Strong governance
and ethical behavior
Leadership in action
Corporate governance and Board details
To demonstrate our commitment to sustainable business practices, we continuously develop our governance framework by refining board charters, policies and overall governance practices. We maintain stringent protocols to uphold high standards of conduct, ethics and checks and balances throughout our operations. stc is working to align its governance of sustainabilityrelated matters with IFRS S1 and S2 standards, enabling partners to understand the processes, controls and procedures we use to monitor, manage and oversee sustainability-related risks and opportunities.
Our corporate governance framework is structured around a clear strategy, welldefined goals, and a precise allocation of responsibilities, ensuring operational efficiency and effectiveness. stc Group is managed by a Board of Directors consisting of 11 members appointed by shareholders for terms of up to 4 years. Shareholders can nominate themselves or others for Board membership, within the limits of their shareholdings.
Board oversight of sustainability and ethical issues
The Executive Management Sustainability Committee, chaired by the GCEO, develops, approves and updates stc’s Statement of Purpose, values and mission, strategies, policies and goals related to sustainability and ethics issues, with oversight from the Board of Directors.
| Governing body | Responsibilities | |
|---|---|---|
| Board of Directors |
|
|
| Executive Management & Sustainability Committee (chaired by GCEO) |
|
|
| Group Chief Strategy Officer (GCSO) |
|
|
Board diversity
Our Board and standing committees are diverse, comprising members from a wide range of industry and professional backgrounds, as well as varying areas of expertise that align with our business needs. stc’s Board actively promotes diversity and supports initiatives aimed at increasing representation in senior management and across other areas of the Group. In 2024, women constituted 18% of our Board.
By gender
By nationality
By age
11
4
18%
Our 11-member Board of Directors brings together a diverse range of skills, expertise and industry experience, ensuring robust governance and strategic oversight. The Board comprises leaders with backgrounds in the following.
Performance evaluation and remuneration
To align financial incentives with long-term sustainability goals, our annual variable compensation scheme incorporates sustainability indicators as a key component. Our sustainability index is embedded in our corporate priorities index, comprising 10% of the performance appraisal criteria for top management’s short-term variable remuneration, with sustainability-specific metrics accounting for 5%. It should further be noted that of the 30% given over to strategic programs, some of this is for programs that have a strong sustainability focus.
Governance with integrity
Business ethics
stc upholds integrity through transparency, accountability and responsible business practices. We adhere to regional standards and respect human rights, setting high ethical benchmarks in the telecom and ICT sectors.
stc’s governance framework confirms transparency, integrity and trust, safeguarding stakeholder rights and interests. Our proactive risk management approach prevents corruption and reinforces a culture of accountability.
Code of ethics: Integrity takes us forward
Ethical considerations form the backbone of stc’s approach to managing information, engaging with employees, allocating resources and addressing sustainability, making sure the Group’s broader impact on society is positive and responsible. stc’s Code of Ethics, titled “Integrity Takes Us Forward”, embodies the Group’s core values of Dynamism, Devotion, and Drive, providing clear guidance and practical advice on conduct expectations. The Code addresses 16 key areas of integrity risk, serving as a reference for employees, customers, business partners, suppliers and other stakeholders.
Business ethics training
At stc, integrity and ethical conduct are at the core of our corporate culture. To uphold these values, all employees, including senior management and new staff members, are required to complete a mandatory Basic Online Integrity course. This training introduces the stc Code of Ethics and reinforces the Group’s unwavering commitment to ethical business practices. Additionally, employees must complete an Advanced Online Integrity course, offering a more in-depth understanding of compliance-related topics tailored to their roles and responsibilities.
Our integrity training series consists of 21 course modules, 9 of which are mandatory for all employees, while the remaining modules are assigned based on job profile and risk exposure. This structured training approach ensures employees at all levels are equipped with the knowledge and tools necessary to make ethical decisions and mitigate compliance risks.
100%
0
100%
In 2024, a total of 617 reports were received through the whistleblowing channels:
28
418
150
21
View our Whistleblowing policy here
https://www.stc.com/content/dam/groupsites/en/pdf/Whistleblowing-Policy-en.pdf
Anti-corruption and whistleblowing
stc’s Code of Ethics, alongside our Group-wide Anti Corruption and Anti-Fraud policies, explicitly prohibit facilitation payments across all Company areas, including all subsidiaries. These policies adhere to the principles and business guidelines established by Transparency International and are periodically reviewed to ensure continued alignment with global efforts to combat bribery, fraud and corruption.
Anti-competitive behavior
Fair competition is essential for a healthy and prosperous economy. We compete fairly by adhering to applicable competition laws and regulations. Our policies are designed to prevent anti-competitive and monopolistic practices, while managing associated legal risks. Our Code of Ethics emphasizes key commitments that help safeguard fair competitive practices, which are supported by senior management and implemented across the organization. A module on fair competition is included in stc’s mandatory Code of Ethics training series for all employees.
In 2024, as in prior years, stc faced no legal penalties related to anti-competitive behavior or violations of antitrust laws.
Compliance
Group-wide compliance
stc’s Corporate Compliance function plays a central role in promoting a strong culture of ethics and integrity across the organization. The Internal Audit function independently reviews all business units on a rolling three-year cycle, in line with the Institute of Internal Auditors (IIA) standards, with a focus on identifying and reporting potential instances of unethical behavior or fraud. Complementing these efforts, stc’s control functions, including Enterprise Risk Management (ERM) and Compliance, proactively monitor the risk and control environment to ensure continuous improvement in governance practices.
This structure also facilitates the implementation of policies, tools and evaluation mechanisms that guide the organization in meeting its compliance and ethical objectives.
stc’s Compliance function operates under a dual reporting framework to both the Board Audit Committee and the Risk Management and Compliance Committee. This approach highlights stc’s commitment to achieving the highest standards of transparency and accountability, reinforcing our ongoing efforts to uphold and increase ethical practices across all facets of our business operations.
| Theme | Strategic Pillars | Objectives |
|---|---|---|
|
C
|
Cultivate forward-looking digitization practices |
|
|
L
|
Lead compliance practices with a robust operating model |
|
|
E
|
Expand stc’s compliance capabilities |
|
|
A
|
Adopt the “Compliance in Business-As-Usual” approach |
|
|
R
|
Run effective compliance monitoring and evaluation |
|
Internal compliance monitoring and reporting
stc’s Corporate Compliance sector makes sure compliance and ethical standards are consistently upheld across the organization. The Internal Audit sector conducts thorough assessments of all stc functions on a rolling 3-year cycle. In line with IIA guidelines, Internal Audit also evaluates the potential for unethical behavior and fraud during audit engagements, reporting any identified occurrences when necessary.
Oversight of compliance and ethics is further reinforced by the Executive Management Sustainability Committee, chaired by the GCEO, which reviews and approves reports from the Head of Compliance on the implementation of the Code of Ethics and its related policies.
In 2024, stc remained fully committed to rigorous compliance with all laws and regulations across the countries in which we operate. We continue to foster positive and constructive relationships with relevant regulators to uphold shareholder rights, protect our reputation, and maintain our competitive position and market share.
As part of our commitment to conducting business with integrity, stc works exclusively with suppliers who uphold the same ethical standards. Given that supplier practices directly impact our corporate reputation, we require all suppliers to sign the Supplier Code of Conduct, confirming their commitment to compliance and ethical business practices.
100%
Our commitment to human rights
At stc Group, human rights are not just a policy, they are a core principle shaping our identity and business practices. They form the foundation of our integrity and the trust we build with stakeholders daily. Strong human rights policies do more than protect brand reputation; they adopt loyalty among investors, customers and employees while acting as a critical layer of risk management. From the way we operate our facilities to how we engage our suppliers and partners, our human rights commitment is embedded in every aspect of our business.
In the fourth quarter of 2024, stc’s CEO approved the new and improved stc Group Human Rights policy, a significant milestone that reaffirms the Group’s commitment to upholding the highest standards of ethical conduct. Aligned with the Universal Declaration of Human Rights, the International Labor Organization’s Declaration on Fundamental Principles and Rights at Work and guided by the UN Guiding Principles on Business and Human Rights, this policy reflects not just compliance but leadership. It is also tailored to meet the unique regulatory needs of our operations in Saudi Arabia and beyond.
Human rights training
At stc, we train our employees to uphold human rights principles within the organization. Our primary policy for addressing human rights issues is our Code of Ethics, which covers key areas such as fair employment, health and safety, and fostering a Speak Up culture. We also offer additional training related to human rights, including data protection and privacy, with specific courses for contractors. These training courses are mandatory, and all employees must complete them at least once.
In 2024, we offered 6 mandatory courses, totaling approximately 58,072 hours.
Risk management
The telecommunications sector faces growing challenges, including declining demand for voice services and surging data consumption, trends accelerated by the pandemic. Disruptive technologies are reshaping traditional revenue models, demanding rapid innovation and adaptation from telecom providers.
In a saturated market, differentiation through superior service offerings is crucial, alongside significant investments in infrastructure, robust data protection, and strict regulatory compliance. Telecom companies must broaden their portfolios and enhance customer experiences to maintain a competitive edge. stc’s risk management function is integral to its strategic framework, embedding risk considerations into planning, performance evaluation, and critical decision-making to drive sustainable impact.
The Board of Directors ensures the highest standard of corporate governance is maintained by regularly reviewing governance development best practices and making certain these are duly adopted. As a result, the Board has established the Board Risk Committee, which plays a key role in overseeing the implementation of the ERM framework, risk strategy and related risk management policies, as well as monitoring stc’s risk management system, reviewing the top risks and the management of those risks. The risk management function is independent and separate from stc’s business groups and sectors; it has completed its first wave of measures this year as per the Board-approved risk strategy to uplift current practices and maturity.
Safeguarding trust in a digital world
Data privacy and security
stc’s Code of Ethics commits us to the privacy, security and protection of customer data; and we have extensive governance processes to manage personal data and cybersecurity risks. We continuously monitor and assess potential threats to data privacy, implementing proactive measures to mitigate identified risks. By prioritizing data protection, we maintain the trust of our stakeholders, protect our reputation and uphold our commitment to responsible personal data stewardship. Our Data Protection and Privacy statements offer clear guidelines on various topics, including:
- The purpose of collecting customer data
- The types of personal data we collect and use
- Our methods for collecting personal data
- The duration of data storage
- The rights of data subjects, including customer rights for stc customers
In 2024, the DPP handled over 1,996 (2023: 1,400) data sharing requests, included data protection clauses in all contracts, and automated data destruction certificates to make sure vendors effectively wipe stc data upon project completion.
Our Data Protection and Privacy framework
stc’s Data Protection and Privacy (DPP) framework establishes 10 fundamental principles that all employees must uphold, regardless of their location.
Cybersecurity
Cyberattacks and professional data breaches are increasingly common, as sophisticated cybercriminal organizations challenge the limits of digital security. This trend necessitates the ongoing development, implementation and evaluation of security strategies for organizations.
In 2024, we completed our strategy to improve our cybersecurity. Key improvements and initiatives by 2024 include:
- Enhanced business resiliency across stc Group
- Shortened incident response time to under 2 hours
- Strengthened stc brand reputation and customer trust by monitoring internet-facing assets and social media for 13 subsidiaries
- Contributed to cybersecurity thought leadership through participation in over 20 global and local events
- Increased employee cybersecurity knowledge with 92% completion rate for employees and contractors fostering a culture of proactive security awareness
- Improved executive understanding of cybersecurity, providing workshops and practical insight to effectively promote and enforce cybersecurity best practices
- Fostered a culture of cybersecurity innovation, with one idea granted startup as a result of the cybersecurity hackathon
As cyber threats become more frequent, we rise to the challenge by tightening our cybersecurity measures and strengthening our defensive capabilities, our protocols and systems.
In 2024, stc recorded zero data security breaches, and zero incidents involving customers’ personally identifiable information (PII), no regulatory actions for data protection violations, and no financial losses from legal proceedings related to customer privacy across stc KSA, Bahrain, and Kuwait.
Data privacy and security training and awareness
Our customers, employees and stakeholders trust us to safeguard their personal information; a responsibility we take most seriously.
Our mandatory data privacy and protection training for stc KSA employees, subsidiaries and contractors, reinforces our Company culture as one that is highly informed and extremely strict on data privacy and protection.
stc conducts a variety of training and awareness campaigns in the fields of cybersecurity and data privacy for all employees and business partners, including:
In 2024, approximately 99% of stc KSA employees completed the mandatory data privacy and protection training. Among our subsidiaries, nearly 35% of employees and 62% of contractors completed the required sessions.
These comprehensive training sessions, averaging 3.5 hours, are delivered through our online learning platform. To ensure compliance, participants must pass the evaluation with a score of 70% or higher. If an employee does not complete the training, departmental GMs are notified, and appropriate actions are taken to remedy the gap.
Data privacy and security audits
As data privacy, protection and security regulations continue to tighten, companies handling personal data face increasingly stringent compliance requirements. To ensure stc’s full adherence to these evolving regulations, we undergo independent external audits of our data privacy and security practices at least once every 2 years.
Child online safety and protection
At stc, we recognize our responsibility in shaping a safer, more secure digital world for children. As a leading enabler of digital connectivity, we are committed to upholding children’s rights across all aspects of our business operations, proactively supporting both parents and young users in becoming responsible digital citizens. Our efforts focus on empowering families with the knowledge, tools and resources needed to navigate the digital landscape safely and confidently.
To support parents in safeguarding their children’s digital experiences, we provide a comprehensive, free parental guide, “Secure Cyberspace for Your Kids.”
Data privacy and security are at the core of our child protection initiatives. stc strictly adheres to robust data protection frameworks that guarantee secure processing of children’s personal information, in line with both internal policies and external regulatory standards.
Beyond technological solutions, stc actively promotes digital literacy and online safety awareness through dedicated educational initiatives.
Supply chain management
Our approach to sustainable procurement involves sourcing sustainable goods and services whenever possible while encouraging sustainable practices throughout the entire supply chain. We expect our suppliers and business partners to operate in alignment with our sustainability requirements and adhere to our principles on critical issues such as safety, human rights and environmental responsibility.
Supplier Code of Conduct
stc’s Responsible Supply Chain policy reaffirms the Group’s commitment to maintaining and promoting responsible business practices with suppliers, while advocating for integrity and transparency in all dealings. Additionally, stc’s Supplier Code of Conduct is a contractual obligation for all suppliers, mandating fair employment practices for their workforces. Compliance is enforced by guaranteeing suppliers respect the dignity, privacy and rights of employees and associated contractors, refraining from unlawful discrimination and the use of child or forced labor, and avoiding exceeding applicable working hours or unfairly compensating employees. Suppliers can also use our Speak Up platform to raise concerns about ethics, human rights or other important matters.
Integrating sustainability into our supplier assessment
Every supplier and contractor is assessed for environmental and social issues as part of a comprehensive supplier evaluation process. Suppliers with customer data access must adhere to legally binding contracts and the Supplier Code. During project implementation, we continuously evaluate suppliers on performance, compliance and ethics, which affects their rankings and future selection. Criteria include quality, sustainability, risk, customer service, innovation, delivery, operational excellence and cost. Serious non-compliance, such as confidentiality breaches or unauthorized disclosure, can lead to disqualification or termination.
Our commitment to local procurement spending has made a meaningful impact on the economies of the countries in which we operate. By supporting local businesses, we contribute to job creation, economic growth and the development of essential infrastructure that benefits communities and strengthens national economies.
96%
96%
Maximising local content through rawafed
Launched in 2018, rawafed is stc’s flagship initiative aimed at maximizing local content within Saudi Arabia’s ICT sector and increasing its contribution to the national economy. rawafed focuses on maximizing local content within the Saudi ICT sector and boosting the sector’s contribution to the national economy. The initiative aims to strengthen the national economy by promoting local businesses and aligning with the broader goals of Saudi Arabia’s Vision 2030.
In 2024, rawafed’s strategy has been refreshed to build upon its past successes and further strengthen local content within the ICT sector. With a vision to maintain its leadership in local content, rawafed aims to develop, expand and grow the ICT sector, increasing stc’s contribution to the national digital economy. The updated strategy prioritizes localized spending, attracting investment, fostering innovation and improving local capabilities.
Promoting SMEs
stc actively supports the participation of small and medium enterprises (SME) through its procurement activities, aligning with the national visions of the countries in which it operates. By enabling local business growth, stc plays a pivotal role in developing the telecom and ICT sectors, contributing to economic diversification. In 2024, stc engaged with more than 492 SMEs, reinforcing its commitment to strengthening local industries and driving sustainable economic development.
Building a digital ecosystem across procurement practices
At stc’s main office, we now have a paperless environment for procurement. We utilize our internal system, HUB. in conjunction with the Oracle Procurement System, to streamline and digitize procurement processes. As a result, 100% of bidding, work orders and letters of award are now paperless, eliminating paper consumption related to procurement.
99%
