Governance Information

Disclosures on ESRS G1 Business conduct

General Disclosures

Disclosure Requirement related to ESRS 2 GOV-1 – The role of the Administrative, Management and Supervisory Bodies

A responsible and transparent corporate governance and supervision structure is the central foundation for Fraport to create value and trust. This plays a crucial role in shaping and implementing business conduct. In accordance with the statutory provisions, Fraport AG is subject to a “dual governance system,” which is achieved by the strict separation of personnel in the management and monitoring bodies (two-tier board). The Executive Board manages Fraport AG, and the Supervisory Board monitors the Executive Board. The members of the Executive Board and the Supervisory Board work closely together in the interests of the company. These bodies ensure a clear strategic direction, efficient management, and compliance with legal regulations, which is crucial to the long-term success of the business.

The Executive Board of Fraport AG consists of the following five members: Dr. Stefan Schulte (Chairman), Anke Giesen, Julia Kranenberg, Dr. Pierre Dominique Prümm, and Prof. Matthias Zieschang. As the management body, the Executive Board conducts the business of the company. It is bound by the company’s interests and corporate sociopolitical principles within the framework of stock corporation law. In addition, its work is based on the “Executive Board rules of procedure,” which have been approved by the Supervisory Board. The schedule of responsibilities for the Executive Board, which governs the allocation of responsibilities, is also attached to these rules of procedure as an annex. On this basis, the Executive Board reports to the Supervisory Board on all relevant matters of business development, corporate strategy, and possible risks in a regular, timely, and comprehensive manner. In addition, the Executive Board must have the prior approval of the Supervisory Board for certain material matters, particularly for capital expenditure and equity investment measures above a value of €10 million, to the extent that this is not provided for in a business plan approved by the Supervisory Board.

The Supervisory Board of Fraport AG supervises the activities of the Executive Board. It is composed of an equal number of shareholder and employee representatives and comprises 20 members as provided for in the company statutes. The ten shareholder representatives are elected by the AGM, and the ten employee representatives are elected by the employees in accordance with the provisions of the German Co-Determination Act (MitbestG) for five years. The Supervisory Board has created rules of procedure, under which it has a quorum if – on the basis of a proper notice of meeting – at least half of its members participate in the voting in person or through submission of written votes. Resolutions are adopted with a simple majority unless otherwise mandated by law. In the event of a tied vote, the Chairman of the Supervisory Board, who must be a shareholder representative, is entitled to a second vote. Beyond this, the rules of procedure provide for, in particular, the creation and powers of committees of the Supervisory Board. As a rule, the Supervisory Board meets four times a year. In 2024, the Supervisory Board held five meetings, one of which was a strategy meeting. The Supervisory Board meetings in 2024 were all held in-person, while individual members had the option of participating virtually.

The members of the Executive Board and the Supervisory Board possess specialized knowledge in various areas due to their many years of experience, enabling them to make well-informed decisions. This ensures the long-term success and sustainability of the undertaking.

The following table contains further details on the current members of the Supervisory Board.

Impacts, Risks and Opportunities Management

Disclosure Requirement related to ESRS 2 IRO-1 – Description of the processes to identify and assess material impacts, risks and opportunities

The process of identifying material impacts, risks, and opportunities in relation to business conduct matters is a systematic process that ensures that the undertaking makes sound, well-informed decisions. This process involves several steps and takes into account a variety of criteria to cover all relevant aspects. The material IROs were identified as part of the double materiality assessment (DMA) (see Disclosure Requirement IRO-1 in ESRS 2). Under G1 Business conduct, these are: cyber risks, legal and compliance risks, corruption and bribery. These IROs were identified by an expert committee consisting of employees from different departments of Fraport AG: Compliance and Integrity, Risk Management, Strategy and Sustainability, Information and Telecommunication, Aviation, Procurement, Claim and Mobility, Corporate Communications, Human Resources, Global Investments and Management, and Finance and Investor Relations. The results were checked accordingly for plausibility by representatives of the Group companies for the entire Group and supplemented if necessary. There are no fundamental differences between Fraport AG and the Group in relation to the identified material IROs and, by their nature, these IROs apply to the entire business model.

Disclosure Requirement G1-1 – Business Conduct Strategies and Corporate Culture

Corporate Culture

The Group strategy Fraport.2030 with the guiding principle "Connecting the world with tomorrow" includes consistent directional decisions and aims at sustainable future security and profitable business growth. Derived from this, Fraport fosters an atmosphere of solidarity, diversity, and continuous development for its employees and all those aspiring to join, in an environment that inspires.

Within the scope of its management responsibilities, the Executive Board determines the values and codes of conduct of the Fraport Group and draws up the framework conditions for legally compliant and ethical behavior of its executives and employees.

In addition to operational excellence and a clear customer promise, compliance and integrity are core components of the corporate culture and form the basis of business activities. Fraport is committed to acting in accordance with laws, internal regulations, and values.

Ensuring the integrity of all employees worldwide is of great importance to Fraport. Compliance is a key prerequisite for the future viability of the company. In order to ensure compliance with the rules, guidelines are applied within Fraport that employees must comply with.

The Code of Conduct for Employees that applies to the Fraport Group reflects the culture of values practiced and stipulates the requirement to act responsibly and appropriately when dealing with the economic, legal, and moral challenges of everyday business. The Code of Conduct is reviewed regularly and updated when necessary.

Strategies Adopted to Manage Material Sustainability Matters

Cyber Risks

All important business and operating processes at Fraport are supported by IT systems. Due to the ongoing development of new technologies and the increasing global threat of cyberattacks generally, there is an underlying risk potential for IT systems. The target is therefore to protect all IT systems and data against failure, manipulation, and unwanted publication. Various actions have been taken to achieve this target, and the effectiveness of these actions is monitored on an ongoing basis. These points are explained in more detail below.

The scope of the strategy is the Fraport Group. The Fraport Group has no overarching influence on the upstream and downstream value chain.

The top level of the organization responsible for implementing the strategy is the Information and Telecommunication unit of Fraport AG. Overall responsibility lies with the Executive Board.

Actions and Resources in Relation to Material Sustainability Matters

Cyber Risks

The actions described below have already been implemented and are continuously being developed further to achieve the greatest possible risk mitigation.

Fraport protects its IT systems and data against failure, manipulation, and unwanted publication with active and preventive IT security management. These systems are configured redundantly and are housed at separate sites. The risks in the area of IT security are included in the risk management system (see also the “Risk and Opportunities Report” chapter). The requirements for IT security are specified in the IT security policy and security guidelines that must be followed throughout the Group. Compliance with these requirements is checked regularly by Internal Auditing, IT Security Management, or external advisors. Fraport AG has implemented a variety of projects to adequately respond to the growing risks arising from information technology. In addition, further personnel were hired in this section. The level of IT security is also part of the annual management review of the Information Security Management System (ISMS) and is audited by external auditors as part of ISMS audits, such as KRITIS and the EU Aviation Security Regulation.

In addition, potential for improvement identified within the scope of internal audits as well as in KRITIS audits conducted according to the German IT Security Act for Critical Infrastructures (KRITIS) is processed and the Information Security Management System (ISMS) developed further.

Within the scope of a working group in the German Aviation Association, Fraport AG along with other airport operators, Deutsche Lufthansa, and the German Air Traffic Control is developing the security standards of the industry. These are based on the new KRITIS requirements. The target is to comply with regulatory requirements and establish a high security standard within the aviation industry.

The Group companies outside of Frankfurt use their own IT infrastructure, that they protect according to the Group’s IT security guidelines. As a rule, the IT systems of the Group companies at the Frankfurt site as well as the SAP systems of Fraport Greece are integrated into the technology of Fraport AG and managed from Frankfurt. Using other IT systems is only possible with the consent of the Executive Board. At Fraport AG, a separate section within the “Information and Telecommunication” service unit is responsible for IT security. Its tasks are, among other things, the ongoing identification and implementation of measures to meet high security standards.

The security management system at Fraport contains a variety of metrics that measure the effectiveness of the actions implemented. These metrics cannot be published for security reasons. Actions are continuously being taken and implemented to ensure IT security. Effective actions ensure the functioning of the business and operating processes supported by IT systems and have a positive impact on the upstream and downstream value chain. For example, IT technology can ensure a smooth passenger flow.

Strategies Adopted to Manage Material Sustainability Matters

Legal and Compliance Risks, Including the Sustainability Matter of Corruption and Bribery

In addition to operational excellence and a clear customer promise, compliance and integrity are core components of the corporate culture and form the basis of business activities. Fraport is committed to acting in accordance with laws, internal regulations, and the company-wide values.

Ensuring the integrity of all employees worldwide is of great importance to Fraport. Compliance is a key prerequisite for the future viability of the company. Fraport has taken various actions to ensure compliance with regulations and to manage legal and compliance risks. These actions are explained in more detail below.

To ensure effective compliance, the Executive Board has introduced a Compliance Management System (CMS). This system ensures, among other things, an effective monitoring process. The scope of the strategy is the Fraport Group. Fraport views the impacts on the upstream and downstream value chain in terms of maintaining and improving the trust that passengers, customers, and suppliers have in Fraport and the business model.

The top level of the organization responsible for implementing the strategy is the entire Executive Board. The Executive Board is also responsible for the organization of compliance within the Fraport Group. It has assigned the Head of the Legal Affairs and Compliance central unit, who also serves as Chief Compliance Officer, to develop, organize, and operate the CMS of Fraport AG. More detailed information on the sustainability matter of corruption and bribery can be found under Disclosure Requirement G1-4.

Actions and Resources in Relation to Material Sustainability Matters

The actions described below have already been implemented and are continuously being developed further to achieve the greatest possible risk mitigation and/or improvement in the sustainability matter of corruption and bribery. More detailed information on the sustainability matter of corruption and bribery can be found under Disclosure Requirement G1-4.

In addition to continuously analyzing legal changes to ensure the timely identification of and response to potential negative changes, Fraport is continuously expanding its Group-wide compliance organization. This is supported by the implementation of the Group CMS policy or the further development of the central internal control system (ICS).

The Code of Conduct for Employees that applies worldwide to the Fraport Group reflects the culture of values practiced at Fraport and stipulates the requirement to act responsibly and appropriately when dealing with the economic, legal, and moral challenges of everyday business. The Code of Conduct is reviewed regularly and updated when necessary. There are several ways for employees and customers around the world to report potential compliance breaches securely and in confidence. The information received is carefully and conscientiously evaluated and examined. Compliance breaches are systematically penalized and any grievances are remedied. Fraport employees are regularly informed on the topic of compliance through various internal channels and undergo training courses. The Code of Conduct and other compliance guidelines in place at the Group are available to employees on the corresponding information platforms.

In its Supplier Code of Conduct, Fraport describes the requirements and principles for cooperation with contractors, suppliers, and service providers. The contractually agreed Supplier Code of Conduct obliges them to comply with the applicable national laws and the relevant internationally recognized standards, guidelines, and principles, as also stipulated in the Code of Conduct.

The CMS at Fraport is a systematic tool for ensuring legal and compliant behavior within the Group. The objective of the CMS is to ensure corporate management based on values and with integrity that goes beyond the mere fulfillment of standards. The CMS of Fraport AG is based on and starts with a rolling compliance risk analysis (CRA), which includes the fight against corruption as one focus area. Within the compliance system at the Fraport Group, a distinction must be made between central and local levels. The Group companies are obliged to set up a local CMS in accordance with the minimum standards set out in the relevant Group guidelines. Responsibility for the individual CMS within the Group lies with the local management of the respective Group company. The central CMS organization is responsible for the Group’s requirements with regard to the minimum standards for the design of the local CMS and monitoring of compliance with those requirements. The finance and audit committee is informed at least once per year of the status of the CMS within Fraport AG and the Group by the Executive Board.

Examining adherence to the Fraport Group’s compliance regulations falls under the remit of Internal Auditing at Fraport AG. This department provides independent and objective audit and consulting services in all major business units of Fraport AG and its Group companies. A standardized and risk-oriented planning process is the foundation for determining the focus points of the audit.

An additional instrument for preventing and discovering compliance violations is the digital whistleblower system (see Whistleblower systems) as an internal reporting office. Employees, customers, suppliers, business partners, and third parties can use the system to provide information about irregularities in the Group companies. For each report, an initial assessment is first carried out to determine whether the incident described can generally be considered plausible and fundamentally possible and whether it could constitute a violation of the law or a serious violation of an internal regulation. The subsequent clarification of the facts is carried out by appropriate persons who are independent and obliged to maintain confidentiality. The aim is to clarify allegations, remedy any grievances identified, and take suitable action to prevent future compliance violations. Each case is closed with a written final report, which is strictly confidential. The distribution list for the report depends on the nature and severity of the violations identified and is determined on a case-by-case basis. Information is disclosed only to the extent necessary and permitted by data protection law. Once the investigation is complete, the whistleblower receives feedback on the follow-up action, if legally permissible.

Information about compliance violations can be provided via the digital whistleblower system, which is open to everyone – employees, customers, suppliers, business partners, and other third parties. This system is available worldwide around the clock and can be accessed via the Fraport AG website and the websites of Group companies. Employees are informed about the electronic whistleblower system in the Code of Conduct, in compliance e-learning courses, and through other communication measures. Employees of the Compliance department at Fraport AG and the compliance officers of the Group companies, who have completed training in whistleblower protection and internal investigations, have been entrusted with the tasks of the internal reporting office in accordance with Section 13 of the German Whistleblower Protection Act. The independence required to perform these duties has been contractually assured.

In addition, an ombudsperson, currently an external and independent lawyer, is available to Fraport AG employees and third parties. Employees at the Frankfurt site can also contact an internal representative.

Whistleblowers who report grievances in good faith are given special protection at Fraport. The digital whistleblower system also allows anonymous reports to be made, with anonymity completely guaranteed by the certified BKMS® system. The Compliance department ensures the protection of named whistleblowers by maintaining the highest level of confidentiality and, if legally possible, by ensuring their anonymity. With regard to the processing of reports at Fraport, this means that the identity of the whistleblower is only known to those persons who are responsible for receiving the reports or taking follow-up action. Whistleblowers do not have to fear reprisals such as suspensions, dismissals, relocations, disciplinary measures, discrimination, bullying, or similar retaliation from their Fraport employer after submitting a report.

Reports of compliance violations, such as corruption and bribery, are investigated by the Compliance department of Fraport AG or the compliance officers of the Group companies. Binding Group-wide standards exist for this purpose, and ensure an immediate, independent, and objective investigation.

Due to the business model and supply chain, Fraport does not have any specific strategies relating to animal welfare.

There are increased risks of corruption and bribery in the functions involved in the procurement of goods and services, both in the purchasing and requesting departments, as well as in the functions involved in the marketing of services. The functions involved in the management of the international investment portfolio, including the purchase and sale of equity holdings and the management of transaction processes, are also subject to an increased risk. For information on training within the organization, see Disclosure Requirement G1-3.

Disclosure Requirement G1-3 – Prevention and Detection of Corruption and Bribery

The Group-wide CMS contains various actions for combating corruption. The regular, systematic identification of compliance risks forms the basis for the development and prioritization of targeted compliance programs to reduce risks to an acceptable level. Corruption and bribery are among the key risks that form the focus of compliance work.

At the heart of the compliance regulations in place at Fraport is the Code of Conduct for Employees. This Code clarifies the responsibility incumbent on employees as a company, as a business partner, and as an employee in the workplace and shows how this responsibility is fulfilled. The Code of Conduct outlines the general framework and the principles of action that Fraport adheres to. In addition, there are Group-wide minimum standards for the handling of gifts and invitations as well as conflicts of interest. Group-wide standards also apply to key compliance processes, in particular the compliance risk analysis, business partner review, whistleblower systems, and internal investigations.

Employees of the Compliance department at Fraport AG and the compliance officers of the Group companies, who have completed training in whistleblower protection and internal investigations, have been entrusted with the tasks of the internal reporting office in accordance with Section 13 of the German Whistleblower Protection Act. The independence required to perform these duties has been contractually assured.

The Compliance department of Fraport AG informs the Executive Board in a semi-annual report on the status of the anti-corruption actions. The Executive Board receives information on material compliance violations immediately after they become known.

Internal stakeholders learn about the strategies in place to combat corruption and bribery in various e-learning courses. External stakeholders are informed about existing strategies via the Fraport website (Compliance) and in the disclosures on combating corruption and bribery in the non-financial reporting.

Group-wide minimum standards apply to the communication of compliance knowledge based on the relevant information requirements of the respective target groups.

Four different e-learning courses are offered at Fraport AG: “Compliance Basic Knowledge” for all administrative and selected operational employees with an introduction to compliance, information on the Code of Conduct, rules on gifts and invitations, conflicts of interest, points of contact for whistleblowers, and contact persons for compliance issues. A specific “Compliance Basic Knowledge for Executives” course with an overview of the main elements of the CMS, the main compliance tasks of executives, “red flags” for identifying corruption and bribery in their own area of responsibility, and the necessary actions.

In addition, functions-at-risk must complete the “Corruption Prevention” course. This course provides an overview of the relevant criminal offenses and explains the gateways to and typical patterns of corruption. The internal regulations are explained using practical examples, and the risks involved in dealing with public officials are also highlighted. Those required to complete the e-learning courses at Fraport AG must repeat them every three years.

Face-to-face training sessions are also held as required. In 2024, for example, the Executive Board and senior managers were trained in corruption and the consequences under criminal law as part of a “Compliance in Focus” event.

Group-wide minimum standards on employee training apply to Group companies. Employees are trained in the Code of Conduct for Employees, relevant local compliance guidelines, and the whistleblower systems in place. In some cases, Fraport AG e-learning courses adapted to the respective Group company are used for this purpose. At Fraport AG, 56% of the functions-at-risk have completed a compliance e-learning course (Basic Knowledge or Corruption Prevention). In the Group, 90% of the functions-at-risk have been trained in compliance, corruption, and bribery.

All members of the Executive Board of Fraport AG were trained in corruption and the consequences under criminal law as part of the “Compliance in Focus” event. 91% of the members of the management and supervisory bodies of the Group companies have undertaken training in compliance, corruption, and bribery, as well as the handling of gifts and invitations.

Metrics and Targets

Disclosure Requirement G1-4 – Incidents of Corruption or Bribery

There were no convictions for violations of anti-corruption and anti-bribery laws in the reporting period. No additional actions were taken in the reporting period to address breaches in procedures and standards of anti-corruption and anti-bribery. During the reporting period, there was a corruption attempt by a potential supplier during a tender process, which was reported by the employee of the Peruvian Group company. None of the undertaking’s own employees were dismissed or disciplined for corruption or bribery in the reporting period. The supplier that attempted to bribe an employee of the Peruvian Group company was excluded from the tender process and barred from future contracts. No contracts with business partners were terminated or not renewed in the reporting period due to incidents involving employees of the Fraport Group. No public legal cases regarding corruption or bribery were brought against Fraport and its own employees in the reporting period.