RPM INTERNATIONAL INC.                                                                                                                    November 26, 2025

VENDOR APPROVAL PROCESS

Purpose

The SOP is to be used each time a new vendor is desired for any good or service. The purpose of this SOP is to guide RPM personnel through the Vendor Approval Process. The tools to follow ensure that RPM knows as much as possible about the vendors with which it does business, mitigates risk related to poor business practices, and ensures compliance with RPM sourcing strategies.

Scope

New vendors by any RPM company, including samples, one-time orders, services, software, indirect and direct suppliers and long-term use.

Vendor Approval Overview

What is the Vendor Approval Process?

Vendor Approval Process is the process by which RPM qualifies vendors, validates key details, and verifies the vendor’s alignment with RPM’s Supplier Code of Conduct. This Vendor Approval Process is to be utilized for all direct vendors used by any RPM company– that is, purveyors of inventoriable goods – regardless of spend, including the acquisition of samples. Likewise, the Vendor Approval Process is to be executed for indirect vendors used by any RPM company – suppliers of services and non-inventoriable goods – which meet certain risk-based criteria described below.

When should I use the Vendor Approval Process?

This Vendor Approval Process is to be used prior to the purchase or use of any goods/services from a vendor not currently used or approved by RPM. A Report of Active Vendors is available here. If the desired vendor appears on the Report of Active Vendors, only steps 1-4 below are required.

This process applies to the acquisition of samples, one-time purchases, ongoing purchases, and purchase of indirect goods and services as set forth below.

RPM companies may only order direct goods – regardless of spend or any other qualifying criteria – from vendors who have successfully completed the Vendor Approval Process and been approved by an RPM Strategic Sourcing Director. This applies to all direct vendors regardless of location, perceived risk, and expected spend. Non-production intent samples may be ordered after completing steps 1-4 below.

RPM companies will need to proceed with the Vendor Approval process prior to ordering any indirect goods (non-inventoriable) or engaging a vendor for services if they meet any of the following criteria:

• Expected annualized spend exceeds $50,000 USD.
• The vendor is based at or conducts significant business activities in any of the countries listed
• The service in question is included in Appendix A.

Please note that this policy does apply to P-Card purchases in accordance with the guidelines contained herein.  

Please note the following process exceptions:  

• This policy does not apply to Travel and Expense (T&E) vendors (e.g. The process is not required for booking hotels, flights, rental cars, etc. through Concur).  
• New vendors for software and other IT-related services are exempt from this policy and shall instead be governed by the Technology Procurement Policy; however, please note that all new software/IT vendors must still be entered into LSEG (Refinitiv) as described below prior to implementing the Technology Procurement Policy. 

Regardless of whether an indirect vendor meets criteria that require the Vendor Approval Process to be followed prior to engagement, all vendors must be entered into LSEG (Refinitiv) for Media Check/World Check analysis and must be approved in LSEG (Refinitiv) prior to ordering any goods or services.  All direct vendors must also be reviewed and approved through the LSEG (Refinitiv) system prior to purchase. If the requesting operating company has not previously executed a LSEG (Refinitiv) check on the vendor in question, a new LSEG (Refinitiv) check is needed even if the vendor in question has been approved and used by another RPM company.

Who should execute the Vendor Approval Process?

The Vendor Approval Process is to be executed by local RPM Operating Company personnel with assistance from RPM Center Led Procurement, RPM Compliance, and RPM Legal. A list of RPM Center Led Procurement team members is included in Appendix B.

Vendor Approval Process

What steps/tools are involved in the Vendor Approval Process?

Prior to engaging in any commercial discussions or receiving samples, the Operating Company personnel shall:

1. Engage local Operating Company Procurement to determine if a new vendor is appropriate or if an already approved vendor could provide the desired good or service. If there is software involved, please also contact Operating Company IT services.
2. Engage the appropriate RPM Center Led Strategic Sourcing Director (SSD) according to Appendix B. If unsure of which SSD is responsible, please contact a member of the Center Led Procurement team for clarification.
3. The SSD will discuss options for using current vendors from the RPM Approved Vendor List. If the SSD agrees that a new vendor is needed, the Vendor Approval Process will continue.
4. Complete the Vendor Supplier Required Information Form and forward as follows:
   1. Operating Company Finance Team or local, trained LSEG (Refinitiv) users: The requesting company finance team/trained users will input the vendor information into LSEG (Refinitiv) for Media Check & World Check verification. The results will be assessed by LSEG (Refinitiv) and will be given a score of “Low Risk”, “Medium Risk”, or “High Risk”. If “Medium” or “High”, RPM Compliance will execute expanded due diligence as appropriate.
5. Once steps 1-4 are complete, the SSD will add the prospective vendor to the Vendor Hub Directory.
   1. The SSD will add basic vendor information to the form and click “Save”. Be sure to add contact information using the “Add Contact” button.
   2. Once added to the directory, click the “Request Vendor Signature” to request acknowledgement of RPM’s Supplier Code of Conduct. When the form has been acknowledged by the vendor, the “Pending Signature” flag will read, “False”.
   3. Once the vendor acknowledges the Supplier Code of Conduct, the Operating Company may request samples from the vendor. Continue with subsequent steps for full vendor approval. No production-intent orders may be placed until the entire Vendor Approval Process is complete.
6. Engage with your in-house lawyer to determine what contracts are needed with the vendor, such as a Non-Disclosure Agreement (NDA) or a supply agreement. No contract may be signed without legal approval. If your operating company does not have an in-house lawyer, please request that the SSD obtain an NDA through RPM Legal. The NDA may be either at the operating company level or at the RPM level; however, one must be in place.
7. Unless otherwise directed by the SSD, local personnel and/or the SSD will execute a site visit to the manufacturing facility (Direct materials only) and will complete the RPM Supplier Visit Checklist by following the steps outlined in the RPM Supplier Checklist SOP. It is the responsibility of the SSD to determine if any concerns uncovered by the Supplier Visit Checklist may be addressed/corrected or if the vendor is qualified or disqualified as-is.
8. If approved by the SSD, local personnel and SSD will engage the vendor to negotiate commercial terms.
9. The SSD will add the vendor to the Active Vendor List and send an email to the requesting Operating Company confirming acceptability for use.
   1. Upon completion of this step, the vendor is considered acceptable to be used by all RPM operating companies with the exception that each Operating Company must execute their own LSEG/Refinitiv check if using a previously approved vendor by another operating company The SSD may ask the vendor to revisit certain items prior to approval.
   2. If a vendor is not successful in completing the Vendor Approval Process, local procurement shall block the vendor in their local ERP and the SSD shall change the vendor status to “Do Not Use” in BI 2.0.

The process above is to be additional to any local new vendor procedures. The Vendor Due Diligence Log can be used by SSDs for tracking purposes of the entire Vendor Approval process.

A suspected violation of this procedure can be reported to your supervisor, human resources or to any member of the legal and compliance department. Employees are also welcome to contact the Company’s Hotline to report their concerns to RPM. A suspected violation received by anyone in a management or supervisory role must be reported to RPM as a Reportable Event. Allegations will be investigated thoroughly and objectively. For more information, refer to RPM’s Hotline and Non-Retaliation Policy. Any employee who violates this Procedure, including the failure to submit a Reportable Event, directs, or who knowingly permits a subordinate to violate a Policy or Procedure, or who engages in retaliatory actions, may be subject to disciplinary action up to and including termination. The Company retains the right to report any violations of a Procedure that are also illegal to the appropriate authorities.

APPENDIX A – SERVICES REQUIRING DUE DILIGENCE

APPENDIX B – RPM CENTER-LED PROCUREMENT PERSONNEL