Whistleblowing Policy

1. Purpose

Lapasar Sdn Bhd is committed to conducting its business honestly, ethically, and in compliance with all applicable laws. As a B2B procurement and marketplace platform serving enterprise and government-linked clients, the integrity of our procurement, tendering, pricing, and fulfilment processes is fundamental to the Company’s licence to operate.

This Policy establishes a confidential avenue for employees and external parties to raise genuine concerns about improper conduct within or involving Lapasar, and guarantees protection against retaliation for those who do so in good faith. It supports the Company’s obligations and defences under the Malaysian Anti-Corruption Commission Act 2009 (including Section 17A on corporate liability), and is guided by the principles of the Whistleblower Protection Act 2011 (Act 711) and the Guidelines on Adequate Procedures issued pursuant to Section 17A(5) of the MACC Act.

2. Scope

This Policy applies to:

• All directors, officers, and employees of Lapasar Sdn Bhd, whether permanent, contract, or part-time, across all divisions (including FMCG Wholesale and Enterprise Procurement);
• External parties dealing with Lapasar, including suppliers, vendors, logistics partners, agents, consultants, customers, and clients.

It covers concerns relating to the conduct of any Lapasar personnel or any third party acting for or on behalf of Lapasar.

3. Reportable Conduct

A disclosure should be made under this Policy where a person has a reasonable, good-faith belief that any of the following has occurred, is occurring, or is likely to occur:

• Bribery or corruption, including offering, giving, soliciting, or accepting gratification in connection with tenders, quotations, supplier onboarding, purchase orders, or client contracts;
• Fraud, theft, misappropriation of Company or client funds, stock, or assets;
• Bid-rigging, kickbacks, undisclosed commissions, or collusion with suppliers or customers;
• Falsification or manipulation of financial records, invoices, delivery orders, inventory records, or platform data;
• Undisclosed conflicts of interest, including undeclared interests in suppliers or customers;
• Breach of law or regulation, including competition, tax, customs, or data protection law (Personal Data Protection Act 2010);
• Misuse or unauthorised disclosure of confidential client, supplier, or Company information;
• Conduct endangering the health and safety of any person, including in warehouse and delivery operations;
• Abuse of authority, or actions taken to conceal any of the above;
• Retaliation against any person for making, or intending to make, a disclosure under this Policy.

3.1 Matters outside this Policy

Personal employment grievances (e.g. performance appraisals, remuneration disputes, interpersonal conflicts) should be raised through the Company’s grievance and HR procedures, not this Policy, unless they involve reportable conduct listed above. Deliberately false or malicious reports are not protected and may result in disciplinary or legal action.

4. How to Make a Disclosure

Disclosures may be made openly, confidentially, or anonymously, through any of the following channels:

A disclosure should, where possible, include: the nature of the concern; the individuals or entities involved; relevant dates, locations, transactions, or documents; and any supporting evidence. Whistleblowers are not expected to investigate or prove the allegation — a reasonable, honest belief is sufficient.

Anonymous disclosures will be accepted and assessed on their merits. However, anonymity may limit the Company’s ability to investigate fully, seek clarification, protect the whistleblower, or provide feedback.

5. Confidentiality

The identity of a whistleblower, the content of the disclosure, and the identity of any person implicated will be kept confidential and disclosed only:

• To those with a strict need to know for the purpose of assessment, investigation, or remediation;
• Where required by law, regulation, or a lawful order of a court or enforcement agency; or
• With the whistleblower’s written consent.

All whistleblowing records will be stored securely with restricted access and handled in accordance with the Personal Data Protection Act 2010.

6. Protection Against Retaliation

Lapasar strictly prohibits any form of retaliation against a person who makes a good-faith disclosure, assists an investigation, or refuses to participate in improper conduct. Prohibited retaliation includes dismissal, demotion, suspension, harassment, intimidation, discrimination, adverse changes to duties or conditions, termination of a supplier or customer relationship, or any other detrimental action.

Any person who retaliates against a whistleblower commits a serious breach of this Policy and will face disciplinary action up to and including dismissal, and — for external parties — termination of the business relationship. A whistleblower who believes they have suffered retaliation should report it immediately through the channels in Section 4; such reports will themselves be treated as protected disclosures.

Protection under this Policy does not extend to a person who knowingly makes a false report, or who was themselves complicit in the misconduct disclosed — although voluntary self-reporting and cooperation will be taken into account in determining any consequences.

7. Handling and Investigation

Disclosures will be handled as follows:

1. Acknowledgement — receipt of the disclosure will be acknowledged within five (5) working days (where the whistleblower is contactable).
2. Initial assessment — the Whistleblowing Officer will assess within ten (10) working days whether the matter falls within this Policy and warrants investigation, and whether any person must be recused due to conflict of interest.
3. Investigation — investigations will be conducted objectively, confidentially, and without presumption of guilt, by persons independent of the matter. External professional advisers may be appointed where appropriate. The Company targets completion within sixty (60) working days, extendable for complex matters.
4. Outcome — findings will be reported to the CEO and, for material matters or matters involving senior management, to the Board of Directors. Substantiated findings will result in disciplinary action, contractual remedies, process remediation, and/or referral to the relevant authorities (including the MACC or Royal Malaysia Police).
5. Feedback — where practicable and lawful, the whistleblower will be informed that the matter has been concluded. Specific details of disciplinary outcomes may be withheld for confidentiality and legal reasons.

Any person implicated in a disclosure will be accorded due process, including the opportunity to respond to the allegations at the appropriate stage of the investigation, without compromising the investigation or the whistleblower’s protection.

8. External Disclosures

This Policy does not restrict any person’s right to report suspected offences directly to enforcement agencies, including the Malaysian Anti-Corruption Commission (MACC), the Royal Malaysia Police, the Companies Commission of Malaysia (SSM), or other relevant regulators. Disclosures made to enforcement agencies in accordance with the Whistleblower Protection Act 2011 may attract statutory protections under that Act.

9. Roles and Responsibilities

• Board of Directors — approves this Policy, receives reports on material whistleblowing matters, and oversees its effectiveness.
• Chief Executive Officer — champions a speak-up culture, ensures resources for implementation, and acts on findings.
• Whistleblowing Officer — receives, records, and assesses disclosures; maintains the confidential register; coordinates investigations; reports to the CEO and Board.
• Managers and Heads of Division — communicate this Policy to their teams, must never discourage reporting, and must escalate any disclosure received to the Whistleblowing Officer without conducting their own inquiries.
• All employees — report reportable conduct promptly, cooperate with investigations, and maintain confidentiality.

10. Communication, Training, and Records

This Policy will be published internally, referenced in employee onboarding, and made available to suppliers and business partners (including via lapasar.com). Periodic awareness briefings will be conducted. The Whistleblowing Officer will maintain a confidential register of all disclosures, assessments, and outcomes, and will report at least annually to the Board on the number and nature of disclosures (in anonymised form) and any systemic issues identified.

11. Review

This Policy will be reviewed at least once every two (2) years, or earlier where required by changes in law, regulation, business structure, or lessons learned from reported matters. Amendments require Board approval.