (RPPG), it may be possible to undertake a single multi-metal assurance engagement, if the following criteria are met: • There is one multi-metal refinery processing all metals in scope • The Refiner’s supply chain policies and management systems are consistent for all metals in scope • The RGG is used as the basis for the multi-metal assurance engagement, i.e., all metals in scope should be assessed for threat finance risk and ESG factors • Detailed sample testing adequately covers all metals in scope (further guidance is provided in the Third-Party Assurance Guidance) • Refiners provide sufficient disclosures on each metal in scope in the Compliance Report • Assurance Providers include sufficient information on each metal in scope in the Assurance Report or provide separate Assurance Reports for each metal in scope. Refiners may continue to commission separate assurance engagements against the relevant metal Guidance should they choose to. Where refineries are in different jurisdictions or sites, Refiners must undertake separate assurance engagements for each refinery. <!-- page 37 --> RESPONSIBLE GOLD GUIDANCE V.9 37 ## Step 5. Report Annually on Supply Chain Due Diligence The objective of Step 5 is for Refiners to publicly report on their gold supply chain due diligence policies, practices and performance for the reporting year, with appropriate regard for security, proprietary information, data protection regulations and the legal rights of the other supply chain actors. This public disclosure is to raise awareness of and generate confidence in the Refiner’s measures to combat threat finance risks and to address adverse ESG factors in the Refiner’s primary gold supply chain.

## 5.1 Reporting Requirements Reporting objective Step 5 reporting is expected to provide sufficient detail of the Refiner’s supply chain due diligence policies, management systems and risk assessment processes for users of the reporting to obtain a complete, accurate, timely and balanced view of the Refiner’s activities over the reporting period. Critically, the annual reporting must also detail actual performance during the year, including, in particular, the results of the risk assessment and risk mitigation steps in order for users to understand the effectiveness with which the Refiner is meeting the objectives of the RGG. It is expected that annual reporting will be specific to the business circumstances in each particular year and reflect the dynamic due diligence process. Reporting period Reporting on the Refiner’s conformance to the RGG is required on an annual basis, covering the supply chain due diligence activities over a 12-month reporting period. Reporting deliverables Refiners must provide the following four reporting requirements to meet the needs of different stakeholders for each reporting period: 1. Supply Chain Policy (Public) Refiner’s Supply Chain Policy should be documented and/or updated in line with Step 1 at the beginning of each reporting period. The Policy document must be made publicly available on the Refiner’s website. <!-- page 38 --> RESPONSIBLE GOLD GUIDANCE V.9 38 2. Refiner’s Compliance Report (Public) The Compliance Report should, as a minimum, meet the requirements outlined in the Disclosure Guidance Document in the Refiners Toolkit. Minimum information includes (but is not limited to): • Name of the Refiner and refinery • Reporting period • Summary of activities undertaken to conform to the RGG and meet the objectives of the Programme • Refiner’s level of conformance with each of Steps 1 to 5 of the RGG • Management’s overall conclusion on conformance with the RGG and the objectives of the Programme • The steps taken to map the circumstances of the high-risk operations and supply chains (EDD), methodology, practices and information yielded by on-site visits, and actual or potential risks identified. • The steps taken to strengthen chain of custody or traceability systems for high-risk supply chains, risk mitigation strategies, monitoring and tracking of performance, and results of follow-ups after six months. • The number of instances where the Refiner has disengaged with suppliers and/or supply chains without disclosing the identity, except where the Refiner deems this acceptable in accordance with applicable laws. The Compliance Report must be submitted to LBMA and made publicly available on the Refiner’s website. 3. Refiner’s Country of Origin Annex (Confidential) The Country of Origin Annex should, as a minimum, meet the requirements outlined in the Disclosure Guidance document in the Refiners Toolkit. Minimum information includes: • List of gold sources by country and by type of material sourced • Total gold sourced by type of material (LSM, ASM, Recycled Gold, Grandfathered Stocks) in the reporting period • The identity of the Refiner and the local exporter located in high-risk locations should always be disclosed except in cases of disengagement.14 The Country of Origin Annex should be submitted to LBMA but is not required to be made publicly available. 4. Corrective Action Plan (Confidential) Refiners should submit a Corrective Action Plan if a high-risk non-conformance has been identified during the assurance and/or if the Refiner fails to satisfy one or more of the requirements as set out in 14 This requirement is stipulated on page 111, footnote 59 of the OECD Due Diligence Guidance <!-- page 39 --> RESPONSIBLE GOLD GUIDANCE V.9 39 Steps 1 to 5 of this Guidance. For each high-risk non-conformance identified, the Corrective Action Plan should include: • A description of the issue • Reference to the relevant section in this Guidance • The corrective action(s) to be taken • The timeframe for completion of corrective action(s) • The person responsible for the implementation of each corrective action. The Corrective Action Plan must be submitted to LBMA but is not required to be made publicly available. In addition, Refiners must report any of the following to LBMA, with due consideration of local and international legal requirements: • Zero-tolerance non-conformances identified during the Refiner’s due diligence processes in suppliers or supply chains already onboarded • Zero-tolerance non-conformances identified during the Refiner’s assurance process • Assurance Providers with whom the Refiner has decided to cease engagement as a result of performance issues. The incidents should be reported to the Responsible Sourcing Manager. Submission of reporting deliverables to LBMA Copies of all four deliverables should be submitted by the Refiner, or the Assurance Provider as designated by the Refiner, to the LBMA Chief Executive via email on an annual basis and within three months of the reporting year-end. The Compliance Report should be publicly disclosed alongside the independent Assurance Report within three months of the reporting year-end. Refiners may apply for an extension should this not be feasible due to unforeseen circumstances.