FMA Circular 08/2018: Internal Control Mechanisms for Portfolio Management Reporting Obligations under WAG 2018

FMA CIRCULAR ESTABLISHING THE REQUIREMENTS FOR THE INTERNAL CONTROL MECHANISM FOR THE MONITORING OF SYSTEMS AND PROCEDURES FOR SATISFYING REPORTING OBLIGATIONS FOR PORTFOLIO MANAGEMENT IN WAG 2018 CIRCULAR ON THE INTERNAL CONTROL MECHANISM Document no.: 08 / 2018 Publication date: 29.10.2018

Circular on the Internal Control Mechanism 29.10.2018 2 / 12 INHALT Introduction............................................................................................................................................ 3

1. General remarks about reporting obligations in portfolio management..................................... 5 A. Requirements for internal control mechanisms for observing reporting obligations in relation to the contents and valuation of the portfolio ........................................................... 6 B. Requirements for internal control mechanisms for observing reporting obligations in relation to fees and charges ...................................................................................................... 8 C. Requirements for internal control mechanisms for observing reporting obligations in relation to comparing the portfolio’s performance with the investment performance benchmark ................................................................................................................................. 8 D. Requirements for internal control mechanisms for observing reporting obligations in relation to dividends, interest and other payments................................................................. 9 E. Requirements for internal control mechanisms for observing reporting obligations in relation to capital measures.................................................................................................... 10 F. Requirements for internal control mechanisms for observing reporting obligations in relation to executed transactions ........................................................................................... 10 G. Requirements for internal control mechanisms for observing reporting obligations in relation to the performance of the portfolio .......................................................................... 11 H. Common requirements for systems and procedures............................................................. 12

Circular on the Internal Control Mechanism 3 / 12 INTRODUCTION (1) One of the main objectives of Directive 2014/65/EU1 (MiFID II) is to increase investor protection. This objective is also intended to be achieved by improving client information. For this purpose, comprehensive reporting obligations were specified in MiFID II and in the delegated legal acts that must be satisfied in the provision of portfolio management services. The legal entity is bound by the obligation to submit reports even when such submissions are filed by other persons. These reporting obligations are intended to increase individual investor protection, while the client is able to check whether the services provided within the context of portfolio management correspond to their specifications. Reporting obligations are of material importance in relation to portfolio management, in particular as the portfolio manager has scope of discretion prescribed under law, within which scope the portfolio manager is able to take investment decisions for the client. The report that is made available to the client by the legal entity is therefore often the only possibility for the client to gain timely insights into the portfolio manager's activities. (2) The Securities Supervision Act 2018 (WAG 2018)2 , which transposes MiFID II, as well as the delegated legal acts are based on the principle that systems and procedures must be established to institutionalise material operating processes, thereby safeguarding the achievement of the objectives pursued by the individual activities. To ensure that such systems and procedures are duly observed, legal entities are moreover required to establish appropriate internal control mechanisms and to implement them permanently. (3) In view of the significance of the reporting obligations within the scope of portfolio management, the FMA is of the opinion, that systems and procedures are also to be implemented for fulfilling them that are subject to internal control mechanisms in order to ensure that they are duly observed. (4) With regard to the implementation of the necessary systems and procedures and the design of the internal control mechanisms, to take into account the diversity of the legal entities’ business activities in accordance with the principle of proportionality simplifications may be made use of in the application of individual organisational rules. The nature, scope and complexity of business activities as well as the scope of the portfolio management services provided shall be taken into account when assessing proportionality. Every legal entity shall be required of its own accord to evaluate the application of the principle of proportionality for its specific business model and to present and document this in a plausible way and manner upon request to the FMA. 1 Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU, OJ L 2014/173, p. 349. 2 Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018), published in Federal Law Gazette I No. 2017/107.

Circular on the Internal Control Mechanism 4 / 12 (5) This circular contains specifications regarding internal control mechanisms for observing the resolutions and procedures that are taken for implementing and observing reporting obligations within the scope of portfolio management. It specifically relates to the following reporting obligations: o reporting obligations in relation to the contents and valuation of the portfolio; o reporting obligations in relation to fees and charges; o reporting obligations in relation to compare of the portfolio’s performance against a benchmark; o reporting obligations in relation to dividends, interest and other payments; o reporting obligations in relation to capital measures; o reporting obligations in relation to the executed transactions; o reporting obligations in relation to the performance of the portfolio; (6) The circular is addressed to the follower legal entities as defined in Article 26 para. 1 WAG 2018 and respectively within the scope of providing individual portfolio management: o credit institutions pursuant to Article 1 para. 1 BWG as well as CRR credit institutions pursuant to Article 9 BWG; o investment firms pursuant to Article 3 para. 1 WAG 2018, branches of investment firms (Article 19 para. 5 WAG 2018) as well as branches of third-country firms (Article 23 para. 2 WAG 2018) o management companies pursuant to Article 5 para. 1 InvFG 2011 with an additional licence; o AIFMs with an additional licence. (7) This circular does not constitute a Regulation. It is intended to serve as guidance and reflects the FMA's legal interpretation. No rights and obligations extending over and above the provisions of the law can be derived from this circular. Possible legally compliant solution￾based approaches are listed in the course of this circular, and observing them guarantees legal and planning clarity in the area of individual portfolio management. Alternative solution￾based approaches remain possible, and the principle of proportionality will not be impeded in this way. (8) Regarding its supervisory activity, the FMA assumes that legal entities will observe this circular with effect from 1 January 2019.

Circular on the Internal Control Mechanism 5 / 12

1. GENERAL REMARKS ABOUT REPORTING OBLIGATIONS IN PORTFOLIO MANAGEMENT (9) Pursuant to Article 60 para. 1 WAG 2018, which transposes Article 25 (6) first sub paragraph of MiFID II a legal entity is report to its client in a suitable format using a durable medium about the services it has performed for the client. Such reports shall contain regular messages to the client, which contain the type and complexity of the respective financial instruments as well as the type of service provided for the client is taken into account, as well as where applicable the costs that are associated with the transactions conducted on behalf of the clients and services provided. Article 60 Delegated Regulation (EU) 2017/5653 contains specific remarks in relation to the general reporting obligation set out in Article 60 WAG 2018. (10) Article 16 (5) second sub paragraph MiFID II stipulates that an investment firm shall have sound administrative and accounting procedures, internal control mechanisms, effective procedures for risk assessment, and effective control and safeguard arrangements for information processing systems. Article 32 WAG 2018 transposes this requirement. Although the obligation to establish internal control mechanisms in Article 32 WAG 2018 was inserted under the heading “Risk management and internal audit” general rule for establishing internal control mechanisms independent of risk management and internal audit. This provision is to be considered as the general norm for establishing internal control mechanisms, which is specified further in the delegated legal act. (11) General organisational requirements are defined in Article 29 WAG 2018. Under Article 29 para. 1 WAG 2018 the legal entity shall establish adequate policies and procedures to ensure that it as a legal entity, its managers, employees, and tied agents are able to comply with the organisational requirements and operating conditions set out in Chapter II of Delegated Regulation (EU) 2017/565. (12) Article 21 (1) (c) of Delegated Regulation (EU) 2017/565 contains the provision to establish, implement and maintain adequate internal control mechanisms to secure compliance with decisions and procedures at all levels of the investment firm. 3 Commission Delegated Regulation (EU) 2017/565 of 25 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive, OJ L 2017/87, p. 1.

Circular on the Internal Control Mechanism 6 / 12 A.REQUIREMENTS FOR INTERNAL CONTROL MECHANISMS FOR OBSERVING REPORTING OBLIGATIONS IN RELATION TO THE CONTENTS AND VALUATION OF THE PORTFOLIO (13) Article 60 (2) (c) of Delegated Regulation (EU) 2017/565 states that within the scope of reporting obligations details must be transmitted in the periodic statements about the contents and the valuation of the portfolio, including details of each financial instrument held, its market value, or fair value if market value is unavailable and the cash balance at the beginning and at the end of the reporting period, and the performance of the portfolio during the reporting period. (14) The FMA is of the opinion that the reported content of the portfolio is in line with the investment rules agreed with the client4 or the contents of the agreement between the legal entity and the client under Article 58 (b) of Delegated Regulation (EU) 2017/565 (permitted types of financial instruments as well as the types of transactions that may be undertaken on behalf of the client, as well as any instruments or transactions prohibited). For this purpose, internal control mechanisms ensure that the procedure is observed that guarantees that the content of the portfolio is in line with investment guidelines or the contents pursuant to Article 58 (b) of Delegated Regulation (EU) 2017/565. For this purpose, a procedure is implemented in which the investment guidelines or the contents pursuant to Article 58 (b) of Delegated Regulation (EU) 2017/565 are duly filed. Upper limits are particularly suitable that are defined in terms of the financial instruments in which investments may be made matching the client in question’s investment guidelines or the contents pursuant to Article 58 (b) of Delegated Regulation (EU) 2017/565. From the FMA’s perspective, a limit system is a possible procedure that serves the purpose of orderly reporting with regard to the contents of the portfolio. In relation to the content of the portfolio, special requirements can be addressed with the help of limits, which for example define restrictions regarding the type and amount of investments, such as e.g. maximum limits for investment categories, markets, regions, sectors, issuers, instruments or the use of leveraged financing. If within the scope of individual investment guidelines or the contents pursuant to Article 58 (b) of Delegated Regulation (EU) 2017/565 requirements were agreed upon regarding the liquidity of the investment instruments chosen, then corresponding limits are taken into account in the limit system. (15) Regarding the valuation of the portfolio, the FMA’s view is the that the valuation of the financial instruments contained in the portfolio occurred both correctly and in full in the 4 The investment guidelines are drawn up on the basis of the information provided by the client with regard to their investment objectives and risk tolerance, their financial circumstances with regard to their ability to absorb losses as well as their knowledge and experience in the field of investing and should include an as detailed as possible description of the investment strategy that has been agreed upon, which contains a definition of the permitted instruments, investment categories, ranges and investment limits as well as a description of the portfolio risks. The investment guidelines may form part of the agreement between the client and the legal entity pursuant to Article 58 of Regulation (EU) 2017/565. There is no statutory obligation to draw up investment guidelines. However, such guidelines simplify cooperation with the client, as the scope for the manager’s investment activity is clearly demarcated, and the raising of awareness is improved for the client in terms of the risks that are entered into.

Circular on the Internal Control Mechanism 7 / 12 periodic statements that are required to be provided. For this reason, internal control mechanisms ensure that a procedure is observed that guarantees that the value of the portfolio is presented in a correct and complete manner. This valuation procedure ensures that the prices used for valuation are obtained from traceable and objective pricing sources. Depending on the investment instruments in question, official stock exchange prices or the calculated values published by management companies constitute the primary source of valuations. If it is not possible to perform a valuation based on market values, the value to be quoted may be determined with help from comparative values (valuation of similar assets) or estimates (using valuation models depending on the investment instruments in questions such as, for example, the Discounted Cash Flow method or similar). The procedure is intended to permit a plausible presentation of the portfolio’s performance. Plausible in this context means that the prices used for the valuation need to be checked for plausibility (e.g. By comparing them with a valuation on a portfolio statement). (16) For the purpose of this circular “checks for plausibility” is used as a designation for the structured and approximate reviewing of results or underlying data for their traceability and acceptability. The objective is to detect blatant inaccuracies, however no review for correctness is conducted for all individual values. (17) Both the procedure established for guaranteeing the correct composition of the portfolio as well as the one for correct valuation are designed in a way that stands up to internal auditing, which means that where interventions are made in the system, that it is apparent when and by whom interventions were made. In the case of changes being made, all bases for decisions are fully documented. (18) If in the course of the reporting obligation under Article 60 (2) (c) Delegated Regulation (EU) 2017/565 additional information exists regarding the previous performance of the portfolio, in the case of the gross performance being stated, pursuant to Article 44 (4) (f) of Delegated Regulation (EU) 2017/565 its effect on commissions, charges and other fees will be presented. (19) The obligation presented of establishing valuation procedures as well as the requirements about their contents are in line with the requirements that arise pursuant to Article 63 (2) (f) of Regulation (EU) 2017/565. Article 63 of Delegated Regulation (EU) 2017/565 defines reporting obligations for legal entities that hold client financial instruments or client funds.

Circular on the Internal Control Mechanism 8 / 12 B.REQUIREMENTS FOR INTERNAL CONTROL MECHANISMS FOR OBSERVING REPORTING OBLIGATIONS IN RELATION TO FEES AND CHARGES (20) Article 60 (2) (d) of Delegated Regulation (EU) 2017/565 defines that the periodical statement shall include details about the total amount of fees and charges incurred during the reporting period, itemising at least total management fees and total costs associated with execution, and including, where relevant, a statement that a more detailed breakdown will be provided on request. (21) Internal control mechanisms as defined in Article 32 WAG 2018 in conjunction with Article 21 (1) (c) of Delegated Regulation (EU) 2017/565 ensure that suitable procedures for presenting total costs correctly and completely are observed at all times. Taking into consideration the agreement concluded with the client pursuant to Article 58 of Delegated Regulation (EU) 2017/565 a correct calculation of the assessment basis and application of calculation parameters occurs. During the course of total costs in relation to the provision of services, a plausibility check is conducted of the underlying data with regards to its completeness and correctness5 . The procedure is designed in a way that stands up to internal auditing, which means that in the case of there being interventions in the system, it is visible when and by whom they were conducted. In the case of changes being made, all bases for decisions are fully documented. C.REQUIREMENTS FOR INTERNAL CONTROL MECHANISMS FOR OBSERVING REPORTING OBLIGATIONS IN RELATION TO COMPARING THE PORTFOLIO’S PERFORMANCE WITH THE INVESTMENT PERFORMANCE BENCHMARK (22) Article 60 (2) (e) Delegated Regulation (EU) 2017/565 defines that the periodic statement that is required to be provided within the scope of the reporting obligations shall be required to contain a comparison of the portfolio’s performance during the reporting period with the investment performance benchmark in the event one was agreed. (23) Internal procedures ensure in this context that the performance comparison with the investment performance benchmark is presented correctly and completely. An internal control mechanism ensured that this procedure is duly observed. Depending on the investment guidelines that have been agreed upon individually with the client or the contents pursuant to Article 58 (b) of Delegated Regulation (EU) 2017/565 different investment performances benchmarks may be defined. Investment performance benchmarks that may be used for example include benchmarks (individual or compiled benchmarks), targeted returns (in absolute terms or with a benchmark e.g. EURIBOR as a basis) as well as risk ratios 5 See the definition of the term “checks for plausibility” in MN 16

Circular on the Internal Control Mechanism 9 / 12 (volatility, VaR, maximum loss of value or similar). Valuation points are defined during the processes of drawing up the comparison of the portfolio against the investment performance benchmark, taking into account the type of investment performance benchmark used. The procedure is designed in a way that stands up to internal auditing and meets the requirements listed in MN 17. (24) In the event that variance ranges have been defined relative to an investment performance benchmark in the investment guidelines that have been individually with the client or the contents pursuant to Article 58 (b) of Delegated Regulation (EU) 2017/565, then internal control mechanisms ensure that a procedure is observed for correctly presenting the comparison to the agreed investment performance benchmark taking into consideration the agreed variance ranges. It shall be guaranteed during the procedure that the portfolio remains within the agreed range at all times. For example, from the FMA’s perspective a limit system meets these requirements. The procedure is designed in a way that stands up to internal auditing and meets the requirements listed in MN 17 especially with regard to the documentation of any limit changes. D.REQUIREMENTS FOR INTERNAL CONTROL MECHANISMS FOR OBSERVING REPORTING OBLIGATIONS IN RELATION TO DIVIDENDS, INTEREST AND OTHER PAYMENTS (25) Article 60 (2) (f) of Delegated Regulation (EU) 2017/565 defines that the periodic statement that is required under the reporting obligations shall be required to include information about the total amount of dividends, interest and other payments that have been received during the reporting period in relation to the client portfolio. (26) In relation to the capturing of the total amount of dividends, interest and other payments, internal control mechanisms ensure that a procedure for the correct and complete presentation of the information about the total amount is observed. During the course of the procedure, the legal entity checks the plausibility6 of the total result and the data that is receives from the custodian bank or the depositary. This may take place, for example, by comparing data based on financial information systems. The procedure is designed in a way that stands up to internal auditing and meets the requirements listed in MN 17. 6 See the definition of the term “checks for plausibility” in MN 16

Circular on the Internal Control Mechanism 10 / 12 E. REQUIREMENTS FOR INTERNAL CONTROL MECHANISMS FOR OBSERVING REPORTING OBLIGATIONS IN RELATION TO CAPITAL MEASURES (27) Article 60 (2) (g) Delegated Regulation (EU) 2017/565 defines that the periodic statement that is required to be provided within the scope of the reporting obligations shall include information about other corporate actions giving rights in relation to financial instruments held in the portfolio. (28) With regard to other corporate actions giving rights in relation to financial instruments held in the portfolio, internal control mechanisms shall ensure that a procedure is observed that guarantees that fair, clear and non-misleading information is provided about every individual capital measure in which the undertaking has actively taken a decision in its function as an individual portfolio manager, in order to give the client an accurate representation of the portfolio manager’s action (e.g. The exercising of voting rights, decisions regarding capital increases etc.). Accordingly, the information received from the custodian bank or the depositary shall be submitted to a plausibility check7 . The procedure is designed in a way that stands up to internal auditing and meets the requirements listed in MN 17. F. REQUIREMENTS FOR INTERNAL CONTROL MECHANISMS FOR OBSERVING REPORTING OBLIGATIONS IN RELATION TO EXECUTED TRANSACTIONS (29) Article 60 (2) (h) Delegated Regulation (EU) 2017/565 defines that the periodic statement that is required to be provided within the scope of the reporting obligations shall include the information referred to in Article 59(4)(c) to (l) where relevant, unless the client elects to receive information about executed transactions on a transaction-by-transaction basis for each transaction executed during the period. If the client wishes to receive information about the executed transaction individually, then these are to be reported to the client separately directly following the execution of the transaction. In this instance, the information pursuant to Article 60 (2) (h) Delegated Regulation (EU) 2017/565 shall no longer be required to be included in the statements that is required to be provided periodically. (30) Information regarding every transaction executed during the reporting period shall be presented in the statement that is required to be provided periodically both correctly and completely regarding the scope and content that is legally prescribed. The observance of the procedures established for this purpose is ensured by an internal control mechanism. During the course of the procedure, information from the custodian bank or the depositary about executed transactions are checked for plausibility8 . 7 See the definition of the term “checks for plausibility” in MN 16 8 See the definition of the term “checks for plausibility” in MN 16

Circular on the Internal Control Mechanism 11 / 12 (31) Regarding the correct presentation of transactions executed during the reporting period, we refer to the implicit effect of the assessment of suitability pursuant to Article 56 para. 1 WAG 2018 and Article 54 (2) of Delegated Regulation (EU) 2017/565. According to this provision, periodic reports should only contain information about executed transactions, which at the time of execution matched the investment guidelines individually agreed with the client, or the contents pursuant to Article 58 (b) of Delegated Regulation (EU) 2017/565. (32) The Pre Trade Check can be cited as an example of a suitable procedure for guaranteeing the conformity of every planned transaction at the time of execution with the agreed investment guidelines, or the contents pursuant to Article 58 (b) of Delegated Regulation (EU) 2017/565. (33) In the general rule on reporting obligations pursuant to Article 60 WAG 2018 para. 4 of that provision contains specific remarks, namely that a legal entity that provides portfolio management services for a client, or that has informed the client, that it will perform a regular assessment of suitability, shall be required to enclose an updated declaration with the regular report, that must contain how investment was matched with the preferences, objectives and other characteristics of the retail client. For this reporting obligation to be able to be met, a procedure must be implemented that allows this declaration to be attached. For example, the Pre Trade Check mentioned in MN 32 may be used for such purposes. From the FMA’s perspective this procedure is able to guarantee the conformity of every planned transaction with the agreed investment guidelines or the contents pursuant to Article 58 (b) Delegated Regulation (EU) 2017/565 at the time of execution, by virtue of every planned transaction being checked prior to execution about whether it observes the requirements regarding the maximum limits agreed with the client for investment categories, markets, regions, sectors, issuers, instruments or any other rules and restrictions imposed by the client. (34) The reports to be created pursuant to Article 60 para. 4 WAG 2018 may for example contain details and a description about the pre-trade procedure used. The description shall include an updated explanation about the how the investment matches the preferences, objectives and other characteristics of the retail client. G.REQUIREMENTS FOR INTERNAL CONTROL MECHANISMS FOR OBSERVING REPORTING OBLIGATIONS IN RELATION TO THE PERFORMANCE OF THE PORTFOLIO (35) Article 62 (1) Delegated Regulation (EU) 2017/565 defines that legal entities providing the service of portfolio management shall inform their clients where the overall value of the portfolio, as evaluated at the beginning of each reporting period, depreciates by 10 % and thereafter at multiples of 10 %, no later than the end of the business day in which the threshold is exceeded or, in a case where the threshold is exceeded on a non-business day, the close of the next business day.

Circular on the Internal Control Mechanism 12 / 12 (36) The FMA is of the opinion that the development of the value of the portfolio is to be monitored on an ongoing basis with regard to depreciation thresholds of -10% compared to the start of the reporting period. For this reason, internal control mechanisms for the observing of procedures for correctly calculating the total value of the portfolio on an ongoing basis, also ensure that clients are informed promptly. A limit system is a procedure, which from the FMA’s perspective is able to guarantee orderly reporting in relation to the portfolio’s performance. The basis for this is a correct data basis regarding the composition or valuation of the individual financial instruments contained in the portfolio. Reference is made to the explanations in MNs 14 and 15 in relation to procedures for guaranteeing the correct contents and valuation. H.COMMON REQUIREMENTS FOR SYSTEMS AND PROCEDURES (37) It should generally be noted that efficient escalation processes form a material component of effective systems and procedures. They should permit a prompt reaction to the actual or likely exceeding of thresholds and limits, so that it may be ensured that the respective responsible persons and organisational units are able to carry out necessary corrective measures in accordance with legal obligations without delay and so that existing reporting obligations are able be observed. Relevant escalation processes shall be stipulated for all systems and procedures for meeting reporting obligations.