Impact, risk, and opportunity management

Material business conduct-related impacts, risks, and opportunities (IRO-1)

PUMA performs assessments to confirm existing risks or identify new risks and their impact when it comes to business conduct. In considering the nature of our business, the locations of our sales entities and sourcing facilities, we focus on the following compliance risk areas: bribery, corruption, money laundering, fraud, conflicts of interest, anti-competitive behaviour, human rights violations, and environmental damage. When we examine the impact of risks, we look at the impact on our business operations, financial performance, and reputation. The result of each risk assessment is a risk matrix that we use to prioritise identified risks based on their likelihood and impact. This helps us focus resources on managing the most critical risks. This process not only allows risks to be spotted, it also allows opportunities to be addressed.

With respect to our business partners from whom we source our core products, we identify risks by conducting thorough due diligence, which involves sanctions and reputational checks, and examination of their sustainability policies and ethical practices. The level of scrutiny applied to each business partner varies and we prioritise based on the country risk, industry risk, and volume of business.

The details of the process of identifying of business conduct-related material topics are explained in the Process to identify material impacts, risks and opportunities (IRO-1) section.

Strategy

PUMA’s strategy for business conduct is built on fostering a strong corporate culture of integrity, transparency, and accountability. PUMA maintains a compliance management system with policies designed to prevent corruption and support ethical standards. Supplier relationships are managed through ongoing engagement, regular assessments, and capacity-building to help ensure alignment with PUMA’s Code of Conduct and responsible purchasing practices. PUMA promotes responsible behaviour through training, accessible grievance mechanisms, and whistleblower protections, ensuring that ethical practices are embedded throughout its operations and supply chain.

Corporate culture and business conduct (G1-1)

Working at PUMA means that we operate in a legal, fair, respectful and ethical manner in all that we do. We want our employees and business partners to be proud to work with us. We follow the UN Global Compact principles and strive to meet all relevant laws and standards across a wide range of countries and cultures, even when challenges arise. Given the many international and multicultural landscapes in which PUMA operates, the ‘right thing to do’ may not always be obvious or easy to identify.

To understand the role each person plays in maintaining our ethical standards, PUMA has issued a Code of Ethics which introduces PUMA’s values and guiding principles. Our values shape our identity as a company and affirm what we stand for. For us, success is not success if it is achieved through breaking the law, deceiving, or cheating.

We will not tolerate breaches of law or our internal policies. We expect our employees at every level of our organisation and business partners in every country to act with fairness and respect, celebrate diversity, act with integrity and take accountability for our work and the resources entrusted to us.

PUMA Code of Ethics

Our fundamental principles for conduct and decision-making are key themes embedded in our Code of Ethics. These include among others:

• Respect for human rights
• Providing a safe work environment
• Respecting intellectual property
• Using assets responsibly
• Working towards a sustainable future
• Selecting our business partners carefully
• Rules to avoid conflicts of interest
• Avoiding insider trading
• Preventing money laundering
• Trade and sanctions compliance
• Competitive behaviour to comply with antitrust laws
• Anti-corruption and anti-bribery rules
• Confidentiality protection
• Speaking up against actual or suspected misconduct

The PUMA Code of Ethics is a key guideline that helps employees and business partners to understand PUMA's values and forms part of their respective contractual agreements. As part of the onboarding process, new employees participate in orientation sessions that introduce PUMA’s culture, values, mission, and expectations. This approach helps new employees become familiar with PUMA values and expectations.

Corporate culture is assessed through a structured review of compliance maturity, including evaluation of employee familiarity with policies, use of the Gift Register, awareness of our public electronic whistleblowing platform SpeakUp, and conflict of interest disclosures. PUMA Group entities must undertake annual compliance risk assessments and internal audits to determine if controls are sufficient and policies remain effective. Additional measures include monitoring training completion rates, tracking compliance violations, conducting business partner due diligence, and implementing awareness initiatives. The internal audit function supports compliance by reviewing the effectiveness of compliance controls, policies, and procedures across the organisation in selected entities according to its audit plan. If the audit team identifies any incidents or risks, these findings are escalated to Group Compliance for independent investigation and follow-up. This systematic approach fosters ethical standards, transparency, and continuous improvement and strong risk management.

To better understand how PUMA embeds its corporate culture throughout the organisation, it is essential to examine the core elements that collectively promote ethical behaviour, integrity, and accountability. PUMA’s approach includes a Compliance Management System (CMS), a set of policies that reinforce the Code of Ethics, an annual work plan featuring targeted training modules and awareness initiatives, a whistleblowing mechanism with structured case-handling procedures, and a process for reporting to governing bodies that facilitates oversight and continuous improvement. Each of these components plays a distinct role in shaping and sustaining the company’s corporate culture.

The role of the administrative, supervisory and management bodies (G1-1)

PUMA’s governing bodies are committed to acting in accordance with applicable laws and the company’s self-imposed standards of ethical conduct across all business activities. The Management Board bears overall responsibility for implementing an appropriate and effective CMS, which is central to PUMA’s integrity framework.

To fulfil this responsibility, the Management Board is supported by a dedicated Group Compliance function, comprising the Chief Compliance Officer, who reports directly to the CEO, ensuring a direct line of accountability and strategic alignment, and who will report quarterly to the Audit Committee of the Supervisory Board and the Management Board, covering the status of the CMS and any significant violations.

The members of the Management Board are obliged to disclose conflicts of interest to the Chair of the Supervisory Board and to the CEO without undue delay and to inform the other members of the Management Board accordingly. They may only assume sideline activities, in particular supervisory board and comparable mandates outside the PUMA Group, with the prior consent of the Supervisory Board. If a conflict of interest would occur each member of the Supervisory Board informs the Chair of the Supervisory Board without undue delay.

PUMA requires its leadership to possess the necessary expertise in business conduct. Members of the Management Board and shareholder representatives on the Supervisory Board bring extensive experience from international corporations, with proven track records in establishing sound governance frameworks. Furthermore, all Management Board members are required to complete training on the PUMA Code of Ethics, reinforcing their commitment to ethical leadership.

To mirror the involvement of governing bodies in compliance matters at the local level, PUMA appoints Local Compliance Officers (LCOs). This structure reinforces the role of local Management Bodies in supporting compliance efforts, with LCOs responsible for the communication, implementation, and documentation of compliance-related activities.

Compliance Management System (CMS)

PUMA has established a CMS to systematically prevent, detect at an early stage and sanction violations in the areas of human rights, environment protection, corruption, money laundering, conflicts of interest, antitrust law, fraud, embezzlement, or any other breach of the Code of Ethics. The CMS helps us to operate within legal and regulatory boundaries while fostering ethical behaviour and it is structured around three core pillars:

• Prevent: Compliance risks are identified and assessed through annual and ad hoc risk assessments. Based on these insights, targeted policies and training programmes are developed to mitigate risks. A consistent ‘Tone from the Top’ reinforces the importance of ethical conduct and serves as a key preventive measure.
• Detect: Through SpeakUp, both internal and external stakeholders can raise concerns for us to further investigate. In addition, external stakeholders have access to third-party complaints mechanisms. All these mechanisms provide assurance that concerns can be raised confidentially and will be handled appropriately.
• Respond: Compliance violations are addressed with proportionate actions based on the severity of the case. These may include disciplinary measures, remediation plans, awareness campaigns, or adjustments to training content and cycles to reflect newly identified risks. Case studies and clear guidance are used to reinforce learning outcomes and prevent future incidents.

The CMS is managed by Group Compliance, which operates independently, together with our LCOs in all subsidiaries to offer certainty that employees in the Group comply with PUMA’s values. LCOs serve as key points of contact for employees, providing guidance through targeted communication measures and managing compliance-related incidents. To foster collaboration and consistency across the company’s compliance network, quarterly virtual meetings are held with LCOs.

As outlined in the preceding section, the Chief Compliance Officer delivers quarterly reports regarding the status of the CMS to both the Audit Committee of the Supervisory Board and the Management Board.

Policies

PUMA has established a set of policies that guide responsible business conduct. These policies serve as a foundation for responsible corporate behaviour and are designed to prevent misconduct, promote integrity, and reinforce compliance with applicable laws and international standards. Our policies are intended to be understandable, accessible, and applicable to various local contexts. They are mandatory for all PUMA entities and subsidiaries. The policies provide a standardised foundation for ethical conduct across different regions. When local laws have similar aims but vary in scope, the provisions that impose more comprehensive or specific protections will take precedence.

Each policy is formally released by the CEO to all employees, reinforcing the importance of ethical conduct through a strong ‘Tone from the Top’. Policies are distributed via email and made accessible through the PUMA SharePoint. Additionally, each policy names a designated contact person who provides guidance on interpretation and implementation. Unless otherwise indicated, there were no changes to the policies in 2025.

Code of Ethics

PUMA’s Code of Ethics outlines PUMA’s core ethical principles for employee conduct, emphasising legality, fairness, respect, and integrity. It promotes values such as accountability and a strong commitment to diversity and inclusion, supported by key guiding principles. This policy applies to both PUMA’s own operations and its upstream activities. The Compliance department is responsible for its implementation, and it is published on the company website and the internal PUMA SharePoint.

Human Rights Policy

This policy affirms PUMA’s commitment to upholding human rights across its operations and supply chain. It establishes a robust due diligence framework aimed at identifying, preventing, mitigating, and remediating actual and potential adverse impacts on people and the environment linked to business activities. The policy covers both own operations and upstream activities, with implementation led by the Compliance, P&O, and sustainability teams. It is available on the website and PUMA SharePoint. During 2025, this Policy statement was updated to incorporate changes aligning with the requirements of the German Supply Chain Due Diligence Act (LkSG).

Human Rights Guideline

This guideline sets out fundamental principles for respecting human rights through a top-down approach. It details applicable requirements, controls, and measures to be implemented by all PUMA entities, with the primary goal of safeguarding employee rights. The guideline is anchored in international standards such as the UN Guiding Principles on Business and Human Rights (UNGPs), ILO Core Conventions, UN Global Compact, and OECD Guidelines for Multinational Enterprises. It applies to own operations and is implemented by Compliance and P&O and published on the website and PUMA SharePoint.

Code of Conduct

The Code of Conduct defines the social and environmental standards expected of PUMA’s business partners. It requires adherence to international human rights standards, compliance with applicable laws, and avoidance of any unlawful activities. The policy aims to protect the rights of employees and stakeholders affected by business partners’ operations. It applies to upstream activities and is implemented by Compliance and Supply Chain Sustainability. The policy is published on the website and PUMA SharePoint. During 2025, the Code of Conduct was updated to incorporate changes aligning with the requirements of the LkSG.

Anti-Corruption and Anti-Bribery Policy

This policy establishes a framework designed to support compliance with national and international anti-bribery and anti-corruption laws. It seeks to prevent any perception of undue influence in PUMA’s business relationships with third parties. The policy is developed based on the UN Convention against Corruption and is intended to help mitigate risks such as penalties, financial loss, and reputational damage. It applies to own operations and is implemented by Compliance, and published on PUMA SharePoint. This policy will be reviewed in 2026.

Anti-Money Laundering Policy

This policy offers guidance and rules for situations where there is a risk of inadvertent involvement in money laundering or terrorist financing. It applies to own operations and is overseen by Compliance. The policy is published internally via PUMA SharePoint.

Business Partner Due Diligence Policy

The policy sets rigorous standards for working with partners from diverse legal and cultural backgrounds. It requires partners to avoid corruption, pay taxes, respect human rights, and protect the environment. The policy outlines onboarding and monitoring procedures, with high-risk partners subject to additional compliance due diligence. It applies to own operations and upstream activities, is implemented by Compliance, and published on the internal PUMA SharePoint channel.

Conflicts of Interest Policy

This policy outlines the principles and rules for preventing or managing conflicts of interest, ensuring that personal interests do not influence business decisions. PUMA expects employees to adhere to these standards across its own operations. Compliance is responsible for implementation, and the policy is available on the internal PUMA SharePoint.

Rules for the Complaint Procedure

The rules for the complaint procedure describe the principles and processes for handling complaints related to human rights or environmental risks and violations. The policy applies to both own operations and upstream activities and is implemented by Compliance. It is published on the website and PUMA SharePoint.

Whistleblowing Policy

The policy supports a culture of zero tolerance towards unethical conduct, fraud, corruption, unfair competition, and other serious misconduct. It provides detailed guidance on reporting compliance violations or suspicions. The policy applies to own operations and is implemented by Compliance and published on the internal PUMA SharePoint channel.

Animal Welfare Policy

This policy reflects PUMA’s commitment to ethical sourcing and responsible production. It ensures that animal products used in the upstream value chain do not originate from inhumanely treated animals and excludes skins or hides from exotic, CITES-listed, or IUCN Red-listed species. The policy applies to own operations and upstream activities, is implemented by the Chief Operating Officer, and is published on the website and PUMA SharePoint.

Policy training in business conduct

PUMA’s Compliance Training Strategy is approved by the Management Board; it supports all employees and key governance bodies in understanding and upholding the company’s ethical standards. The strategy defines the scope of training, including key topics, training modules, target audiences, frequency, and depth.

To reinforce ethical business conduct, all employees are required to complete two mandatory e-learning modules each year. New employees receive onboarding training focused on the Code of Ethics, introducing PUMA’s compliance culture, key risk areas, relevant policies, and the SpeakUp whistleblowing channel.

In addition to annual e-learning, face-to-face training sessions are available upon request or in response to specific risk situations. These sessions serve both preventive and corrective purposes.

Members of the Management Board participate in all mandatory e-learning programmes regarding corporate culture and ethical behaviour. Training is communicated globally by the CEO and closely monitored to secure full participation and compliance.

To remain aligned with evolving regulations and emerging risks, PUMA reviews and updates its Compliance Training Strategy on an annual basis.

Mechanisms to identify unlawful behaviour and file complaint (G1-1)

SpeakUp is PUMA’s public electronic whistleblowing platform accessible to our employees and employees of our business partners. The platform enables the reporting of risks or actual/potential violations of laws, PUMA policies, human rights, or environmental regulations. Our whistleblowing platform complies with the German Whistleblower Protection Act (Hinweisgeberschutzgesetz) transposing Directive (EU) 2019/1937.

All complaints are treated seriously and investigated confidentially in accordance with our Rules for the Complaints Procedure and Whistleblowing Policy. We have established procedures to promptly, independently, and objectively investigate business conduct incidents including those related to corruption and bribery through our Case Handling Rules and Investigation Guidelines. Complainants may choose to remain anonymous. If a reporter discloses their identity, it will not be shared with third parties without explicit consent, unless required by law. Information related to investigations is communicated strictly on a need-to-know basis.

Complaints can be submitted in good faith by PUMA employees, external stakeholders, human rights and environmental defenders, rights holders, and employees of our business partners across the supply chain without fear of retaliation. PUMA has zero tolerance for threats, intimidation, or attacks against human and environmental rights defenders. Any acts of retaliation against a complainant shall lead to appropriate disciplinary action. For complaints not filed by PUMA employees, PUMA will work with its suppliers or third parties and strive to protect the confidentiality of the complainant. No actions shall be taken with the intention of identifying the complainant.

For workers in the upstream value chain, PUMA contractually requires its suppliers to display the PUMA Code of Conduct, which includes a reference to SpeakUp. Compliance is monitored through supplier audits. Furthermore, PUMA passes on the obligation to suppliers to reinforce that upstream partners in their own supply chains also enable their employees to access effective complaint mechanisms. This cascading responsibility helps strengthen grievance access and accountability throughout the supply chain. Alternatively, factory workers may submit complaints through independent channels operated by Micro Benefits, Labor Solutions, Hamari Awaz, and Amader Kotha. Complaints from factory workers using independent complaints channels are escalated to PUMA if there is a delayed response by factory management.

As part of PUMA’s commitment to responsible business conduct and effective grievance management, we support our employees in becoming well informed about the use of SpeakUp. Awareness is reinforced through visual materials such as posters, inclusion in internal communication channels, and integration into all relevant corporate policies. The platform is featured in compliance training modules and onboarding sessions, to emphasise that SpeakUp is the designated mechanism for reporting concerns or misconduct.

During 2025, SpeakUp was technically enhanced to improve complaint tracking and provide greater visibility into reports across our operations and the supply chain. As part of these enhancements, a new voice recording function was introduced, allowing reports to be submitted verbally; the audio is automatically transcribed into text and can be translated, increasing accessibility for users with language or literacy barriers. To support this, targeted training sessions were delivered to designated case managers, including LCOs, POs, and sourcing teams. These sessions were designed to build capacity and promote consistent, fair, and timely handling of complaints. In addition, we developed user manuals and concise one-pagers to facilitate practical use of the platform and support the assessment of complaints, improving its accessibility for stakeholders.

Prevention and detection of corruption and bribery (G1-3, G1-4)

PUMA’s Anti-Corruption and Anti-Bribery Policy provide a framework for compliance with relevant laws and international standards. Our CMS takes a systematic approach to the prevention and detection of, and response to, corruption and bribery risks. Anti-corruption and anti-bribery are standard themes in both in-person and e-learning compliance training for all employees and are also included in supplier training and onboarding. The members of the Management Board are included in the dedicated annual compliance training plan. The Supervisory Board receives updates and training on anti-bribery and anti-corruption developments during quarterly meetings to reinforce continuous awareness.

Additionally, any concerns related to corruption and bribery can be reported confidentially via SpeakUp, which is accessible to both employees and external business partners. The internal audit function reinforces anti-corruption and anti-bribery compliance by assessing related controls and procedures. Any identified risks or incidents are escalated to Group Compliance for independent review and follow-up. Reports are investigated independently by Group Compliance, with investigators appointed to avoid conflicts of interest, typically from unrelated departments or, if necessary, external experts. Clear reporting lines make sure that investigators report solely to the compliance department. For particularly sensitive cases, external investigators or forensic auditors may be engaged. Group Compliance oversees all investigations to maintain adherence to protocols and fairness.

Outcomes of investigations are reported to the Management and Supervisory Boards by the Chief Compliance Officer in quarterly updates. PUMA enforces a zero-tolerance policy on corruption and bribery, with mandatory disciplinary consequences and remediation plans for each confirmed case.

In 2025, PUMA had zero convictions or fines for violations of anti-bribery and anti-corruption laws.

In 2025, both the Anti-Corruption and Anti-Bribery Policy and the Business Partner Due Diligence Policy were specifically addressed in dedicated e-learning sessions for all corporate employees at Group level. Training data reflects annual compliance training campaigns; all percentages shown are based on eligible employees during the campaign period. Immaterial factors such as post-campaign hires, do not materially impact overall compliance completion rate.

¹ Key topics covered in the e-learning: purpose and policy framework, definitions and types of corruption, identifying public officials, recognising bribery, gifts and hospitality, case scenarios and practical guidance, reporting mechanisms, and key takeaways.

¹ Key topics cover purpose and policy framework, definitions, onboarding and risk assessment, compliance due diligence, best practices, practical scenarios and key takeaways.

Management of relationships with suppliers (G1-2)

PUMA minimises supply chain disruptions through practices that are aligned with its strategy and risk management:

• Vendor Financing Programme: Established in 2016, this programme offers suppliers attractive financing terms through partnerships with banks like BNP Paribas, Standard Chartered Bank, and HSBC, providing liquidity during disruptions
• Collaborative adjustments: During unforeseen disruption of production (for example pandemics or national unrest), PUMA works with retail partners and manufacturers to adjust order placements, sharing the burden and maintaining continuity
• Continuous communication: PUMA maintains ongoing dialogue with suppliers to proactively assess and address risks related to factory work suspensions, layoffs, wage payments, and working conditions
• Responsible purchasing: PUMA aims to pay orders in full and compensate for materials even if orders are cancelled, helping to build trust and reliability
• Health and Safety Guidelines: PUMA guides manufacturers to follow government and ILO guidelines to protect workers’ health, with the goal of supporting safe operations during crises
• Sustainability strategy: PUMA’s strategy, informed by the SDGs, focuses on human rights, climate action, and circularity, with the intention of supporting long-term resilience and adaptability.

PUMA recognises the impact of its business practices on suppliers and aims to reduce negative effects through its Responsible Sourcing Policy. Since 2019, the Responsible Purchasing Practice Policy has served as a guide for decision-making. PUMA trains its sourcing staff and suppliers on this policy, referencing the UNGPs to highlight the link between purchasing practices, working conditions, and human rights risks.

We ask strategic Tier 1 suppliers to participate anonymously in the Better Buying survey to gather feedback on PUMA’s responsible purchasing practices, helping us improve our practices. We share the survey results with our sourcing team and suppliers. We paused this survey in 2025.

Since 2023, PUMA had a responsible disengagement clause in its purchasing practices. Following FLA guidelines, PUMA commits to providing at least six months’ notice before significantly downscaling orders or ending business relationships. A longer notice period may be granted based on average production capacities over the past two to three years to mitigate impacts on workers and allow suppliers time to find new buyers.

PUMA’s Code of Conduct is integral to our manufacturing agreements. As part of the manufacturing agreements all suppliers sign a legally binding Declaration of Principles specifying the principles and standards to be observed by the suppliers, including annexes on anti-corruption, building safety, animal protection, PUMA sustainability audits, restricted substances, and PUMA cotton sourcing policies. The supplier acknowledges the importance of adhering to social and environmental standards and guarantees these rights to all employees and affected stakeholders. Additionally, the supplier commits to respecting internationally recognised human rights, complying with all applicable laws to prevent slavery, servitude, forced labour, and human trafficking, and avoiding any activities that would constitute an offence.

PUMA extends its local supply chain initiatives in markets such as China, India, Latin America and Türkiye. By sourcing materials and products regionally, PUMA fosters closer relationships with local suppliers.

Payment practices (G1-6)

PUMA has digitised its supply chain to promote transparency and operational efficiency, which helps facilitate timely payments to suppliers. As a result, all payments to suppliers are automated and paper-free, supporting adherence to applicable payment terms. PUMA’s standard contract payment terms are 90 days after receipt of the invoice. To support supplier payment in addition to our standard payment terms, the PUMA Vendor Financing Programme enables our suppliers to access reduced payment terms through the banking partners. In 2025, approximately 99% of annual invoices were paid according to these standard terms, with payments being made on average within 95 days. The remainder of invoices were paid based on local terms agreed upon between the sales subsidiary and the supplier. In 2025, there were no outstanding legal proceedings for late payments, as this process is automated.

Governance & control