Governance: committees, compliance policies and integrity statements

analysisNaspers's governance web page states that the governance structures of Naspers and Prosus substantially mirror each other and that the Naspers board has constituted six committees from among its directors: an audit committee, a risk committee, a social, ethics and sustainability committee, a nominations committee, a human resources and remuneration committee and a projects committee. Each committee acts within written terms of reference, which the page says are published on the Prosus website, and its chair reports at each scheduled board meeting; the chairs of the audit, risk, sustainability, human resources and remuneration, and nominations committees are non-executive directors and are required to attend annual general meetings to answer questions. According to the page, the audit and risk committees monitor compliance with the Financial Supervision Act, the “South African Civil Code” (a reference reproduced as the page publishes it) and the South African Corporate Governance Code, and with the JSE requirements applicable to the Naspers bonds listed on that exchange. This is the company's own description of its committee structure. ¹

analysisThe audit committee charter linked from the governance page is a Prosus N.V. document, last reviewed and approved on 23 November 2022, which sets the committee's purpose as fulfilling the legal obligations of Prosus N.V. (“Prosus or the company”) under Dutch law and the Dutch Corporate Governance Code. It provides that the committee comprises independent non-executive directors, with a minimum of three members; that the chair of the board may not be a member (but may attend by invitation) and the committee may not be chaired by a former executive director who acted in that capacity in the past five years; that one member must have competence in the preparation and auditing of financial statements; and that members may not serve simultaneously on the audit committees of more than three public, listed companies, excluding Naspers Limited and Prosus N.V. Under the charter, the chief executive, the financial director, the head of the group's internal audit and the external auditor attend its meetings unless the committee determines otherwise. ^{2 1}

analysisThe charter provides that the committee approves, within the confines and requirements of the Dutch Civil Code, related-party transactions as defined by the JSE and IAS 24 of between US$5 million and US$50 million, while transactions above US$50 million are for the board alone to approve; transactions between wholly owned direct and indirect subsidiaries of Naspers are excepted and reviewed in the context of accounting disclosure requirements, and related-party transactions of less than US$5 million must be brought to the committee's attention at the meeting closest to their conclusion. The committee also reviews, approves and recommends to the board material related-party transactions outside the ordinary course of business or on other than normal market terms. The charter further requires the committee to ensure that internal audit provides an annual statement on the effectiveness of the company's governance, risk management and control process and is subject to an external, independent quality review every five years, and to obtain annual confirmation from the head of group internal audit that internal audit conforms to a recognised industry code of ethics. ²

analysisThe governance web page also states that the group has a governance committee comprising the segment chief executive officers, the chief financial officers of Naspers and Prosus, the group company secretary, the group general counsel, the group head of risk and audit, the global head of sustainability, the global head of governance and the global ethics and compliance lead, which was tasked with ensuring that the group's governance structures and framework were employed across the consolidated entities during the financial year. According to the page, the adopted governance, risk and compliance framework is in line with legislated requirements and Dutch Corporate Governance Code recommendations, subsidiaries, associates and investees must comply with applicable laws and regulations, and a risk-based legal compliance programme (including anti-bribery and anti-corruption) has been implemented under this framework in all subsidiaries; these are the company's own statements, and the retained record contains no independent assessment of how the programme operates in practice. Naspers's ethics and compliance policy, last reviewed and approved on 27 November 2024, applies to Naspers Limited and its subsidiaries and states that the group is subject to the rules and regulations of Euronext Amsterdam and the Authority for Financial Markets in the Netherlands and of the Johannesburg Stock Exchange, as well as to the Dutch Code of Corporate Governance and the King Report on Governance for South Africa. It requires the management of each group company to appoint an ethics and compliance officer and to run a fit-for-purpose ethics and compliance programme that covers at least the code, anti-bribery and anti-corruption, competition compliance, sanctions and export controls, anti-money laundering and counter financing of terrorism, third party risk management, and speak up and investigations; under the policy, group ethics and compliance, together with group risk & audit, is responsible for monitoring the design, implementation, adequacy and effectiveness of these programmes. ^{1 2}

analysisNaspers's policies web page publishes a group code of business ethics & conduct and a group speak up policy; group policies, among them anti-bribery & anti-corruption, anti-money laundering & counter financing of terrorism, competition compliance, cybersecurity, data privacy governance, ethics and compliance, remuneration, sanctions & export controls and trading in securities policies; charters of the board and of the audit, risk, sustainability, nominations, HR & remuneration and project committees; and other documents, including a Board Diversity Plan, FAQs on GDPR, privacy & cybersecurity, a human rights statement and a PAIA manual. The speak up policy, approved on 21 November 2025, applies to Naspers and its subsidiaries and sets out speak up principles that the group expects all employees, officers and directors (as well as anyone working for or on behalf of the group) to observe. It is intended for concerns about legal or ethical misconduct, for example breaches of competition, privacy, or sanctions or export control laws, bribery or corruption, conflicts of interest, discrimination or harassment, fraud or theft, human rights violations, insider trading, money laundering or terrorism financing, and retaliation for speaking up, and it states that the group does not tolerate any threat, retaliation or other action against anyone who raises a concern in good faith. The policy describes a web and telephone speak up service operated by an independent provider, available 24/7, which accepts reports confidentially, in multiple languages and, if desired and allowed by local law, anonymously, through a dedicated Naspers speak-up website, with authorised members of the ethics and compliance team receiving a copy of each report; the group's anti-money laundering policy names the service as operated by Navex Global EthicsPoint. This is policy text; the retained record contains no data on reports received under it. ^{3 4 5}

analysisNaspers's anti-money laundering and counter financing of terrorism (AML/CFT) policy, in the retained version last reviewed and approved on 28 November 2023, applies to Naspers Limited and its subsidiaries, defined as companies in which Naspers has a shareholding of more than 50% (direct or indirect); the policies page links a file under a 2024 path that is not in the record. The policy states that the group does not tolerate or facilitate, nor wish to be involved in, any form of financial crime, that its objective is to protect the group, its employees and directors from any involvement in money laundering and terrorism financing, and that it is reviewed annually by Naspers Group Ethics & Compliance. It requires every group business, including businesses whose activities do not include payment or other financial services, to assess annually which AML/CFT laws and regulations apply or may apply to it, and to identify and assess money laundering and terrorism financing risks relating to its customers, geographical areas of operation, products and services, distribution channels, transactions and third parties. Depending on the nature of its activities, each group company should consider internal policies, controls and procedures covering AML/CFT, risk management, customer due diligence, customer and/or transaction screening, transaction monitoring, reporting, record keeping, internal controls, compliance management, employee screening, and employee training and awareness, and should consider processes to identify customers and transactions involving politically exposed persons and sanctioned persons, entities or countries; the policy is to be read together with the group's anti-bribery and anti-corruption and sanctions and export controls policies. ^{1 2}

analysisFor sanctions, Naspers's policies page links a sanctions & export controls policy under its own website path, but that file is not retained; the retained copy is the Prosus sanctions & export controls policy, last reviewed and approved on 23 November 2022 and published on Prosus's website, which applies to Prosus N.V. and its subsidiaries. It states that Prosus is committed to conducting business in accordance with applicable economic and trade sanctions and endeavours to meet all sanctions-related obligations imposed on it by third parties, and describes sanctions as measures taken by international bodies such as the United Nations or the European Union, or countries such as the United States or the United Kingdom. Its minimum standards require sanctions-related risks to be assessed regularly, with measures such as screening and due diligence of counterparties, geo-blocking, monitoring geographical sources of revenues and classification of goods subject to export controls, and require any presence or activity in comprehensively sanctioned or other heightened-risk countries, regions or territories, and any dealings with or for the benefit of sanctioned governments, individuals or entities, to be reviewed in advance by the Prosus Group Chief Ethics & Compliance Officer. ³

analysisA Prosus Policy on Data Privacy Governance, approved by the board on 22 August 2019 and published on Naspers's website, applies to Prosus N.V. and its subsidiaries, defined as companies in which Prosus has a shareholding of more than 50% (direct or indirect). Its stated objectives include defining how data privacy is managed in the group as an element of the information and technology governance described in the King IV Code; it uses “personal data” consistently with Article 4(1) of the EU General Data Protection Regulation, and it states that individual businesses manage data privacy directly, with the CEOs in the group holding ultimate responsibility. The policy sets seven data privacy principles that the group expects all businesses to implement: notice, individual control, respect for context, limited sharing, retention, security and governments. Under them, personal data should be retained only as long as needed to fulfil the purpose for which it was collected, under a defined and proportionate period; administrative, technical, personnel and physical measures should safeguard personal data against loss, theft and unauthorised uses or modifications; and businesses should have procedures to handle government requests to access personal data in a consistent and lawful manner. ¹

analysisUnder the same policy, each business is expected to implement a data privacy programme proportionate to its size, scale, geography and resources, including executive buy-in (the CEO designating a data protection lead or team), knowing what personal data it holds, adopting at a minimum a consumer privacy policy, a human resources privacy policy, a security policy and a data breach/incident response plan, employee privacy training, vendor and third-party management (scrutiny of partners, confidentiality or data processing agreements and risk-based vendor audits), legal compliance support, and readiness to report to group executives, internal audit, Prosus's board committees and board, or regulators. The policy states that the group's Data Privacy Office supports businesses with programme implementation, legal compliance, regulatory engagements and privacy impact assessments, that the group requires biannual privacy and security status reports to group executives, and that the risk committee of the Prosus board reviews the policy and its implementation annually. ¹

analysisNaspers's own website privacy statement is issued by Naspers Limited (registration number 1925/001431/06), covers personal information processed through its website and is governed by the laws of South Africa. It states that personal information may be shared with other companies or divisions within the Naspers group, website hosting and email marketing partners and other service providers, researchers and analytics providers, and third parties as required by law, and that by using the website visitors consent to their personal information being processed, should it be required, in a foreign country with less stringent data protection laws than South Africa. Naspers's security web page states that the group runs a responsible disclosure programme on the BugCrowd platform, works with external researchers to identify vulnerable systems and is part of the Safe Harbour project, so that any vulnerability reported in good faith will not be penalised. It lists contacts for the security teams of “our businesses” Prosus, Takealot, Superbalist, MrD, Media24, Property24 and Autotrader, and asks that vulnerabilities at Naspers businesses not listed be reported through its disclosure form on BugCrowd. ^{2 3}

analysisIn its announcement of 11 August 2026 that Pedro Arnt had been appointed an independent non-executive director with effect from 10 August 2026 and a member of the audit and risk committees, the Naspers board confirmed that fit-and-proper assessments had been conducted in compliance with the JSE Listings Requirements and that it was satisfied with their outcomes, and the group confirmed that there were “no positive statements to report in respect of the integrity information contained in the director's declarations”; Naspers's FY24 remuneration report states that a fit-and-proper evaluation is performed for each board candidate. In Amendment No. 1 to their Schedule 13D on Trip.com Group Limited, dated February 10, 2023 and filed jointly with the US Securities and Exchange Commission by MIH Internet SEA Private Limited, MIH Internet Holdings B.V., Prosus N.V. and Naspers Limited as an exit filing, the reporting persons stated that during the last five years none of them nor, to their knowledge, any of their directors and officers had been convicted in a criminal proceeding (excluding traffic violations or similar misdemeanors) or had been a party to a civil proceeding of a judicial or administrative body as a result of which they were or are subject to a judgment, decree or final order enjoining future violations of, or prohibiting or mandating activities subject to, federal or state securities laws, or finding any violation of such laws. The statement covers the five years before the filing and, for directors and officers, is made to the filers' knowledge. ^{1 2 3}