Compliance Policies

Amris Aviation Limited (“Amris”) does not offer, give, request or accept bribes, in any form, anywhere, for any reason. This applies without exception, including where a payment is said to be customary, where it is small, or where refusing it may cost Amris business.

This policy applies to every director, employee, officer, contractor, mentor, consultant and agent of Amris, and to anyone performing services for or on behalf of Amris, wherever located.

Amris also expects its partner training organisations and other business partners to maintain standards consistent with this policy, and records that expectation in its agreements with them.

Amris complies with all anti-corruption laws applicable to its business, including in particular:

• the Criminal Justice (Corruption Offences) Act 2018 (Ireland);
• the Bribery Act 2010 (United Kingdom);
• the Foreign Corrupt Practices Act (United States);
• the United Nations Convention against Corruption; and
• the anti-corruption laws of each country in which Amris operates or whose nationals it trains, including the Law of the Republic of Kazakhstan dated 18 November 2015 No. 410-V “On Combating Corruption” where that law applies.

No person covered by this policy may, directly or through a third party:

• offer, promise, give, request, agree to receive or accept any financial or other advantage intended to induce or reward the improper performance of a function or activity;
• make a facilitation payment — a small unofficial payment to secure or speed up a routine action to which Amris is already entitled. Facilitation payments are prohibited without exception;
• offer or accept a kickback, commission or rebate that is not recorded transparently in a written agreement;
• seek to influence the selection, assessment, grading or recruitment decision of an airline, training organisation, examiner or regulator by any improper means; or
• use a consultant, introducer or agent to do anything this policy prohibits Amris from doing itself.

Modest and proportionate business hospitality is a normal part of the aviation training industry, and Amris attends industry events at which hospitality is offered and given. Hospitality is permitted only where it is reasonable in value and purpose, given openly and not in secret, properly recorded, and incapable of being understood as an attempt to influence a decision.

Hospitality or a gift with an estimated value above EUR 150 requires the prior approval of the President & CFO and is entered in the gifts and hospitality register.

No gift or hospitality may be offered to, or accepted from, any person involved in an active selection, assessment or procurement decision concerning Amris.

Cash and cash equivalents are never given or accepted.

Amris and its partner training organisations interact with civil aviation authorities, examiners and other public bodies. Particular care is required: nothing of value may be offered to a public official, examiner or their family, and all interactions must be capable of withstanding public scrutiny.

Before engaging a partner training organisation, introducer, agent or consultant, Amris carries out proportionate due diligence on that party, including sanctions and adverse media screening and an assessment of corruption risk. Engagements are recorded in writing, describe the services actually to be provided, and provide for remuneration that is proportionate to those services.

All payments, expenses, gifts, hospitality and third-party engagements are recorded accurately and in reasonable detail. No false, misleading or incomplete record may be created, and no off-the-record account or arrangement of any kind is permitted.

Anyone who suspects that this policy has been or may be breached must report it promptly under the Amris Speak Up (Whistleblowing) Procedure, or by email to info@amrisaviation.com. Amris does not tolerate retaliation against anyone who raises a concern honestly, and a person who refuses to pay or accept a bribe will never be penalised for doing so, even if Amris loses business as a result.

The Executive Chairman is responsible for this policy. Day-to-day ownership sits with the President & CFO. Breach of this policy is a serious matter and may result in disciplinary action up to dismissal, termination of a contract for services, and referral to the relevant authorities.

This policy is reviewed by the Executive Chairman annually, and on any material change to the business such as entry into a new jurisdiction or the addition of a new partner training organisation or airline customer.

Amris trains and places pilots internationally and licenses software to airlines in several regions. This policy sets out how Amris ensures that it does not breach applicable trade or economic sanctions, embargoes or export controls, and how it satisfies itself about the parties it deals with.

Amris complies with the sanctions and trade control laws applicable to it and to its counterparties, including those of:

• the European Union and its member states, including Ireland;
• the United Kingdom, including measures administered by the Office of Financial Sanctions Implementation (OFSI);
• the United Nations; and
• the United States, including measures administered by the Office of Foreign Assets Control (OFAC).

Where regimes differ, Amris applies the most restrictive requirement that applies to the transaction.

Amris does not, directly or indirectly:

• deal with any person, entity or vessel designated under an applicable sanctions regime (a “Sanctioned Person”), or with any party owned 50% or more, or controlled, by a Sanctioned Person;
• conduct business in or with a country or territory subject to comprehensive sanctions (a “Restricted Jurisdiction”), currently including Cuba, Iran, North Korea, Syria, the Crimean Peninsula and the non-government-controlled areas of the Donetsk, Luhansk, Kherson and Zaporizhzhia regions of Ukraine;
• engage any Sanctioned Person or party in a Restricted Jurisdiction in the performance of a customer contract; or
• participate knowingly in any arrangement whose purpose or effect is to circumvent a sanctions prohibition.

Before entering into a relationship with an airline customer, a partner training organisation, an agent, an introducer or a material supplier, Amris screens that party — and, so far as reasonably ascertainable, its major shareholders, governing body members and payment bank — against:

• the EU Consolidated Financial Sanctions List;
• the UK Sanctions List and the OFSI Consolidated List; and
• the US OFAC Specially Designated Nationals and Blocked Persons (SDN) List.

Screening is repeated periodically for continuing relationships, and whenever Amris becomes aware of a change in ownership, control or designation. Results are recorded and retained.

The following require escalation to the President & CFO before the matter proceeds:

• a counterparty, beneficial owner or bank connected with a Restricted Jurisdiction;
• a request to route payment through an unrelated third party or an unexpected jurisdiction;
• reluctance to disclose ownership or ultimate beneficial ownership;
• a request to provide training, data or software access to an undisclosed end user; or
• any indication that Amris services or software may be onward supplied to a Sanctioned Person or Restricted Jurisdiction.

Amris supplies training services and licenses the Amris AI platform. Before granting software access or transferring technology to a new jurisdiction, Amris considers whether any export control restriction applies to that transfer, including in respect of the nationality and location of the individuals who will have access. Amris does not permit access by, or supply to, parties on applicable restricted-party or export control lists.

Amris receives and makes payment only through accounts in its own name at regulated banks in jurisdictions not subject to comprehensive sanctions. Amris does not accept payment from, or make payment to, a third party unconnected with the contract.

If Amris, a shareholder, a member of its governing body, or its payment bank becomes subject to a sanctions designation, Amris will notify the affected customer in writing promptly and describe the effect on its ability to perform.

Suspected breaches must be reported immediately to the President & CFO or through the Speak Up Procedure. The Executive Chairman owns this policy; the President & CFO maintains the screening records. The policy is reviewed annually and whenever an applicable sanctions regime changes materially.

A policy that nobody has read is not a control. This policy sets out the compliance training Amris provides, to whom, how often, and how completion is recorded and evidenced to customers.

All directors, employees, contractors, mentors and consultants of Amris must complete compliance training on appointment, before they begin work, and annually thereafter.

Training covers, proportionate to the person’s role:

• the Anti-Bribery and Corruption Policy, including gifts and hospitality, facilitation payments, and the particular risks arising in student selection and placement;
• the Sanctions and Export Control Policy, including counterparty screening and red flags;
• the Data Protection Policy, including the handling of student and candidate training records and the consent requirements that apply before records are shared with an airline;
• modern slavery and human trafficking awareness, focused on student recruitment and the use of agents; and
• the Speak Up (Whistleblowing) Procedure and how to use it.

Where a customer contract requires Amris personnel to be acquainted with that customer’s own compliance policies, Amris circulates those policies to the individuals engaged on the contract, obtains their acknowledgement, and records it. Amris can evidence that acknowledgement to the customer on request.

The President & CFO maintains a training register recording each person’s name, role, the training completed, the date of completion and the date their next refresher falls due. Records are retained for six years.

Where training is not completed when due, the President & CFO escalates to the Executive Chairman. A person who has not completed required training may be withdrawn from customer-facing work until it is completed.

This policy, and the training content, are reviewed annually and updated whenever a policy it covers is amended.

Amris identifies, assesses and controls the corruption risks arising in its business, and records them in a corruption risk register. This policy describes the method. The register itself is an internal document, maintained by the President & CFO and available to customers on request.

For each identified risk Amris records the activity giving rise to it, an assessment of likelihood and impact, the controls in place, the person accountable, and the residual rating after those controls. Risks rated high on a residual basis are reported to the Executive Chairman with a remediation plan.

The register is reviewed at least annually. It is also reviewed on any material change to the business, including entry into a new jurisdiction, the addition or removal of a partner training organisation, the engagement of a new agent or introducer, and the signature of a new airline customer agreement.

The register is presented to the Executive Chairman at the annual review, together with any changes since the previous review and the status of remediation actions.

Amris wants to hear about wrongdoing, and would always rather hear about it early and internally. This procedure explains how to raise a concern, what happens next, and the protection available to the person who raises it.

Anyone may use it: directors, employees, contractors, mentors and consultants of Amris, and also students, graduates, partner training organisations, airline customers, suppliers and members of the public.

• Bribery, corruption, kickbacks or facilitation payments.
• Breach of sanctions or export controls.
• Fraud, theft or falsification of records, including training records.
• Misuse or unauthorised disclosure of personal data.
• Modern slavery, human trafficking, forced labour or exploitation of students.
• A danger to the health or safety of any person, including anything compromising flight safety or the integrity of training and assessment.
• An undisclosed conflict of interest.
• Any attempt to conceal any of the above, or retaliation against someone who has raised a concern.

A concern may be raised by any of the following routes. There is no requirement to use the first before the others.

• By email to info@amrisaviation.com, which is monitored by the President & CFO.
• Directly to the President & Chief Financial Officer.
• Directly to the Executive Chairman.

Where the concern relates to a member of senior management: if the concern involves the President & CFO, it should be raised with the Executive Chairman. If it involves the Executive Chairman, or if the person raising it would prefer not to approach either, it may be raised with any other member of the Board, or with Amris’s external legal advisers, who will bring it to the Board without disclosing the identity of the person raising it unless that person agrees.

A concern may also be raised with a statutory body. Nothing in this procedure, in any Amris policy, or in any contract or settlement, prevents any person from making a protected disclosure under the Protected Disclosures Act 2014 (as amended) or from reporting a matter to a regulator, the Garda Síochána or any other competent authority.

Amris treats the identity of a person raising a concern as confidential, and discloses it only where required by law or where it is strictly necessary for a fair investigation and the person has been told. Anonymous reports are accepted and investigated so far as the information allows, although an anonymous report is harder to investigate and the outcome cannot be reported back.

Amris does not tolerate any detriment to a person who raises a concern honestly, whether or not the concern turns out to be well founded. Retaliation is itself a disciplinary matter. A person who deliberately makes a false report in bad faith is a different matter and may face disciplinary action.

• Receipt is acknowledged in writing within five business days, where contact details are available.
• An initial assessment is made within ten business days to decide whether a formal investigation is required.
• Where an investigation is required, a person independent of the matter is appointed to conduct it, and it is conducted confidentially and proportionately.
• The person raising the concern is told the outcome so far as confidentiality, data protection and the rights of others allow.
• Where wrongdoing is found, Amris takes corrective action, which may include disciplinary action, termination of a contract, recovery of funds and referral to the authorities.

A confidential record of each concern, the steps taken and the outcome is maintained by the President & CFO and retained for six years. A summary of reports received, anonymised, is presented to the Executive Chairman annually together with the review of this procedure.

This statement sets out the steps Amris Aviation Limited has taken to ensure that slavery and human trafficking are not taking place in its business or its supply chain. Amris is below the turnover threshold at which a statement is mandatory under section 54 of the Modern Slavery Act 2015 (United Kingdom). It makes this statement voluntarily, applying the principles of that Act, and will keep the position under review as the business grows.

Amris provides mentoring, evidence-based training oversight and career preparation to student pilots; consultancy to airlines and training organisations on evidence-based and competency-based training; and an AI platform for the analysis of training data. Flight training itself is delivered by approved partner training organisations.

The Amris supply chain is short and consists principally of:

• approved partner training organisations in Switzerland, Greece and the United Kingdom;
• individual mentors, instructors and consultants engaged directly by Amris;
• technology and software suppliers; and
• professional advisers.

Amris assesses the overall risk of modern slavery in its own operations as low: its people are a small number of skilled aviation professionals, engaged directly and paid above market norms into bank accounts in their own names.

The area warranting attention is student recruitment. Amris trains students from many countries, and international recruitment into aviation training can involve agents who charge fees to candidates. The risks are debt bondage arising from training-related indebtedness, the charging of improper recruitment fees, and the misrepresentation of terms to candidates who are far from home. Amris treats this as the principal area for diligence.

• No person working for or with Amris is subject to forced, bonded, compulsory or child labour, and no person’s identity documents are retained by Amris.
• Amris does not charge recruitment fees to candidates for the opportunity to be presented to an airline, and does not permit a third party to charge such a fee on its behalf. Fees charged for training are disclosed in writing before a student commits.
• Employment and engagement terms are set out in writing, in a language the individual understands, before work or training begins.
• Where an airline requires a cadet to pay a training bond or deposit, Amris ensures the terms are disclosed to the candidate in writing before application, and will raise with the airline any term that appears to create an improper dependency.
• Partner training organisations are expected to apply equivalent standards, and Amris will cease to present graduates from any organisation that does not.

Modern slavery risk is considered as part of the due diligence Amris carries out before engaging a partner training organisation, agent or material supplier. Awareness of modern slavery indicators, focused on student recruitment, forms part of the annual compliance training described in the Compliance Training Policy.

Concerns may be raised through the Speak Up (Whistleblowing) Procedure or by email to info@amrisaviation.com, by anyone, including students and candidates.

This statement is signed by the Executive Chairman of Amris Aviation Limited. It is reviewed and reissued annually.

Amris processes personal data about student pilots, graduates, employees, contractors and the staff of its customers. This policy sets out how that data is handled, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation) and the Data Protection Act 2018 (Ireland).

• Students and graduates of the Amris Mentored ATPL Program: identity and contact details, licence and qualification status, ATO training records, psychometric assessment results, learning-style profiles, and the Baseline, In-Training and End-of-Training reports produced by Amris.
• Candidates presented to airline customers: the Candidate Pack, comprising the ATO training records summary, the Amris End-of-Training report and the recommendations supporting the candidate.
• Employees, contractors and mentors: engagement, payment and training records.
• Customer and supplier contacts: business contact details.

Where Amris becomes aware of information relating to a person’s health, including medical certificate status, it is treated as a special category of personal data and processed only where a condition under Article 9 GDPR applies.

Amris processes personal data lawfully, fairly and transparently; for specified and legitimate purposes only; limited to what is necessary; accurately and kept up to date; for no longer than necessary; and with appropriate security. Amris is accountable for demonstrating this.

• Performance of a contract, for the delivery of the Mentored Program to a student.
• Explicit written consent, obtained from each graduate before their training records, Amris reports or recommendations are shared with any airline. Consent is specific to the airline concerned, is recorded, and may be withdrawn.
• Legitimate interests, for the administration and improvement of the Amris programme and platform, where balanced against the rights of the individual.
• Legal obligation, where retention or disclosure is required by law.

Where Amris presents a candidate to an airline, Amris and the airline each determine their own purposes for the candidate’s data and act as independent controllers. Neither is a processor for the other. Amris requires each airline to use candidate data solely for assessment and recruitment, and not to retain the data of unsuccessful candidates beyond its own retention policy.

Amris operates internationally and personal data may be transferred outside the European Economic Area. Where it is, Amris puts an appropriate transfer mechanism in place before any transfer occurs, and no personal data is transferred until that mechanism is in place. Where the destination country does not benefit from an adequacy decision, Amris relies on Standard Contractual Clauses together with a transfer risk assessment, or another valid mechanism.

Amris applies technical and organisational measures proportionate to the risk, including access controls on a need-to-know basis, encryption of data in transit and at rest in the Amris platform, authentication controls, logging of access to training records, secure disposal, and compliance training for everyone with access to personal data.

Where Amris engages a supplier to process personal data on its behalf, it does so under a written contract imposing obligations equivalent to those Amris owes, and satisfies itself as to that supplier’s security measures and transfer arrangements before engagement.

Training records and Amris reports are retained for the period necessary to support the individual’s career and to meet legal and regulatory obligations, and are then deleted or anonymised. Candidate data held in connection with an unsuccessful application is deleted in accordance with the retention schedule maintained by the CEO.

Individuals have the right to be informed, of access, to rectification, to erasure, to restriction, to data portability, to object, and not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects.

Automated processing. The Amris platform analyses training data and produces reports, grades and recommendations. These are decision support, not decisions. Every Amris report is reviewed and approved by a qualified human instructor or examiner before it is relied upon, and no student is graded, recommended or rejected by automated means alone.

Requests should be sent to info@amrisaviation.com and are answered within one month.

Any suspected breach must be reported immediately to the CEO and the President & CFO. Amris notifies the Data Protection Commission within 72 hours of becoming aware of a breach where the breach is likely to result in a risk to the rights and freedoms of individuals, notifies affected individuals without undue delay where the risk is high, and notifies any affected customer promptly. A record of every breach, including those not notified, is maintained.

The Executive Chairman is accountable for data protection. Day-to-day responsibility sits with the CEO, supported by the President & CFO. Amris is not currently required to appoint a Data Protection Officer and keeps that assessment under review. This policy is reviewed annually and on any material change to the nature of processing.