In particular, Suppliers must comply with the following:

Suppliers will be required to comply with applicable antitrust or competition laws and will not engage in any restrictive trade practices. Suppliers will at all-times act in a manner that will uphold and encourage healthy competition.

The applicable anti-trust legislation regarding Kenya operations is the Restrictive Trade Practices, Monopolies and Price Control Act (Cap 504 Laws of Kenya).

2.2.1 Bribes

Suppliers shall not make or offer bribes or payments of money or anything of value to any Safaricom employee or any other person including officials, employees, or representatives of any government or public or international organization, or to any other third party for the purpose of obtaining or retaining business with Safaricom. For the avoidance of doubt Safaricom considers an act of bribery to include the giving of money, anything of value or advantage to anyone where It is known or believed that it will be passed on to a government official or Safaricom employee for this purpose. Suppliers are required to comply with all applicable local anti-bribery legislation.

Suppliers are expected to put in place organizational procedures appropriate to their size and scale and to the nature of their operation to ensure the prevention of bribery and corruption. Every person holding a position of authority in a Supplier company shall report to the Ethics and Anti -Corruption Commission within a period of twenty-four (24) hours any knowledge or suspicion of instances of bribery.

2.2.2 Gifts and other business courtesies

It is Safaricom’s policy that all staff should not accept gifts or favours from a customer, potential customer, supplier or potential supplier of goods or services to the company irrespective of the value of the gift.

Suppliers shall ensure that any expenditure incurred in relation to any Safaricom employee or government official is in the ordinary and proper course of business and cannot reasonably be construed as a bribe or so as to secure unfair preferential treatment.

Any queries on this can be made by sending an email to the Ethics Helpdesk

([email protected]). Reports on any irregularities noted can be made directly to the Ethics Helpdesk or anonymously via the Ethics hotline shown in section 3.0

2.2.3 Conflicts of Interest

No supplier shall enter into a financial or any other relationship with a Safaricom employee that creates a conflict of interest for Safaricom. A conflict of interest arises when the material personal interests of the Safaricom employee are inconsistent with the responsibilities of his/her position with the company. All such conflicts must be disclosed and approval to the transaction given. Conflicts of interests should be disclosed via email to [email protected].

The Supplier will comply with all local laws relating to labour, employee health and safety and wages.

2.3.1 Child Labour Safaricom suppliers and their subcontractors will not hire children, a child being any person below the age of 16 years unless in the case of Kenya operations under apprenticeship and, in a technical institution, unless authorized under the Industrial Training Act (Cap 237 Laws of Kenya) and supervised by a public authority.

2.3.2 Forced Labour and Disciplinary Practices Suppliers will: • Not use forced labour nor require any worker whether local or foreign to remain in employment for any period of time against his or her will. • Treat workers with respect and dignity and ensure workers are not subjected to any form of physical, sexual, psychological, or other form of harassment or abuse. • Ensure that workers are free to express their views about their workplace conditions without fear of retribution or losing their jobs.

 

2.3.3 Freedom of Association Suppliers will allow and respect their employees’ right to form or join trade unions of their own choice and to bargain collectively.

2.3.4 Wages and benefits Suppliers will meet minimum wage requirements and will ensure that all statutory deductions as required under any local laws from time to time are complied with. Suppliers will ensure that working hours as provided for in any employment legislations or regulations in force from time to time to time or in any collective bargaining agreement entered with the employee’s trade union are observed. Suppliers will furthermore ensure that workers are provided with at least one day off during any seven-day working period.

 

2.3.5 Health and Safety Suppliers will assess the risks posed by their activities through a risk assessment in relation to the safety and health of their workers, visitors or any other person exposed to their activities, and put in place appropriate control measures to ensure a safe and healthy work environment. In addition, suppliers are expected to comply with any local laws and regulations relating to Occupational Safety and Health as well as Safaricom Health and Safety requirements

At Safaricom PLC, environmental responsibility is an issue that continues to grow in importance as the size of our network continues to expand. We remain committed to operating in an environmentally sound and sustainable way, managing, and reporting our environmental performance openly and transparently and we have established structures and functions responsible for driving environmental management. Integrating the United Nations Sustainable Development Goals (UN SDGs) and proactively implementing various green initiatives across the business, further affirms Safaricom’s commitment to address climate change and the preservation of natural resources.

This Environmental Responsibility sets forth the minimum standards of business conduct that we expect from all our suppliers:

1. Compliance with laws: All suppliers shall comply fully with all laws, standards, and regulations applicable to them.
   
2. Environmental sustainability: Safaricom PLC expects its suppliers to demonstrate a clear understanding of the environmental risks, impacts and responsibilities associated with the products and services they provide:
   
   1. Suppliers should have in place an effective environmental policy, statement, or program to mitigate environmental risks, the implementation of which should be evident throughout all levels of the company.
      
   2. Suppliers to refrain from harmful changes to the soil, water and air pollution, harmful noise emissions, and excess water consumption that significantly impair the natural ecosystems.
      
   3. Suppliers should have processes in place to ensure that their operations conform to all applicable environmental legislation. All required environmental permits, approvals and registrations are to be obtained, maintained, and complied with in accordance with the conditions and requirements defined therein. Environmental performance should be measured, monitored, and reviewed regularly. The supplier should endeavor to make continuous improvements in environmental performance through practicable measures and employ leading practices where possible.
      
3. Safaricom PLC requires that the supplier shall also make continuous efforts to reduce their environmental pollution and risks and improve environmental protection within their own sphere of influence on an ongoing basis. The use of resources (energy, water, raw materials and/or (primary) materials) and the environmental impacts (emissions, pollutants, waste) are to be consistently minimized.
   
4. Safaricom PLC is cognizant of impacts of climate change to planet, businesses and people and is committed to being a net carbon emitting organization by 2050. Subsequently, PLC requires suppliers to implement measures to reduce their direct and indirect CO2 emissions (including in its upstream value chain).

2.5.1 Licenses and Returns 

The Supplier will be required to obtain and renew, in accordance with any law or regulations all permits, licenses and authorizations required for it to carry out its business. In addition The Supplier will be required to prepare and file any returns that it may be required to file under its incorporation statute, the Companies Act (Cap 486 Laws of Kenya) or applicable local or Kenyan revenue legislation.

2.5.2 Taxation, Financial Integrity, and Retention of Records

2.5.2.1 The Supplier will comply with all revenue laws and will not evade tax.

2.5.2.2 Suppliers will be required to maintain accurate and reliable financial and business records and shall not have any false or inaccurate accounting books or records related to Safaricom for any reason. Suppliers shall maintain all business records at the minimum in compliance with the provisions outlined by the Kenya Revenue Authority or local revenue authorities from time to time.

2.5.2.3 When any government investigation or audit is pending or ongoing then Suppliers will not destroy any relevant records until the matter has been investigated and closed.

Safaricom is committed to delivering sustained, consistent, and exceptional services to its customers and meeting the expectations of all stakeholders even in the event of any disruptions. In view of this, Safaricom has implemented a Business Continuity Management System (BCMS) according to the requirements of ISO 22301:2012. Safaricom recognizes the fact that our suppliers play critical roles in the success of our business continuity program. Safaricom therefore requires its suppliers to develop and establish a robust framework for documenting, maintaining, and testing business continuity and recovery procedures. Specifically, the Supplier shall:

• Have its own business continuity management system, based on an accepted standard
  
• Establish and maintain business continuity strategies and plans which ensure that the Supplier can continue to deliver its services to Safaricom in the event of any major incident or crisis, and which are compliant with the agreed business continuity requirements and objectives of Safaricom.
  
• Provide Safaricom with a copy of Supplier's top level business continuity policy.
  
• Review business continuity strategies and plans in the event Safaricom identifies a weakness or noncompliance and implements the agreed improvements within a reasonable timeframe.
  
• Directly support Safaricom’s Crisis Management Team upon request by Safaricom.
  
• Promptly and accurately complete and return any Safaricom business continuity questionnaire whenever requested by Safaricom.
  
• Participate in Safaricom's managed business continuity exercises or audits as requested by Safaricom.
  
• Notify Safaricom in case of any incident that could disrupt provision of goods or services to Safaricom.
  

If the Supplier breaches the obligations in this policy or Safaricom identifies a weakness in the Supplier's business continuity management system, Safaricom has the right to audit the Supplier.

Despite the value delivered by suppliers in delivering crucial skills, services, products and resources, assets that are accessible by suppliers need to be protected. In this regard, Safaricom has implemented an information security management system that mandates Safaricom to comply with ISO 27001:2022 information security requirements. This entails maintaining an agreed level of information security and service delivery in line with supplier agreements.

 Information security incidents such as inappropriate access to or disclosure of sensitive information, Loss of intellectual property or inability of the supplier to maintain the agreed level of information security and service delivery in line with the supplier agreement would potentially diminish the benefits obtained and negatively impact on the Information security position of the company.

In this regard, all Safaricom suppliers shall:

• Promptly and accurately complete and return any Safaricom Information Security Questionnaire whenever requested by Safaricom.
• Safeguard the security of all Safaricom Confidential Information using appropriate security systems and processes reasonably acceptable to Safaricom.
• Perform regular and full testing procedures on such security systems and processes.
• Permit Safaricom, upon reasonable notice to Supplier, to conduct security audits against such security systems and processes (including the right to test the security of any hardware and software used by the supplier in the performance of its obligations under the contract).
• Not reduce the security levels associated with such security systems and processes as defined within the Information Security Questionnaire without Safaricom's prior written consent.
• Advise Safaricom of changes to the security implementation via an update to the Information Security Questionnaire on an annual basis; and
• Notify Safaricom’s ‘Security Operations Centre’ by email at [email protected] immediately after becoming aware of an incident where any Safaricom Confidential Information is at risk of unauthorized or unlawful disclosure, loss, or damage. 
• Provide external independent assessment report upon request e.g., SOC reports, independent audit reports, Security ISO certificates where applicable.

To increase business efficiency and customer satisfaction, Safaricom has embedded a quality management system, in this regard, Safaricom requires all Suppliers to;

To increase business efficiency and customer satisfaction, Safaricom has embedded a

quality management system, in this regard, Safaricom requires all Suppliers to;

• Explicitly review and understand all requirements provided by Safaricom in relation to the product or service being offered.
• Ensure resources are available to participate in product quality planning, as requested and establish a change control system that reacts to changes in a timely and accurate fashion.
• In all cases, acquire written approval from Safaricom prior to implementing any change that may impact form, fit, function, quality, reliability, safety, delivery, service or its compliance with regulatory and statutory requirements. This shall include, but not limited to, manufacturing processes, quality standards for acceptance, and testing requirements.
• Have a documented process for managing quality including continual quality system development.
• Measure own performance against all given Key Performance Indicators (KPI´s) from Safaricom.
• Maintain process, product, and service capabilities to fulfil Safaricom requirements and controls throughout the Supplier’s entire supply chain for the respective Products.
• Possess expertise and resources to perform effective root cause analysis, and to take corrective and preventive actions.
• Notify Safaricom of any potential or actual non-conformance in Products supplied to Safaricom that may affect its form, fit, function, quality, reliability, safety, delivery, service, or its compliance with regulatory and statutory requirements.
• Be responsible and accountable for the impact of poor Supplier Product quality on Safaricom, and Safaricom customers.
• Comply with all its obligations towards Safaricom, including, but not limited to: Recognized and certified Quality Management System (QMS)
• Safaricom’ s Customer Specific Requirements (CSR)
• Warranties

Any exception or deviation to the requirements, terms, and conditions of this Supplier Quality policy, including, but not limited to exceptions or deviations to Safaricom expectations, requires Safaricom prior written approval.

Safaricom requires all its suppliers to sign up to the Code of Ethics for Business in Kenya at contract award. Code_of_Ethics_for_Business.pdf. Code of Ethics for Business Commitment Letter

If a supplier becomes aware of unethical acts either by Safaricom, its staff or other suppliers they should report all pertinent details via one of the following channels;

Toll free number; 0800 720 009

Email; [email protected]

Website: https://www.safaricomethicsline.com

The channel allows for anonymous reporting. Safaricom will investigate the matter in confidence.

Suppliers will be required to comply with the Data Protection Act of Kenya, 2019. This section applies to all Suppliers who have access to any personal information(information that can identify a person either directly or indirectly such as name, identification number, date of birth, gender, transaction data, location data, call data records, MPESA transactions, an online identifier or to one or more factors specific to the physical, psychological, genetic, mental, economic, cultural or social identity of that Personal.)

In respect of Personal Information supplied by Safaricom to you as a Supplier, you are required as a data processor to comply with the provisions of the Data Protection Act.

As the data controller we are obligated to set out the following requirements. You will be required to:

• retain the Personal Information for as long as is reasonably required to achieve your obligation under this agreement and in accordance with applicable laws and regulations;
• take all appropriate technical and organisational measures against unauthorised or unlawful processing of Personal Information and against accidental loss or destruction of, or damage to, Personal Information;
• not publish, transfer, distribute, sell, sub-license, disclose or otherwise part with the Personal Information, or permit any third party, including its Affiliates, to use or exploit the Personal Information without the express written consent of Safaricom;
• Not create copies or duplicates of the data without the knowledge of Safaricom; not transfer any Personal Information outside the Territory without Safaricom’s prior written consent or where provided for in the contract with us;
• immediately inform Safaricom of any inspections and measures conducted by any supervisory authority, insofar as they relate to Personal Information shared by Safaricom, in such a case please [email protected];
• respond to queries, complaints and other correspondence with any Regulatory Body in relation to the processing of Personal Information only after consultation with, and in accordance with the instructions of, Safaricom;
• without undue delay, assist Safaricom, where requested, in investigating queries or complaints about the Personal Information and the processing of the Personal Information or where Safaricom needs your cooperation in complying with any of the obligations under the Data Protection Regulations such as impact assessments;
• permit Safaricom access on reasonable notice to its premises, Systems, books and records and all information in relation to the processing of Personal Information as Safaricom may reasonably require to ensure compliance with data protection regulation and with the requirements outlined herein;
• within twenty-four (24) hours, notify Safaricom of any breach of this clause on Data Protection and provide Safaricom with such details regarding: the nature of the Personal Data Breach, any investigations into such Personal Data Breach and any measures taken, or that the Partner recommends, to address the Personal Data Breach.

All suppliers, their employees, agents, and sub-contractors will be required to comply with Safaricom PLC internal policies and procedures which makes reference to local and international Anti-Money Laundering (AML) and Combating Financing of Terrorism (CFT) and Combating Proliferation Financing (CPF) Regulations. This involves complying with the AML/CFT (Amendment) Act 2023, the Proceeds of Crime and Anti-Money Laundering Act and its Regulations, Prevention of Terrorism (Implementation of the United Nations Security Council Resolutions on the Prevention and Suppression of Terrorism) Regulations 2023, The Prevention of Terrorism (Implementation of the United Nations Security Council Resolutions on Prevention and Suppression and Disruption of Proliferation Financing) Regulations, 2023 and any other relevant laws and regulations applicable in the different jurisdictions of incorporation.

Suppliers shall, in the context of the Agreement:

• comply with all Anti-Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing laws and regulations enacted or enforced by Regulatory Authorities and other Supervisory bodies and any other AML/ CFT/ CPF regulations applicable in other jurisdictions, where the Suppliers are incorporated or have operations;
• not knowingly do anything which may cause a breach in Anti-Money Laundering Combating the Financing of Terrorism and Countering Proliferation Financing laws; 
• cease from entering into arrangements or transactions, directly or indirectly, (i) in violation of any Kenyan, international, or other Anti-Money Laundering and Combating the Financing of Terrorism and Countering Proliferation Financing law or (ii) with persons or entities whose names appear on international sanctions lists of designated entities, Kenyan sanctions list or any other state list, restricting or prohibiting transactions with such persons or entities;
• not finance terrorists or those engaged in illicit activities including money launderers, international narcotics traffickers, and those engaged in activities related to the proliferation of weapons of mass destruction;
• train its employees, agents and sub-contractors in all applicable laws againstinadequate internal controls, money-laundering, financing of terrorism and proliferation financing;
• provide such assistance, documentation and information to the other party as that Party may reasonably request, including but not limited to, written policies and procedures relating to relevant compliance laws including but not limited to enforcing the laws relating to detection and prevention of money laundering, Financing of Terrorism and Proliferation Financing law;
• notify Safaricom PLC in writing as soon as it becomes aware of an actual or potential suspicious activity/investigation/breach in relation to the Applicable Laws or any material change in status, in relation to this agreement, in respect of money laundering, financing of terrorism or proliferation financing;
• be advised that Safaricom shall terminate this agreement if any of the provisions of this clauses are breached;
• Safaricom shall seek indemnities from the Supplier which has breached the relevant provisions for any direct losses incurred.

Safaricom reserves the right at its discretion to terminate the contract where there is breach of the provisions of the code of conduct. In other instances, Safaricom may require that corrective action is carried out before it continues partnership with the supplier.

Safaricom reserves the right to vary this Code at any time.

1st April 2024