Code of Ethics and Conduct

1.Purpose

This Code of Ethics and Conduct sets out the principles, duties, prohibitions and minimum procedures that guide the conduct of ARCA and of all persons acting on its behalf, directly or indirectly. Its purpose is to ensure conduct that is ethical, transparent, responsible and consistent with applicable law, good governance practices, internationally recognized human rights and the socio-environmental safeguards applicable to conservation, restoration, carbon credit generation and community development projects.

This Code must be interpreted as a binding normative instrument. Its provisions are not exhaustive and must be applied consistently with the values, internal policies, contracts, operating procedures and legislation applicable to ARCA's activities.

2.Scope and applicability

This Code applies to all officers, directors, employees, collaborators, consultants, representatives, service providers, suppliers, business partners, project partners, subcontractors and any third parties acting on behalf of ARCA or in connection with its activities.

Compliance with this Code is a condition for maintaining professional, commercial, institutional or contractual relationships with ARCA. Whenever appropriate, suppliers, consultants, partners and other third parties must be made aware of this Code in advance and declare their adherence to its integrity, human rights, safeguards and conduct obligations before signing contracts or starting activities.

3.Institutional values and principles

ARCA operates on the conviction that environmental, climate and socioeconomic solutions will only be legitimate, effective and lasting when they recognize the contribution of all the actors involved, especially Indigenous peoples, extractivist communities, quilombola communities, agrarian reform settlers, local populations and other holders of territorial, cultural and socio-environmental rights.

ARCA's non-negotiable principles are:

Ethics: honest, loyal and responsible conduct, consistent with good faith in all relationships.

Integrity: decisions based on technical criteria, made transparently, grounded in evidence and seeking institutional consistency.

Governance: structured, documented decision-making subject to proportionate control and oversight mechanisms.

Equity: recognition of the cultural, social, economic, linguistic and territorial differences among stakeholders.

Respect for human rights: commitment to dignity, non-discrimination, non-coercion, the protection of vulnerable groups and respect for the self-determination of peoples and communities.

Transparency: clear, accessible and traceable communication, appropriate to the context of each stakeholder.

Socio-environmental responsibility: prevention, mitigation and remediation of risks and impacts associated with the company's activities.

4.Human rights, Indigenous peoples and traditional communities

ARCA is committed to respecting and promoting internationally recognized human rights, applicable Brazilian legislation and the socio-environmental safeguards relevant to its activities. In projects involving Indigenous peoples, traditional communities or local populations, ARCA's actions must observe the principles of self-determination, cultural respect, informed participation, good faith, non-coercion, transparency, fair and equitable benefit sharing and free, prior and informed consent, whenever applicable.

Any conduct that affects the dignity or the physical, moral, cultural, territorial, economic or institutional integrity of communities, leaders, associations, employees, suppliers or other stakeholders is prohibited.

Interactions with communities must be conducted in accessible language, with respect for representative and traditional structures, proper recording of relevant information and, whenever necessary, translation or cultural mediation support. ARCA must ensure that its teams and third parties act in a manner consistent with consultation protocols, territorial management plans, community governance structures and the other instruments of the communities involved.

5.Non-discrimination, diversity and inclusion

ARCA does not tolerate any form of discrimination, prejudice, segregation, humiliation, intimidation or undue unequal treatment. Discrimination based on, among other factors, race, color, ethnicity, people or community of origin, nationality, gender, gender identity, sexual orientation, age, religion, disability, social condition, marital status, political opinion, union affiliation, territorial origin, economic condition or any other characteristic protected by law or incompatible with the company's values is prohibited.

Processes for hiring, promotion, evaluation, compensation, allocation of activities and contracting of third parties must follow technical, objective, transparent and non-discriminatory criteria, and may include legitimate measures for inclusion and for valuing local, traditional, scientific, empirical and technological knowledge.

6.Preventing and combating moral harassment, sexual harassment and abuse of authority

ARCA prohibits any form of moral harassment, sexual harassment, sexual importunement, intimidation, embarrassment, abuse of authority, threats, retaliation, humiliating conduct or behavior that creates a hostile, offensive, unsafe or degrading environment.

Examples of prohibited conduct include, without limitation:

offensive, discriminatory, sexualized, derogatory or humiliating comments;

non-consensual physical contact, unwanted advances, persistent invitations or sexual innuendo;

threats, shouting, public exposure, persecution, deliberate isolation or abuse of hierarchical power;

messages, images, audio recordings, videos or digital communications with offensive, discriminatory or sexually inappropriate content;

making any professional opportunity, hiring, payment, continued participation in a project, access to benefits or any other advantage conditional on the acceptance of improper conduct.

Any suspicion or occurrence must be reported through ARCA's whistleblowing channels. The company will take proportionate measures to protect the persons affected, investigate the facts and hold those involved accountable.

7.Decent work and prohibition of child labor, forced labor and human trafficking

ARCA does not condone or tolerate, and will not hire, people or organizations involved in child labor, forced labor, work analogous to slavery, debt bondage, human trafficking, sexual exploitation, illegal recruitment, improper retention of documents, restriction of freedom, degrading working conditions, abusive working hours or any practice contrary to labor legislation and human rights.

This prohibition applies to employees, suppliers, consultants, subcontractors, business partners and any third parties directly or indirectly involved in ARCA's activities. If suspicion or evidence of such practices is identified, ARCA may take immediate measures, including the precautionary suspension of activities, withholding of payments where legally permissible, contract termination, disqualification from new contracts, reporting to the competent authorities and the adoption of corrective or remedial measures.

Suppliers and service providers must comply with labor, social security and occupational health and safety legislation, and keep supporting documentation available when requested by ARCA in due diligence processes, audits or investigations of reports.

8.Professional conduct and work environment

All employees and third parties must act with courtesy, cooperation, diligence, responsibility and respect. Technical discussions must be based on objective arguments, data, evidence and professional criteria; personal insults, attacks on a person's honor, abusive disparagement or conduct that undermines collaboration are prohibited.

The responsible management of ARCA's data, information, property, financial resources and intangible assets is everyone's duty. Professional activities must be carried out in a manner consistent with the company's objectives, its socio-environmental commitments and this Code, even when adopting safer, more inclusive or more transparent conduct entails greater operational effort or reasonable cost.

9.Relationship with project partners and communities

Project partners, especially Indigenous peoples, extractivist communities, quilombola communities and agrarian reform settlers, are central to ARCA's work. Relationships with these actors must be guided by attentive listening, dialogue, good faith, cultural respect, transparency, accessible language, proper documentation and respect for their own forms of social organization and collective decision-making.

ARCA must ensure that relevant project information is presented in an objective, understandable and culturally appropriate manner, with sufficient time for clarifying questions, internal discussion, collective validation and free expression by the communities involved. Where applicable, consultation protocols, Territorial and Environmental Management Plans (PGTAs), association bylaws, assembly decisions and other community instruments must be observed.

No employee, consultant or third party may induce, pressure, coerce or improperly condition community decisions. The project's benefits, financial expectations, risks, limitations, contractual duties and uncertainties must be presented in a balanced and transparent manner.

10.Stakeholder engagement and transparent communication

ARCA must maintain clear, accessible and traceable communication channels with relevant stakeholders, including communities, associations, partners, suppliers, buyers, certification bodies, auditors, public institutions and other interested parties.

Relevant institutional communications must follow the internal oversight and recording procedures defined by the company. Whenever the context requires, appropriate records must be produced, such as minutes, attendance lists, reports, official letters, confirmation emails, authorized photographic or audiovisual records, translations, explanatory materials and feedback to participants.

Communication must be respectful, objective and appropriate to the intended audience. ARCA must avoid ambiguous language, incomplete information, unauthorized promises, misleading statements, undue pressure or any practice that may compromise the free and informed understanding of stakeholders.

11.Relationship with third parties, suppliers and contractors

The contracting of third parties must follow technical, reputational, financial, socio-environmental and integrity criteria proportionate to the risk of the engagement. Whenever appropriate, ARCA will conduct a transparent selection process, with clear terms of reference and an objective description of the scope, deliverables, responsibilities, evaluation criteria and monitoring mechanisms.

Third parties must comply with this Code, applicable internal policies, current legislation and contractual clauses on integrity, human rights, data protection, confidentiality, anti-corruption, socio-environmental safeguards and decent work. Before contracts are signed, ARCA must make available or communicate the essential conduct and compliance requirements applicable to the engagement.

ARCA may carry out due diligence, audits, document requests and monitoring proportionate to the risk of each engagement. Material violations may result in a warning, a corrective action plan, suspension, contract termination, disqualification and reporting to the authorities, as appropriate.

Exclusivity, non-compete or territorial restriction clauses should only be used when justified by ARCA's legitimate interest, proportionate to the risk, limited in scope, duration and territory, and formalized in a contract, avoiding restrictions that are excessive or incompatible with applicable law.

12.Relationship with clients

Clients must be served with diligence, technical accuracy, transparency and courtesy. ARCA must seek to understand each client's needs and present information that is consistent, verifiable and compatible with the stage of development of the projects, avoiding undue promises or claims that cannot be substantiated.

Communications with clients should preferably take place through official channels or means authorized by the company, with proper recording of relevant negotiations, decisions, proposals, commitments and follow-up actions.

13.Relationship with competitors and competitive integrity

ARCA respects fair competition and will act in accordance with applicable competition law. Any form of market allocation, price fixing, collusion on commercial terms, improper exchange of competitively sensitive information, manipulation of competitive processes or conduct intended to unduly restrict free competition is prohibited.

Non-public information about competitors must not be obtained by unlawful, deceptive or abusive means or by means contrary to good faith. Institutional contacts with competitors must have a legitimate purpose, be properly recorded and, when necessary, be authorized in advance by the Executive Board or the compliance area.

14.Relationship with political parties

ARCA does not make donations of goods, money or advantages to political parties, candidates, election campaigns or party-political organizations, nor does it reimburse donations made by employees in a personal capacity.

The use of ARCA's property, resources, brand, channels, facilities or working time for party-political propaganda, election campaigning or ideological indoctrination is prohibited. Employees' personal convictions must remain separate from the company's technical and institutional activities.

15.Relationship with public officials

Relationships with public officials must observe legality, transparency, integrity, a legitimate institutional purpose and proper recording. Relevant contacts must take place through formal or authorized channels, with clear identification of the subject matter, participants and follow-up actions.

Meetings with public officials should, whenever feasible, be attended by at least two ARCA representatives, or be followed by a record of the discussions and follow-up actions. In virtual meetings, recording may take place with the participants' consent and using secure tools. When there is no recording, it is recommended that an objective summary be sent to the participants and recorded internally.

It is prohibited to offer, promise, authorize or grant any undue advantage, benefit, gift, payment, favor, donation, sponsorship, hospitality or incentive to a public official for the purpose of obtaining information, a decision, an omission, favorable treatment, an authorization, a license, a commercial advantage or any other undue benefit.

Kinship or relevant personal ties between employees, partners or third parties and public officials must be disclosed to the compliance area for the assessment of potential conflicts of interest and the adoption of mitigation measures.

16.Anti-corruption, giveaways, gifts, donations and hospitality

ARCA prohibits bribery, corruption, fraud, facilitation payments, money laundering, illicit financing, undue advantages and any practice intended to improperly influence decisions.

Donations, sponsorships, giveaways, gifts, hospitality or representation expenses may only occur when they have a legitimate purpose, a reasonable value, approval in accordance with internal authority levels, proper accounting records, no expectation of undue reciprocity and compliance with applicable law.

Receiving or offering giveaways, gifts or advantages that may compromise independence, create an appearance of impropriety, influence decisions or create an obligation of reciprocity is prohibited. Items intended for public officials must comply with legal restrictions and specific internal policies, and any offer that could constitute an undue advantage is prohibited.

17.Conflicts of interest

A conflict of interest occurs when personal, family, financial, political, professional or third-party interests may influence, or appear to influence, decision-making in ARCA's best interest.

Employees, partners and third parties must notify the compliance area in advance of any actual, potential or apparent conflict of interest, including equity interests in suppliers or competitors, family relationships with public officials or partners, outside activities, receipt of advantages, supplier referrals, ties to communities or associations involved in projects and any circumstance that may compromise independence or impartiality.

The compliance area will assess the situation and recommend mitigation measures, such as exclusion from decision-making, enhanced supervision, formal recording, replacement of the person responsible, contractual amendments or other appropriate measures.

18.Use of company property, resources and brand

ARCA's property, equipment, systems, financial resources, information, intellectual property, brand and other assets must be used exclusively for legitimate professional purposes, in a responsible and efficient manner consistent with this Code.

ARCA may monitor the use of corporate equipment, systems and channels, in compliance with applicable law and data protection rules, for the purposes of security, integrity, fraud prevention, information protection and operational continuity.

19.Protection of information, confidentiality and personal data

ARCA will handle information and personal data ethically, securely, transparently and in a manner compatible with the purpose for which they were collected, in compliance with Law No. 13,709/2018 — the Brazilian General Data Protection Law (LGPD), contracts, authorizations and applicable internal policies.

Confidential information includes any data, document, strategy, business model, or technical, financial, commercial, community, territorial, contractual or institutional information that is not public or that has been received as a result of ARCA's activities. Such information may not be disclosed to third parties without prior, express and formal authorization from the company's competent authority or from the owner of the information, as applicable.

Sensitive information concerning communities, Indigenous peoples, project partners and stakeholders must receive enhanced protection, especially when it involves territorial location, cultural data, personal data, audiovisual records, information on community governance, financial data, traditional knowledge or strategic project information.

Passwords and access credentials are personal and non-transferable. Confidential documents must be classified, stored in secure environments and properly disposed of when no longer needed.

20.Whistleblowing channel, complaints and grievance mechanism

ARCA will maintain accessible channels for receiving reports, complaints, questions and accounts of non-compliance with this Code, internal policies, contracts, legislation or socio-environmental safeguards. The channels may be used by employees, suppliers, consultants, partners, communities, associations, clients, public institutions and any other stakeholders.

Reports may be submitted through ARCA's website, institutional email, contact with the compliance area or other channels officially announced by the company. Whenever legally permitted, anonymous reports will be accepted. ARCA will encourage identified reports when this allows for better investigation and feedback, but will not make the handling of a report conditional on the identification of the whistleblower.

In projects with Indigenous, extractivist, quilombola or agrarian reform settler communities, ARCA must provide or recognize culturally appropriate means of submitting complaints, including the possibility of oral communication, submission through associations or leaders, translation support, in-person meetings, simplified forms or other formats compatible with local realities.

Reports and complaints must be recorded, classified, assessed and handled with confidentiality, impartiality, promptness and proportionality. Where possible and appropriate, an identified whistleblower should receive acknowledgment of receipt, information on the progress of the case and feedback on its closure, while preserving confidentiality, data protection and the integrity of the investigation.

21.Protection against retaliation

ARCA prohibits any form of retaliation against any person who, in good faith, submits a report, complaint, question, request for guidance, information about a risk or suspicion of wrongdoing, or who cooperates in an internal investigation. Retaliation includes dismissal, threats, embarrassment, isolation, loss of opportunities, reduction in pay, exclusion from activities, contractual harm, intimidation, persecution or any other undue adverse consequence.

Retaliation will be considered a serious violation of this Code and may result in the appropriate disciplinary, contractual and legal measures.

22.Investigation of reports and disciplinary measures

Every report or complaint received must be assessed in accordance with an internal investigation procedure. The analysis may involve collecting documents, conducting interviews, preserving evidence, taking precautionary measures, consulting internal or external experts and notifying the competent authorities when required by law or advisable given the seriousness of the facts.

Disciplinary or contractual measures will be proportionate to the seriousness of the conduct, the degree of involvement, recurrence, the impacts caused and the cooperation of those involved. They may include guidance, training, a warning, suspension, replacement of the person responsible, a corrective action plan, contract termination, disqualification, a ban on new contracts and reporting to the competent authorities.

Reports that are proven to be false and made in bad faith may also result in appropriate measures. The mere lack of confirmation of the facts will not constitute bad faith when the report was submitted on the basis of a legitimate concern.

23.Training, acknowledgment and implementation

ARCA must promote communication, training and awareness measures regarding this Code and its related policies, proportionate to the risk profile of each role or engagement. Training may include onboarding of new employees, periodic refresher sessions, training for field teams, guidance for suppliers and attendance records.

Employees and relevant third parties must acknowledge this Code and commit to complying with its provisions. The area responsible for compliance will keep records of versions, communications, training sessions, adherence statements and evidence of implementation.

24.Governance of the Code

This Code will be approved by ARCA's Executive Board and reviewed periodically, or whenever legal, regulatory, operational, contractual, socio-environmental or risk-related changes warrant an update.

The compliance area will be responsible for supporting the implementation, interpretation, communication, monitoring and updating of this Code, without prejudice to the responsibility of each employee, manager, director, supplier, consultant and partner for fulfilling their obligations.

Questions about the interpretation or application of this Code, or about conflicts between this Code and internal policies, contracts or applicable legislation, must be submitted to the compliance area before any decision is made.

25.Final provisions

This Code will remain in force for an indefinite period from its approval and will remain available, in its updated version, on ARCA's official channels. The current version must be communicated to employees and, where applicable, shared with third parties, suppliers, partners and other relevant stakeholders.

ARCA reaffirms its commitment to compliance with applicable law, business integrity, human rights, the protection of Indigenous peoples, extractivist communities, quilombolas and agrarian reform settlers, institutional transparency and the continuous improvement of its governance, compliance and socio-environmental safeguard mechanisms.