Violations

The answer is not an isolated governance failure. The answer is a mechanism: the financial, accounting, and capital markets violations, and the humanitarian violations, are not parallel — they produce one another, in a closed cycle, sustained for 10 consecutive years. Compliance with any obligation in one sphere would have made non-compliance in the other impossible.

All values below are drawn exclusively from audited primary sources, CMOC's own official sources, and litigation documents. Each pair represents two simultaneously true facts about the same company, during the same period, over the same land.

Each mechanism below explains a different dimension of the cycle's persistence. All four operate simultaneously and reinforce one another. The absence of any single one would be sufficient to render the cycle unstable.

Certifying bodies operate predominantly under a self-reporting standard: the data assessed is provided by the company itself. CMOC did not submit to the ESG assessment process data that it also omitted from the mandatory securities regulatory process. Node 1 is sustained because Node 2 controls the information input into Node 1. Certifiers approved CMOC in every fiscal year based on information that systematically excludes the Duarte litigation — the same exclusion that constitutes a violation of Rule 13.09 before the HKEX. The same omission serves two functions: it preserves the rating and avoids the announcement.

Violations sustained: Violations 1, 3, 11 and 21
Node fed: Node 1 → Node 2 (invisibility feeds certification, and certification legitimizes invisibility)

Current methodologies are not structurally capable of capturing human impacts identifiable outside the scope of direct employees and first-tier suppliers — even when those impacts are public, materially significant, and documented in verifiable primary sources (TJ-GO judicial rulings, DPU statements, CPT Goiás, MPGO, coverage in Diálogo Chino, dialogue.earth, and regional press). MSCI maintained an AA rating for three consecutive fiscal years without the Duarte case featuring as a controversy. S&P approved the MSA for three consecutive years. RMAP certified the Boa Vista Mine with an active litigation over the very land being audited. Certifications cease to serve as guarantees of conduct and become indicators of adherence to a limited reporting standard.

Violations sustained: Violations 11, 20 and 21 (the certifications whose methodology cannot capture the case sustain the violations the case evidences)
Node fed: Node 1 (methodological insufficiency is what allows Node 1 to renew itself every fiscal year)

CMOC practices structurally dual communication: conspicuous regarding awards, certifications, and ratings across voluntary channels (LinkedIn, Instagram, X, corporate website — 175,000 followers); silent regarding the price-sensitive event of 19/03/2025 in the mandatory regulatory channel (HKExNews — 0 announcements in 414 days). This dual operation is not incidental: it is the legal type of misleading advertising by omission under CDC Art. 37, the direct object of the EU Green Claims Directive, and the specific violation of UNGPs Principle 15(c). It serves the function of keeping the ESG reputation intact for the 175,000 followers while the mandatory channel — the only one with real enforcement capacity — remains silenced.

Violations sustained: Violations 3, 8 and 20 (the three communication obligations — regulatory, periodic, and community impact — are violated in a coordinated manner)
Node fed: Node 2 (selective communication is the mechanism that keeps the case invisible in formal channels)

The facts of this case are public, verifiable, and available in primary sources accessible for over a decade. The global ESG verification system — certifiers, auditors, securities regulators, industrial buyers, institutional investors — fails to capture and address the information because each actor operates within its own methodological and jurisdictional limits. The HKEX verifies securities disclosure, not humanitarian impact. ISO verifies the management system, not the operational outcome for communities. Deloitte audits the accounting conformity of recognized provisions, not the adequacy of unrecognized provisions. RMAP audits the due diligence process, not the actual extent of impacts. No actor holds a mandate over the entire case. The entire case falls through the gaps — and the global buyers of niobium (Airbus, BMW, GE Aviation, among others) who bear autonomous obligations under LkSG and CSDDD have yet to document any specific due diligence regarding the Boa Vista Mine.

Violations sustained: Violations 5, 11, 17, 19 and 21 (each violation survives because no external verifier holds an integral mandate over it)
Node fed: Node 3 and Node 4 (the absence of integrated verification is what allows financial and humanitarian costs to accumulate without consequence)

Each of the four points below is individually sufficient to break the cycle. None requires a new fact — all facts are documented and available. What each point requires is compliance with obligations already active and overdue.

Review by certifying bodies of the case facts based on verifiable public primary sources: the TJ-GO ruling of 19/03/2025, court records available via public search, DPU statements, medical reports filed with the proceedings, death certificates of the 6 co-owners, and verified journalistic coverage. Possible outcomes of the review include: downgrade of MSCI AA through activation of Controversy Categories (Category 4–5); suspension or removal of FTSE4Good inclusion for non-compliance with the Human Rights & Community dimension; suspension of the Boa Vista Mine's RMAP certification for violation of the audited scope; and ISO opinion qualifications for non-conformity with Clauses 4.1 and 4.2.

Obligations fulfilled: Violation 21 (certifier notification), Violation 11 (due diligence), Violation 1 (ISO 9001 risk management)
Node interrupted: Node 1 — automatic certification renewal is halted

Publication of a formal announcement on HKExNews regarding the burden-of-proof reversal (TJ-GO ruling, 19/03/2025) and regarding the existence and evolution of TJGO litigation no. . Deadline under Rule 13.09: 2 hours. The announcement would simultaneously constitute the belated compliance with Rule 13.09 (Violation 3), the acknowledgment of the subsequent event under IAS 10 (Violation 4), and the trigger for review by rating agencies that operate on company-supplied data. Additionally, inclusion of the case under KPI B8 in the next annual report (Violation 8).

Obligations fulfilled: Violation 3 (HKEX Rule 13.09), Violation 4 (IAS 10), Violation 8 (HKEX ESG Guide B8)
Node interrupted: Node 2 — the case becomes visible in formal channels; market mechanisms are activated

Recognition of a provision for material contingency in the financial statements — the amount to be determined between the median scenario (USD 240–360 million) and the maximum (USD 3.5 billion, quantified under Art. 1,216 CCB) — with reopening of the Deloitte opinion for fiscal year 2025 or inscription in the next interim financial statements. Accounting recognition transforms the liability from invisible to measurable, compels a review of the Deloitte rating, mandatorily triggers the going concern assessment (Violation 7), and exposes the period of omission to analysis of fiduciary liability of signatory directors (Violation 9). The impairment test for the Brazilian CGU (Violation 5) becomes unavoidable.

Obligations fulfilled: Violation 2 (IAS 37), Violation 5 (IAS 36/IFRS 3), Violation 7 (IAS 1), Violation 9 (HK Companies Ordinance Cap. 622)
Node interrupted: Node 3 — the absence of financial cost is eliminated; the internal arithmetic of omission is reversed

Fulfillment of humanitarian obligations under the seven criteria of UNGPs Principle 31: (1) formal identification of the Duarte Family as a stakeholder (Violation 10); (2) provision of an accessible and effective grievance mechanism, with reasonable accommodations for Glória Duarte as a person with disabilities (Violations 12 and 13); (3) development of a livelihood restoration plan (Violation 18); (4) documented remediation measures communicated publicly (Violation 16); (5) a compensation proposal for proceeds harvested since the extrajudicial notification of 30/03/2015 (Violation 15). Effective remediation is the only point that simultaneously fulfills obligations in both spheres: by documenting and disclosing the remediation process, the company necessarily also fulfills Violations 3, 8 and 20.

Obligations fulfilled: Violations 10, 12, 13, 14, 15, 16 and 18 — and consequently Violations 3, 8 and 20
Node interrupted: Node 4 — the humanitarian violation is ended; the return to Node 1 that sustains the cycle is eliminated

Each of the 17 active recognitions was granted based on information provided by the company itself. None processed the verifiable facts of the Duarte litigation within its assessment methodology. The table below maps each recognition against the specific violation it implicitly certifies as non-existent.

The 21 violations are distributed across two structurally interdependent spheres: the first — 9 financial, accounting, and governance violations; the second — 12 humanitarian and corporate responsibility violations. The map below identifies for each violation the applicable standard, a precise description of the breach, and the node(s) of the cycle it feeds.

The coexistence of 17 active ESG recognitions with 21 simultaneous violations is not a statistical accident. It is the measurable result of a four-node cycle operating without interruption for 10 years. The equation below describes the causal relationship:

• USD 3.5 BILLION extracted over 10 years from claimed land
• US$0.00 paid to the family in 10 years
• 6 DEATHS of co-owners without remediation
• 2 HOURS Rule 13.09 deadline ignored for 414 days
• R$0.00 IAS 37 provision over 10 fiscal years
• 0 HRIAs in 10 years of certified operation

The paradox has a structure: 17 ESG certifications, 21 violations coexisting with 6 deaths, zero compensation, and no remediation in 10 years of litigation.

It is the foreseeable consequence of a cycle in which the obligation to register risk was never fulfilled, which made it possible not to disclose it, which eliminated the financial cost of omission, which allowed extraction to continue, which kept the humanitarian impact invisible, which enabled the renewal of certifications.

The cycle has lasted 10 years. It has 21 obligations simultaneously violated. It has identifiable victims with names, ages, medical reports, and death certificates filed in the case record for each of the 6 deaths. It has the survivor, Glória Duarte. It has verifiable primary sources for every claim.

What the cycle does not have is a point of irreversibility: any one of the four operational points above is sufficient to break it. The Rule 13.09 deadline is 2 hours. The silence is being counted every day.