CBFA Communication on its policy regarding outsourcing of retail portfolio management services to a service provider in a non-EEA state

rue du Congrès 12-14 | 1000 Bruxelles t +32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be Prudential Policy for Banks and Insurances Brussels, 6 November 2007

CBFA Communication on its policy concerning the outsourcing of retail portfolio management services to a service provider located in a State not a member of the European Economic Area

Madam, Sir,

Introduction

Pursuant to Article 20bis of the Law of 22 March 1993 and Article 62bis of the Law of 6 April 1995¹, the CBFA must publish on its website a communication regarding its policy on the outsourcing of retail portfolio management services to a service provider located in a State not a member of the European Economic Area (EEA) when one or both of the following conditions, set out in Article 22, §1, of the CBFA Regulation of 5 June 2007 on organizational rules applicable to establishments providing investment services (hereinafter, the CBFA Regulation of 5 June 2007), are not met²:

− the service provider must be authorized or registered in its home country for the provision of this service and must be subject to prudential supervision; − there must be an appropriate cooperation agreement between the CBFA and the supervisory authority of the service provider.

1 These articles stipulate, in their §4, that when a credit institution (Article 20bis of the Law of 22 March 1993) or an investment firm (Article 62bis of the Law of 6 April 1995) "entrusts a third party with the execution of essential operational tasks to ensure the continuous and satisfactory provision of its investment services and the exercise of its investment activities, it takes adequate measures to limit the associated operational risk. The outsourcing referred to in the first paragraph cannot be carried out in a manner that significantly impairs the adequacy of the company's internal control procedures and prevents the Banking, Finance and Insurance Commission from controlling whether the company complies with its legal obligations. The Banking, Finance and Insurance Commission publishes a communication in which it sets out the policy it follows regarding the outsourcing of portfolio management services provided to retail clients." 2 Article 22, §3, of the CBFA Regulation of 5 June 2007. This Article 22 transposes into Belgian law Article 15.3 of Commission Directive 2006/73/EC of 10 August 2006 laying down implementing measures for Directive 2004/39/EC of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive (hereinafter, Directive 2006/73/EC).

rue du Congrès 12-14 | 1000 Bruxelles t +32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be

• 2 Indeed, if one or both of these conditions "are not met, an establishment may not outsource portfolio management services by entrusting them to a service provider located in a third country without first notifying the CBFA of the contract and the outsourcing regime, as well as all other useful information, and provided that the CBFA has not raised objections to this contract and regime within one month of receiving the notification"³.

Through this communication, the aim is, for regulatory transparency and to ensure an appropriate degree of legal certainty⁴ for establishments, to give examples of cases in which the CBFA will not, or will probably not, raise objections to an outsourcing, even though one or both of the conditions provided for in Article 22, §1, of the CBFA Regulation of 5 June 2007 are not met.

This communication specifies: − the CBFA's approach in this matter; and, − the elements that an establishment considering such outsourcing is invited to notify to the CBFA.

It concerns credit institutions and investment firms under Belgian law, as well as Belgian branches of investment firms subject to the law of States that are not members of the EEA.

Within the framework of this communication, "portfolio management services" should be understood as referring solely to the investment service of portfolio management, as defined in Article 46, 8°, of the Law of 6 April 1995. As for the notion of "appropriate cooperation agreements," it covers not only Memoranda of Understanding (MoUs) concluded by the CBFA but also all modes of collaboration governed otherwise than by a formal MoU (such as, for example, cooperation regulated by exchange of letters).

1. Principles regarding the outsourcing of portfolio management to a service provider subject to a non-EEA State

1.1. Approach followed

The two conditions referred to in Article 22, §1, of the CBFA Regulation of 5 June 2007 can be considered as aiming, on the one hand, to ensure that the interests of the Belgian establishment's clients (concerned by the outsourcing) are adequately protected and, on the other hand, that the CBFA can access the necessary information in the exercise of its duties.

It is in light of these objectives that the CBFA will examine outsourcing cases covered by Article 22, §2, of the CBFA Regulation of 5 June 2007 and decide whether or not to raise objections to the envisaged outsourcing.

3 Article 22, §2, of the CBFA Regulation of 5 June 2007. 4 See in this regard Recital 22 of Directive 2006/73/EC.

rue du Congrès 12-14 | 1000 Bruxelles t +32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be

• 3 From the moment the establishment wishing to outsource has previously demonstrated – for example by adopting measures such as those set out in points 1.2 and 1.3 below – that these objectives will be met despite the non-compliance with one or both of the conditions referred to in Article 22, §1, of the CBFA Regulation of 5 June 2007, and that it will be able to comply with the obligations incumbent upon it under Articles 17 to 21 of the CBFA Regulation of 5 June 2007 as well as the principles set out in Circular PPB 2004/5, the CBFA should in principle not raise objections to this outsourcing project.

Regarding the measures thus set out in points 1.2 and 1.3 below, it should be noted that they are cumulative and non-exhaustive: it is indeed not excluded that, in the framework of the examination of a concrete file, the CBFA may consider that other measures than those are necessary for the sought-after objectives of protecting client interests and accessing necessary information to be achieved.

1.2. Situation where the service provider is neither authorized nor registered and is not subject to prudential supervision

The CBFA should in principle raise an objection to an outsourcing project to a service provider that is not authorized or registered and is not subject to prudential supervision, unless the outsourcing establishment demonstrates that appropriate measures exist or have been taken to ensure that the provider operates in a manner similar to that of an authorized or registered entity subject to prudential supervision. The following measures may notably be considered in this regard:

− the establishment demonstrates that the service provider is subject to a supervisory regime close to the existing prudential supervision regime in Belgium; − the establishment demonstrates that the service provider has and commits to maintaining, for the duration of the outsourcing contract, sufficient and adequate resources for the provision of the outsourced service, including appropriate supervisory oversight (internal control, compliance, risk management, and internal audit); − the establishment demonstrates that the service provider has taken the necessary measures for the establishment to comply with its obligations towards its clients, in particular those defined in Articles 27 and 28 of the Law of 2 August 2002, and that it can verify the compliance with these measures and impose the necessary corrective measures if applicable; − the establishment has obtained from the service provider that it will inform it not only of any event that could have a significant impact on its ability to fulfill its obligations under the outsourcing contract but also: ◦ of any negative effect that a new law or regulation introduced in the provider's home State could have on the execution of its tasks under the outsourcing contract; ◦ of any significant modification of its structure, shareholding, effective management, own funds, or prudential risk profile;

rue du Congrès 12-14 | 1000 Bruxelles t +32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be

• 4 − the establishment has reserved the right to terminate the outsourcing contract in the event of modification of the service provider's structure, shareholding, effective management, own funds, prudential risk profile, insolvency, bankruptcy, or concordat or any equivalent procedure in the State concerned, or if the provider does not fulfill its obligations under the outsourcing contract; − the establishment has reasonable certainty that the service provider has the necessary financial capacity to assume its liability under the outsourcing contract in the event that such liability is invoked; − the establishment has obtained from the service provider: ◦ that it will prepare its annual accounts in accordance with its national law, which – for all significant aspects – is similar or identical to internationally accepted accounting standards, and that these accounts will be subject to an independent audit, carried out in accordance with its national law, which must be similar or identical to internationally recognized audit standards; ◦ that it will transmit to it annually a copy of its audited annual accounts and inform it as soon as it becomes aware of any issue raised in the framework of the audit of its accounts; − the establishment demonstrates that it has provided for appropriate measures, such as the following, regarding confidentiality (these measures must comply with the privacy protection rules to which the establishment is otherwise subject): ◦ the outsourcing contract imposes on the service provider to take the necessary measures to ensure the protection of confidential information of which it becomes aware in the framework of the execution of this contract and provides for the possibility for the establishment to verify the compliance with these measures and to impose the necessary corrective measures if applicable; ◦ the outsourcing contract provides that the provider must not only protect any confidential information relating to the establishment or its clients but also inform the establishment without delay of any breach of this confidentiality obligation; − the outsourcing contract is subject to the law and jurisdiction of an EEA Member State, knowing that the outsourcing cannot prejudice the establishment's respect for the rules to which it is subject in Belgium (including those on privacy protection) and cannot further have the consequence that rules of law other than those agreed apply to its relationship with clients.

1.3. Situation where there is no appropriate cooperation agreement

When the service provider to which the establishment envisages outsourcing portfolio management services is subject to a supervisory authority located in a State not a member of the EEA with which the CBFA has not concluded an appropriate cooperation agreement, the CBFA should in principle not raise an objection to the outsourcing project if the establishment demonstrates that appropriate measures have been taken to ensure that the CBFA and the establishment's commissioner have access to the information necessary for the exercise of their respective duties.

This could be the case, inter alia, when the following measures are provided for:

rue du Congrès 12-14 | 1000 Bruxelles t +32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be

• 5 − the outsourcing contract authorizes the establishment to have access to and communicate to the CBFA and the establishment's commissioner any information(s) relating to the outsourced activity that would be requested by the CBFA and/or by the commissioner in the framework of the exercise of their supervisory duties. This implies in particular that the establishment should previously verify that the supervisory authority of the service provider and/or the local law or regulation do not limit access to information relating to the outsourced activities. Any restriction should be previously described to the CBFA; − the outsourcing contract imposes on the service provider to communicate to the establishment all information necessary to allow it to meet its legal and regulatory obligations. The contract also recognizes to the establishment, the CBFA, and the establishment's commissioner the right to have access, at any time and without hindrance, to data relating to the outsourced activities and to the service provider's business premises.

2. Notification procedures

If one or both of the conditions mentioned in Article 22, §1, of the CBFA Regulation of 5 June 2007 are not met, an establishment may not outsource portfolio management services by entrusting them to a service provider located in a State not a member of the EEA without first notifying the CBFA of the contract and the outsourcing regime as well as all other useful information relating to this outsourcing project.

Such a notification should notably include the following information:

− a justification of the decision to outsource; − the name of the envisaged service provider and the reasons why the establishment wishes to resort to it; − the draft outsourcing contract that the establishment envisages to conclude with the service provider and the expected entry into force date (unless the CBFA raises objections); − details regarding the condition(s) provided for in Article 22, §1, of the CBFA Regulation of 5 June 2007 that would not be met; − the measures proposed by the establishment to meet the obligations incumbent upon it under Articles 17 to 21 of the Regulation of 5 June 2007, the principles set out in Circular PPB 2004/5 of 22 June 2004, and the objectives set out in point 1.1 above throughout the execution of the outsourcing contract; − if applicable, details regarding the authorization or registration enjoyed by the provider as well as proof of this authorization or registration, the contact details of the person(s) within the authority that issued this authorization or carried out this registration, a summary of the legislation and/or regulation governing the status and/or activities of this provider.

rue du Congrès 12-14 | 1000 Bruxelles t +32 2 220 53 42 | f +32 2 220 54 93 | www.cbfa.be

• 6 Regarding compliance with the obligations provided for by Article 17, b), of the Regulation of 5 June 2007, the establishment's attention is drawn to the fact that it will have to take all necessary measures to continue to fulfill its obligations towards its clients as defined in Articles 27 and 28 of the Law of 2 August 2002, notwithstanding the outsourcing.

Please accept, Madam, Sir, the expression of our distinguished sentiments.

The President, Jean-Paul SERVAIS.