Authorisation and organisation of entities acting as UCI administrators

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 1/38 Circular CSSF 22/811 (as amended by Circular CSSF 25/900) Authorisation and organisation of entities acting as UCI administrators

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 2/38 Circular CSSF 22/811 (as amended by Circular CSSF 25/900) Re: Authorisation and organisation of entities acting as UCI administrators TABLE OF CONTENTS

1. Definitions 4
2. Scope 7 2.1 Eligible entities 7 2.2 UCI administration activity 8 2.2.1 Appointment of a UCI administrator: Authorisation requirements 8 2.2.2 UCI administration activity 10 2.2.3 Registrar function 13 2.2.4 NAV calculation and accounting function 15 2.2.5 Client communication function 18
3. Organisational arrangements 19 3.1 General provisions 19 3.2 Internal organisation 21 3.2.1 General principles 21 3.2.2 Approval of new business relationships and new services 23 3.2.3 Management of conflicts of interest 23 3.2.4 Relationship with the depositary 24 3.2.5 Access and retention of the core UCI documentation, including in case of change of UCI administrator 25 3.3 Human resources 27 3.4 ICT resources and, Business Continuity and Disaster Recovery Planning 28 3.5 Delegation models 30
4. Entry into force and various provisions 35 A - List of information to be provided to the CSSF to apply for authorisation to act as UCI administrator 37

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 3/38 Circular CSSF 22/811 (as amended by Circular CSSF 25/900) Re: Authorisation and organisation of entities acting as UCI administrators Ladies and Gentlemen, Chapter D of Circular IML 91/75 specifies the rules concerning the central administration of Luxembourg UCIs. This circular replaces Chapter D of Circular IML 91/75 taking into account the legislative developments, changes in technology and market evolution with respect to the activity of UCI administration. This new circular clarifies the activity of UCI administrators by specifying the principles of sound governance and the CSSF requirements on internal organisation and good practice applicable to them. To that effect, the circular will apply to the entities acting as UCI administrator for regulated and non-regulated UCIs established, or not, in Luxembourg. It is reminded that all entities carrying out the activity of UCI administration are subject to the laws and regulations in force, notably due to their status, authorisation or activities, including, but not limited to, legislation in the area of the fight against money laundering and terrorist financing and on delegation. UCIs must refer to applicable laws and regulations to determine the eligibility of UCI administrators. Luxembourg, 16 May 2022 To all entities, as defined hereafter, carrying out the activity of UCI administration or part thereof

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 4/38

1. Definitions For the purposes of this circular: 1993 Law: shall mean the Law of 5 April 1993 on the financial sector, as amended. 2004 Law: shall mean the Law of 15 June 2004 relating to the investment company in risk capital (SICAR), as amended. 2007 Law: shall mean the Law of 13 February 2007 relating to specialised investment funds, as amended. 2010 Law: shall mean the Law of 17 December 2010 relating to undertakings for collective investment, as amended. 2013 Law: shall mean the Law of 12 July 2013 on alternative investment fund managers, as amended. AIF: shall mean an alternative investment fund as defined in Article 4(1)(a) of Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers. BCL: shall mean the Banque centrale du Luxembourg (Luxembourg Central Bank). BCP: shall mean business continuity plan. Circular IML 91/75: shall mean Circular IML 91/75, as amended by Circulars CSSF 05/177, 18/697, 21/790 and 22/811, on the revision and remodelling of the rules to which Luxembourg undertakings governed by the Law of 30 March 1988 on undertakings for collective investment ("UCI") are subject, as amended or replaced, where applicable. Circular CSSF 04/146: shall mean Circular CSSF 04/146 on the protection of undertakings for collective investment and their investors against Late Trading and Market Timing practices, as amended or replaced, where applicable. Circular CSSF 16/644: shall mean Circular CSSF 16/644, as amended by Circular CSSF 18/697, on the provisions applicable to credit institutions acting as UCITS depositary subject to Part I “and UCIs subject to Part II” of the Law of 17 December 2010 relating to undertakings for collective investment and all UCITS, where appropriate, represented by their management company, as amended or replaced, where applicable. Circular CSSF 18/697: shall mean Circular CSSF 18/697 on the organisational arrangements applicable to fund depositaries which are not subject to Part I of the Law of 17 December 2010 relating to undertakings for collective investment, and, where appropriate, to their branches, as amended or replaced, where applicable. Circular CSSF 20/750: shall mean Circular CSSF 20/750, as amended by Circulars CSSF 22/828 and 25/881, on the requirements regarding information and communication technology (ICT) and security risk management, as amended or replaced, where applicable.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 5/38 Circular CSSF 22/806: shall mean Circular CSSF 22/806, as amended by Circular CSSF 25/883, on outsourcing arrangements, as amended or replaced, where applicable. Circular CSSF 24/856: shall mean Circular CSSF 24/856 on the protection of investors in case of an NAV calculation error, an instance of non-compliance with the investment rules and other errors at UCI level, as amended or replaced, where applicable. Circular CSSF 25/882: shall mean Circular CSSF 25/882 on requirements on the use of ICT third-party services for Financial Entities subject to the Digital Operational Resilience Act (DORA), as amended or replaced, where applicable. Delegate: shall mean any third party carrying out on behalf of a UCI administrator one or more functions or tasks. Delegation: shall mean the appointment by an entity of a third party or of third parties to carry out functions or tasks, fully or partially, on its behalf. For the purpose of this circular, the terms “externalisation” or “outsourcing” should be understood as “delegation”. DORA Regulation: shall mean Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011, and all its underlying regulatory technical standards and implementing technical standards. DRP: shall mean disaster recovery plan. External valuer: shall mean a natural or legal person that is independent from the AIF, the IFM and any other person having close links to the AIF or the IFM, and appointed by the IFM to perform the valuation function, in accordance with Article 17 of the 2013 Law. A third party that carries out the calculation of the net asset value for an AIF should not be considered as an external valuer as long as it does not provide valuations for individual assets, including those requiring a subjective judgement, but incorporates into the calculation process values which are obtained from the IFM, pricing sources or an external valuer. Foreign UCIs: shall mean undertakings for collective investment and collective investment undertakings, respectively, not established in Luxembourg. FTE: shall mean full-time equivalent. ICT: shall mean information and communication technology. IFM: shall mean an investment fund manager. For the purpose of this circular, IFM shall mean the designated external IFM or, where applicable, the internally managed UCI.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 6/38 Investments: shall mean the assets in portfolio, along with the derivatives (including those used for efficient portfolio management and hedging techniques) in which a UCI is invested at a given time and/or owned by a UCI at a given time. KPI: shall mean key performance indicators. KRI: shall mean key risk indicators. Management Body: shall mean a) as regards sociétés anonymes (public limited companies), the board of directors (conseil d’administration) or the management board (directoire) of the UCI administrator, as the case may be; b) as regards other types of companies, the body that represents the UCI administrator by virtue of the law and the instruments of incorporation. NAV: shall mean net asset value. Non-regulated UCIs established in Luxembourg: shall mean undertakings for collective investment and collective investment undertakings, respectively, established in Luxembourg that do not qualify as regulated UCIs established in Luxembourg as defined by this circular. Proper instruction: shall mean any signed, dated and written instruction delivered by the UCI or a person duly authorized to give an instruction on behalf of the UCI upon a decision of the UCI or the IFM. Regulated UCIs established in Luxembourg: shall mean the following entities:

• UCITS, shall mean an undertaking for collective investment in transferable securities subject to Part I of the 2010 Law;
• UCI Part II, shall mean an undertaking for collective investment established in Luxembourg, subject to Part II of the 2010 Law;
• SIF, shall mean a specialised investment fund within the meaning of the 2007 Law; and
• SICAR, shall mean an investment company in risk capital within the meaning of the 2004 Law. Sectorial legislation: shall mean legislation/laws/regulations in force to which entities carrying out the activity of UCI administration are generally subject, notably due to their status, authorisation or activities, including but not limited to, legislation in the area of the fight against money laundering and terrorist financing and on delegation arrangements. UCI administrator: shall mean an entity, as defined in section 2.1. of this circular, performing the activity of UCI administration. This activity may cover one, two or all of three function(s) defined in point 10 of this circular. UCIs: shall mean regulated UCIs established in Luxembourg, non-regulated UCIs established in Luxembourg and foreign UCIs.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 7/38 UCITS: shall mean an undertaking for collective investment in transferable securities falling under the scope of Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities. 2. Scope 2.1 Eligible entities

1. This circular applies to all entities carrying out the activity, or part of the activity (ie. one or two of the three functions as defined in point 10 of this circular), of UCI administration as listed in point 2 of this circular.
2. The following UCIs and IFMs are eligible to act as UCI administrator:

• Management companies incorporated under Luxembourg Law and subject to Chapter 15 of the 2010 Law;
• Management companies incorporated under Luxembourg Law and subject to Chapter 16 of the 2010 Law;
• Alternative investment fund managers authorised under Chapter 2 of the 2013 Law;
• Foreign IFMs pursuing the activity of UCI administrator for UCIs established in Luxembourg;
• Regulated Luxembourg UCIs. The last type of UCI administrator hereabove may only act as UCI administrator for themselves and may not offer those services to other UCIs. The UCI or its IFM, when applicable, performing all or parts of the UCI administration functions will be referred to as a UCI administrator in this circular. To that effect, when all the UCI administration functions are carried out by the UCI or its IFM when applicable, the provisions of this circular should be adapted to the specificity of such model. When the UCI administration activity has been wholly or partially delegated by the UCI or its IFM, to another entity (or several other entities), the UCI or its IFM must monitor the delegate(s) in accordance with applicable sectorial legislation. In this case, the UCI or its IFM must ensure the coordination and supervision of the UCI administration activity. As the case may be, a UCI or its IFM may also delegate the UCI administration activity, or part thereof, to an external IFM in Luxembourg, which is not the designated IFM of a given UCI.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 8/38 The UCI administration activity may further also be performed by the following external service providers established under the 1993 Law:

• Credit institutions authorised under Part I, Chapter 1 of the 1993 Law;
• Luxembourg branches of credit institutions governed by foreign laws and authorised under Part I, Chapter 3 of the 1993 Law;
• Registrar agents authorised under Part I, Chapter 2 of the 1993 Law;
• Client communication agents authorised under Part I, Chapter 2 of the 1993 Law, only for the client communication function as described in section 2.2.5 of this circular; and
• Administrative agents authorised under Part I, Chapter 2 of the 1993 Law, only for the NAV calculation and accounting function and client communication function as described, respectively, in sections 2.2.4 and 2.2.5 of this circular. Before acting as an administrator for a given UCI, the entities and service providers listed in point 2 of this circular must assess whether the carrying out of this activity by them is permitted taking into account applicable legal provisions. 2.2 UCI administration activity 2.2.1 Appointment of a UCI administrator: Authorisation requirements

3. The appointment to act as a UCI administrator is subject to prior CSSF authorisation, either through a complete authorisation application (under the applicable sectorial legislation) or authorisation through the defined administrative procedure (further referred to as authorisation) as detailed in point 4 hereafter.
4. Some entities are by operation of law authorised to perform all or some functions of the UCI administration activity in accordance with applicable sectorial legislation as long as they duly demonstrate compliance with the requirements set out in this circular at the time of their application for authorisation under this sectorial legislation and hereafter on a continual basis. This is the case for the following entities:

• Registrar agents authorised under Part I, Chapter 2 of the 1993 Law;
• Client communication agents authorised under Part I, Chapter 2 of the 1993 Law, only for the client communication function as described in section 2.2.5 of this circular; and
• Administrative agents authorised under Part I, Chapter 2 of the 1993 Law, only for the NAV calculation and accounting function and client communication function as described, respectively, in sections 2.2.4 and 2.2.5 of this circular.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 9/38 For the following entities intending to act as UCI administrator, this circular will introduce an authorisation for obtaining and maintaining such authorisation:

• Management companies incorporated under Luxembourg Law and subject to Chapter 15 of the 2010 Law;
• Management companies incorporated under Luxembourg Law and subject to Chapter 16 of the 2010 Law;
• Alternative investment fund managers authorised under Chapter 2 of the 2013 Law;
• Foreign IFMs pursuing the activity of UCI administrator for UCIs established in Luxembourg;
• Regulated Luxembourg UCIs;
• Credit institutions authorised under Part I, Chapter 1 of the 1993 Law; and
• Luxembourg branches of credit institutions governed by foreign laws and authorised under Part I, Chapter 3 of the 1993 Law. The application file to be submitted for the authorisation as provided for in point 3 of this circular must include, at least, the information listed in Annex A of this circular.

5. Any authorisation as a UCI administrator shall remain valid as long as the elements on the basis of which it was granted have not changed. Any entity acting as UCI administrator is required to apply with the CSSF for authorisation of any substantial changes to the initial application (in particular in case of substantial changes to its operational model) or to notify in advance any substantial changes regarding the aspects of delegation of critical or important operational tasks in accordance with section 3.5. of this circular.
6. UCI administrators, having been authorised as per the above, must ensure compliance with the requirements set out in this circular for the time they do act in such capacity. The information provided in the authorisation file must be kept up-to-date.
7. The UCI administrator must communicate to the CSSF, on an annual basis, information regarding its UCI administration activities, in accordance with the reporting modalities and instructions as further detailed on the CSSF website.
8. The UCI administrator must, in addition, comply with applicable sectorial legislation.
9. It is to be noted that all requirements of this circular apply at the level of the UCI administrator (irrespective of whether the function is performed by the UCI, the IFM and/or by an external provider). Section 3.5. of this circular covering delegation requirements must be complied with by the entity(ies) acting as UCI administrator.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 10/38 2.2.2 UCI administration activity 10. The UCI administration activity may be split into three main functions: the registrar function, the NAV calculation and accounting function, and the client communication function.

• The registrar function encompasses all tasks necessary to the maintenance of the UCI’s unit-/shareholder register. The reception and execution of orders relating to units/shares subscriptions and redemptions1, and the distribution of income (including the liquidation proceeds) are part of the registrar function;
• The NAV calculation and accounting function covers the legal and fund management accounting services and, the valuation and pricing (including tax returns); and
• The client communication function is comprised of the production and delivery of the confidential documents intended for investors.

11. The CSSF considers that only one service provider may be designated and is responsible for a specific UCI administration function, as defined in point 10 of this circular, for a UCI. For UCIs with multiple compartments, each function must be performed by the same service provider. However, the UCI administrator may receive support from delegates or designated third parties such as, for example, for corporate secretary or valuation duties. In this context, it is possible that the UCI or its IFM, when applicable, does not appoint a provider for each function but perform(s) the function itself, possibly with the support of third parties.
12. The UCI administration activity is globally composed of, at the least, the following tasks:

• Legal and fund management accounting services; o Bookkeeping; o Reconciliation of the UCI’s books and records; o In cooperation with the UCI or its IFM, when applicable, drawing￾up of prospectuses, financial reports and other documents intended for the UCI’s investors and their dispatching, filing and publication when required; o Cooperation and participation in the preparation of general meetings of the UCI’s unit-/shareholders, notices of meetings and related publications, filing and dispatching as well as all the preparation and dispatching of all other documents intended for investors; 1 For the purpose of this circular, the terms “subscription” and “redemption” should be understood in the rest of the text as covering also transfer, conversion, split or cancellation of units/shares, when applicable. Additionally, the terms units/shares should be understood as also including bearer units/shares.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 11/38 o Regulatory reporting (in particular, to the CSSF, to the BCL, or to the UCI national competent authority where applicable); and o Maintenance of the core documentation relating to the UCI and its operations (including but not limited to, contracts and agreements, minutes of the Management Body’s meetings, minutes of the liquidator’s resolutions, correspondence with the statutory auditors and the CSSF or any other national competent authority of the UCI, UCI’s books and financial reporting, prospectuses, financial reports and other documents intended for investors).

• Customer inquiries; o Reception and, when applicable, treatment of customer inquiries and complaints, including the records retention of such inquiries and complaints, as necessary.
• Valuation and pricing, including tax returns; o Calculation of the NAV of the UCI, and when applicable, of the compartment and unit/share classes; o Determination of the UCI’s subscription and redemption prices; o Valuation of investments held by the UCI in accordance with the UCI valuation policy, except when the valuation is performed, partially or wholly, by the UCI or its IFM, when applicable, or when the valuation has been delegated to an external valuer. In that case, the task of the UCI administration consists in the recording of the valuation provided by the external valuer in the books and records of the UCI; o Calculation of the income generated by the UCI to investors; and o Calculation, reporting and verification of payment of taxes, such as subscription tax or the VAT for regulated UCIs established in Luxembourg.
• Regulatory compliance monitoring; o Monitoring of the UCI’s compliance with applicable laws and regulations, along with the UCI’s rules as set out in the offering documents.
• Maintenance of the UCI’s unit-/shareholder register; o Performance of registrations, alterations or deletions necessary to ensure the regular update of the unit-/shareholder register.
• Distribution of income; o Allocation and distribution of the income generated by the UCI to investors, and distribution of liquidation proceeds to the investors, when applicable.
• Units/shares issues and redemptions; o Collection and processing of subscription, redemption and transfer orders for the units/shares issued by the UCI; and o Application of the subscription and redemption prices.
• Contract settlements, including certificate dispatch;

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 12/38 o Drawing-up of subscription or redemption (including liquidation bonus) contract notes and the certificates of title and the dispatch of such documents to the individual investors.

• Record keeping; o Maintenance of current and historical records allowing for the evidence or reconstitution of the UCI's operations (including, but not limited to, trade and bank statements, contract notes, subscription and redemption forms, invoices, audit accounting adjustments, minutes of meetings of the valuation committee). Not all of the aforementioned tasks included in the scope of UCI administration activity when provided individually necessarily require an authorisation as UCI administrator. Those tasks and the related controls must be performed as frequently as necessary, in line with the UCI activity, the NAV calculation frequency and regulatory requirements, where applicable.

13. The tasks of handling customer inquiries, regulatory compliance monitoring and record keeping apply to all three functions as defined in point 10 of this circular in accordance with the applicable legal provisions. The UCI administrator and the UCI or its IFM, when applicable, must agree, in a contract, on the roles and the allocation of responsibilities of each party with regard to these tasks to ensure that adequate means and procedures are in place to ensure a proper performance of their respective obligations.
14. In this context, the UCI administrator may, on the basis of delegation, perform the compliance monitoring, or part thereof, of the investment policy and investments restrictions in accordance with the applicable laws and regulations, along with the UCI rules as set out in the offering documents. The restrictions and limits in the scope of such delegated compliance monitoring must be agreed upon between the UCI administrator and the UCI or its IFM, when applicable, in a contract. In this context, the UCI administrator must establish, implement and maintain procedures to detect, assess and notify the UCI or its IFM, when applicable, without delay, of any instances of non￾compliance with the investment policy and restrictions.
15. The UCI administrator must establish, implement and maintain procedures to detect, assess and, when applicable, notify the UCI or its IFM, when applicable, without delay, of material or non-material NAV errors, breaches or operational incidents (with a financial impact or “near-by” incident). Such material or non￾material NAV errors, breaches or operational incidents must be logged by the UCI administrator and in case of relevant or significant shortcomings, the UCI administrator, in cooperation with the other parties, should design a

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 13/38 remediation plan to be approved by the UCI or its IFM, when applicable and implement the related corrective measures as well as ensure that a proper follow-up is being done. 16. In accordance with the aforementioned requirements, the UCI administrator must establish, implement and maintain an escalation process detailing for each type of error/breach/incident, the type of information to be exchanged, the parties to be involved (internally and externally) and the steps to be taken (log, corrective actions, etc.). In particular, the UCI administrator must, when applicable, ensure that an adequate notification is sent to the CSSF or any other national competent authority of the UCI either by the UCI itself, the IFM, when applicable, or by the UCI administrator itself (as required or agreed upon contractually). The processes and procedures under points 14 and 15 of this circular must also document in sufficient detail the appropriate steps in terms of communication towards investors and the national competent authority of the UCI and/or the IFM, in particular in case of NAV errors and breaches. 17. For regulated UCIs established in Luxembourg, such procedures and processes must comply with Circular CSSF 24/856, when applicable. 18. For regulated UCIs established in Luxembourg, the UCI administrator must inform the CSSF without undue delay in case the UCI administrator becomes aware that the UCI or its IFM, when applicable, does not properly fulfil its legal, regulatory or contractual obligations and/or does not notify the CSSF as required by applicable laws and regulations of material or non-material NAV errors/breaches/incidents. 2.2.3 Registrar function 19. The entity in charge of the registrar function must ensure the maintenance of the UCI’s unit-/shareholder register. The register must be available at all times to the UCI administrator which performs the registrations, alterations or deletions necessary to ensure its regular update and maintenance. The maintenance of the UCI’s unit-/shareholder register must be performed in accordance with the applicable laws and regulations, along with the UCI rules as set out in the offering documents. 20. For each UCI, the registrar function must at least cover the following operations:

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 14/38

• Reception and execution of the subscription, redemption, transfer and cancellation orders1;
• Application of the subscription and redemption prices;
• Calculation of the number of outstanding units/shares and maintenance of the unit-/shareholder register;
• Reconciliation of the subscription and redemption orders with the related cash flows;
• Distribution of the income generated by the UCI to investors according to the provisions of the prospectus, when applicable;
• Drawing-up of the subscription or redemption contract notes and the certificates of title and dispatch of such documents to the individual investors. This task may be performed by the registrar function or the client communication function as contractually agreed upon with the UCI or its IFM, when applicable;
• When applicable, application of the exchange ratio in case of merger, as well as subscription, redemption or distribution in kind;
• When applicable, for regulated and non-regulated UCIs established in Luxembourg, distribution of proceeds to the Public Trust Office (Caisse de Consignation) and for foreign UCIs to the relevant foreign public office; and
• Maintenance of adequate records of the UCI’s activity relating to the registrar function.

21. The requirement relating to the execution of subscriptions and redemptions by the UCI administrator does not prevent UCIs or their IFMs, when applicable, from appointing Luxembourg or foreign intermediaries as authorised financial agents and representatives for the subscriptions and redemptions of their units/shares. The UCI administrator must, in such situation, be in a position to provide adequate services, considering the structure and complexity of the distribution network and the types of UCIs concerned.
22. It is understood that the appointment of the intermediaries referred to above must in no way restrict the ability of investors to deal directly with the UCI, the IFM when applicable, or the UCI administrator when placing their subscription and redemption orders. It is therefore necessary for UCIs to explicitly and prominently mention this possibility in their offering documents.
23. The dispatching of confidential documents sent to investors must remain under the supervision of the UCI administrator. When the UCI administrator does not perform this task itself (in the event of delegation of this task), the 1 For the purpose of this circular, the terms “subscription” and “redemption” should be understood in the rest of the text as covering also transfer, conversion, split or cancellation of units/shares, when applicable. Additionally, the terms units/shares should be understood as also including bearer units/shares.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 15/38 UCI administrator must implement adequate procedures to control the dispatching, in particular the safeguard of data confidentiality relating to investors. The measures of protection should ensure that non-authorised third parties may not access confidential data relating to investors for whom the dispatches are intended. These measures are equally applicable to the dispatching of other, non-confidential documents to investors or potential investors by the UCI administrator. 24. When applicable, the UCI administrator must implement and apply adequate procedures and processes to ensure compliance of the UCI with the well￾informed and professional investor statuses. 25. When acting as registrar for regulated UCIs established in Luxembourg, the UCI administrator must, beside others, comply with Circular CSSF 04/146. 2.2.4 NAV calculation and accounting function 26. The entity in charge of the NAV calculation and accounting function must ensure that the UCI’s NAV is accurate. It must ensure the correct and complete recording of transactions to adequately keep the UCI’s books and records in compliance with applicable legal, regulatory and contractual requirements as well as the applicable accounting principles. The UCI’s books must be available at all times to the UCI administrator. The calculation and production of the NAV of UCIs must be performed in accordance with the applicable laws and regulations, along with the UCI rules as set out in the offering documents. 27. To calculate the UCI’s NAV and, when applicable, the NAV of its units/shares at compartment and/or class level, the NAV calculation and accounting function must at least cover the following operations:

• Identification and correct recording of all accounting movements in the UCI’s books against proper instructions and supporting documents and, when applicable, the consolidation of underlying assets/ vehicles;
• Valuation of liquid investments (using appropriate reliable valuation sources, in accordance with the UCI valuation policy);
• Valuation of complex and illiquid investments (using proper and independent valuations in accordance with the UCI valuation policy), or verification that the valuation of complex and illiquid investments is compliant with the UCI valuation policy when this valuation is performed by the UCI or its IFM, when applicable, or when this task has been delegated to an external valuer;
• Determination of the amount of unrealised and realised gain/loss generated by those investments;

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 16/38

• Calculation of income to be distributed to investors as per the UCI rules, when applicable;
• Compilation, provision, and allocation of fees, commissions and taxes, to be borne by the UCI as well as all incomes to which the UCI is entitled;
• Conversion of operations in foreign currencies in the reference currency of the UCI’s books;
• Calculation of the total NAV of the UCI, and validation of the NAV per unit/share (including, when applicable, the NAV per unit/share classes according to the provisions of the offering documents);
• When applicable, calculation of the exchange ratio in case of merger, as well as subscription, redemption or distribution in kind;
• Publication of the UCI’s NAV per unit/share;
• In cooperation with the UCI and/or its IFM, when applicable, drawing-up of financial reports and other documents intended for investors. This task may be performed by the NAV calculation and accounting function or the client communication function as contractually agreed upon with the UCI and/or its IFM; and
• Maintenance of adequate records of the UCI’s activity relating to the NAV calculation and accounting function.

28. For the completion of the above tasks and the calculation of the NAV, the UCI administrator may receive information and support from third parties (including, for example, the portfolio manager) in particular regarding the valuation of the investments or the computation of performance fees. The UCI administrator is in charge of the correct booking of any entries in accordance with UCI rules, in compliance with applicable accounting and valuation policies (types of documents used, information channels, sources, etc.). The UCI administrator must be critical of the information received (for example: identify unusual movements or assess the reliability of documents received). The sole compilation/input of accounting information is not sufficient to comply with the duties of the UCI administrator. UCI accounting and NAV calculation must be performed by the UCI administrator in a timely manner in accordance with the provisions of the offering documents.
29. The production of the NAV also encompasses related controls that must be adequately documented. In this context, the UCI administrator shall perform, at least, the following controls in addition to the operations detailed in point 27 of this circular:

• Review of unusual or significant movements of all or some of the NAV components (in particular of the NAV per unit/share, investments, cash, fees, invoices), including using benchmark comparison, when applicable;
• Comparison and reconciliation of NAV per unit/share prices, when applicable;

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 17/38

• Reconciliation of the investments and cash accounts (including those in relation with the subscription and redemption orders) against reliable and independent sources;
• Reconciliation between the total number of outstanding units/shares in the UCI’s accounts and the total number of outstanding units/shares in the UCI’s unit-/shareholder register;
• Oversight of accruals and provisions;
• Controls of the performance fees and carried interests’ calculation and their conformity with the provisions laid out in the offering documents, when applicable;
• Review of the application of liquidity management tools, when applicable (such as, but not limited to, the anti-dilution levy assessment, or the control of the application of swing factors); and
• Calculation and control of the Total Expense Ratio (TER), when applicable.

30. The UCI administrator must reconcile the accounting entries against reliable and independent sources, in particular transactions on investments, cash accounts and other assets. It must be able to explain the changes in the accounting balance from one NAV date to the next by keeping and analysing the records of the movements affecting the accounting items. This analysis is to be based on the accounting and valuation policy of the UCI policies (including, but not limited to, changes in valuation principle from going concern to liquidation value). A solid control system for calculating the NAV has to be put in place and controls regarding all steps of the NAV calculation have to be properly and appropriately documented.
31. The books and records of the UCI shall be kept in such a way that all assets and liabilities of the UCI can be directly identified at all times. For UCIs with multiple compartments and/or unit/share classes, separate books and records shall be maintained for the distinct compartments and adequate records for each unit/share classes, respectively.
32. The UCI administrator must comply with the accounting policies and procedures implemented and maintained by the UCI or its IFM, when applicable. Such policies must allow that, upon request of the CSSF, financial reports which reflect a true and fair view of the UCI financial position and which comply with all applicable accounting standards and rules, can be delivered to the CSSF in a timely manner. To that effect, the UCI administrator must establish, implement and maintain appropriate procedures to ensure the proper and accurate valuation of the assets and liabilities of the UCI. In case of delegation, the UCI administrator is always in charge of the final step of the NAV production and must perform a final validation.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 18/38 2.2.5 Client communication function 33. The client communication function is comprised of the handling of confidential communication and correspondence of confidential documents intended for investors. The aforementioned communication and correspondence must be performed in accordance with the applicable laws and regulations, along with the UCI rules as set out in the offering documents. 34. The UCI administrator executing the client communication function may cover the following operations:

• Drawing-up of financial reports and other documents intended for investors. This task may be performed by the entity in charge of the NAV calculation and accounting function or by the entity in charge of the client communication function as contractually agreed upon with the UCI or its IFM, when applicable;
• Correspondence and dispatch of offering documents, financial reports and other documents intended for investors detailing, in accordance with regulatory requirements, necessary information regarding compartments and/or unit/share classes, when applicable;
• Drawing-up of the subscription or redemption contract notes and the certificates of title and the dispatch of such documents to the individual investors. This task may be performed by the registrar function or the client communication function as contractually agreed upon with the UCI or its IFM, when applicable; and
• Maintenance of adequate records of the UCI’s activity relating to the client communication function. Mailing houses’ services which only cover the simple printing and dispatch of documents are not in scope of the client communication function.

35. The documents as mentioned in point 34 must always be produced in cooperation with the UCI or its IFM, when applicable. They may be produced in tangible form or in electronic format depending on their nature and in accordance with the applicable legal provisions. The requirements relating to the production of the aforementioned documents exclude the simple printing of those documents.
36. The dispatching of confidential documents sent to investors must remain under the supervision of the UCI administrator. When the UCI administrator does not perform this task itself (i.e. having delegated this task), the UCI administrator must implement adequate procedures and processes to control the correct dispatching, in particular the safeguard of the data confidentiality relating to investors. The UCI administrator must have specific ex-post controls in place to ensure that documents are duly transmitted to the final investors. The measures of protection should ensure that non-authorised third

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 19/38 parties may not access confidential data relating to investors for whom the dispatches are intended. 3. Organisational arrangements 3.1 General provisions 37. The UCI administrator must have an adequate internal organisation (including an adequate and appropriate environment of control) and sufficient resources (e.g. human resources, technical infrastructure and IT means). In particular, it must comply with the provisions set out in this chapter. Those provisions apply in the context of its activity as UCI administrator. 38. A written contract must be concluded between the UCI administrator and the UCI and/or the IFM1, when applicable. The contract must clearly set out the roles, the responsibilities, the rights and the obligations of each party. It must, at least, include the following elements:

• A description of the services, function(s) and/or task(s) covered by the contract;
• The rights and obligations of each party including the right to delegate certain tasks, and the applicable restrictions;
• The confidentiality obligations applicable to the parties in accordance with the relevant laws and regulations, as well as the notice period applicable under the contract;
• The means and procedures by which the UCI or its IFM, when applicable, transmits all relevant information or ensures the UCI administrator has access to all the information it needs in order to fulfil its duties, including the confirmation that the UCI administrator will receive necessary information from other parties appointed by the UCI or its IFM, when applicable;
• The means and procedures by which the UCI administrator transmits to the UCI or its IFM, when applicable, all relevant information that it needs to perform its duties, and in order to allow the UCI or its IFM, when applicable, to have a timely and accurate overview of the books and records of the UCI; 1 Even when it is not legally required, the CSSF recommends the UCI having designated an IFM to sign a tripartite contract with the IFM and the UCI administrator.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 20/38

• The means and procedures by which the UCI administrator transmits to or receives from any other stakeholder, such as the depositary, the statutory auditors or the liquidator of the UCI, the delegate(s) when applicable, and any other entity involved in the UCI operations (upon proper instruction of the UCI or its IFM, when applicable) all relevant information that it needs to perform its duties;
• The establishment of an operating memorandum agreed upon by all relevant parties detailing at least the content, the frequency, the format, the timing of information flows and the organisation of the operations; and
• The escalation and notification procedures for significant irregularities, breaches or suspicions of non-compliance to the UCI or its IFM, when applicable and as the case may be, to the CSSF or any other national competent authority of the UCI, where applicable. In case the UCI administration activity is performed partially or wholly by the UCI or its IFM, when applicable, the UCI or IFM acting as UCI administrator must also cover the aforementioned elements in an operating memorandum or, where applicable, the contract by which the IFM is designated as such.

39. The written contract as mentionned in point 38 of this circular must not prevent the UCI or its IFM, when applicable, from giving instructions at all times to the entity to which UCI administration functions have been delegated or from withdrawing the mandate with immediate effect when this is in the best interest of investors.
40. The UCI administrator must grant a right of access for the UCI and when applicable, the IFM, the statutory auditor of the UCI, the liquidator, the CSSF or any other national competent authority of a UCI, where applicable, to the documents and data relating to its administration upon simple request. Moreover, the UCI administrator must allow the UCI or its IFM, when applicable, to carry out on-site visits at a frequency and under the terms to be laid down in the contract, for the purposes of exercising its due diligence and ongoing monitoring activities. The UCI administrator must communicate proactively the information, documents and data necessary to perform its duties to the UCI or its IFM, when applicable. Furthermore, the UCI administrator must answer requests from the statutory auditor of the UCI, the CSSF or any other national competent authority of the UCI, where applicable, in a diligent and professional manner.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 21/38 41. Since the UCI administrator is a main actor of a UCI, its name shall be disclosed in the offering documents of any UCI for which the UCI administrator acts in this capacity. When several entities cover different functions, all entities shall be listed and their functions indicated. 42. The UCI administrator must act honestly, fairly, professionally, independently and in the best interest of the UCI and its investors. To that effect, the UCI administrator must act independently and be functionally and hierarchically separated from the depositary as specified in point 60 of this circular. 43. The UCI administrator’s premises must be of sufficient size, adequate and secure. Access must be restricted to its staff and approved persons such as clients or visitors. To that effect physical documents and records must be kept secure to warrant data confidentiality and protection. It is the responsibility of the UCI administrator to keep and safeguard physical records for the UCIs it services. 3.2 Internal organisation 3.2.1 General principles 44. The UCI administrator must have in place an adequate internal organisation , including an adequate and appropriate control framework. 45. The internal control functions must adequately cover the UCI administration activity. 46. The UCI administrator must establish, implement and maintain written procedures and processes covering and describing in an accurate manner all the related administration functions of UCIs. The procedures and processes must be kept up-to-date taking into account the evolution of the business (e.g. activities, clients, etc.) and the regulatory updates. 47. The UCI administrator should maintain a manual of procedures and processes easily accessible to the UCI administrator staff. The manual should cover the overall activity by documenting the overall framework and also include the necessary details to cover each UCI’s type and profile. Those procedures and processes should at least cover:

• Duties and obligations towards the UCI or its IFM, when applicable;
• Duties and obligations towards the depositary;
• Duties and obligations towards all stakeholders appearing in the written contract (as mentioned above);
• Duties and obligations towards delegates, when applicable;

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 22/38

• Exchange of information with the UCI and its IFM, when applicable, the depositary, other third parties and when applicable, delegates;
• Allocation of tasks among the staff as well as reporting lines;
• Daily and other regular important controls performed on the main functions, including the way such control results are properly evidenced;
• Escalation process for main functions;
• Dedicated procedures covering NAV suspension, NAV calculation errors (material or non-material), non-compliance with investment policy and restrictions, reporting deadlines, or operational incidents;
• Approval of new business relationships and new services;
• Handling of reports of infringements of the regulatory framework (whistleblowing);
• Monitoring and oversight of the delegation model; and
• Reasonable and prompt handling of investor complaints. Each complaint and the measures taken for its resolution should be recorded and properly documented. Investors shall be able to file such a complaint free of charge. The information regarding the handling of their complaint should also be made available to investors free of charge.

48. The aforementioned procedures and processes must be assessed and regularly reviewed, at least annually, by the UCI administrator with regard to their effectiveness. Adequate measures must be taken to remedy any deficiencies.
49. The UCI administrator must comply with the four eyes principle when performing critical or important tasks.
50. The UCI administrator should record its operations in an adequate, correct, complete and timely manner. To that effect, the tasks and controls performed by the UCI administrator must be duly documented in writing in the procedures and processes.
51. The UCI administrator must keep an up-to-date organisational chart, including the hierarchical and functional lines and, where appropriate, the reliance on other entities. The person designated as responsible for the UCI administration activity must be clearly identified in the organisational chart. The chart must also draw a distinction between the different functions and disclose the allocation by number of staff.
52. The UCI administrator must establish, implement and maintain protective measures against fraud.
53. The UCI administrator must have in place KPIs/KRIs that cover the UCI administration activity. Those indicators must take into account the services

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 23/38 rendered, the number of UCIs, the compartments and unit/share classes administered, along with the volume and complexity of the UCIs. 3.2.2 Approval of new business relationships and new services 54. When approving new business relationships or services, the UCI administrator must:

• Follow a documented risk acceptance policy and decision-making process (based on the implementation of sound procedures and the use of an approval committee, when applicable);
• Perform an adequate risk assessment (based on the UCI profile and complexity) and an appropriate, formalised and documented due diligence; and
• Follow sound and prudent management principles in its interest, promoting a sound risk culture. In this context, the risk acceptance policy and decision-making process must:
• Be compliant with the UCI administrator risk profile; and
• Provide for escalation measures. 3.2.3 Management of conflicts of interest

55. The UCI administrator must establish, implement and maintain an effective conflicts of interest policy covering the specificities of the UCI administration business line. This policy must be set out in writing and be appropriate to its size and organisation as well as the nature, scale and complexity of its business.
56. In order to minimise the potential risk of conflicts of interest, the UCI administrator must put in place an appropriate segregation of duties and activities, and take all reasonable steps to identify conflicts of interest. In its analysis of the risks of conflicts of interest, the UCI administrator must in particular identify and assess the risks arising from the relationship with the UCI, the IFM when applicable, and the depositary.
57. The procedures relating to the conflicts of interest policy must be regularly updated so as to adapt them to the evolution of the UCI administrator’s business.
58. The UCI administrator must keep and regularly update a record of the types of activities and clients in which a conflict of interest entailing a material risk of damage to the interests of one or more UCIs or its investors has arisen or, in the case of an ongoing activity, may arise. This record must be specific to the organisation and activities of the UCI administrator. It is recommended that the record covers at least the following items:

• Description of the conflict of interest (whether potential or actual);

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 24/38

• Identification of the persons or units concerned by the conflict of interest;
• Date on which the conflict of interest occurred or was discovered;
• Potential or actual impacts of the conflict of interest;
• Description of the envisaged solutions and chosen measures, including the dates of their implementation and resolution; and
• Where appropriate, arrangements for informing investors, including the date of such communication to investors.

59. The UCI administrator must be organised so as to minimise potential or actual conflicts of interest. Where such conflicts of interest cannot be avoided, they must be disclosed to the Management Body of the UCI, its IFM, when applicable, and where appropriate and relevant, to investors in order to prevent them from adversely affecting the interests of those parties. 3.2.4 Relationship with the depositary
60. The UCI administrator must act independently from the depositary. When the UCI administration function and the depositary function are performed by the same entity for a given UCI, this independence requirement can be complied with by implementing a functional and hierarchical separation between the buiness line in charge of the UCI administration activity and the business line in charge of the depositary activities, as opposed to a legal or structural independence, taking into account specific requirements under the respective sectorial legislation.
61. The UCI administrator must identify the potential and actual conflicts of interest and strive to avoid them in accordance with the procedures provided for in its conflict of interest policy. In particular, the UCI administrator must ensure a clear segregation of its UCI administration activities from those incumbent upon a depositary under the respective sectorial legislation.
62. The UCI administrator must, on an ongoing basis, make available to the depositary all the relevant information the latter needs to carry out its duties. On the same basis, the depositary must, on an ongoing basis, make available to the UCI administrator all the relevant information it needs to carry out its duties. For this purpose, the UCI administrator and the depositary must agree upon adequate information flows (means, type of information, format, frequency, etc.) in line with the UCIs profile and complexity. The means and procedures by which the UCI administrator, or the depositary, transmits all relevant information should be documented and formalised in an agreed-upon operating memorandum, or an internal operating memorandum when the same entity performs both functions.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 25/38 63. Whereas the depositary is in charge of the safekeeping of all of the UCI assets, the UCI administrator must beside others reconcile the investments and cash accounts of the UCI by using independent and reliable sources. In particular, the UCI administrator should use different sources that are considered valid to confirm the existence of each kind of reconciled assets. It is reminded that for regulated UCIs established in Luxembourg, point 36 of Circular CSSF 16/644 and point 75 of Circular CSSF 18/697 acknowledge that the depositary uses the records and accounts opened in the accounting books of the UCI with the UCI administrator and accounts statements issued by third parties to perform its own record-keeping of the other assets. 3.2.5 Access and retention of the core UCI documentation, including in case of change of UCI administrator 64. The data necessary to keep adequate records of the UCI’s activity and encompassing the core UCI documentation, shall be retained on a medium that allows for the storage of information in a way for it to be accessible for future reference by the UCI, the IFM when applicable, the statutory auditor of the UCI and the CSSF or any other national competent authority of the UCI, where applicable, and in such a form and manner that the following conditions are met:

• These records must be readily accessible and enable the reconstruction of each key stage of the processing of each portfolio transaction;
• Any corrections or other amendments to these records may be possible but the content of the records prior to such corrections or amendments, must remain easily ascertained (“audit trail”); and
• It must not be possible to manipulate or fraudulently alter these records.

65. The UCI administrator must keep all accounting and other documents which constitute the core UCI documentation and which are necessary to the proper performance of its obligations. The aforementionned documents of the UCI may be kept electronically by the UCI administrator. Other non-essential documents may also be kept electronically. Physical documents kept initially by the delegate of the UCI administrator that are irreplaceable and critical must be transferred to the UCI administrator without delay. This storage is to be ensured for a period of time as further defined by the laws applicable to the UCI for which UCI administration activities are performed.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 26/38 66. In case of liquidation of regulated UCIs established in Luxembourg, the UCI administrator must ensure that the essential documents necessary for the NAV calculation, as mentioned above, are (i) stored for a period of 10 years after the end of the relevant accounting period, and (ii) made available upon request to the statutory auditor of the UCI and the CSSF. The UCI’s books and essential documents at the liquidation date must hence be kept in Luxembourg. In case of a non-judicial liquidation of a UCI, the UCI’s books and documents must be kept for at least 5 years in Luxembourg after the closure of the liquidation in the Luxembourg Business Registers. In case of liquidation of non-regulated UCIs established in Luxembourg and foreign UCIs, the UCI administrator must ensure that the UCIs’ books and essential documents are kept and made available in accordance with the relevant laws and regulations. 67. In case of change of the UCI administrator (e.g. migration), the current UCI administrator, the future UCI administrator and the UCI or its IFM, when applicable, must agree upon a transfer process (proportionate to the size and complexity of the migration and including elements such as, for instance, a parallel run requirement, etc.) which should be adequately documented. The document describing the transfer process (the “process document”) must cover, at least, the following:

• Date of transfer, covering for each service (NAV calculation, registrar, financial reporting, etc.), the duties and responsibilities of all parties;
• Transfer of electronic and physical data. The process document shall ensure that the future UCI administrator obtains all core UCI documentation necessary to establish the UCI’s unit-/shareholder register as well as the books, the records and the NAV of the UCI at the date of the transfer. In particular, the future UCI administrator must obtain all documents evidencing investment purchases/sales and valuations (including minutes of the valuation committee, if any). The process document must also ensure that the future UCI administrator will be able to produce the historical figures disclosed in the financial statements and other documents intended for investors that are necessary for the current UCI activity; and
• Accessibility to historical electronic or physical data kept by the current UCI administrator, along with the procedure to access the data, delay to answer by type of data and the time during which data remains accessible by the future UCI administrator, the UCI, the IFM when applicable, and the statutory auditor.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 27/38 3.3 Human resources 68. The UCI administrator must at all times have sufficient substance and resources (including but not limited to human resources, operational processes and procedures, and ICT resources) to perform its activity in accordance with this circular. The staff must be sufficient in number and skills, taking into account the volume of UCIs serviced and their complexity. 69. Staff at the UCI administrator must:

• Be sufficient in number to service the volume of UCIs administered depending on NAV frequency and complexity. The complexity should be assessed with, at least, the following criteria: number of compartments, number of transactions, number of investors, structure closed/open￾ended, type of investment strategy, type of assets under management, type of asset classes, application of performance fees. Therefore, the number and skills of the staff should be adapted in an ongoing manner;
• Be in sufficient number to ensure that the four eyes principle (maker/checker) is enforced at all times, taking into account back-up scenarios in case of absences occurred in this context;
• Possess appropriate and sufficient individual and collective (e.g. “as a team”) skills and professional experience (“qualified staff”) having regard to the type(s) of UCI(s) concerned and to the investment strategies of the administered UCIs and their complexity. The appropriateness refers in particular to professional skills (knowledge, understanding and experience). The staff must on a collective basis have an understanding of all the activities, risks incurred, as well as of the economic and regulatory environment of the administered UCI. The staff must also have an understanding of the internal governance arrangements; and
• Upgrade skills through ongoing training (i.e. training plans must be adapted to the UCI administrator activity, in particular to the complexity of the UCIs administered).

70. In addition to requirements generally applicable to the UCI administrator under the sectorial legislation, the substance and resources of the UCI administrator for the specific performance of the UCI administration activity must be ensured.
71. Long-term absences or departures of staff (for example, resignations or dismissals) shall not impair the proper functioning of the UCI administrator in the medium and long run.
72. The UCI administrator must have clear hierarchical and reporting lines which shall involve the nomination of a person responsible for the UCI administration business line.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 28/38 73. The person in charge of and responsible for the UCI administration, whose name shall be provided to the CSSF forthwith, must:

• Prove to be of good professional repute and possess sufficient skills and the required professional experience having regard to the type(s) of UCI(s) concerned and to the investment strategies of the UCIs. With regard to sufficient experience, (s)he must have adequate professional experience gained, for example, through having already carried out similar activities at a high level of responsibility and autonomy; and
• Be able to satisfactorily demonstrate to the CSSF that other duties do not and are not likely to prevent him/her from honouring his/her role with the necessary time and due attention.

74. The person responsible for the UCI administration should be the head of operations, a conducting officer or a member of the Management Body, taking into account the principle of proportionality.
75. The UCI administrator’s work and activities must be documented and formalised in writing. This documentation must include the agenda and minutes of meetings recording the decisions and the measures taken by the head of the UCI administrator, the review/supervision of the UCI administration activity (including oversight of delegation model(s), when applicable). These minutes must be available or accessible at the premises of the UCI administrator. 3.4 ICT resources and, Business Continuity and Disaster Recovery Planning
76. All entities subject to this circular must follow the ICT requirements (including the requirements in case of delegation) under the applicable sectorial legislation. The UCI administrator is responsible for identifying, managing and mitigating its ICT risks. In particular, the UCI administrator must establish, implement and maintain protective measures against cyber risks. In this context, UCI administrators must comply with the DORA Regulation and/or Circular CSSF 20/750, as and when applicable.
77. Additionally, a UCI administrator must have the necessary and appropriate technical resources for the performance of its activities. This implies that it has its own systems of execution, i.e. procedures and technical and ICT infrastructures. To that effect, the CSSF considers that a UCI administrator must use a dedicated professional software to calculate NAVs and maintain the UCIs’ unit-

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 29/38 /shareholder registers, suitable to the complexity and nature of the UCIs it administers and allowing for the timely and proper recording of accounting movements, in line with legal and regulatory requirements. End-user computing systems (e.g. MS Excel with macro features, MS Access) shall be avoided, except when the UCI administrator can justify that the volume and complexity of the UCI administered do not require the use of such a professional software. When end-user computing systems are used, the UCI administrator must implement specific controls to reduce and mitigate the risks associated with such systems. 78. A UCI administrator must establish, implement and maintain systems and procedures that are adequate to safeguard the security (confidentiality, integrity and availability) of information, taking into account the nature of the information in question. The need-to-know/need-to-have principles must be ensured when granting access rights which must be regularly reviewed. In addition, the UCI administrator must ensure that the systems used are suitable for their chosen function and allow for, at least, the appropriate audit trail for accounting and registrar transactions and positions and privileged IT management activities. 79. Every UCI administrator must establish, implement and maintain an adequate business and service continuity policy ensuring the recovery of its activities and services after a disaster (i.e. BCP and DRP) within an adequate timeframe with regard to the NAV calculation frequency and providing for regular testing of those plans. In this context, the UCI administrator shall define and implement data and system backup and restoration procedures to ensure that they can be recovered as required. 80. When using a system that is located outside of Luxembourg, the UCI administrator shall have a secure backup of all accounting and registrar positions in a readable format at the end of each NAV calculation day. This backup shall be stored in the European Economic Area, either in the UCI administrator’s premises, or by a service provider different from the one to whom the system is outsourced, or by a group entity. In case of liquidation, the UCI administrator must take into account the requirements set out in point 66 of this circular. UCI administrators in the scope of the DORA Regulation that make use of services provided by ICT third-party service providers must follow the applicable requirements of the DORA Regulation and Circular CSSF 25/882. UCI administrators outside the scope of the DORA Regulation, having implemented or planning to implement ICT outsourcing arrangements, must follow the requirements of Circular CSSF 22/806, as amended.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 30/38 81. Since the ICT requirements may evolve or be clarified through the adoption of new regulations or through the publication of guidelines, recommendations, or questions and answers of the European Securities and Markets Authority (ESMA), the organisational arrangements set out in this chapter may be supplemented or amended and, where relevant, should be read together with such regulations, guidelines, recommendations and questions and answers. 3.5 Delegation models1 82. In accordance with applicable sectorial legislation, the UCI administrator may delegate to third parties (i.e. delegates) the performance of one or more of its UCI administration tasks, for the purpose of a more efficient conduct of its business. This section sets out the delegation requirements that apply to the entities acting as UCI administrator which are delegating one or more of their UCI administration tasks. In that case, the principles set forth in this chapter must be complied with at all times during the delegation by all its delegates. However, under no circumstances may the monitoring of the delegated tasks or the due diligence/oversight on the delegates be delegated. 83. The delegation of tasks must be clearly detailed in a dedicated written contract following the requirements listed under point 38 and, when applicable, 88 of this circular. In any case, the division of tasks related to the duties of UCI administration must not result in a fragmentation which renders the exercise of the coordination and general supervisory function difficult, if not impossible, or which unnecessarily increases costs by unjustified duplication or complexity of the operating model. 84. The delegation model must not be detrimental to the UCI administration services provided to the UCIs (notably in terms of quality and/or cost). It also must not generate additional or increased risks for the UCIs, in particular legal or operational risks. 85. The delegation of tasks does not relieve the UCI administrator of its responsibilities. It must be able to provide at any time to the CSSF the list of all delegation arrangements (critical/important or not) in place, including the description of the delegated tasks performed and information on its delegates. 1 ICT delegations are excluded from the scope of this section and subject to the applicable sectorial legislation.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 31/38 86. With respect to the delegation in the area of the NAV calculation and accounting function, any final NAV, respectively its publication, must be controlled and validated by the UCI administrator. The final controls/checks and the validation must therefore be performed and duly documented by the UCI administrator in accordance with point 29 of this circular. 87. Adequate initial and ongoing due diligence must be performed by the UCI administrator on its delegates. The UCI administrator must in this context:

• Design, implement and keep up-to-date a procedure regarding the selection, monitoring and change of delegates. The nature, scope and frequency of the periodic due diligence to be carried out on delegates must also be covered by this procedure. In the case where the delegate obtains a service auditors’ report on the operating effectiveness of its internal controls prepared in accordance with a recognised standard such as ISAE 3402, the UCI administrator may take this information into account for the organisation of its monitoring of the delegate;
• Implement and monitor defined KPIs/KRIs on a regular basis adapted to the UCI activity (at least annually);
• Review the IT systems, operational processes and procedures;
• Review the agreements/contracts with the delegates;
• Have regular contact with the delegates (including periodic calls/chats, meetings, at least monthly); and
• Conduct a periodic due diligence, in particular organise regular on-site and/or virtual visits. A sole recourse to virtual on-site visits is not deemed to be sufficient in this context.

88. A written contract must be concluded between the UCI administrator and any of its delegates. The contract must clearly set out the roles, the responsibilities, the rights and the obligations of each party. It must, at least, include the following elements:

• A description of the services, function(s) and/or task(s) covered by the contract;
• Rights and obligations of each party including the right to delegate certain tasks, and the applicable restrictions;
• The confidentiality obligations applicable to the parties in accordance with the relevant laws and regulations, as well as the notice period applicable under the contract as well as specific provisions regarding the transfer of activities towards another service provider or back to the UCI administrator;
• Means and procedures by which the UCI administrator transmits all relevant information or ensures the delegate has access to all the information it needs to fulfil its duties, including, when applicable, the procedures ensuring that the delegate will receive information from other parties appointed by the UCI or its IFM, when applicable;

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 32/38

• Means and procedures by which the delegate transmits to the UCI administrator all relevant information that it needs to perform its duties, and in order to allow the UCI administrator to have a timely and accurate overview of the tasks performed by the delegate;
• Workflows of the interaction with the delegate (notably meetings, regular reports, incident management, KPIs, KRIs);
• Establishment of an operating memorandum agreed upon by both parties detailing at least the content, the frequency, the format, the timing of information flows;
• Restrictions and conditions to comply with in case of sub-delegation by the delegate;
• Clauses covering data privacy and data protection covering the type of data transferred; and
• Integration of the UCI administrator’s needs in the BCP/DRP and the back￾up plans of the delegate.

89. The UCI administrator must draft, implement and maintain adequate procedures and processes to efficiently monitor the delegated activities. To that effect, it must, at least, ensure that:

• The necessary workflows and controls in place are detailed in a written policy, memorandum or procedure available at the delegate and the UCI administrator. Such documents must be reviewed regularly, at least annually;
• The delegate provides in writing on a regular basis and, when necessary, on an ad hoc basis, to the UCI administrator detailed information, reports and/or KPIs/KRIs regarding the status (completion, volume, etc.), the quality and any issues relating to the delegated tasks;
• It retains the capacity and skills to adequately monitor the delegated activities on an ongoing basis; and
• An escalation procedure in case of problems, shortcomings and irregularities, exists and is implemented.

90. The UCI administrator must have access to its data at all times. Moreover, data must enjoy the same level of protection and confidentiality at the delegate. Adequate encryption must be ensured.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 33/38 To that effect, the UCI administrator must be provided with an immediate and unlimited editor access to the delegate’s related system(s) allowing it to directly intervene in the processing of information. Such access must also allow for the instantaneous and full production of any data necessary for normal operations of the UCI administrator. If this is not possible, the UCI administrator must be provided with a non-restrictive and immediate reader access to such system allowing it to adequately retrieve the data necessary to perform its duties and maintain suitable systems to upload and use such data. In addition, the UCI administrator must ensure that the delegation model complies with point 80 of this circular. 91. The essential documentation of the UCIs must be available at all times at the UCI administrator. Therefore, the delegate must forward all necessary documents to the UCI administrator (electronically or physically if such documents are irreplaceable). 92. The UCI administrator shall assess, in view of possible legal risks and obligations, whether or not the third parties concerned by the delegation, and in particular investors, should be informed or their consent be obtained. In this respect, the UCI administrator shall also comply with the regulations in force relating to, beside others, general data protection. 93. In case the delegation implies a transfer of relevant information to a third party, the UCI administrator must ensure that the UCI or its IFM, when applicable, has accepted the delegation of the relevant delegated services, the type of information transmitted in the context of the delegation and the country of establishment of the entities that provide the delegated services. Any transfer of information related to investors should be disclosed prior to the transfer, by the UCI or its IFM, when applicable, to investors through appropriate means, namely the offering documents and the subscription form combined, if appropriate, with a reference to a website. Existing investors should be informed by the UCI or its IFM, when applicable, prior to the transfer of their information, about any update of the offering documents aiming at the aforesaid disclosure by means of a letter, email or any other means of communication provided for by the offering documents. 94. The UCI administrator’s BCP as mentioned in point 79 of this circular must take into account any delegation model. Special attention should be paid to the continuity aspects and the revocable nature of delegation. The UCI administrator shall in this context take the necessary measures to be in a position to adequately transfer the delegated activities to a different service provider or back to itself, whenever the continuity or quality of the services provisions are likely to be affected negatively.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 34/38 95. The results of the due diligences and the ongoing oversight must be formalised in writing. 96. The CSSF considers that, if the UCI administrator operates its UCI administration activities based on a delegation model, it must always be able to take over or transfer to alternative service providers the delegated UCI administration tasks when required (in the event of any issues that would negatively impact the services provided). Any delegation model, which is of such a scale that the UCI administrator can no longer be considered as a UCI administrator in substance and that it would become a letter-box entity, must be considered as contravening the conditions which the UCI administrator is required to meet in order to obtain and maintain its authorisation. 97. The concept of letter-box entity is particularly assessed in the light of the size of the staff performing the UCI administration, which must be appropriate, given for example the complexity and number of NAVs administered by the UCI administrator. The size of the staff must also be proportionate to the size of the team providing support at the delegate. 98. When the UCI administrator relies on companies of the group to which it belongs for due diligence assessment and/or oversight monitoring, it must perform an independent review of its group’s assessment and monitoring. Consequently, it must be in a position to challenge the group’s decision. As a general principle, the overall delegation model should remain at all times under the control of the UCI administrator. 99. The requirements, which apply when delegating, must apply mutatis mutandis where the delegate sub-delegates UCI administration tasks (excluding ICT delegation), and in case of any subsequent level of sub-delegation (i.e. a chain of delegation). The conditions applicable to any sub-delegation are those referred to in this chapter on delegation. In this context, the CSSF considers that the risks associated with sub-delegation of UCI administration tasks outside the group to which the UCI administrator belongs, to an entity not supervised by the CSSF, do not allow the UCI administrator to comply with the requirements of this circular and such sub-delegations are therefore prohibited. 100. A UCI administrator that intends to delegate a critical or important operational task shall notify in advance its plans to the CSSF using the instructions and, where available, the forms on the CSSF website. Such a notification is to be submitted at least three months before the planned delegation comes into effect. When resorting to a client communication agent or an administrative agent authorised under Part I, Chapter 2 of the 1993 Law, this notice period is reduced to one month. Any planned delegation

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 35/38 arrangement which has not been notified within the above notification period and/or without using the instructions and, where applicable, the forms available on the CSSF website will be considered as not notified. 101. The notification is without prejudice to the supervisory measures or the application of binding measures and/or administrative sanctions which the CSSF might take as part of its ongoing supervision, where it appears that these delegation projects do not comply with the applicable legal and regulatory framework. In any event, the UCI administrator remains fully responsible to comply with all the relevant laws and regulations as regards the planned delegation projects. 102. The UCI administrator must assess the criticality or importance of tasks considering, in particular, where a defect or failure in its performance would materially impair any of the following:

• Its continuing compliance with the conditions of its authorisation and/or its other legal and regulatory obligations;
• Its financial performance; or
• The soundness or continuity of its activity. The UCI administrator must ensure that these conditions are always met when delegating tasks of core business activities.

4. Entry into force and various provisions
5. This circular repeals Chapter D of Circular IML 91/75.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 36/38 104. This circular enters into force with immediate effect. The requirement of authorisation set in section 2.2.1 of this circular does not apply to entities already acting as UCI administrator at the date of entry in force of this circular. A grandfathering period, in order to comply with the remaining provisions of the present circular, is granted to such entities already acting as UCI administrator at the date of entry in force of this circular until 30/06/2023. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General Annexe A - List of information to be provided to the CSSF to apply for authorisation to act as UCI administrator

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 37/38 ANNEXE A - List of information to be provided to the CSSF to apply for authorisation to act as UCI administrator The application file must be submitted ex-ante in electronic format to the CSSF. To this end, the prospective UCI administrator must duly fill in and submit the corresponding form(s) available on the CSSF website. The prospective UCI administrator must provide at least the following information:

• A description of the function(s) and tasks performed by the UCI administrator as described in section 2.2. of this circular.
• The programme of activity including, at least, information on the scope of the proposed services for the next three financial years concerning: o The number of serviced UCITS, AIFs, other Luxembourg UCIs and other vehicles (including foreign vehicles), and their compartments; and o An estimated NAV and number of accounting and/or register entries per year.
• A description of the human resources, in particular: o The number of FTEs and staff; o An organisational chart for the UCI administration activity (by function) and for the whole entity. In the case of delegation, a chart with all third-party entities must also be provided; and o The name of the person responsible for the UCI administration and its curriculum vitae.
• A description of the technical infrastructure, in particular: o A summarised description of the IT organisation and systems used; o A description of the logical access security measures; o A description of the continuity measures (backup, BCP/DRP).
• A detailed description of all controls covering the function(s) and tasks performed by the UCI administrator.
• When applicable, a description of the delegation model: o A description of the delegated tasks and the details of the delegates; o The applicable form(s) in case of delegation of administration operational tasks as available on the CSSF website; and o A confirmation relating to the establishment of such a manual of procedures.
• A description of the procedures implemented for handling complaints.
• A confirmation that the written procedures regarding conflicts of interest have been put in place.

CIRCULAR CSSF 22/811 (AS AMENDED BY CIRCULAR CSSF 25/900) 38/38 Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1-1 direction@cssf.lu www.cssf.lu