Regulation on Organizational Requirements for Pension Management Companies Managing Voluntary Pension Funds (NN, No. 2/20 and 70/24)

UNOFFICIAL CONSOLIDATED TEXT (Narodne novine No. 2/2020, 70/2024) The Croatian Financial Services Supervisory Agency (hereinafter: Hanfa), pursuant to Article 55.b(12), Article 55.c(4), Article 58(18), Article 59(5), Article 60(4), Article 67, Article 74.a(7) and Article 77(4) of the Voluntary Pension Funds Act (»Narodne novine« No. 19/2014, 29/2018, 115/2018 and 156/2023, hereinafter: the Act), at its Management Board meeting held on 4 June 2024, adopts REGULATION ON ORGANIZATIONAL REQUIREMENTS FOR PENSION MANAGEMENT COMPANIES MANAGING VOLUNTARY PENSION FUNDS I. GENERAL PROVISIONS Article 1. (1) In order to ensure proper and efficient operations, and to reduce operational risk, this Regulation more precisely prescribes the requirements for a pension management company managing voluntary pension funds (hereinafter: pension company) regarding:

1. organizational requirements,
2. conflicts of interest,
3. administrative and accounting procedures,
4. monitoring compliance with relevant regulations,
5. risk management,
6. internal audit,
7. conditions that key function holders must meet,
8. conditions for exemption from the application of Article 55.b(10),
9. receipt of notifications regarding breaches of the Act and/or subordinate regulations adopted pursuant to the Act, and procedures concerning submitted notifications,
10. internal control mechanisms,
11. business continuity measures,
12. remuneration policies,
13. management and preservation of the pension company's business documentation,
14. appropriate management of information systems, including cyber risks and their management,
15. business conduct rules,
16. criteria for assessing the adequacy of risk management processes used by the pension company,
17. reporting to Hanfa in accordance with Article 58(17) of the Act,
18. procedures, conditions, documentation, participants and other requirements related to the investment process,
19. corporate governance,
20. procedure for delegating tasks by the pension company to third parties,
21. institutions considered as counterparties and limits from the Act that a pension company may apply to the central counterparty,
22. criteria under which it may be considered that assets covering technical provisions of a voluntary pension fund achieve an equivalent level of protection as individual segregation within the meaning of the Act,
23. content of compliance audits regarding risk management rules and information system status and adequacy, for Hanfa's purposes, submission methods and deadlines, and reasons why Hanfa may reject the audit firm's opinion. (2) The following form an integral part of this Regulation:
24. Quantitative limits on investments in derivatives (Appendix 1),
25. Derivative contracts (Appendix 2).

Article 2. Terms used in this Regulation have the following meanings:

1. Pension company is a company managing a voluntary pension fund.
2. Pension fund is a voluntary pension fund.
3. Relevant person is a person as defined in the Act.
4. Senior management means board members and/or persons who actually conduct the business of the pension company.
5. Board means the board of the pension company.
6. Supervisory Board means the supervisory board of the pension company.
7. Key functions are the internal audit function, risk management function, compliance monitoring function and actuarial function, where applicable.
8. Counterparty risk is the loss risk for a pension fund arising from the possibility that a counterparty may not be able to fulfill its obligations to the pension fund.
9. Liquidity risk is the risk that a pension fund's assets cannot be liquidated within a sufficiently short time frame and at a price approximately equal to fair value, so that the pension fund can meet its obligations under the Act regarding membership termination or pension payments via the pension company, as well as other due liabilities.
10. Market risk is the loss risk for a pension fund that may arise due to fluctuations in market prices of assets in the pension fund's portfolio, as a result of changes in various market conditions and factors (e.g., interest rates, exchange rates, prices of financial instruments, creditworthiness of issuers, etc.).
11. Operational risk is the loss risk for a pension fund due to inadequate or failed internal processes, procedures and omissions relating to human resources or systems within the pension company, or due to external influences or events, including legal and documentation risk and risk arising from trading, settlement and valuation procedures conducted on behalf of the pension fund.
12. Remuneration encompasses all forms of fixed and variable payments and benefits, in cash or in kind, that the pension company (including remuneration linked to performance and profit-sharing) pays or allocates to an identified employee of the pension company in exchange for services performed, and includes: a. remuneration based on employment - salary and discretionary pension benefits, b. other remuneration.
13. Remuneration framework is the range of total remuneration for each employee in the categories of senior management and risk-takers - from highest to lowest paid in these categories.
14. Identified employees are categories of workers, including senior management, risk-takers, key function holders and any other employee whose remuneration falls into the salary grade of senior management and risk-takers, as well as third-party employees to whom the pension company has delegated asset and/or risk management tasks in accordance with Article 76 of the Act, whose work has a significant impact on the risk profile of funds managed by the pension company.
15. Risk-takers are employees whose professional activities have a significant impact on the risk profile of the pension company or the risk profile of the pension fund and/or UCITS fund managed by the pension company, including persons authorized to conclude contracts or take up risk positions, or make decisions affecting the exposure to risks of the pension company, pension fund and/or UCITS fund managed by the pension company.
16. Variable remuneration is an amount dependent on the performance of the employee, business unit, pension company and/or pension fund managed. The variable remuneration includes the amount of severance paid to an employee exceeding the statutory amount.
17. Discretionary pension benefit is a remuneration agreed as a pension contribution that the pension company agrees to or allocates to an employee on a discretionary basis. This remuneration is not paid regularly but is determined and formed for pensions. Discretionary pension benefits are part of employees' variable remuneration.
18. Malus is a contractual provision according to which the employee agrees that the pension company is not obliged to pay or transfer rights over a portion of deferred unpaid variable remuneration, or over the entire deferred unpaid variable remuneration, if the realization of previously assumed risks leads to impaired performance or worse financial results for the pension company, business unit, pension fund managed by it, and the employee where applicable.
19. Remuneration clawback is a contractual provision according to which the employee undertakes to return a certain amount of variable remuneration to the pension company, if the realization of previously assumed risks leads to impaired performance or worse financial results. This provision may be agreed for deferred and non-deferred variable remuneration.
20. Assessment period is the period during which the performance of funds and the pension company, or its employees, is evaluated and measured to determine their remuneration level.
21. Deferral period is the period during which variable remuneration is retained and after the end of the assessment period, during which deferred remuneration is paid out. The deferral period begins with the payment of a portion of variable remuneration that is not deferred. If the entire payment of variable remuneration is deferred, the deferral period begins on the day the variable remuneration is determined. The deferral period ends with the payment of the last portion of deferred variable remuneration.
22. Vesting point is the moment when an employee receives payment and becomes the legal owner of the remuneration. Once vested, no subsequent (ex-post) adjustment can be made, except based on the remuneration clawback clause.
23. In-depth analysis is an analysis of all aspects of a potential investment, to determine all relevant facts related to the investment and avoid possible adverse consequences of the investment itself, and includes interdisciplinary assessment of the investment from commercial, financial and legal perspectives, with the aim of gaining the best possible insight into various aspects of the business of the company considered as a potential investment.

II. ORGANIZATIONAL REQUIREMENTS General organizational requirements Article 3. (1) A pension company is obliged, taking into account the type, scope and complexity of its operations:

1. to establish an internal organizational structure that ensures the proper performance of pension fund management tasks, in such a way that tasks are divided into at least the following organizational units: a. front office (operational unit), b. middle office (control unit) and c. back office (support unit),
2. to prescribe, apply and regularly update internal acts governing its internal organizational structure and decision-making process, from which the decision-making process and allocation of responsibilities for these decisions are clearly and documentedly visible, and which include: a. division into organizational units, b. detailed description of tasks and responsibilities of each organizational unit, c. list of job positions and employees within each organizational unit, d. duties and division of powers of senior management and pension company employees, e. internal reporting and decision-making procedure within the pension company, f. method of preserving business documentation and data,
3. to ensure that all relevant persons are familiar with all procedures and processes they must apply for the proper performance of their duties, and when performing multiple roles in the pension company, to ensure that each is performed independently, conscientiously and professionally,
4. to establish, implement and regularly update appropriate internal control systems that ensure the implementation of internal decisions and procedures at all levels of the pension company,
5. to employ persons with qualifications, knowledge and experience necessary for performing entrusted duties,
6. to establish, implement and regularly update effective internal reporting and communication systems at all appropriate levels within the pension company as well as towards third parties,
7. to appropriately and systematically preserve records of the internal organization and business organization of the pension company. (2) A pension company is obliged to establish and organize business processes in such a way that it clearly prescribes and documents all phases of each business process through internal acts, ensures the involvement of all relevant organizational units, and is able at any time to identify and manage all risks arising from a specific business process. (3) A pension company is obliged, taking data types into account, to establish, apply and regularly update systems and procedures that ensure the security, integrity and confidentiality of data. (4) A pension company is obliged to prescribe, apply and regularly update business continuity measures, which include:
8. procedures in extraordinary circumstances,
9. storage of security copies of all records enabling uninterrupted operation during extraordinary circumstances,
10. timely establishment of functions and data access and timely resumption of the pension company's operations if uninterrupted operation during extraordinary circumstances is not possible. (5) A pension company is obliged to prescribe, apply and regularly update accounting policies and procedures that enable the timely delivery of financial reports in accordance with the Act and other relevant regulations, providing a true and fair view of the financial situation of the pension company and pension funds managed by it, in accordance with applicable accounting standards and rules. (6) A pension company is obliged to regularly monitor, update, improve and rectify deficiencies in internal business systems, internal controls and policies and procedures from paragraphs 1 to 5 of this article. (7) A pension company that also performs the activity of managing UCITS funds under Article 11(1)1.b) of the Act is obliged to appropriately apply regulations governing organizational requirements for UCITS management companies. (8) A pension company is obliged to ensure adequate resources for the uninterrupted performance of all activities under Article 11 of the Act that it performs.

III. ADMINISTRATIVE AND ACCOUNTING PROCEDURES Handling complaints Article 4. (1) In handling complaints, a pension company must comply with Article 64 of the Act and make information on how to submit complaints and handle them freely available to pension fund members free of charge, and enable free submission of complaints. (2) A pension company is obliged to submit to Hanfa by 15 February each year an annual report on complaints containing the number of complaints received from members in the previous year, reasons for submitting complaints and measures taken based on them. (3) The report from paragraph 2 of this article must be submitted to Hanfa in the manner prescribed