Principles of governance

Corporate responsibility management and good governance

• Sustainability, consisting of both corporate responsibility and ESG integration in all business areas, is managed in a structured way at Aktia. Sustainability is an integrated part of all Aktia operations. Sustainability matters are also on the agendas of Aktia’s Executive Committee and Board of Directors. On the Board level, the Audit Committee oversees ESG development and the corporate responsibility programme. Depending on the issue, some matters are also approved by the Boards of Directors of the relevant subsidiaries within the Group. 
• The Sustainability Director is responsible for sustainability development at Aktia together with a team of corporate responsibility and ESG professionals. The director reports to the Executive Vice President, Group Functions. However, the scope of the team’s responsibility covers all Group activities.
• The management, indicators, and results of corporate responsibility and ESG work are regularly assessed by the Executive Committee and the Board of Directors. The sustainability work is guided by the Group’s sustainability programme and Aktia’s climate strategy, both of which support the selected UN Sustainable Development Goals. The strategy focuses on long-term sustainability targets and actions whereas the sustainability programme is the short-term action plan for advancing sustainability. 
• The development of Aktia’s sustainable investing efforts is headed by the director for sustainability. The ESG Committee of our Asset Management business coordinates the implementation of Aktia’s ESG policy, stewardship policy, actions, and initiatives, as well as ESG analyses and sustainability outcomes of investments. The ESG Committee consists of experts in sustainable investing. 
• The development of responsible lending activities is done in co-operation between the Banking business area and the Group-wide ESG team. The demand for responsible lending is growing and we see new business opportunities arising in this field.
   

Information and cyber security 

As a critical organisation for emergency supply within the financial sector, information security, data protection and the protection of customer data is of paramount importance to us and key factors in maintaining customer trust. The work to maintain and promote information security and data protection at Aktia is employee-based, comprehensive (People, Processes, Places and Products/Technology), long-term, and integrated into all our activities.

In order to comply with regulations from the Finnish Financial Supervisory Authority, the European Banking Authority and different legislative requirements, including GDPR and its national derivates, DORA and the NIS1/NIS2 directive, Aktia has chosen the ISO/IEC 27001 framework as a basis of its information security management system (ISMS). Our ISMS is fully integrated into our overall management system including established guidelines for information security and data protection. ISMS covers all business areas at Aktia and all employees are responsible for compliance with the rules for protection of information, and all managers and named owners are responsible for compliance with the rules in their own area of responsibility.

Aktia heavily invests resources to making sure that all Aktia services are adhering to security by design, and privacy by design principles, and that the provided services are tested and secure. These services are thoroughly security tested on a continuous, on-going regular basis by external parties that are experts in security testing. 

Aktia implements a comprehensive approach to security, which means that Aktia implements security on many levels, according to so called defense-in-depth principle, and performs regular security tests on its services, processes, and infrastructure by third-party experts that utilize industry best practices and that use cutting edge security tooling and proven methodologies. By performing regular comprehensive security and penetration testing against its services and systems and by utilizing proven state of the art security tools for monitoring, Aktia can monitor its overall security posture for effectiveness and address potential improvements needs.

Security and privacy are core values of Aktia, the security of Aktia’s services is constantly being developed and scrutinized, and this is reflected in the security and awareness training that Aktia mandates from its personnel, and in the high level of security of the services that Aktia provides to its customers.

Corporate responsibility policies and guidelines

Aktia’s sustainability work is guided by the Group’s sustainability programme and climate strategy, which support the selected UN Sustainable Development Goals. Our main policies and principles are Codes of Conduct for Aktia's employees and suppliers, the sustainability programme, climate strategy, climate policy, WWF’s Green Office principles, principles for responsible investment, anti-bribery policy, occupational health and wellbeing programme (Aktia Wellbeing), diversity policy, disclosure policy, and the principles for responsible lending. Aktia also complies with laws, regulations and good banking and insurance practice. To protect employees, Aktia has a whistleblowing channel for reporting actual or suspected unethical business practices. Training is organised around relevant themes to raise awareness of sustainability and foster the commitment of the organisation to corporate responsibility work.

• Aktia Groups' Code of Conduct
• Aktia Group’s Ethical code of conduct for suppliers
• Aktia Group’s Climate policy
• Aktia Group’s Green Procurement Guidelines
• Aktia Group's Health and safety policy
• Aktia Group's diversity & non-discrimination policy
• Aktia - Responsible investment policy
• Aktia - Statement on sustainability risks and factors
• Aktia's Stewardship Policy
• Aktia - Statement on principal adverse impacts of investment decisions on sustainability factors