Responsible Gold Guidance Version 10 (June 2026) — public consultation draft (file "RGGv10-Public-Consultation-1-FINAL")

## 1.1 Adopt and commit to a policy for gold supply chain due diligence 1.1.1 Gold Supply Chain Policy Refiners must adopt a Gold Supply Chain Policy that incorporates the risks and risk management measures outlined in Annex II of the OECD Minerals Guidance 7 (OECD Annex II). The policy must also address adverse ESG factors in the Refiner’s Mined and Secondary Gold supply chains, based on factors outlined in the OECD Environmental Handbook 8 and other Social and Governance factors that have been deemed as relevant and material for RGG10. 1.1.2 Threat financing (includes conflict risks as per the OECD Annex II) • Systematic or widespread human rights abuses associated with the extraction, transport or trade of gold, including: ο Any forms of torture, or inhuman and degrading treatment. ο Forced or compulsory labour. ο Worst forms of child labour. ο Widespread sexual violence or other gross human rights violations. ο War crimes, crimes against humanity or genocide. • Direct or indirect support to illegitimate non-state armed groups, or public or private security forces (“illegitimate non-state armed groups, public or private security forces”)9 which: ο Illegally control mines, sites, traders or other intermediaries, and transport routes through the supply chains; or ο Illegally tax or extort money or minerals through the supply chains. • Bribery and fraudulent misrepresentation of the origin of gold. • Non-compliance with taxes, fees and royalties due to governments related to mineral extraction, trade and export from CAHRAs. • Money laundering or terrorism financing. • Contribution to conflict. 1.1.3 ESG factors Refiners are expected to address material ESG factors applicable in their mined and secondary gold supply chains by making enquiries on policies and practices for the ESG factors noted below, and by using the 7 OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict Affected and High-Risk Areas. 8 OECD Handbook on Environmental Due Diligence in Mineral Supply Chains 9 UN Office of the High Commissioner on Human Rights: https://www.ohchr.org/en/instruments-and-mechanisms/international-human-rights-law <!-- page 19 --> RESPONSIBLE GOLD GUIDANCE V.10 18 Refiners Toolkit. ESG due diligence should be risk-based to reflect the nature, size and complexity of the counterparty. • Compliance with environmental, health, safety and labour regulations in country of operation and/or company policy whichever is the more stringent. • Environmental management, including: ο Air, water, land pollution and incident management plans. ο Water stewardship, especially in water scarce and stressed areas. ο Unauthorised sourcing from World Heritage Sites and Protected Areas. ο Biodiversity loss or degradation (e.g. deforestation and land use change, impacts on endangered or at-risk species). ο Tailings and waste rock storage facilities, including management of acid mine drainage. • Climate change including greenhouse gas (GHG) emissions measurements and transitions plans for mitigation and adaptation to the physical impacts of climate change. • Storage, handling and disposal of hazardous chemicals, including mercury and cyanide. Note: Mercury: LBMA recognises that mercury is used mainly in ASM sources and therefore does not ban such supply chains, other than in jurisdictions where legislation explicitly outlaws its use in or if used in large-scale mining operations. Instead, LBMA requires Refiners working with artisanal supply chains to assist them in establishing processes to use and store mercury in a safe manner and to limit negative impacts on the environment and health and safety. Refiners are also encouraged to support such suppliers that are implementing mercury reduction plans and/or finding alternative solutions to mercury. Refiners should consult the ASM Toolkit for further guidance. Cyanide: Refiners must engage with upstream producers to encourage them to comply with the International Cyanide Management Code. • Management of labour issues, including remuneration, working hours, collective bargaining, discrimination and harassment, diversity, equity and inclusion, disputes, and safeguarding of workers. • Community engagement and management programmes (land acquisition and community resettlement, cultural heritage sites and indigenous people, closure planning and safeguarding of vulnerable populations, and impacts of noise and vibrations on communities). • Management of business integrity and ethical conduct, and supporting the implementation of relevant initiatives such as the Extractive Industry Transparency Initiative (EITI). 1.1.4 Supply Chain Policy The policy (or supporting process documentation) must include sufficient details on the gold supply chain due diligence. Refiners may, however, choose to publish a concise policy commitment document. Minimum criteria for the internal (or external) Supply Chain Policy document: • Scope: Organisational Boundary: The full Responsible Sourcing Policy (including the criteria below) must be applied to all the departments or units within the Refiner’s corporate structure that are involved in the gold supply chain (for example, sales, sourcing, smelting, refining and supply chain risk assessment operations). • Organisation and responsibilities. • Identification and assessment of threat finance risks and consideration of ESG factors, including all those defined above. <!-- page 20 --> RESPONSIBLE GOLD GUIDANCE V.10 19 • Detailed and meaningful Know Your Counterparty (KYC) and supply chain due diligence processes that, at a minimum, meet RGG Step 2 requirements. • Transaction monitoring processes that, at a minimum, meet RGG Step 2.1 requirements. • Criteria for high-risk supply chains that, at a minimum, meet RGG Step 2.2 requirements. • KYC and supply chain due diligence record maintenance requirements. • Employee training programme.

## 1.2. Establish management structures to support supply chain due diligence Refiners must establish internal governance structures to provide effective oversight of the implementation and continuous improvement of the supply chain due diligence programme. Refiners must apply the minimum requirements set out below. 1.2.1 Board level oversight As a minimum, the Refiner must assign authority and accountability to the Board, or a committee appointed by the Board (and for the purposes of this Guidance, both the Board and/or Board Committee are referred to as the Board Committee). Board accountability must include, but not be limited to: • Having the necessary competence, knowledge and experience, or utilising external expert advisors to provide oversight of the supply chain due diligence framework and outcomes, including effective oversight of ESG risks. • Ensuring internal accountability for the effectiveness of the supply chain due diligence policies and processes, including effective integration of ESG factors. • Assessing whether effective structures and communication processes are in place for critical information, including the company policy, to reach relevant employees and gold-supplying counterparties. • Regularly, and at a minimum annually, assessing the effectiveness of supply chain due diligence policies and processes to drive continuous improvement. • Assessing whether an appropriate Compliance Officer has been appointed to take responsibility for all matters regarding the gold supply chain. • Assessing whether the Compliance Officer has sufficient support in terms of the availability of resources necessary to support the operation and monitoring of the supply chain due diligence processes and systems, including ESG factors. • Being informed of decisions relating to risk mitigation, disengagement and remedial actions. 1.2.2 Compliance Officer The Refiner must appoint a Compliance Officer, who must be a senior person in the organisation, reporting directly to the CEO (or equivalent) and/or the Board. The Compliance Officer’s responsibilities must include, but not be limited to: • Reviewing the gold supply chain due diligence processes and systems to meet the objectives of the RGG and the Refiner’s risk management appetite. • Ensuring effective structures and communication processes are in place for critical information, including the company policy, to reach relevant employees and gold-supplying counterparties. <!-- page 21 --> RESPONSIBLE GOLD GUIDANCE V.10 20 • Ensuring the availability of sufficient resources (including capacity and experience) necessary to support the operation and monitoring of the supply chain due diligence processes and systems, including ESG factors. • Training employees with respect to supply chain risks (including threat finance and ESG), and preparing and updating of the Refiner’s Gold Supply Chain Policy and procedures. • Reviewing KYC files and risk classifications, and requesting additional documentation or information, as necessary. • Reviewing appropriate risk classification of gold-supplying counterparties and ensuring that appropriate measures are executed in the case of high-risk supply chains or transactions. • Providing proper and timely information for the Board to perform its duties. 1.2.3 Training Refiners must develop a comprehensive, ongoing gold supply chain training programme, covering both threat finance and ESG factors, for all staff involved directly in the gold supply chain. As well as the responsible sourcing compliance team, this must also include sourcing, logistics, goods receivable, sales and trading, treasury and finance, on a comply or explain basis. Proportionate and appropriate awareness-raising should also be conducted for other personnel involved in the gold supply chain, including transformation or refining, sampling and assaying, or any other personnel at the Compliance Officer’s discretion. Details of these activities must be recorded, with appropriate monitoring of attendance and understanding of the supply chain risks and due diligence processes. 1.2.4 Payment through official regulated payment channels For transactions over $10,000 in value, Refiners must make and receive payments for gold through official regulated payment channels 10 and must not undertake any cash-based transactions. The only permissible exceptions to this rule include: • Cash purchases above the threshold with suppliers with records of government-issued identification and a purchase receipt which can be used for income tax purposes, where applicable. • Cash purchases of legitimate ASM gold, as long as all transactions involving legitimate ASM gold are made through formal channels from the point of export in the country of production to any onward counterparty. These ASM practices and/or cash transactions below the stipulated threshold must be supported by verifiable information and approved by the Compliance Officer. 1.2.5 Cooperation with government authorities Refiners must cooperate fully and transparently with government authorities and provide full access to records and information, as appropriate. Authorities include national or international law enforcement agencies and customs officials. 10 Refers to financial institutions or payment instruments that are licensed or authorised and subject to regulatory supervision by a competent authority in the jurisdiction in which they operate. <!-- page 22 --> RESPONSIBLE GOLD GUIDANCE V.10 21 1.2.6 Maintaining records Refiners must maintain adequate records to demonstrate appropriate and ongoing risk identification, due diligence and traceability. Records are required to be maintained for at least five years, or the minimum timeframe stipulated by local regulatory requirements, following the end of the Refiner’s reporting year.

## 1.3 Establish a gold traceability system The Refiner must establish a system of controls for visibility and transparency over the supply chain. This includes a chain of custody or traceability system that identifies the origin of the gold and the upstream partners involved in the supply chain, and a mechanism to trace the input of each lot refined and the first destination of each product shipment. Material segregation is not required. 1.3.1 Supply chain traceability system The traceability system must collect and maintain supply chain information for each lot of Mined Gold, Investment Gold, Secondary Gold or other feedstock refined. The traceability information must include, but not be limited to: • Proof of mining origin for Mined Gold or gold-bearing material. • Proof of origin for Investment Gold. • Proof of Verifiable Date for Grandfathered material. • Proof of origin for Secondary Gold or gold-bearing material. Supporting documentation must include as a minimum: ο Official government-issued certificate of origin where available. ο Formal packing list. ο Formal invoices. ο Shipping/transportation documents (waybill/airway bill, pro forma invoice, if applicable) to establish chain of custody from counterparty country of origin to Refinery. ο Official export and import forms. ο Official customs tax compliance documentation, including for officially declared hand-carried material. Supporting documentation may include: ο Audited chain of custody documentation if applicable. ο Blockchain or other traceability records. LBMA encourages Refiners to consider technology solutions (e.g. blockchain, machine learning or artificial intelligence), where feasible, to enhance transparency and efficiency in supply chain traceability. • Date of arrival at the refinery and date of assay finalisation. • A unique reference number assigned to each input and output in order for any tampering to be evident. • Type of gold received (including source): ο Mined Gold: LSM, ASM, Mining By-Product. ο Secondary Gold: Unprocessed, Melted, Industrial By-Product. ο Investment Gold. ο Grandfathered Stocks. • Weight and assay: declared and processed. <!-- page 23 --> RESPONSIBLE GOLD GUIDANCE V.10 22 • Records confirming appropriate goods receipt, including appropriate delivery and matching to physical type of material, quantity and packaging (in sealed containers where possible) as documented in packing lists. • Reference number linking each lot to supplier due diligence records and risk assessments.

## 1.4 Strengthen company engagement with gold-supplying counterparties Refiners should build long-term relationships based on trust and mutual recognition with suppliers. Refiner’s responsibilities include, but are not limited to: 1.4.1 Policy Refiners must require the gold-supplying counterparty to commit to either: • the Refiner’s Gold Supply Chain Policy; or • the counterparty’s own gold supply chain policies, which at a minimum must be consistent with the OECD Annex II and demonstrate commitment to the relevant ESG factors. For the avoidance of doubt, inclusion of these requirements within a counterparty’s policy does not lessen or replace Refiners’ obligations to undertake due diligence. 1.4.2 Contracts The Refiner’s Gold Supply Chain Policy or its requirements, or the counterparties’ own gold supply chain policies or requirements per 1.4.1, must be incorporated into contracts and/or agreements between the Refiner and its gold-supplying counterparties. Contracts may also include Refiner’s due diligence requirements and/or templates for suppliers to commit to. Contracts with ASM suppliers must explicitly reference the progressive implementation of this requirement within [one year] of commencing a commercial relationship. For the avoidance of doubt, inclusion of these requirements into contractual arrangements does not lessen or replace Refiners’ obligations to undertake due diligence. 1.4.3 Capacity building Where appropriate, Refiners must assist in establishing processes to promote responsible mining and sourcing practices throughout the supply chain and assist gold-supplying counterparties or prospective suppliers, including legitimate ASM and local traders, in improving their supply chain practices and implementing progressive improvement requirements outlined in the ASM Toolkit. For example, Refiners must communicate their expectation and provide guidance or share good practices during on-site visits. Refiners may also consult and work together with national and industry authorities, local and international NGOs, human rights institutions, donor agencies and large-scale mining, etc. to support gold-supplying counterparties. 1.5 Establish a confidential grievance mechanism Refiners must maintain a confidential grievance mechanism that allows any employee or external stakeholder (intended user or whistleblower) to voice concerns over the gold supply chain or any newly identified risk. <!-- page 24 --> RESPONSIBLE GOLD GUIDANCE V.10 23 The grievance mechanism must be based on, but not be limited to, the following principles: • Accessible: The mechanism should be known and usable by all intended users without fear of reprisal, and must include considerations for language, literacy, costs, physical location and technology. • Independent: The mechanism should have a formal and independent oversight structure (e.g. the Refiner’s compliance department) that ensures parties cannot interfere with fair conduct. • Respectful: All complaints must be treated seriously and with respect. • Transparent: The mechanism should have procedures to keep parties informed about the progress of their grievances through each stage and clarity on possible outcomes, must provide sufficient information to build confidence in its effectiveness and meet any public interest reporting requirements. • Contribute to continuous learning: The mechanism should provide a source for identifying lessons for improving both the mechanism and preventing future grievance and harm. • Refiners should encourage outcomes from supplying counterparties that enable appropriate and effective remedy for actual or potential adverse impacts, or disengage with the supplying counterparties, proportionate to the severity of the adverse impacts. • Protection against retaliation: Refiners must take all reasonable steps to prevent and address retaliation, including any form of victimisation, threats, adverse employment actions or informal reprisals. <!-- page 25 --> RESPONSIBLE GOLD GUIDANCE V.10 24 ## Step 2. Identify and Assess Supply Chain Risks The objective of Step 2 is for the Refiner to identify actual and potential adverse impacts with respect to Threat Financing (OECD Annex II) and the adverse ESG factors set out in Step 1.1 in the Refiner’s gold supply chain. Due diligence must be conducted on a risk basis across the supply chain. This should include using good faith efforts to map the supply chain up to the Mine of Origin or Intermediate Refiners where this information is reasonably available. Step 2.1 outlines the Initial Due Diligence (IDD) that should be proportionate to each Refiner’s business activities and supply chains. Step 2.2. provides criteria for GDL Refiners to conduct an integrated risk-based approach that considers sourcing risks from CAHRAs, in combination with additional location, supplier and material-type risks, as the most effective way to assess the Inherent Risks present in supply chains. High Inherent Risk supply chains must then be prioritised for Enhanced Due Diligence (EDD) in line with the criteria provided in Step 2.3. The outcome of Step 2 is expected to be a Residual Risk classification of supply chains, which factors in existing controls identified during the EDD assessment, for Refiners to then determine the next steps with respect to each supply chain.

## 2.1 Conduct supply chain due diligence to identify potential risks Refiners must perform Initial Due Diligence on their supply chains following a risk-based approach. For consistent application, RGG10 defines the expectations for Minimum Provenance Point for each material category, based on practicality and risk sensitivity. To identify high-risk supply chains, GDL Refiners should undertake the following measures as a minimum: 2.1.1. Location risk identification should include, but not be limited to: • Determination and documentation of the Minimum Provenance Point of the gold source, regardless of whether material is sourced directly or indirectly (i.e. via traders), per the definitions on pages [11-17] and below for: ο Mined Gold: a) The location of the mine (LSM and ASM) b) Mining By-Product: The country of the base metal mine ο Investment Gold: a) GDL Investment Gold Bars: The country of the GDL Refinery where the bar was produced b) GDL Investment Gold Coins: The country of shipping c) Non-GDL Investment Gold Bars: The countries from which the Intermediate Refiner is sourcing its feedstock. 11 11 When sourcing indirectly, e.g. via traders, it may not be possible for Refiners to ascertain the Minimum Provenance Point of material sourced by the Intermediate Refiner in the supply chain. In this case, a responsible sourcing audit of the Intermediate Refinery should be used to manage the supply chain risk. <!-- page 26 --> RESPONSIBLE GOLD GUIDANCE V.10 25 d) Grandfathered Stocks: determination of origin for due diligence purposes not required. ο Secondary Gold: a) Melted Gold: The countries from which the counterparty is sourcing its feedstock. b) Unprocessed Gold: The country of shipping. c) Industrial By-Products: The country of production. • Determination of the general transportation routing of the gold source from supplying counterparty to Refinery. • Verification that sourcing from the Minimum Provenance Point is not in breach of any International Sanctions. • Verification that the mine site is not located in a World Heritage Site. This location-based risk identification process must include an integrated assessment of all risks (threat financing and ESG factors) outlined in Step 1.1. The integrated assessment should consider in a structured manner, as a minimum, but not limited to, the following sources: • Sanctions lists (at a minimum US, UK, EU, UN and other relevant sanctions lists). • Dodd Frank s. 1502. • EU CAHRA list. • Heidelberg Barometer. • Fragile States Index or equivalent. • UN Human Rights Office of the High Commissioner or equivalent. • FATF grey lists (as per Disclosure Guidance). • Credible market intelligence on high-risk gold centres/transit hubs and on countries where there is a high risk of money laundering. Refiners should also consider credible market intelligence to cover the ESG risk factors included in Step 1.1, as relevant: for example, MSCI ESG Governance Ratings; World Bank Sovereign ESG Data Portal; Yale Environmental Performance Index. 2.1.2 Supplier risk identification should include, but not be limited to: Refiners must use the KYC Questionnaire in the Refiners Toolkit (or an equivalent template that incorporates all the requirements of the LBMA KYC Questionnaire as a minimum) for the: • Identification, verification and documentation of the gold-supplying counterparty’s name, physical address, corporate registration and licence information, using reliable, independent source documents, data or information. • Identification, verification and documentation of Ultimate Beneficial Owners (UBOs) (defined as 10% or more ownership) and authorised signatories 12 of the gold-supplying counterparty, using reliable and current government-issued photo identity documents. • Documented confirmation, based on sanctions and adverse media screening, that the gold-supplying counterparty and its UBOs are not named on International Sanctions lists (at a minimum US, UK, EU, UN and other relevant sanctions lists) or on government lists as wanted money launderers, or as known fraudsters or terrorists. 12 Ultimate Beneficial Owners with significant influence over the gold-supplying counterparty and authorised signatories. Not required in the case of companies that are part of a group listed on a stock exchange or for banks with appropriate AML-CFT policies, or governmental authorities. <!-- page 27 --> RESPONSIBLE GOLD GUIDANCE V.10 26 • Obtaining and documenting the gold-supplying counterparty’s business (including locations of operation and supply chain profiles, types of products and relevant affiliates), and financial details and management of ESG factors. • Obtaining and documenting information on the purpose and intended nature of the business relationship. 2.1.3 Type of material risk identification The sections below detail additional due diligence measures specific to various types of sourced material and scale of sourcing operations. Refiners must use reasonable and good faith efforts to apply each of the measures described, which represent the minimum requirements. Recognition of other standards and schemes Refiners may also use independent audit, assurance or certification reports (collectively termed third-party audits) of conformance with responsible sourcing standards and/or schemes (other initiatives) included in the LBMA Reference List of Standards and Schemes (LBMA Reference List) as supporting evidence for all or part of the requirements outlined below. The onus is on the Refiner to determine which aspects of the RGG are being addressed through other initiatives and to ensure residual RGG requirements are appropriately met. A. High identification for Mined Gold from LSM must include, but not be limited to: Refiners must use the KYC Questionnaire for Mined Material in the Refiners Toolkit (or an equivalent template that incorporates all the requirements of the LBMA KYC Questionnaire as a minimum) to obtain, assess, document and, where possible, verify against publicly available information: • Mining licence. • Import/export gold licence for gold-supplying counterparty, if applicable. • Mining practice, including processing and transportation method. • Production data and processing capacity, if available. • Sources of any third-party stock, including that from ASM, on the mine site and controls to appropriately manage these. • Proximity to ASM and local communities. • Anti-money laundering and terrorist financing policies and practices, where relevant. • Bribery and corruption policies and practices, including payment to government. • Human rights policies and practices. • Environmental policies and practices. • Health and safety policies and practices. • Labour policies and practices, if not already covered through other policies collected. • Community engagement programmes. • Ethics and business integrity policies and practices. Note 1: Risk identification for gold sourced from owned mines Where Refiners are sourcing from mines within the same corporate group as the Refiner, i.e. owned mines, it is expected that risk-based due diligence is still performed on applicable risks, e.g. management of third-party stock and ESG factors. This should be appropriately documented and evidenced in the supplier due diligence files. <!-- page 28 --> RESPONSIBLE GOLD GUIDANCE V.10 27 B. Risk identification for gold sourced from Mining By-Products: Refiners must use the KYC Questionnaire 13 for Mining By-Products in the Refiners Toolkit (or an equivalent template that incorporates all the requirements of the LBMA KYC Questionnaire as a minimum) to obtain, assess, document and, where possible, verify against publicly available information: • Main markets, products and customer segments of the smelter. • Types and forms of gold-bearing material sourced by the smelter. • Minimum Provenance Point for all gold and precious metals sourced by and received by the smelter directly and indirectly (i.e. through trading companies). • Smelter’s import/export licences, if applicable. • Smelter’s anti-money laundering and terrorist financing policies and practices, if applicable. • Smelter’s anti-bribery and corruption policies and practices, if applicable. • Smelter’s OECD Annex II aligned responsible sourcing policies and processes. • Smelter’s confirmation of compliance with environmental, health, safety and labour regulations. Note 2: A Refiner that only sources Mining By-Product from group companies must still undergo an RGG assurance over its supply chain due diligence policies, processes and systems, and manage the risk of false misrepresentations of origin. C. Risk identification for Mined Gold from ASM should include, but not be limited to: Refiners must use the KYC Questionnaire for ASM Material (ASM Toolkit) in the Refiners Toolkit (or an equivalent template that incorporates all the requirements of the LBMA KYC Questionnaire as a minimum) to obtain, assess, document and, where possible, verify against publicly available information: • Suppliers of ASM gold sources, including: o Local artisanal mining team, association or cooperatives (it is not necessary to identify individual miners). o Ore processing plant or aggregators. o Traders. o Local gold exporter. • Whether the ASM mining project is legally registered and licensed, or part of a recognised sourcing scheme or government or central bank initiative. • Location of the mining concessions and domestic processing, through the use of GPS tools and mine site visits, undertaken on a sampled and risk-assessed basis.14 • Supply chain mapping from mining concessions to Refinery, including aggregators, processing plants, trader, exporters and transporters. • Mining practice, including extraction, processing and transportation methods. • Geological estimates or known gold reserves, where available. • Number of miners, and the potential risk for illicitly Mined Gold to enter the supply chain. 13 When sourcing indirectly, for example via traders, Refiners may request an independent supply chain audit instead on the smelter. Where the operation is a vertically integrated smelter-Refiner operation and sourcing of Mining By-Product is directly from a mine, section A will apply. 14 LBMA recognises that an ASM Aggregator or ASM Processing Plant may receive material from a large number of mines. From a due diligence perspective, it may be impractical for Refiners to visit every individual mine site prior to onboarding, and requiring this in all circumstances may serve as a barrier to responsible ASM sourcing. RGG10 therefore requires Refiners to adopt a risk-based sampling approach for on-site visits in line with the minimum requirements outlined in the ASM Toolkit. This does not exempt Refiners, however, from gathering and/or reviewing the KYC documentation outlined above for all suppliers of ASM material. <!-- page 29 --> RESPONSIBLE GOLD GUIDANCE V.10 28 • Any conflict or tensions in the relationship between LSM and ASM. • Risk, suspicions or reports that gold from other sources is being unknowingly introduced into the gold supply chain and/or fraudulently represented. • Use, storage and recovery of mercury, and policies and practices in place to safely dispose of spent mercury and adopt a structured phase-out of mercury use. • Human rights practices and policies,15 including the presence of underage workers. • Security practices at mines to identify risks posed by local armed groups, including risk of supply chain actors being exhorted for illegal taxes. • Risk of militarisation of mine sites and transportation routes, and the risk of direct or indirect support to illegitimate non-state armed group, or public or private security forces. • Environmental policies and practices, including an assessment of the proximity to and potential impacts on environmentally sensitive areas (i.e. water bodies, nature reserves). • Health and safety practices and policies, including records evidencing staff training and quantifying health and safety incidents. • Labour practices and policies, including fair working hours and fair pricing for ASM miners. • Understanding payments or compensation made to government agencies and officials, public or private security forces, or other armed groups at all points in the supply chain from extraction onwards, unless prohibited by law. • Payment mechanisms (cash-based, mobile banking applications, etc). Note 3: The ASM Toolkit has been designed to encourage direct sourcing relationships with legal ASM providers and outlines specific requirements for Refiners with respect to engagement and sourcing from different actors working in the ASM sector (i.e. miners, processors/aggregators, traders). It is based on the notion of progressive improvement. Unless specified otherwise in the ASM Toolkit, minimum requirements are expected to be fully implemented one year from the commencement of a sourcing relationship. LBMA recognises that sometimes local factors beyond the control of a supplier (i.e. lack of regulatory or monitoring capacity) may hinder full implementation of certain progressive requirements. In such instances, GDL Refiners must obtain documentation from affected suppliers that evidences their good faith efforts to meet local and/or national regulations, and demonstrates that responsibility for the delay rests with a relevant regulatory agency. ASM standards and/or schemes included in the LBMA Reference List must, as a minimum, incorporate the ASM Toolkit requirements. Recognition of ASM schemes signifies alignment to the requirements of the ASM Toolkit; it does not guarantee risk mitigation, nor does it replace the need for Refiners to undertake appropriate due diligence and ongoing monitoring of sourcing relationships and streams. D. Risk identification for Investment Gold and Secondary Gold should include, but not be limited to: Refiners must use the KYC Questionnaire for Investment Gold and Secondary Materials in the Refiners Toolkit (or an equivalent template that incorporates all the requirements of the LBMA KYC Questionnaire as a minimum) to obtain, assess, document and, where possible, verify against publicly available information: • Main markets, products and customer segments of the gold-supplying counterparty. • Types and forms of precious metals sourced by the counterparty. 15 Policies, where not available, are required to be implemented within the timeframe stipulated in the ASM Toolkit. This applies to all policy requirements in current and following bullets relating to ASM. <!-- page 30 --> RESPONSIBLE GOLD GUIDANCE V.10 29 • Minimum Provenance Point and chain of custody of all gold and precious metals sourced by the gold-supplying counterparty, including key actors, e.g. Intermediate Refiners/Melting Operators, Traders, Exporters as applicable. • Profiles of the counterparty’s gold and precious metals suppliers. • Minimum Provenance Point and chain of custody of all gold and precious metals sourced by and received from trading companies, where possible. • Type and location of facilities operated by the counterparty (refining, manufacturing, jewellery production, pawn shops, etc.) • Counterparty import/export licences, if applicable. • Counterparty anti-money laundering and terrorist financing policies and practices. • Counterparty anti-bribery and corruption policies and practices. • Counterparty OECD Annex II aligned responsible sourcing policies and processes (or Refiner’s policy per Step 1.4.1). • Counterparty confirmation of compliance with local environmental, health, safety and labour regulations. Note 4: Risk identification for gold sourced from own group companies Where Refiners are sourcing from within the same corporate group as the Refiner, it is expected that risk-based due diligence is still performed on applicable risks, for example, assessment of overall sourcing profiles and traceability. This should be appropriately documented and evidenced in the supplier due diligence files. 2.1.4 Monitoring of transactions The Refiner must conduct appropriate scrutiny and monitoring of transactions undertaken through the course of the relationship to ensure that the transactions are consistent with the Refiner’s knowledge of the supply chain and risk profile. The monitoring of transactions should be undertaken by applying a risk-based approach. Transactions monitoring should include, but not be limited to: • Checking and documenting volumes, types and concentrations of gold-bearing material for consistency with previous shipments. • Monitoring the actual transportation routing for each shipment to understand and document transit routes and any deviations from planned routing.16 • Verifying and documenting physical shipment properties against shipping/transportation documents (assays, weights, serial numbers). • Confirming that documents and materials are consistent with each other (purchase order, goods receipt, invoice) and with the KYC information (mine capacity, origin, sources). Where material inconsistencies or suspicions are identified: • The gold should be physically segregated and secured (until the inconsistencies are resolved). • An investigation should be undertaken and documented. • Findings should be reported to the Compliance Officer, Board and appropriate authorities, as applicable. 16 It is not expected that the Refiner knows the detail of the transport route as this may be sensitive information, but the general transportation route to determine transportation from and transit through CAHRAs. <!-- page 31 --> RESPONSIBLE GOLD GUIDANCE V.10 30

## 2.2 Classify supply chains based on risk profiles Refiners must classify the Inherent Risks in supply chains based on the risk profiles determined during the Initial Due Diligence. Risk classification criteria are expected to incorporate the Threat Finance and ESG factors stipulated in Step 1.1, and should be regularly reviewed and updated. Refiners must apply the following minimum criteria to determine zero-tolerance and inherent high-risk supply chains. 2.2.1 Zero-tolerance supply chains Where any zero-tolerance issues are identified, the Refiner must not enter a business relationship with a gold-supplying counterparty or must terminate an existing relationship immediately. The Refiner must notify LBMA immediately as outlined in Step 5.1.3. Zero-tolerance criteria include, but are not limited to: • The Mined Gold is known to originate from areas designated as World Heritage Sites. • The Mined Gold or Secondary Material Gold is known to be sourced in breach of International Sanctions (at a minimum, including but not limited to UN, EU, UK and US sanctions lists). • The Mined Gold or Secondary gold-supplying counterparty, other known upstream companies or their UBOs are named on International Sanctions lists (at a minimum, US, UK, EU, UN and other relevant sanctions lists) or are known money launderers, fraudsters or terrorists, or have been implicit in serious human rights abuses, or in direct or indirect support to illegitimate non-state armed groups. 2.2.2 High Inherent Risk supply chain criteria A. High Inherent Risks for Mined Gold should include, but not be limited to: For location-based high Inherent Risks, Mined Gold that: • Originates from, has transited or has been transported via a high-risk location. • Is claimed to originate from a country through which gold from CAHRAs is known, or reasonably suspected, to transit. • Is claimed to have originated from a country that has limited known reserves, likely resources or expected production levels. For supplier-based high Inherent Risks, gold-supplying counterparty or other known upstream companies that: • Have shareholders, or UBOs, or other gold supplying interests in one of the location-based high-risk criteria. • Have UBOs that are PEPs. • Have activities in a higher-risk business activity such as arms, gaming and casino industry, antiques and art, and sects and their leaders. • Have been known to have sourced gold from a high-risk location in the last 12 months. • Have material discrepancies/inconsistencies in the documentation provided or have refused to provide requested documentation. <!-- page 32 --> RESPONSIBLE GOLD GUIDANCE V.10 31 For type of material-based high Inherent Risks, Mined Gold that is: • Sourced from ASM mine, Aggregator or ASM Processing Plant that is not part of a scheme included in the LBMA Reference List. • Produced with the use of mercury. • Contributing to Catastrophic Harm or Highly Adverse ESG factors. B. High Inherent Risks for Mining By-Product: For location-based high Inherent Risks, gold-bearing material that: • Originates from, has transited or has been transported via a high-risk location, as defined in Step 2.1. For supplier-based high Inherent Risks, gold-supplying counterparty or other known upstream companies that: • Have shareholders, or UBOs, or other gold-supplying interests in a high-risk location as defined in Step 2.1 • Have UBOs that are PEPs. For type of material-based high Inherent Risks, Mined Gold that is: • Contributing to Catastrophic Harm or Highly Adverse ESG factors, to the extent that the Refiner is able to identify this (e.g. through a record in the public domain, in the Refiner’s due diligence file or third-party audits). C. High Inherent Risks for Investment and Secondary Gold: The risk classification of Investment and Secondary Gold should be proportionate to the risks identified, with priority given to persons, places and transactions that present higher risk. For location-based high Inherent Risks, Investment or Secondary Gold that: • Originates from, has transited or has been transported via a high-risk location as defined by the Refiner in Step 2.1. • Is claimed to originate from a country through which gold from a CAHRA is known, or reasonably suspected, to transit. • Is unjustifiably claimed to have originated from a country that has limited exports of gold. For supplier-based high Inherent Risks, gold-supplying counterparty or other known upstream companies that: • Operate in a money laundering high-risk country. • Have shareholders, or UBOs, or other gold-supplying interests in one of the location-based high-risk criteria. • Have UBOs who are PEPs. • Have activities in a higher-risk business activity such as arms, gaming and casino industry, antiques and art, and sects and their leaders. • Have been known to have sourced gold from a high-risk country in the last 12 months. • Have significant unexplained geographic routing from their supplier or counterparty in the supply chain. <!-- page 33 --> RESPONSIBLE GOLD GUIDANCE V.10 32 For type of material-based high Inherent Risks: • Non-GDL Investment Gold that is sourced directly or indirectly (i.e. through trading companies) from Intermediate Refiners with high-risk supply chains (including location and supplier risk criteria). • Melted Secondary Gold that is sourced directly or indirectly from Intermediate Refiners and Melting Operators with: o High-risk location-based supply chains; and o Production of high-grade rudimentary bars (above 90%); or o Unjustifiably complex supply chains (i.e. sourced via multiple intermediaries with limited traceability within a short time frame). • All Mixed Materials. The above criteria must be used as minimum requirements for Inherent Risk identification. Refiners may identify additional location, supplier or type of material criteria to assess Inherent Risks based on internal risk classification processes and risk appetite. Any Inherent Risk identified is expected to trigger Enhanced Due Diligence.

## 2.3 Undertake Enhanced Due Diligence measures for high-risk supply chains Refiners must apply, at a minimum, the following Enhanced Due Diligence (EDD) measures for different types of gold-bearing material.17 These measures may be conducted during the on-site visit or remotely, as appropriate, and in accordance with Step 2.3.1.2. 2.3.1 EDD measures A. EDD measures for high Inherent Risk LSM gold supply chains must include but not be limited to: Requirements may be addressed through third-party audits or certification schemes: • Proportionate KYC on each company involved in the conflict location-based high-risk supply chain from the mine to the refinery (including gold producers, intermediaries, gold traders and exporters, and transporters). • Understanding the nature of public or private security services provided at the mine sites and through the supply chain, including the screening and training of security personnel in line with the Voluntary Principles on Security and Human Rights. • Considering the risks of militarisation of mine sites and transportation routes, and direct or indirect support to illegitimate non-state armed group, or public or private security forces. • Determination of the risk of any serious human rights abuses committed by any party at mine sites, transportation routes and points where gold is traded and/or exported. • Estimating the number of artisanal and small-scale miners (if any) on the producer’s concession, and: o Confirming their status as legitimate ASM. o Considering risks of gold from third-party sources unknowingly being introduced into the producer’s operations. 17 In the case of PEP and ESG risks, GDL Refiners are expected to focus on EDD measures that are commensurate to that particular risk. For all other Threat Finance risks, GDL Refiners must undertake all EDD minimum criteria stipulated. <!-- page 34 --> RESPONSIBLE GOLD GUIDANCE V.10 33 o Considering the relationship between producer and ASM actors to identify instances of conflict or tension. • Complete self-declaration of taxes and royalties compliance, as applicable. • Understanding payments or compensation made to government agencies and officials, public or private security forces, or other armed groups at all points in the supply chain from extraction onwards, unless prohibited by law. • Considering compliance with environmental, health, safety, labour, community, business integrity regulations, policies and good practices for issues identified in the Initial Due Diligence. B. EDD measures for high Inherent Risk Mining By-Product must include, but not be limited to: • Obtaining an Independent Assurance Report on the smelter’s responsible sourcing practices on a comply or explain basis. Where an Independent Assurance Report on smelter’s responsible sourcing practices is not or cannot be obtained, the Refiner must undertake the following EDD steps for the gold-bearing material supplying mine: • Supply chain mapping from mine to smelter and from smelter to Refiner. • Proportionate KYC on each company involved in the conflict location-based high-risk supply chain from the mine to the refinery (including gold producers, intermediaries, gold traders and exporters, and transporters). • Obtain and assess information from the gold-bearing material mine supplying the Refiner, including: o Mining licence. o Mining practice, including processing and transportation method. o Mine production data and processing capacity, if available. o Any risks associated with proximity to ASM and local communities. • The nature of public or private security services provided, including the screening and training of security personnel in line with the Voluntary Principles on Security and Human Rights. • Risks of militarisation of mine sites and transportation routes, and direct or indirect support to illegitimate non-state armed group, or public or private security forces. • Risk of any serious human rights abuses committed by any party at mine sites, transportation routes and points where gold is traded and/or exported. • Payments or compensation made to government agencies and officials, public or private security forces, or other armed groups at all points in the supply chain from extraction onwards, unless prohibited by law. • Compliance with local regulatory environmental, health, safety and labour regulations. • Catastrophic Harm or Highly Adverse ESG incidents in the last two years. C. EDD measures for high Inherent Risk ASM gold supply chains should include, but not be limited to: • For direct or indirect ASM sourcing, the Refiner must undertake the following EDD procedures. Requirements may be addressed through certification scheme reports: • Proportionate KYC on each company involved in the conflict location-based high-risk supply chain from the ore processing plant or gold aggregator to the Refiner (including cooperatives, gold traders and exporters, and transporters). • Undertaking on-site visits in accordance with the ASM Toolkit for: o Evaluating information on the government, or political or military affiliations of ASM suppliers, including any reported instances of affiliation with non-state armed group, or public or private security forces. <!-- page 35 --> RESPONSIBLE GOLD GUIDANCE V.10 34 o Evaluating evidence of any serious human rights abuses committed by any party at mine sites, transportation routes and points where gold is traded and/or exported. o Evaluating information on controls to manage the risk, suspicions or reports that gold from other sources is being unknowingly introduced into the gold supply chain and/or fraudulently represented. o Evaluating evidence of appropriate storage, handling and usage of mercury, and the impacts on the environment and workers’ health. o Evaluating the appropriateness of other ESG risk management practices pertaining to issues identified in the Initial Due Diligence. Refiners may consider independent third-party audits per section 2.3.1.1 for appropriate risk management, particularly when sourcing from ASM Processing Plants with multiple supply chains. D. EDD measures for high Inherent Risk Investment Gold (i.e. from Intermediate Refiners with high- risk supply chains), must include, but not be limited to: • A periodic independent assurance on the Intermediate Refiners’ responsible sourcing practices. Where high Inherent Risk Investment Gold is sourced indirectly (e.g. through traders), EDD measures must include: • Tracing supply chains back to Intermediate Refiners; and • Requesting a periodic independent assurance on the Intermediate Refiner supply chain (as above). If the Refiner is unable to identify the Intermediate Refiners or obtain sufficient independent assurance, risk management procedures per Step 3 must be applied and these must be clearly documented in the Refiner’s Compliance Report. E. EDD measures for high Inherent Risk Melted Gold must include, but not be limited to: • A periodic independent assurance on the Intermediate Refiners’/Melting Operators’ responsible sourcing practices on a comply or explain basis. Where Melted Gold is sourced indirectly (e.g. through traders), EDD measures must include: • Tracing supply chains back to Intermediate Refiners and/or Melting Operators; and • Requesting an Independent Assurance Report on the Intermediate Refiner or Melting Operator (as above). If the Refiner is unable to identify the Intermediate Refiners or Melting Operators or obtain sufficient assurance, risk management procedures should be applied, and these must be clearly documented in the Compliance Report. F. EDD measures for other high Inherent Risk Secondary Material EDD measures for other high Inherent Risks identified that are not covered by the above EDD requirements (e.g. Melted Material with high-risk suppliers only, Unprocessed material and Industrial By- Products with high-risk locations and/or suppliers) must include, but not be limited to: • Checking government watchlist information for each company located in conflict high-risk locations for Secondary Gold and involved in the supply chain from the counterparty to the refinery (including transporters). <!-- page 36 --> RESPONSIBLE GOLD GUIDANCE V.10 35 • Interviewing select management and site personnel to determine and corroborate the supply chain due diligence practices, purchasing, and anti-money laundering and counter-terrorist financing procedures. • Considering the counterparty’s competence and capacity for supply chain due diligence proportionate to risk. • Considering the appropriateness of the counterparty’s risk classification methodology. • Assessing due diligence records to confirm that procedures are being undertaken as per the counterparty’s Supply Chain Due Diligence Policy with due considerations for commercially sensitive information. • Assessing on-site visit methodology to the counterparty’s high-risk supply chains, with due consideration for commercially sensitive information. 2.3.2 Independent assurance or certifications Where Refiners request independent assurances, audits or certifications, commissioned by the Mine, ASM Processing Plant, Intermediate Refiner, Melting Operator, as relevant (collectively third-party audits) to fulfil EDD requirements: • The third-party audits must: o Include conformance with a responsible mining or sourcing scheme on the LBMA Reference List. o Be conducted by an Approved Assurance Provider under the relevant scheme. o Focus on threat financing as a minimum. Where material ESG risks identified during the Initial Due Diligence need to be addressed, Refiners should conduct EDD on these specific material ESG risks identified and this may include a targeted third-party assessment. o Be completed before the start of a new business relationship and for existing relationships as indicated below:  Melting Operator: A phased approach for existing counterparties, beginning with third-party audits commissioned no later than 31 December 2028. All remaining supplier assurance engagements must be initiated 18 by 31 December 2029 and incorporated in the Refiners’ FY2029 reporting. • The third-party audits must deliver: o The supply chain actor’s Compliance Report for all sources (regardless of whether material from these supply chains are sent to the GDL Refiner) o A third-party Audit Report with clear conclusions on conformance; and o A Non-conformance Form (or management report) outlining risk-rated non-conformances with scheme requirements. The independent assurance does not guarantee onboarding /continuation of the supply chain. Refiners must review the information obtained, including the assurance deliverables to determine whether the results are in line with their risk appetite and/or apply the appropriate risk mitigation measures in Step 3. 18 Initiated means an audit site visit must have been completed by 31 December 2029. <!-- page 37 --> RESPONSIBLE GOLD GUIDANCE V.10 36 2.3.3 On-site visits Refiners must consider on-site visits 19 as a possible measure for EDD, particularly where risks are high-severity, information gaps persist and desk-based measures are insufficient. The decision to conduct or not conduct an on-site visit must be risk-based, documented and justified. On-site visits must follow the minimum requirements set out in the LBMA Refiners Toolkit. At a minimum, RGG10 requires on-site visits for all high inherent location and type of material risks for Mined Gold, Investment Gold and Melted Material,20 as outlined in Step 2.2.2. Where undertaken, the on-site visit must be at the location of the producing facility (i.e. mine sites for Mined Gold, production facility for directly sourced Investment Gold and Secondary Gold, and gold-supplying counterparty location for indirectly sourced Investment Gold and Secondary Gold). The on-site visit must be, at a minimum, but not limited to: • Conducted before any transactions occur or, at the least, within six months of the business relationship commencing. • Aimed at substantiating the documented KYC information. • Focused on investigating threat financing risks, as defined under Step 1.1, and the specific ESG risks from the supply chain due diligence findings. • Conducted by competent employees or independent third parties that are free of any conflict of interest with the supplier. Everyone conducting an on-site visit must commit to reporting truthfully and accurately. • Consult relevant internal and external stakeholders (for example, local or central authorities, upstream companies, international or civil society organisations, or affected third parties) to corroborate information, where applicable. • Fully and accurately documented in the Site Visit Report templates in the Refiners Toolkit. Refiners choosing to not use the template will be required to justify their position and must demonstrate that the requirements of the LBMA template have been captured in their chosen format. • Followed up, depending on the number and severity of issues identified and documented in the improvement plans. • Repeated within an appropriate risk-based periodic review cycle. Where on-site visits are not feasible or would not materially improve risk understanding, Refiners must apply alternative, proportionate measures to obtain equivalent assurance. 2.3.4 Residual Risk classification The outcome of Step 2, once EDD is complete, is expected to be a Residual Risk classification of supply chains and business relationships. Where Residual Risk remains high, risk mitigation is triggered, and Refiners must apply the measures outlined in Step 3. 19 Virtual site visits may be permissible where security concerns or other such circumstances make an on-site visit challenging, subject to prior approval by LBMA. Refiners must send an approval request at least one month prior to responsiblesourcing@lbma.org.uk, stating the name of the supplier and location of the site, the date of the scheduled assessment, a reason for virtual assessment, and whether an on-site visit has been conducted in the past or is being planned for the future. 20 Mandatory or voluntary third-party audits may have already covered the EDD requirements. In this case, it is not necessary for Refiners to also carry out on-site visits as long as the third-party audit incorporates an on-site assessment and scope to address all EDD requirements. <!-- page 38 --> RESPONSIBLE GOLD GUIDANCE V.10 37 Where Inherent Risk is high but Residual Risk is deemed acceptable, the Compliance Officer and/or the Board Committee should approve each new supply chain and should revisit each year the decision whether to continue with these business relationships or not. <!-- page 39 --> RESPONSIBLE GOLD GUIDANCE V.10 38 ## Step 3. Design and Implement a Management Strategy to Respond to Identified Risks The objective of Step 3 is for Refiners to evaluate and respond appropriately to the Residual Risks identified in Step 2. Where appropriate, Refiners should seek to exercise leverage and enhance supplier engagement to address the risk most effectively. Refiners should also enhance their own systems of information collection and transparency. Where known risks or founded suspicion of upstream suppliers sourcing from or linked to any party committing zero-tolerance or high-risk abuses are identified, the Refiner must immediately cease or suspend engagement with the counterparty.

## 3.1 Devise a risk management strategy for the identified Residual Risk Refiners must determine their own risk management strategies based on risk appetite and processes. Refiners must apply the following minimum criteria for risk mitigation. 3.1.1 Terminate relationship The Refiner must immediately stop refining gold, with due consideration for local and international legal requirements, where its EDD concludes that there are known instances of: • Money laundering. • Terrorist financing. • Serious human rights abuses. • Direct or indirect support to illegitimate non-state armed groups. • Fraudulent misrepresentation of the origin of minerals. The Refiner must report such instances to the appropriate authorities and to LBMA, where applicable, and in accordance with local and international legal requirements. 3.1.2 Suspend relationship The Refiner must suspend refining gold with due consideration for local and international legal requirements where its EDD concludes that: • There is a founded suspicion of: o Money laundering. o Terrorist financing. o Serious human rights abuses. o Direct or indirect support to illegitimate non-state armed groups. o Fraudulent misrepresentation of the origin of minerals. • There are reported catastrophic ESG impacts (as defined on page 8). <!-- page 40 --> RESPONSIBLE GOLD GUIDANCE V.10 39 In cases of suspension of a business relationship, it is recommended that the Refiner give due consideration to responsible disengagement practices.21 Refining may resume once additional information/data refuting the preliminary suspicions, or a timely and appropriate response to addressing the ESG impacts, has been obtained from the supplier. This must be approved by the Compliance Officer and/or the Board Committee. 3.1.3 Continue relationship with improvement plan Refiners may continue to source gold where the EDD is not fully satisfactory or where it concludes that the counterparty is using reasonable and good faith efforts despite instances of: • Bribery. • Non-fraudulent misrepresentation of the origin of minerals. • Non-compliance with taxes, fees and royalties due to government. • Material breaches of environmental, health, safety, labour and community-related local legislation, and/or ESG risks that have the high likelihood to result in highly adverse impacts (as defined on page [12]. In this case, the Refiner must require the counterparty to adopt an improvement plan which is: • Devised with the Refiner’s input and engagement. • Clearly documented, including performance objectives and quantitative and/or qualitative performance measurement indicators. Approved by the Compliance Officer and/or the Board Committee. Where the counterparty already has an action plan in place, the Refiner must review this to ensure it addresses the risk in line with RGG10 requirements and that it aligns with the Refiner’s risk appetite.

## 3.2 Monitor the improvement plan Where Refiners decide to continue relationships as counterparties implement an improvement plan, the principles of good faith efforts to make meaningful improvements in the supply chain must be adopted. The risk management strategies must include measurable steps to be taken by the counterparty, performance monitoring, periodic reassessment of risk and regular reporting to the Board Committee, as applicable. 3.2.1 Improvement plan monitoring The risk monitoring strategy must at a minimum: • Identify significant and measurable improvements towards eliminating the risk within six months from the adoption of the improvement plan. To facilitate monitoring activities, Refiners should, as appropriate: 21 OECD Responsible Business Conduct 2018: Consider disengagement from the supplier or other business relationship as a last resort after failed attempts at preventing or mitigating severe impacts; when adverse impacts are irremediable; where there is no reasonable prospect of change; or when severe adverse impacts or risks are identified and the entity causing the impact does not take immediate action to prevent or mitigate them. Any plans for disengagement should also take into account how crucial the supplier or business relationship is to the enterprise, the legal implications of remaining in or ending the relationship, how disengagement might change impacts on the ground, as well as credible information about the potential social and economic adverse impacts related to the decision to disengage. <!-- page 41 --> RESPONSIBLE GOLD GUIDANCE V.10 40 • Consult relevant stakeholders such as local or central authorities, upstream companies, international or civil society organisations, and affected third parties. After the six-month time frame, Refiners must: • Formally assess performance to determine that measures have been properly undertaken by the deadline (e.g. through independent audits, a follow-up on-site visit or remote review, as appropriate). • Review and document Residual Risk classification to ensure it does not require escalation. Refiners must consider: o Suspending the relationship where limited or no measurable improvement can be demonstrated within six months of the adoption of the improvement plan. Where no such measurable improvement is evident within six months, Refiners should suspend or discontinue engagement with the supplier for a minimum of three months; or o Terminating the relationship after failed attempts at risk mitigation and performance improvement. • Define additional measures in a revised improvement plan where progress has been achieved within the first six months and the current risk mitigation strategy remains valid. • Continue formal performance assessments and review of the risk mitigation strategy every six months, until de-escalation or termination. The Compliance Officer and/or the Board Committee must frequently revisit the decision to continue with business relationships under the risk mitigation strategy (i.e. annually, at a minimum).

## 3.3 Report findings to the Board Committee The Board retains ultimate control and accountability for the gold supply chain. Actual and potential risks identified in the supply chains and proposed risk management strategies must be communicated to the Board Committee. The Board must at a minimum receive information on the following: • Relevant statistics on high Inherent Risk supply chains. • Counterparty under risk mitigation strategies and status of risk mitigation strategies. • Reports on the progress and effectiveness of improvement plans.

## 3.4 Continuously monitor adequacy of risk management strategies Supply chain due diligence is a dynamic process and requires ongoing risk monitoring. After implementing a risk management strategy, Refiners must assess if Step 2 of this Guidance should be repeated or, for instance, if another on-site visit is required. Any changes in the supply chain may require the Refiner to repeat some due diligence steps to ensure effective management of risk. <!-- page 42 --> RESPONSIBLE GOLD GUIDANCE V.10 41 ## Step 4. Obtain Independent Third-Party Assurance on Supply Chain Due Diligence Practices The objective of Step 4 is for Refiners to have their supply chain due diligence policies and processes, applicable to each gold refinery, independently assured by an LBMA Approved Assurance Provider (AAP). The assurance is risk-based and requires AAPs to identify, assess and focus their assurance efforts on the areas most prone to risk.

## 4.1 Assurance requirements 4.1.1 Assurance objective The objective of the assurance is to enhance the intended users’ degree of confidence in the Refiner’s public Compliance Report and supplementary confidential reports as outlined in Step 5.1.3. Refiners must grant AAPs the requisite access to relevant sites, personnel, documentation (including previous years’ management reports) and data for them to perform their duties. AAPs are expected to express a conclusion on: • Whether the Refiner’s annual reporting (refer to Step 5 of this Guidance) fairly describes the Refiner’s activities. • The Refiner’s overall conclusion on meeting the objectives of the RGG. It is designed to enhance the intended users’ degree of confidence in the Refiner’s public Compliance Report and the confidential Country of Origin Annex. 4.1.2 Approved Assurance Provider independence and competency LBMA undertakes rigorous AAP approval and monitoring through a structured application and annual certification process, as described in the Third Party Assurance Guidance. LBMA has aligned assurance independence requirements to the EU mandatory audit firm rotation 22 and Refiners must rotate AAPs every ten years on a comply or explain basis. Where assurance firm rotation is not a viable option, the Refiner must at a minimum rotate the lead APP responsible for signing off on the engagement.23 Any exceptions, including instances where neither option is viable, must be approved by LBMA. The Board Committee is responsible for: • The appointment of a third-party AAP from the LBMA AAP List. • Ensuring that the APP is independent of the organisation. • Ensuring that the AAP has the requisite competencies, experience and capacity to carry out each specific engagement. 20 EU Statutory Audit Reform Directive 2014/56/EU3 and Regulation 537/2014. 23 The ten-year audit period begins on 1 January 2022. Rotated assurance firm or partner may be re-engaged after a period of ten years. <!-- page 43 --> RESPONSIBLE GOLD GUIDANCE V.10 42 4.1.3 Assurance standards LBMA will only accept an assurance engagement performed in accordance with the International Standard on Sustainability Assurance 5000 General Requirements for Sustainability Assurance Engagements (ISSA 5000), issued by the International Auditing and Assurance Standards Board (IAASB). ISSA 5000 replaces the ISAE 3000 revised standard for reporting years beginning 1 January 2027. A reasonable level of assurance should be carried out in year one of implementation or appointment of a new Assurance Provider. Refiners may select a limited level of assurance for the next two years only if medium-risk or high-risk, or indeed zero-tolerance, non-conformances are not identified during the reasonable or limited assurance engagements. Reasonable assurance is mandated every three years; however, Refiners may choose this level of assurance each year. The required assurance frequency should increase if instances of non-conformance are identified or if there is a significant change of circumstance in the Refiner’s supply chain. LBMA has prepared detailed Third-Party Assurance Guidance for the application of ISSA 5000 to this type of engagement (which is available on www.lbma.org.uk). Refiners should consult this document to support their preparation for the assurance engagements. 4.1.4 Assurance period Assurance of the Refiner’s conformance to the RGG is required on an annual basis (in accordance with the assurance standards section above) within three months of its financial year end and should cover the supply chain due diligence activities over a 12-month reporting period. 4.1.5 Assurance deliverables AAPs must use the AAP Toolkit. This is designed to provide AAPs with a standardised structure for assurance reporting. The assurance deliverables must include the reports described below: 1. Reasonable or Limited Assurance a) Independent (Reasonable or Limited) Assurance Report on the Refiner’s Compliance Report (Public) This report is addressed to the Refiner’s Board of Directors and states the AAP’s conclusion on the Refiner’s Compliance Report. It must be publicly disclosed alongside the Refiner’s Compliance Report, or it must be made clear how it can be accessed by intended users. b) Independent Limited Assurance Report on the Refiner’s Country of Origin Annex (Public) This report is also addressed to the Refiner’s Board of Directors and states the AAP’s conclusion on the information included in the Country of Origin Form. The Country of Origin Form is an annex to the Compliance Report; however, only a limited level of assurance is required on the data presented. c) Independent Assurance Reports on other subject matters LBMA may notify relevant Refiners of any additional assurance requirements as needed. A private management report may be issued by the AAP to the Refiner’s management to communicate detailed assurance findings. This is at the discretion of the AAP and the Refiner, including whether the Refiner wishes to share the private management report with LBMA. <!-- page 44 --> RESPONSIBLE GOLD GUIDANCE V.10 43 2. Quality Control Toolkit a) 1.1 – Pre-Assurance Briefing Form (Confidential) This form must be completed by the AAP. It provides details on the scope of engagement, the assurance team and the assurance planning procedures to identify risk areas. b) 1.2 – Final Deliverables Form (Confidential) This form must be completed by the AAP. It summarises the detailed testing and quality control procedures undertaken by the AAP to reach their conclusions. c) 1.3 – Non-Conformance Form (Confidential) This form must be completed by the AAP. It records non-conformances identified during an assurance engagement and documents the required corrective actions. Note 4: Consistency in assurance deliverables AAPs are expected to ensure sufficient transparency and consistency in the information presented in both the Refiner’s reporting and the assurance deliverables to meet the users’ needs. For example: • For an unqualified Assurance Report, the Compliance Report cannot conclude full compliance with the RGG when high-risk assurance non-conformances have been raised. • The Assurance Report must draw attention to the high-risk assurance non-conformances identified and confirm that they are disclosed in the Refiner’s Compliance Report. Further detail is provided in the Third-Party Assurance Guidance. 4.1.6 Submission of assurance deliverables to LBMA Copies of all deliverables must be submitted by the Refiner, or the AAP, as designated by the Refiner, to LBMA via the GBI Platform on an annual basis and within three months of the financial year end. Refiners must apply for an extension if it is not feasible to meet the submission deadline due to unforeseen circumstances. 4.1.7 Multi-site assurance and standards equivalence Where Refiners source multiple metals that are covered under LBMA’s and LPPM’s Responsible Sourcing Programmes, and are required to conform to the RGG, Responsible Silver Guidance (RSG) and the Responsible Platinum and Palladium Guidance (RPPG), a single multi-metal assurance engagement may be undertaken if the following criteria are met: • There is one multi-metal refinery processing all metals in scope. • The Refiner’s supply chain policies and management systems are consistent for all metals in scope. • The RGG is used as the basis for the multi-metal assurance engagement, i.e. all metals in scope should be assessed for threat finance risk and ESG factors. • Detailed sample testing adequately covers all metals in scope (further guidance is provided in the Third-Party Assurance Guidance). • Refiners provide sufficient disclosures on each metal in scope in the Compliance Report. <!-- page 45 --> RESPONSIBLE GOLD GUIDANCE V.10 44 • AAPs include sufficient information on each metal in scope in the Assurance Report or provide separate Assurance Reports for each metal in scope. Refiners may continue to commission separate assurance engagements against the relevant metal Guidance should they choose to. Where refineries are in different jurisdictions or sites, Refiners must undertake separate assurance engagements for each refinery. <!-- page 46 --> RESPONSIBLE GOLD GUIDANCE V.10 45 ## Step 5. Report Annually on Supply Chain Due Diligence The objective of Step 5 is for Refiners to publicly report on their gold supply chain due diligence policies, practices and performance for the reporting year, with appropriate regard for security, proprietary information, data protection regulations and the legal rights of the other supply chain actors. The purpose of this public disclosure is to build awareness and confidence in the Refiner’s measures to mitigate threat finance risks and to address adverse ESG factors in the Refiner’s mined and secondary gold supply chain.

## 5.1 Reporting Requirements 5.1.1 Reporting objective Step 5 reporting is expected to provide sufficient detail of the Refiner’s supply chain due diligence policies, management systems and risk assessment processes for users of the reporting to obtain a complete, accurate, timely and balanced view of the Refiner’s activities over the reporting period. Critically, the annual reporting must also detail actual performance during the year, including the results of the risk assessment and risk mitigation steps for users to understand the effectiveness with which the Refiner is meeting the objectives of the RGG. It is expected that annual reporting will be specific to the business circumstances in each particular year and reflect the dynamic due diligence process. 5.1.2 Reporting period Reporting on the Refiner’s conformance to the RGG must be submitted: • On an annual basis, covering the supply chain due diligence activities over a 12-month reporting period, aligned to the Refiner’s financial reporting period. • Within three months of the reporting year end. Refiners must apply for an extension if it is not feasible to meet the submission deadline due to unforeseen circumstances. 5.1.3 Reporting deliverables Refiners must submit the following reporting requirements set out below for each reporting period: 1. Supply Chain Policy (Public) Refiner’s Supply Chain Policy must be reviewed annually, and updated as necessary, to remain aligned with Step 1. The Policy document must be made publicly available on the Refiner’s website each time it is updated. 2. Refiner’s Compliance Report (Public) The Compliance Report must, as a minimum, meet the requirements outlined in the Disclosure Guidance Document. The Compliance Report must be submitted to LBMA via the GBI Platform and be made publicly available on the Refiner’s website when the Refiner receives an LBMA responsible gold certificate. Minimum information includes (but is not limited to): • Name of the Refiner and refinery. • Reporting period. • Summary of activities undertaken to conform to the RGG and meet the objectives of the Programme. • Refiner’s level of conformance with each of Steps 1 to 5 of the RGG. <!-- page 47 --> RESPONSIBLE GOLD GUIDANCE V.10 46 • Refiner’s overall conclusion on conformance with the RGG and the objectives of the Programme. • The steps taken to map the circumstances of the high-risk operations and supply chains (EDD), methodology, practices and information yielded by on-site visits, and actual or potential risks identified. • The steps taken to strengthen chain of custody or traceability systems for high-risk supply chains, risk mitigation strategies, monitoring and tracking of performance, and results of follow-ups after six months. • The number of instances where the Refiner has disengaged with suppliers and/or supply chains without disclosing the identity, except where the Refiner deems this acceptable in accordance with Applicable Laws. • The Refiner Transparency Roadmap disclosures as set out in the most recent version of the Disclosure Guidance. 3. Refiner’s Country of Origin Annex 24 • Annual Country of Origin Report (Public): Refiners must submit a Country of Origin Form, as an annex to the Compliance Report using the relevant template in the Refiners Toolkit and in conformance with the Disclosure Guidance, on an annual basis. • Periodic Reporting (Confidential): Refiners must also submit the cumulative Form to LBMA via the GBI Platform on a monthly basis. The monthly submissions may be used for trend analysis and analytically reviewed by LBMA and AAPs during the annual assurance process. However, only the full 12 months of reported data is subject to the annual assurance. 4. High Risk Supplier Form (Confidential) Refiners must submit a high Inherent Risk Supplier Form to LBMA using the relevant template on the GBI Platform. 5. Corrective Action Plan (Confidential) Refiners must complete a Corrective Action Plan (CAP) if a non-conformance has been identified during the assurance and/or if the Refiner fails to satisfy one or more of the requirements as set out in Steps 1 to 5 of this Guidance. This must be completed in accordance with the requirements set out in the AAP Toolkit Quality Control Form 1.3 – Non-Conformances. Refiners must implement Corrective Action Plans per the timelines set out below: • For high-risk non-conformances: o CAP implementations must start within one month following submission of the Refiner’s deliverables. o A follow-up assurance on the CAP must be completed within 90 days. • For medium-risk non-conformances: o CAP implementations must start within three months following submission of the Refiner’s deliverables. o Progress and resolution of the CAP must be reviewed during the following period’s assurance engagement, unless otherwise requested by LBMA. 24 Periodic Country of Origin reporting is expected to provide LBMA with early visibility of possible sanctions breaches, high-risk sourcing or anomalies in trends. LBMA reserves the right to investigate any potential red flags based on the information reported by GDL Refiners but does not guarantee the accuracy or completeness of this information. Annual Country of Origin reporting is expected to be assured for completeness and accuracy by Approved Assurance Providers. <!-- page 48 --> RESPONSIBLE GOLD GUIDANCE V.10 47 • For low-risk non-conformances: o CAP implementation must be addressed as part of normal business practice and continuous improvement commitments. o Progress and resolution of the CAP must be reviewed during the following period’s assurance engagement. The Corrective Action Plan must be submitted to LBMA but is not required to be made publicly available. 6. Breaches and incidents must be reported to LBMA In addition, Refiners must report any of the following to LBMA, with due consideration of local and international legal requirements: • Zero-tolerance non-conformances identified during the Refiner’s due diligence processes in suppliers or supply chains already onboarded. • Zero-tolerance non-conformances identified during the Refiner’s assurance process. • AAPs with whom the Refiner has decided to cease engagement as a result of performance issues. Actions taken for emerging incidents: LBMA may contact Refiners for proactive reporting in the event of a catastrophic or high-impact incident identified through adverse news and/or market intelligence. Refiners must complete and submit an Incident Reporting Template or a written response per requested format and timeline to LBMA. Information provided to LBMA in relation to emerging incidents must be considered by the AAP in their annual assurance process. Refiners are expected to disclose material incidents and risk responses in their Compliance Report, in accordance with the Disclosure Guidance, subject to confidentiality and Applicable Laws.