Insurance and Medical Aid Fund Industry Comments on the Outsourcing Standard

1 INSURANCE INDUSTRY COMMENTS ON FIMA GENERAL STANDARD 10.10- 2024 (OUTSOURCING OF FUNCTIONS AND RESPONSIBILITIES BY FINANCIAL INSTITUTIONS AND FINANCIAL INTERMEDIARIES) Company Name: STD/REG No. & Section/Clause: Comment/Description of issue: Proposed Amendment/Solution: Accepted (Comments): Rejected (Comments): Renaissance Health Medical Aid Fund S1 definitions “in-sourcing arrangement” means the outsourcing of a material business function by a financial institution or financial intermediary to a related service provider such as a subsidiary, affiliate or associate; and “outsourcing” means an arrangement whereby a financial institution or financial intermediary uses a service provider to provide a material business function on its behalf, and it includes in-sourcing, off-shoring and sub-outsourcing arrangements; In terms of the definition of an “in-sourcing arrangement”, a subsidiary or an associate is specifically included. However, in terms of the “outsourcing” definition reference is only made to a service provider in or outside Namibia. NAMFISA must kindly clarify whether service provider includes a subsidiary or an associate to enable to Fund to ensure compliance via procurement. Declined. Outsourcing is a broader term and insourcing only refers to a related party or subsidiary or associate. Prosperity Health Namibia S1 definitions “in-sourcing arrangement” means the outsourcing of a material business function by a financial institution or financial intermediary to a related service provider such as a subsidiary, affiliate or associate “outsourcing” means an arrangement whereby a financial institution or financial intermediary uses a service provider to provide a material business function on its behalf, and it includes in- sourcing, off-shoring and sub- outsourcing arrangements; “In-sourcing arrangement”: Per definition, it includes a subsidiary/Associate etc. However, the “Outsourcing” Definition only refers to a service provider in or outside Namibia. Does service provider include a subsidiary/Associate? Declined. Outsourcing is a broader term and insourcing only refers to a related party or subsidiary or associate. Napotel Medical Aid Fund S1 definitions “in-sourcing arrangement” means the outsourcing of a material business function by a financial institution or financial intermediary to a related service provider such as a subsidiary, affiliate or associate; and “outsourcing” means an arrangement whereby a financial institution or financial intermediary uses a service provider to provide a material business function on its behalf, and it includes in-sourcing, off-shoring and sub-outsourcing arrangements; NAMFISA must clarify whether service provider includes a subsidiary or an associate as in terms of the definition of an “in-sourcing arrangement”, a subsidiary or an associate is specifically included. However, in terms of the “outsourcing” definition reference is only made to a service provider in or outside Namibia . Declined. Outsourcing is a broader term and insourcing only refers to a related party or subsidiary or associate. NASIA Clause 1(1)(h): “principal business” means the functions or activities that are defined in Schedule 2; The concept of creating outright prohibitions on outsourcing principal business is highly problematic for the reasons set out under description of issue under clause 3 below. See our proposed changes under clause 3 Declined. 1.The functions that are prohibited in terms of a medical aid fund do not prohibit using in sourcing of those functions to the related parties. 2. The core functions must reside with the principals of the fund, but the

2 support functions can be insourced for better supervision of the entity. 3. There may be initial costs but in the long run it will work out cheaper for the fund to comply with the Standard. Nammed Medical Aid Fund Section 1 (1)(b) “in-sourcing arrangement” means the outsourcing of a material business function by a financial institution or financial intermediary to a related service provider such as a subsidiary, affiliate or associate; Does material business function in this context refer to either any function or activity that may materially impact the business of the financial institution (hereinafter the “fund”) [section 321(1)] or the financial intermediary (hereinafter the “administrator”, unless otherwise stated), or any function or activity that materially impact the duties of the board and/or administrative services [section 363(1)]? As Funds and Administrators are both referred to herein, does this mean that for purposes of Chapter 7, Administrators are viewed to be integrally linked and inseparable in so far as the definition of administrative services are concerned? If funds utilise a speciaised and dedicated department that sole purpose is administrative services with its own management, would that be considered as insourcing as a form of outsourcing? The question then arises whether this would not create an additional financial burden on members? A cost analysis scenario be done to consider the cost implication for members if in-sourcing is also considered to be out-sourcing. In-sourcing should not be considered to be included as a form of outsourcing. Declined.

1. Insourcing is a form of outsourcing a material business function to a related party. The functions that are prohibited in terms of a medical aid fund do not prohibit using in sourcing of those functions to the related parties.
2. The core functions must reside with the principals of the fund, but the support functions can be insourced for better supervision of the entity.
3. There may be initial costs but in the long run it will work out cheaper for the fund to comply with regulation.
4. The definition of material business function is provided for under section 1(c ) of the Standard and provides that “material business function or activity” means a business function or activity of a financial institution or financial intermediary that has the potential, if disrupted, to significantly and negatively impact – (i) the finances, reputation or operations of the financial institution or financial intermediary; or (ii) the financial institution’s or financial intermediary’s ability to manage key risks effectively; Nammed Medical Aid Fund Section 1(1)(c) “material business function or activity” means a business function or activity of a financialinstitution or financial intermediary that has the potential, if disrupted, to significantlyand negatively impact – (i) the The definition of material business function or activity seems vague and needs clarification. Is this definition limited to the provisions of section 6(2) only, or is it inclusive of administrative services [Section 363(1)], the duties of the board [section 344], the appointment of an auditor [section 345], and the appointment of a valuator [section 346]? What would constitute a key risk [section 1(1)(c)] to NAMFISA? The parameters of material business functions or activities need to be defined. Key risks need to be defined as well. Clarification. Key risk - Although not defined it would mean -any risk that poses a threat to the business. Declined. The Standard is principle based in line with NAMFISA’s risk based supervisory approach and international best practice. It is accepted that because regulated entities vary in size, complexity, products and services, and activities, that the extent to which they use outsourcing will differ. Therefore, the application and implementation of the Outsourcing Principles should be proportional to and suitable for the

3 finances, reputation or operations of the financial institution or financial intermediary; or (ii) the financial institution’s or financial intermediary’s ability to manage key risks effectively; size, complexity and risks outsourcing poses to the regulated entity i.e. the application of the Outsourcing Principles should be tailored to fit the specific characteristics and challenges posed by the regulated entity. Please be guided by Schedule 2 which sets out the clear parameters of the business functions/activities which cannot be outsourced by a regulated entity. Nammed Medical Aid Fund Section 1(1)(d)(ii) (d) “off-shoring arrangement” means the outsourcing of a material business function by a financial institution or financial intermediary to – (i) a service provider located outside Namibia; or (ii) a service provider located in Namibia but who conducts the material business function outside Namibia. Would the arrangement with a service provider situated in Namibia, but who conducts parts of the material business functions in Namibia and other parts outside of Namibia, be considered off￾shoring or outsourcing? Make provision for this scenario in the definitions. Clarification. This is typical in managed care business and ultimately the entity bears the onus whilst making a comparison against the definition to prove whether it qualifies as outsourcing or off￾shoring. However, if the service provider is within Namibia it is considered outsourcing and if the service provider is outside Namibia it is considered off￾shoring. Nammed Medical Aid Fund Section 1(1)(e) “outsourcing” means an arrangement whereby a financial institution or financial intermediary uses a service provider to provide a material business function on its behalf, and it includes in￾sourcing, off￾shoring and sub￾outsourcing arrangements; NO COMMENT

4 Nammed Medical Aid Fund Section 1(1)(j) (j) “sub￾outsourcing arrangement” means an arrangement whereby a service provider in an outsourcing arrangement further outsources the whole or part of an outsourced material business function to another service provider. In agreements where funds or administrators specifically provide that certain portions of the service provider’s services may be out￾sourced with its consent and knowledge due to its specialty, complexity and/or limited nature, would this now be prohibited? If it is prohibited, it would mean that the fund or administrator must enter into a separate agreement with such sub-service provider, which may have a negative effect on costs and therefore for the members. Allow sub-service providers to perform service to the service providers which enhances the services to be provided to the fund or administrator. Permission could be granted by NAMFISA upon application, duly motivated. Declined. The definition of “outsourcing arrangement” in the Standard includes sub-outsourcing. Therefore the same oversight or terms of outsourcing would equally apply to the sub-outsourced service provider. Nammed Medical Aid Fund Section 1(1)(h) “principal business” means the functions or activities defined in Schedule 2 below; Schedule 2, Chapter 7, Sub-section (i) does not specify what claim means. Define (i) Assessing and determining healthcare and related expenses claims. Declined. Please refer to the ordinary or literal meaning of the process, thus meaning process of the assessment (implies a critical appraisal) or determination of the claim. Namibia Medical Care Schedule 1 (t) (vi) Grammar correction “…will be undertaken by the service provider to prevent recurrence..” Accepted. . GEMHEALTH Medical Aid Scheme S1 definitions “in-sourcing arrangement” means the outsourcing of a material business function by a financial institution or financial intermediary to a related service provider such as a subsidiary, affiliate or associate. Whereas “outsourcing” means an arrangement whereby a financial institution or financial intermediary uses a service provider to provide a material business function on its behalf, and it includes in-sourcing, off￾shoring and sub-outsourcing arrangements; “In-sourcing arrangement”: Per definition, it includes a subsidiary or an Associate etc. However, the “Outsourcing” Definition only refers to a service provider in or outside Namibia. Does service provider include a subsidiary or an Associate? Regulator to provide clarity. Declined. Outsourcing is a broader term that includes in-sourcing, off￾shoring, outsourcing or sub￾outsourcing. The distinction between outsourcing and in-sourcing lies in the fact that in-sourcing the service provider is a related party whereas in outsourcing the service provider is not a related party to the financial institution/ financial intermediary. Namibia Insurance Association Standard No. GEN.S.10.10 Clause 1(1)(b) Definition of “in￾sourcing” and “service provider” “in-sourcing arrangement” means the outsourcing of a material business function by a financial institution or financial intermediary to a related service provider such as a subsidiary, affiliate, or associate The definitions seem to exclude other services that are insourced or are those automatically allowed to be insourced? i.e. Compliance, Risk, Legal, Human Capital, IT services etc. To remove “material” from the definitions. “in-sourcing arrangement” means the outsourcing of a material business function by a financial institution or financial intermediary to a related service provider such as a subsidiary, affiliate, or associate (i) “service provider” means a person who provides a material business function to a financial institution or financial intermediary The intention of the standard is to provide a distinction as it relates to material business function and not all business functions for the purposes of seeking NAMFISA approval. Declined. We are unable to remove the term “material” because disruptions to these functions could potentially impact business operations significantly. This is a principles based standard, thus judgment must be exercised to decide what is material to the business. Refer to clause 6 to decide whether a function is material or not. Whether something is material or not depends on business model and thus they should apply the definition to their set of circumstances.

5 “service provider” means a person who provides a material business function to a financial institution or financial intermediary; FirstRand Namibia Limited Article 1(1)(b) Definition of “in￾sourcing” and “service provider” in-sourcing arrangement” means the outsourcing of a material business function by a financial institution or financial intermediary to a related service provider such as a subsidiary, affiliate, or associate “service provider” means a person who provides a material business function to a financial institution or financial intermediary; The definitions seem to exclude other services that are insourced or are those automatically allowed to be insourced? i.e. Compliance, Risk, Legal, Human Capital, IT services etc. Or alternatively, Article 6 provides that all business functions are relevant as it relates to “in-sourcing”. To remove “material” from the definitions. “in-sourcing arrangement” means the outsourcing of a material business function by a financial institution or financial intermediary to a related service provider such as a subsidiary, affiliate, or associate (i) “service provider” means a person who provides a material business function to a financial institution or financial intermediary; The intention of the standard is to provide a distinction as it relates to material business function and not all business functions for the purposes of seeking NAMFISA approval. We further propose the standard completely removes in￾sourcing from the provision as many companies leverage off their local holding company for shared services which ultimately has financial benefits for front end user/client. Clarification. The onus is on the regulated entity to determine whether those in sourced activities meet the materiality test provided under section 6 of the Standard. Therefore, we are unable to remove material from the definitions as suggested. FirstRand Namibia Limited “material business function” The definition is very subjective and may be difficult to apply. Reputation for example as a measuring stick for business materiality is too subjective. The definition and the catch all provisions in article 6 of the Standard makes it applicable to almost every single aspect of the business functions. We require the materiality aspect to be narrowed down much more to avoid stringent, unintended consequences to the industry and its customers. Declined. Considering sections 6 and 7 of the Standard, the Standard is principle based in line with NAMFISA’s risk based supervisory approach and international best practice. It is accepted that because regulated entities vary in size, complexity, products and services, and activities, that the extent to which they use outsourcing will differ. Therefore, the application and implementation of the Outsourcing Principles should be proportional to and suitable for the size, complexity and risks outsourcing poses to the regulated entity i.e. the application of the Outsourcing Principles should be tailored to fit the specific characteristics and challenges posed by the regulated entity FirstRand Namibia Limited Article 2 Applicability There is currently uncertainty to the extent the standard would apply to banks that render services which form the subject matter of this standard. Between Namfisa and BON there needs to be exact clarity on how the regulators roles would be demarcated under the applicable legislation considering BID-34 and the standard. Declined. This Standard applies to financial institutions and financial intermediaries regulated by NAMFISA. Therefore, for the bank to offer services under NAMFISA’s regulatory purview it must be regulated by NAMFISA.

6 Namibia Medical Care 3 The principal business is outsourced to the Administrator. The Fund office does not have the capacity for facilitating the management of members or other core services. Medical aid funds should be exempted from outsourcing the principal business to an administrator. Declined. We encourage the funds to explore alternative business models – i.e self-administration. Ultimately, Medical Aid funds must capacitate themselves to comply with the Standard. Methealth Namibia Clause 3 Principal business “A financial institution or financial intermediary may not outsource its principal business.” As explained in the general comments above, our proposal is that all requirements applicable to outsourcing of material business functions in the Standard shall apply to outsourcing of principal business. Outright or blanket prohibition of outsourcing of principal business is problematic for the following reasons:

1. It is not in line with international best practice which seeks to regulate outsourcing, not prohibit it;
2. It ignores the group structure of most regulated entities wherein a company within the group has a certain function and insourcing arrangements mean these functions can be leveraged by the rest of the group without duplication of staffing and cost which ultimately enable it not only to be competitive within the Namibian market but also as a Namibian entity internationally.
3. It means that many players in the Namibian market would need to greatly reduce their service offering because they can’t leverage off expertise in other jurisdictions which is in today’s world and in most international markets common practice. It impacts outsourcing agreements between Namibian entities in the same group of companies. We propose either deleting this section so that principal business will be dealt with in a similar vein as material business. Alternatively, we propose that clause 3 be amended to make provision for exceptions. In other words, that outsourcing of principal business is prohibited, but that a financial institution or intermediary that insources its principal business to a related party, may do so, subject to proper risk management practices being employed. In the further alternative, we propose that if principal business should remain prohibited from being outsourced, that we should be allowed to apply for exemption from NAMFISA or to obtain dispensation or reach an agreement/arrangement with the Regulator in respect thereof. Declined. 1&2. Outsourcing of principal business is prohibited because a regulated entity obtains a license to conduct its principal business which inherently carries regulatory obligations. Therefore, these regulatory obligations cannot be delegated to a third party. This is in line with international best practice. The core functions must reside with the principals of the fund, but the support functions can be insourced for better supervision of the entity. 3.Section 3 of the Standard is provides that Principal business should not be outsourced. Outsourcing of principal business is prohibited because a regulated entity obtains a license to conduct its principal business which inherently carries regulatory obligations. Therefore, by these regulatory obligations cannot be delegated to a third party. MMN Group Clause 3 Principal business “A financial institution or financial intermediary may not outsource its principal business.” As explained in the general comments above, our proposal is that all requirements applicable to outsourcing of material business functions in the Standard shall apply to outsourcing of principal business. Outright or blanket prohibition of outsourcing of principal business is problematic for the following reasons:

It is not in line with international best practice which seeks to regulate outsourcing, not prohibit it; 2) It ignores the group structure of most regulated entities wherein a company within the group has a certain function and insourcing arrangements mean these functions can be everaged by the rest of the group without We propose either deleting this section so that principal business will be dealt with in a similar vein as material business. Alternatively, we propose that clause 3 be amended to make provision for exceptions. In other words, that outsourcing of principal business is prohibited, but that a financial institution or intermediary that insources its principal business to a related party, may do so, subject to proper risk management practices being employed. In the further alternative, we propose that if principal business should remain prohibited from being outsourced, that we should be allowed to apply for exemption from NAMFISA or to obtain dispensation or reach an agreement/arrangement with the Regulator in respect thereof. Declined. 1&2. Outsourcing of principal business is prohibited because a regulated entity obtains a license to conduct its principal business which inherently carries regulatory obligations. Therefore, these regulatory obligations cannot be delegated to a third party. This is in line with international best practice. The core functions must reside with the principals of the fund but the support functions can be insourced for better supervision of the entity.

7 duplication of staffing and cost which ultimately enable it not only to be competitive within the Namibian market but also as a Namibian entity internationally. 3) It means that many players in the Namibian market would need to greatly reduce their service offering because they can’t leverage off expertise in other jurisdictions which is in today’s world and in most international markets common practice. 4) In the case of investment management, it means all investment management must be done locally. i.e. only segregated portfolio offering can be done locally, unless a local manager can find local staff with expertise in offshore markets (which is very limited) and in sufficient quantities to manage key man risk. 5) It may even mean that certain businesses will close for business or drastically shrink their AUM/revenue as it is no longer financially viable to operate in Namibia as either; 6) the staff compliment required to perform and compete with global players to perform special functions such as active offshore portfolio management is not viable given the relatively small size of the local industry; or 7) clients chose to contract with global service providers directly. The potential consequence is a smaller investment management industry with less skills transfer, less local taxes and less NAMFISA levies. 8) It impacts outsourcing agreements between Namibian entities in the same group of companies. 3.Section 3 of the Standard is clear that Principal business should not be outsourced. Outsourcing of principal business is prohibited because a regulated entity obtains a license to conduct its principal business which inherently carries regulatory obligations. Therefore, by these regulatory obligations cannot be delegated to a third party. NASIA Clauses 3 Principal business “A financial institution or financial intermediary may not outsource its principal business.” As explained in the cover letter, our proposal is that exceptions be allowed in clause 3 for the outsourcing of principal business functions. For the avoidance of doubt, in such instances, all requirements applicable to outsourcing of material business functions in the Standard shall apply to outsourcing of principal business. We propose that in-sourcing of principal business functions be allowed in instances when the outsourcing is to a service provider located in Namibia. Outright or blanket prohibition of outsourcing of principal business is problematic for the following reasons: 1) It is not in line with international best practice which seeks to regulate outsourcing, not prohibit it; 2) It ignores the group structure of most regulated entities wherein a company within the group has a certain function and insourcing arrangements mean these functions can be leveraged by the rest of the group without duplication of staffing and cost which ultimately enable it not only to be competitive within the Namibian market but also as a Namibian entity internationally. Amend clause 3 to reflect our concerns raised in the cover letter and under general comments. We propose the following wording: 3 (1). A financial institution or financial intermediary may not outsource its principal business unless: (a) It in-sources its principal business to a related service provider such as a subsidiary, affiliate or associate, provided that such service provider is located in Namibia; or (b) A financial institution or financial intermediary has applied for and has been granted written consent by NAMFISA in terms of sub-clause (2) below. (2) For purposes of clause 3(1(b) above, a financial institution or financial intermediary must, prior to entering into an outsourcing arrangement with a service provider: (a) Seek written approval from NAMFISA and provide detailed justification why the function or activity cannot be feasibly conducted in Namibia; and (b) Assess and ensure that the risks of the outsourcing arrangement are adequately addressed in the financial Declined. Outsourcing of principal business is prohibited because a regulated entity obtains a license to conduct its principal business which inherently carries regulatory obligations. Therefore, these regulatory obligations cannot be delegated to a third party. This is in line with international best practice. Furthermore, the suggestions are noted, however:

1. For the insurance industry this may not apply as it specifically refers to underwriting and claims making decision making – which is the principal business of an insurer and hence the prohibition.

8 3) It impacts outsourcing agreements between Namibian entities in the same group of companies. 4) It means that many players in the Namibian market would need to greatly reduce their service offering because they can’t leverage off expertise in other jurisdictions which is in today’s world and in most international markets common practice. In the case of investment management, it means all investment management must be done locally. i.e. only segregated portfolio offering can be done locally, unless a local manager can find local staff with expertise in offshore markets (which is very limited) and in sufficient quantities to manage key man risk. This is worsened by the fact that nothing prevents local asset owners from contracting directly with foreign managers with no presence in Namibia, which will not develop any Namibian skills. This goes against NAMFISA’s goal of creating a globally competitive financial services sector. It may even mean that certain businesses will close for business or drastically shrink their AUM/revenue as it is no longer financially viable to operate in Namibia as the staff compliment required to perform and compete with global players to perform special functions such as active offshore portfolio management is not viable given the relatively small size of the local industry. institution’s or financial intermediary’s risk management framework. 2. There are various issues to consider and not only the cost saving aspects, but issues such as avoiding regulating entities with no/minimal operational activity . The Standard applies to the registered/ licensed entity and not necessarily what the group does. Regulated entities may make use of In-sourcing arrangements for group structures. There would be difficulty in having oversight over data quality and there are certain legislative requirements that each entity must satisfy in order to be compliant with the respective regulatory regime. Namibia Insurance Association Clause 3 Principal business: Refer to proposed amendments to the definition of “principal business” as defined in Schedule 2 regarding “Insurers” and “Reinsurers” Refer to Schedule 2, below, for proposed amendments to the definition of “principal business”. Accepted. Item 2 of Schedule 2 is amended to read as follows” Insurer/Reinsurer: (i) Assessing, determining and deciding on claims; and (ii) Assessing and deciding to accept or decline risk. NNH Group 3 A financial institution or financial intermediary may not outsource its principal business The extent to which financial institutions will use outsourcing differs depending on the size of the entity, its business model and product offering, whether the entity forms part of a wider group etc. It is therefore proposed that principal business functions be dealt with from a risk-based approach, similarly, all requirements applicable to outsourcing of material business functions in the Standard to apply to outsourcing of principal business functions. Alternatively, Clause 3 should be expanded to state that principal business may not be outsourced or off-shored, but it may be in-sourced. In light of the above, it is therefore proposed that the list of principal business functions in schedule 2 be refined, whilst taking into consideration the differences in product offering, business models, etc across entities within the same industry. Declined. Outsourcing of principal business is prohibited because a regulated entity obtains a license to conduct its principal business which inherently carries regulatory obligations. Therefore, these regulatory obligations cannot be delegated to a third party. This is in line with international best practice. Further, proportionality or the size of the entity was already considered in terms of the materiality test. Therefore, the application and implementation of the Outsourcing Principles by the board and senior management should be proportional to and suitable for the

9 size, complexity and risks outsourcing poses to the regulated entity i.e. the application of the Outsourcing Principles should be tailored to fit the specific characteristics and challenges posed by the regulated entity. NASIA Clauses 4(2) The board and senior management of a financial institution or financial intermediary must designate employees responsible for continuously identifying, reporting and mitigating risks strategies of outsourced activities The term “outsourced activities” is not a defined term. For clarity, we suggest using the term “outsourcing arrangements” such that the clause reads as follows: “The board and senior management of a financial institution or financial intermediary must designate employees responsible for continuously identifying, reporting and mitigating risks strategies of outsourced activities outsourcing arrangements.” Accepted. FirstRand Namibia Limited Article 4 (c) Role of Board and Senior Management This is a vague and cumbersome requirement. It creates a subjective element – risks should be identified in accordance with its policy and taking into consideration the prominent risks associated with the industry or nature of service. It would be impossible for an institution to identify all (real and perceived) risks at any given time. Consider narrowing it down to risks that can be directly linked backed to materiality. Declined. The expectation is for the board and senior management to be aware of the risks associated with the outsourcing arrangement. – This is required for due diligence purposes and is also in alignment with best practices and NamCode. Namibia Insurance Association Clause 4(2) Role of the board and senior management: (2) The board and senior management of a financial institution or financial intermediary must designate employees responsible for continuously identifying, reporting and mitigating risks strategies of outsourced activities “outsourced activities” is not defined, but is expected to mean a broken-down portion or element of an “outsourced material business function”. Such an outsourced activity may not be a “material business function” in itself and thus should not fall within the ambit of this Standard. To ensure clarity, it is suggested that the section should read as follows: 2) The board and senior management of a financial institution or financial intermediary must designate employees responsible for continuously identifying, reporting and mitigating risks strategies of outsourced arrangement. Accepted. NASIA Clause 4(3) (3) The designated employees referred to in sub￾clause (2), must timeously inform the board and senior management of the financial institution or financial intermediary about those risks. The requirement to notify the board of risks related to outsourcing seems operational and employees should only be tasked to notify the senior management who will then take it further. Proposed rewording: “(3) The designated employees referred to in sub-clause (2), must timeously inform the board and or senior management of the financial institution or financial intermediary about those risks.” Accepted – senior management can use their structures to inform the Board.

10 Namibia Insurance Association Clause 4(4)(a) Role of the board and senior management (4) The board and senior management of a financial institution or financial intermediary must, when outsourcing any material business function – (a) ensure the development, adoption and implementation of an outsourcing policy It is understood that when no outsourcing of a material business function takes place, or, the business function outsourced is not material with reference to Clause 1(1)(c), no outsourcing policy is required. Is the understanding correct? It is understood that when no outsourcing of a material business function takes place, or, the business function outsourced is not material with reference to Clause 1(1)(c), no outsourcing policy is required. Is the understanding correct? Accepted. However, it would be prudent for the policies to be put in place even for non￾material business functions. Namibia Insurance Association Clause 5(a) Outsourcing policy The financial institution’s or financial intermediary’s outsourcing policy must ̶ (a) comply with this Standard; The Standard’s requirements are cumbersome and complex, which will require more time, cost and capacity (upskilled staff, systems, capital) to be complied with by financial institutions or financial intermediaries. Additional capacity requirements could negatively affect SME’s financial well-being Declined. The standard is principle based and thus provides a guideline for a standard outsourcing policy or agreement. NASIA Clause 6(2) (a) financial, reputational and operational impact if the material business function is disrupted, deteriorates or fails; The word ‘material’ should not be here as these factors are to establish whether a business function is material or not. (a) financial, reputational and operational impact if the material business function is disrupted, deteriorates or fails; Declined. Material is added here for completeness’ sake. FirstRand Namibia Limited Article 6(2)(e) The standard fails to consider the cost implication associated with bringing certain services in-house. Larger groups of companies leverage off their larger holding companies locally for shares services support. Furthermore, it refers to “in-house” but it could be argued that in￾house constitutes within a group of companies with a common shareholder. The cost element needs to be taken into account by the standard as well as clarity on the extent to which in-house could be applied to a group of companies. Declined. The policy issue that this Standard aims to address is: Outsourcing of principal business is prohibited because a regulated entity obtains a license to conduct its principal business which inherently carries regulatory obligations. Therefore, these regulatory obligations cannot be delegated to a third party. The Standard allows for the in-sourcing of a material business function/activity and not of the principal business. The cost aspect is noted however it is justifiable to meet the policy objective of the Standard. Clause 6(2)(g) affiliation, association or other relationship between the financial It is unclear how an affiliation between a financial institution and the service provider would impact the analysis on whether a business function is considered material or not. This determination is separate from the relationship with a specific service provider which Declined. The affiliation or association between the financial institution /intermediary and service provider is relevant to

11 institution or financial intermediary and the service provider; Clause 6(2)(h) regulatory compliance status of the financial institution or financial intermediary and, if applicable, of the service provider; is dealt with in later clauses. The same is true for the regulatory status. We suggest deleting 6(2)(g) and (h). determining whether a business function is material or not because: a) The risks associated with outsourcing tasks to an affiliated service provider may be different to those encountered in outsourcing to an unaffiliated external service provider. b) the affiliated or associated relationship may restrict the ability of the regulated entity to control or influence the service provider, and, by extension, of NAMFISA’s ability to effectively supervise the regulated entity. MMN GROUP Clause 6(2)(g) affiliation, association or other relationship between the financial institution or financial intermediary and the service provider; It is unclear how an affiliation between a financial institution and the service provider would impact the analysis on whether a business function is considered material or not. This determination is separate from the relationship with a specific service provider which is dealt with in later clauses. We suggest deleting 6(2)(g). Declined. The affiliation or association between the financial institution /intermediary and service provider is relevant to determining whether a business function is material or not because: a) The risks associated with outsourcing tasks to an affiliated service provider may be different to those encountered in outsourcing to an unaffiliated external service provider. b) the affiliated or associated relationship may restrict the ability of the regulated entity to control or influence the service provider, and, by extension, of NAMFISA’s ability to effectively supervise the regulated entity. Methealth Namibia Clause 6(2)(g) affiliation, association or other relationship between the financial institution or financial intermediary and the service provider; It is unclear how an affiliation between a financial institution and the service provider would impact the analysis on whether a business function is considered material or not. This determination is separate from the relationship with a specific service provider which is dealt with in later clauses. We suggest deleting 6(2)(g). Declined. The affiliation or association between the financial institution /intermediary and service provider is relevant to determining whether a business function is material or not because: a) The risks associated with outsourcing tasks to an affiliated service provider may be different to those encountered in outsourcing to an unaffiliated external service provider. b) the affiliated or associated relationship may restrict the ability of the regulated entity to control or influence the service provider, and, by extension, of NAMFISA’s ability to

12 effectively supervise the regulated entity. Namibia Insurance Association Clause 6(2) In determining whether a business function is a material business function, the financial institution or financial intermediary must consider the following factors: … (h) regulatory compliance status of the financial institution or financial intermediary and, if applicable, of the service provider Does regulatory compliance determine materiality of a business functions? Clarification. It is imprudent to outsource material business to non￾compliant entities considering the reputational issues such a provider may pose on the regulated entity. FirstRand Namibia Limited Article 7 What informs the degree of materiality? There is no clear guideline and it may be that this could be applied differently to different institutions depending on their size etc. The 7 principles furthermore introduce new operational requirements which may or may not require changes to systems, people and processes which will directly increase operational costs. There needs to some form of uniformity on what constitutes the degree of materiality to ensure consistent application amongst industry role players. Declined. As the standard is principle based there cannot be uniformity in what will be considered material for every entity, it will thus be dependent on the specific entities size, business model, products, services etc.. Therefore, the application and implementation of the Outsourcing Principles by the board and senior management should be proportional to and suitable for the size, complexity and risks outsourcing poses to the regulated entity. Namibia Insurance Association Clause 9(1) Principle 2: The contract with a service provider A financial institution or financial intermediary and the service provider must enter into a signed outsourcing agreement in respect of each outsourcing arrangement, covering, at a minimum, the requirements contained in this Standard and the Schedule attached to this Standard. Schedule 1 is specifically applicable in this instance. It is suggested that the section should read as follows: Clause 9(1) A financial institution or financial intermediary and the service provider must enter into a signed outsourcing agreement in respect of each outsourcing arrangement, covering, at a minimum, the requirements contained in this Standard and the Schedule 1 attached to this Standard. Accepted. MMN Group Clause 11: Principle 4: Confidentiality issues Issues” implies problematic behavior by service providers. We propose the following heading: Principle 4: Confidentiality issues Accepted.

13 Methealth Namibia Clause 11: Principle 4: Confidentiality issues Issues” implies problematic behavior by service providers. We propose the following heading: Principle 4: Confidentiality issues Accepted. NASIA Clause 11: Principle 4: Confidentiality issues Issues” is contentious and implies problematic behavior by service providers. We propose the following heading: Principle 4: Confidentiality issues Accepted. FirstRand Namibia Limited Article 11 The provisions contained in this article will be subordinate to the Data Protection Bill provisions and therefore the financial institutions and intermediaries would apply the data privacy provisions in the primary legislation. Furthermore, the use of the word “ensure” creates the expectation of the financial institution or intermediary guaranteeing the integrity and safety of confidential information. This creates an impossibility on the part of the financial institution or intermediary. We propose that the requirement be that the specific SLA with service providers sufficiently covers for data protection and liability in the event of breaches. There is no way for a financial institution or intermediary to guarantee the safety of data and at best can apply their best endeavours to ensure risk mitigation controls are put in place. Declined. We will retain this section to ensure that entities continue to uphold data protection standards. Methealth Namibia Clause 13(1): Principle 6: Access to data, premises and personnel A financial institution or financial intermediary must ensure that NAMFISA, their auditors (if applicable) and the financial institution or financial intermediary themselves can promptly obtain, upon request, information concerning the outsourced material business function and where necessary, there must be prompt access to the data, information technology systems, premises and personnel of the service provider. This clause is too far reaching and it needs to make provision for the access to be reasonable. Access to be limited for the purposes of supervisory powers and subject to Part 5 of Chapter 10 of the Act We propose: “A financial institution or financial intermediary must ensure that NAMFISA, their auditors (if applicable) and the financial institution or financial intermediary themselves can promptly obtain, upon request, information concerning the outsourced material business function that are relevant to undertake regulatory oversight functions and where necessary, there must be prompt reasonable access to the data, information technology systems, premises and personnel of the service provider.” Clarification. The intention of this clause is to allow NAMFISA and the auditors of the regulated entity upon their request, prompt access to information, data, IT systems, premises and personnel related to the outsourced material business function. This is in line with sections 3 and 4 of the NAMFISA Act No. 3 of 2021. NASRIA Section 13 (1) NAMFISA can upon request and where necessary have access to data, information systems, premises and personnel of the service provider. How will this work when we have Reinsurers abroad, how will NAMFISA obtain access to premises or personnel? Delete reference to ‘premises’ provided that relevant information is accessible and relevant personnel can be reached for information. Declined. The provision is to cover any applicable circumstance, i.e. where there is a premises and where there is no access to the premises, then NAMFISA can still access the data and information systems. MMN Group Clause 13(1): Principle 6: Access to data, premises and personnel A financial institution or financial intermediary must ensure that NAMFISA, This clause is too far reaching and it needs to make provision for the access to be reasonable. Access to be limited for the purposes of supervisory powers and subject to Part 5 of Chapter 10 of the Act. We propose: “A financial institution or financial intermediary must ensure that NAMFISA, their auditors (if applicable) and the financial institution or financial intermediary themselves can promptly obtain, upon request, information concerning the outsourced material business function that are relevant to undertake regulatory oversight functions and where necessary, there Clarification. The intention of this clause is to allow NAMFISA and the auditors of the regulated entity upon their request, prompt access to information, data, IT systems, premises and personnel related

14 their auditors (if applicable) and the financial institution or financial intermediary themselves can promptly obtain, upon request, information concerning the outsourced material business function and where necessary, there must be prompt access to the data, information technology systems, premises and personnel of the service provider. must be prompt reasonable access to the data, information technology systems, premises and personnel of the service provider.” to the outsourced material business function. This is in line with sections 3 and 4 of the NAMFISA Act No. 3 of 2021. NASIA Clause 13(1): Principle 6: Access to data, premises and personnel A financial institution or financial intermediary must ensure that NAMFISA, their auditors (if applicable) and the financial institution or financial intermediary themselves can promptly obtain, upon request, information concerning the outsourced material business function and where necessary, there must be prompt access to the data, information technology systems, premises and personnel of the service provider. We believe this clause to be too far reaching as currently worded. It also needs to make provision for the access to be reasonable. Access to be limited for the purposes of supervisory powers and subject to Part 5 of Chapter 10 of the Act. Our suggested edits as follows: “A financial institution or financial intermediary must ensure that NAMFISA, their auditors (if applicable) and the financial institution or financial intermediary themselves can promptly obtain, upon request, information concerning the outsourced material business function that are relevant to undertake regulatory oversight functions and where necessary, there must be prompt reasonable access to the data, information technology systems, premises and personnel of the service provider.” Clarification. The intention of this clause is to allow NAMFISA and the auditors of the regulated entity upon their request, prompt access to information, data, IT systems, premises and personnel related to the outsourced material business function. This is in line with sections 3 and 4 of the NAMFISA Act No. 3 of 2021. FirstRand Namibia Limited Article 13 Is the requirement that maintenance of records mean that these documents be electronic or physical documents? Further, is the requirement that the primary place of these documents be in￾country? The standard is silent on cloud-base services. Furthermore, what is the nature of the records that NAMFISA requires the financial institution or intermediary to maintain? How long should this data be retained after the services have been terminated? These are all questions that need to be addressed with precise clarity. The requirement for NAMFISA auditors to approach financial institutions and have direct access to their systems premises etc. With regards to data management and systems – is the requirement that this data be in country? Or is cloud computing allowed? Clarification. The information may be maintained in physical or electronic format provide NAMFISA and the auditors of the financial institution or intermediary have prompt access to the information whether in cloud format or not.

15 There is no relationship between NAMFISA auditors and the company and as such exposes the company’s confidential information and other data which may be subject to compromise. Accepted. The provision will be amended to require financial institutions and intermediaries to maintain records for 5 years. Namibia Insurance Association Clause 13(2) Principle 6: Access to data, premises and personnel. (2) The financial institution or financial intermediary remains accountable to NAMFISA for their regulatory compliance, and accordingly must ensure that they have processes and procedures in place maintaining records to facilitate NAMFISA to carry out its inspection, investigation and monitoring powers over the activities that it regulates. There is a legal requirement with regards to the keeping of records. Is the requirement that maintenance of records mean that these documents be electronic or physical documents? Further, is the requirement that the primary place of these documents be in￾country? The standard is silent on cloud-based services. It is suggested that the following is added: “… in place maintaining records, as legally stipulated, to facilitate NAMFISA to carry out its inspection, investigation and monitoring powers over the activities that it regulates. With regards to data management and systems – is the requirement that this data be in country? Or is cloud computing allowed? Further (entity sent incomplete info) Clarification. The information may be maintained in physical or electronic format provide NAMFISA and the auditors of the financial institution or intermediary have prompt access to the information whether in cloud format or not Namibia Medical Care 15. (1) (b) (ii) and 15. (2) There will be significant costs associated with the additional assessments. Clarify who will carry the cost associated with the additional audit assessments. Clarification. This cost will be carried by the fund itself and considerations must be made so that the costs do not cascade to the policyholders. FirstRand Namibia Limited Article 16 In-sourcing arrangements A financial institution or financial intermediary must be able to demonstrate, through supporting documentation which includes a due diligence report, the selection criteria, the outsourcing agreement and a service level agreement with the service provider, submitted to NAMFISA as and when required, that in assessing the options for an in-sourcing arrangement, they have taken into account. We further propose that in-sourcing be specifically excluded in its entirety from the standards for the reasons provided above. A request is that this section refers to material business functions if the definition is aligned, and human capital services for instance provided in a group setting would not have to pass through an assessment as required? This also avoids any uncertainty around other services that are in￾sourced i.e. compliance, etc. Clarification, a financial institution or financial intermediary may in source a material business function. Material business function is defined in section 1(1)(c). Therefore, provided human capital services are material to the financial intermediary or institution they may be outsourced . MMN Group Clause 16 (b) the cost of the services being provided and that the financial institution or financial intermediary has taken steps to ensure that the cost is commensurate to the Kindly note that the rationale behind insourcing is to take advantage of economies of scale applied to shared products, policy administration systems, resources, etc. It’s unlikely that there would be a reliable open market for this in order for us to determine fair value at all times. We propose deleting of 16(b). Declined. The intention of this clause is for the regulated entity to demonstrate or show that the price is fair for the services or that there was a consideration of the pricing when entering in-sourcing arrangements. –.

16 fair value of like services that could be provided by an arm’s￾length service provider; Methealth Namibia Clause 16 (b) the cost of the services being provided and that the financial institution or financial intermediary has taken steps to ensure that the cost is commensurate to the fair value of like services that could be provided by an arm’s￾length service provider; Kindly note that the rationale behind insourcing is to take advantage of economies of scale applied to shared products, policy administration systems, resources, etc. It’s unlikely that there would be a reliable open market for this in order for us to determine fair value at all times. We propose deleting of 16(b). Declined. The intention of this clause is for the regulated entity to demonstrate or show that the price is fair for the services or that there was a consideration of the pricing when entering in-sourcing arrangements. NASIA Clause 16 (b) the cost of the services being provided and that the financial institution or financial intermediary has taken steps to ensure that the cost is commensurate to the fair value of like services that could be provided by an arm’s￾length service provider; We insource due to the economies of scale applied to shared products, policy administration systems, resources, etc. It’s unlikely that there would be a reliable open market for this in order for us to determine fair value at all times. Cost considerations are provided for under 6(2)(f). We propose deleting of 16(b). Declined. The intention of this clause is for the regulated entity to demonstrate or show that the price is fair for the services or that there was a consideration of the pricing when entering in-sourcing arrangements. Namibia Insurance Association Clause 16 In-sourcing arrangements 16. A financial institution or financial intermediary must be able to demonstrate, through supporting documentation which includes a due diligence report, the selection criteria, the outsourcing agreement and a service level agreement with the service provider, submitted to NAMFISA as and when required, that in assessing the options for an in-sourcing A request is that this section refers to material business functions if the definition is aligned, and human capital services for instance provided in a group setting would not have to pass through an assessment as required? This also avoids any uncertainty around other services that are in-sourced i.e. compliance, etc. First part is unclear. However, please refer to the definition of “insourcing arrangement” which means: ‘the outsourcing of a material business function by a financial institution or financial intermediary to a related service provider such as a subsidiary, affiliate or associate’.

17 arrangement, they have taken into account: …… FirstRand Namibia Limited Article 17 Article deals with “off-shoring” but in contrast refers to “off￾sourcing”. Article 17(2) is especially problematic. There should be a distinction to instances where approval is sought and instances where the regulator (NAMFISA) should only be notified. We are concerned that this will create immense backlogs in the office of the regulator if companies have to wait for approval which may take months, and in the meantime business cannot proceed thereby directly impacting the customer who ultimately benefits from the services. What are contractual obligations to the financial institution and intermediary if the agreement is concluded and NAMFISA is notified? The Standard is silent on whether or not NAMFISA can force a company to exit the agreement / SLA or introduce additional terms. We propose this section be significantly reconsidered and all the eventualities considered. Please provide further consideration on implications post notification of exiting SLA’s. Accepted, off-sourcing substituted for off-shoring. Declined. The requirements under section 17(2) require approval from NAMFISA and not merely notification because the onus is on the financial institution or financial intermediary to justify why the function or activity cannot be feasibly conducted in Namibia. NAMFISA a will be guided by the financial institutions/intermediaries’ risk management frame work and that of the service provider in deciding if the institution can manage the risk. NASRIA Section 17 (1) The reference to “due a” was a typographical error. “A financial institution or financial intermediary must be able to demonstrate, through supporting documentation which includes due a diligence report….” The sentence should be changed to a “a due diligence report”. Accepted. Namibia Medical Care 17. (1) Grammar correction “..documentation which includes a due a diligence report,” Accepted. Namibia Medical Care 17. (1) (a) Grammar correction “from the off-shoring ar rangement arrangement and the manner in which this changed risk profile is to be addressed in the risk man agement management framework” Accepted. MMN Group Clause 17(2) A financial institution or financial intermediary must, prior to entering into an off-shoring arrangement with a service provider: (a) Seek written approval from NAMFISA and provide detailed justification why the function or activity cannot be feasibly conducted in Namibia. The Standard is silent on the process to be followed for existing off￾shoring arrangements. To avoid confusion and uncertainty in the industry, we suggest that NAMFISA clarify its intention here. Furthermore, whilst we are not averse to seeking approval from NAMFISA for off-shoring arrangements in principle, there should not be a presumption that the only situation where offshoring is permissible is where the function cannot be conducted in Namibia. There may be other good reasons why an offshoring arrangement makes sense to the particular financial institution. Suggested wording as follows: 17(2) A financial institution or financial intermediary must, prior to entering into an off-shoring arrangement with a service provider, unless the off-shoring arrangement is already in place prior to the commencement date of this Standard: (a) Seek written approval from NAMFISA and provide detailed justification why the function or activity cannot be feasibly conducted in Namibia. Clarification. Existing off-shore arrangements must comply with the this Standard because the Standard applies retrospectively. Declined, detailed justification is necessary for the Registrar to approve the offshoring arrangement for a material business function. NASIA Clause 17(2) A financial institution or financial intermediary must, prior to entering into an off-shoring arrangement with a service provider: (a) Seek written approval from NAMFISA and provide The Standard is silent on the process to be followed for existing off￾shoring arrangements. To avoid confusion and uncertainty in the industry, we suggest that NAMFISA clarify its intention here. It is unclear if the intention is that existing off-shoring arrangements need approval from NAMFISA. We drafted the suggestion with the understanding that existing agreements do not need written approval. If NAMFISA is of a different view, this needs to be stipulated and a timeframe included. Offshoring certain functions is standard practice globally. Clarity is needed of the Regulator’s intention in including the phrase “and provide detailed justification why the function or activity cannot be Suggested wording as follows: 17(2) A financial institution or financial intermediary must, prior to entering into an off-shoring arrangement with a service provider, unless the off-shoring arrangement is already in place prior to the commencement date of this Standard: (a) Seek written approval from NAMFISA and provide detailed justification why the function or activity cannot be feasibly conducted in Namibia. Clarification. Existing off-shore arrangements must comply with the this Standard because the Standard applies retrospectively. Declined, detailed justification is necessary for the Registrar to approve the offshoring arrangement for a material business function.

18 detailed justification why the function or activity cannot be feasibly conducted in Namibia. feasibly conducted in Namibia”. Location of a service provider is but one consideration in assessing the risks from outsourcing. While we are not averse to seeking approval from NAMFISA for off￾shoring arrangements in principle, we don’t think there should be a presumption that the only situation where offshoring is permissible is where the function can’t be conducted in Namibia. There may be other good reasons why an offshoring arrangement makes sense to the particular financial institution. For example, the ability to access better service delivery or products and obtain lower rates when transacting as part of a larger Group which ultimately benefits the service experience of the Namibian customer. NASIA Clause 17(3) If the off￾shoring arrangement involves risks that the financial institution or financial intermediary is not managing, or will not be able to manage appropriately, NAMFISA may require the financial institution or financial intermediary to make alternative arrangements for the performance of the material business function if the financial institution or financial intermediary cannot satisfy such concerns within the period specified by NAMFISA. This clause suggests NAMFISA to be fettering with the freedom to contract as it forces a financial institution or financial intermediary to terminate its outsourcing arrangements. We suggest NAMFISA should be able to penalize non-compliance with the Act and standards, but not to dictate where or which entity provides services to a Financial Institution. Suggest clause 17(3) is deleted completely. Declined, this clause applies when the financial institution or intermediary has entered into an off￾shore arrangement and is not adequately managing the risks associated with the off-shore arrangement. Naturally in that instance and because the Registrar approved the off-shore arrangement he must be able to require the financial institution or intermediary to appoint an alternative service provider to adequately manage the risk. MMN Group Clause 18(1) A financial institution or financial intermediary must notify NAMFISA, in writing not later than 30 business days after entering into an outsourcing greement, of such agreement. The Standard is silent on the process to be followed for existing outsourcing arrangements. To avoid confusion and uncertainty in the industry, we suggest that NAMFISA clarify its intention here. If NAMFISA’s intention is that it be notified of existing outsourcing arrangements, we suggest that the Standard stipulate this and a include a timeframe. Suggested wording as follows: “A financial institution or financial intermediary must notify NAMFISA, in writing not later than 30 business days after entering into an outsourcing agreement, of such agreement or in the case of an existing outsourcing agreement, within 12 months of the commencement date of this Standard.” Clarification. A 12-month transitional period will be offered to allow existing arrangements time to comply with the Standard. NASIA Clause 18(1) A financial institution or financial intermediary must notify NAMFISA, in writing not later than 30 business days after entering into an outsourcing agreement, of such agreement. The Standard is silent on the process to be followed for existing outsourcing arrangements. To avoid confusion and uncertainty in the industry, we suggest that NAMFISA clarify its intention here. If NAMFISA’s intention is that it be notified of existing outsourcing arrangements, we suggest that the Standard stipulate this and a include a timeframe. Suggested wording as follows: “A financial institution or financial intermediary must notify NAMFISA, in writing not later than 30 business days after entering into an outsourcing agreement, of such agreement or in the case of an existing outsourcing agreement, within 12 months of the commencement date of this Standard.” Clarification. A 12-month transitional period will be offered to allow existing arrangements time to comply with the Standard.

19 Namibia Insurance Association Clause 18 Notification requirement (1) A financial institution or financial intermediary must notify NAMFISA, in writing not later than 30 business days after entering into an outsourcing agreement, of such agreement. According to Clause 17 (2)(a) “A financial institution or financial intermediary must, prior to entering into an off-shoring arrangement with a service provider: (a) Seek written approval from NAMFISA and provide detailed justification why the function or activity cannot be feasibly conducted in Namibia.” Any change in the off-shoring arrangement would most likely necessitate further approval from NAMFISA. Thus, with the above being the case, the Notification requirement per Clause 18 should exclude an off-shoring arrangement as NAMFISA is notified prior to entering the off-shoring arrangement. It is proposed that “Except for an off-shoring arrangement approved by NAMFISA in accordance with clause 17(2)” be added to Clauses 18 (1) and (2) to read as follows: 18. (1) Except for an off-shoring arrangement approved by NAMFISA in accordance with clause 17(2) a financial institution or financial intermediary must notify NAMFISA, in writing not later than 30 business days after entering into an outsourcing agreement, of such agreement. (2) Except for an off-shoring arrangement approved by NAMFISA in accordance with clause 17(2) a financial institution or financial intermediary must notify NAMFISA, in writing not later than 30 business days after an extension, renewal or amendment of an outsourcing agreement, of such extension, renewal or amendment. . Declined. Clause 17 requires entities to seek written approval from NAMFISA before entering into off￾shoring arrangements. While clause 18 requires entities to notify NAMFISA that it has entered into off-shoring agreement. Both are essential to ensure NAMFISA has sufficient regulatory oversight. NNH Group A financial institution or financial intermediary must notify NAMFISA, in writing not later than 30 business days after entering into an outsourcing agreement, of such agreement. The Regulator to consider rewording clause 18(1) as follows: "A financial institution or financial intermediary must notify NAMFISA, in writing not later than 30 business days after entering into an outsourcing agreement, of such agreement or in the case of an existing outsourcing agreement, within 12 months of the commencement date of this Standard.” Clarification. A 12 month transitional period will be offered to allow existing arrangements time to comply with the Standard. Therefore there is no need to amend section 18 of the Standard. FirstRand Namibia Limited Article 19 Existing outsourcing arrangements No transitional period is provided for existing agreements. Noting the time and costs associated with some of these agreements the request is to provide a 6 or 12 month transitional agreement to bring all existing agreements into compliance. Clarification. A 12 month transitional period will be offered to allow existing arrangements time to comply with the Standard. NNH Group 19 Existing outsourcing arrangements All existing outsourcing arrangements must comply with the requirements of this Standards. The Regulator to define and set a transition period for all existing outsourcing arrangements ie a 12 months transitions period; post the operationalization of FIMA and/or the existing outsourcing agreements to run their course. Clarification. A 12 month transitional period will be offered to allow existing arrangements time to comply with the Standard. Methealth Namibia Clause 19: All existing outsourcing arrangements must comply with the requirements of this Standards. This therefore means that the Standard will apply retrospectively? Surely that is not reasonable nor legally sound? We request, a transitional timeframe to comply with the Standard. There will be uncertainty and confusion in the industry if there is no time for the financial institutions and financial intermediaries to comply with the Standard as there is no clarity on an effective date. We propose that the Regulator allow for a grace period within which to align existing arrangements with the provisions of the Standard. Clarification. A 12 month transitional period will be offered to allow existing arrangements time to comply with the Standard. MMN Group Clause 19: All existing outsourcing arrangements must comply with the requirements of this Standards. This therefore means that the Standard will apply retrospectively? Surely that is not reasonable nor legally sound? We request, a transitional timeframe to comply with the Standard. There will be uncertainty and confusion in the industry if there is no time for the financial institutions and financial intermediaries to comply with the Standard as there is no clarity on an effective date. We propose that the Regulator allow for a grace period within which to align existing arrangements with the provisions of the Standard. Clarification. A 12 month transitional period will be offered to allow existing arrangements time to comply with the Standard. NASIA Clause 19: All existing outsourcing We request, a transitional timeframe to comply with the Standard. There will be uncertainty and confusion in the industry if there is no Please include the following wording: Clarification.

20 arrangements must comply with the requirements of this Standards. time for the financial institutions and financial intermediaries to comply with the Standard as there is no clarity on an effective date. “All existing outsourcing arrangements must comply with the requirements of this Standards within 5 years of the commencement date of this Standard or as agreed with the Regulator.” A 12 month transitional period will be offered to allow existing arrangements time to comply with the Standard. Namibia Insurance Association Clause 19 Existing outsourcing arrangements 19. All existing outsourcing arrangements must comply with the requirements of this Standards. No transitional period is provided for existing agreements. Noting the time and costs associated with some of these agreements the request is to provide a 12-month transitional agreement to bring all existing agreements into compliance It is proposed that Clause 19 to read: 19. All existing outsourcing arrangements must comply with the requirements of this Standard within 12 months of the commencement of this Standard or as agreed with the Regulator. Clarification. A 12 month transitional period will be offered to allow existing arrangements time to comply with the Standard. NASIA Schedule 2: 2. Insurer and Reinsurer Some claims and risks assessed by insurers are dependent on the reinsurer’s capacity and whether the claim will be paid. Does this amount to outsourcing of a principal function? Please clarify. Clarification. This does not constitute as outsourcing because the claim must be settled by the insurer as the reinsurer is a 3rd party to the contract. Thus, the assessment, determination and decision to pay is already made by the insurer before going to the reinsurer. The reinsurers capacity will not be for the client’s knowledge in any case as the insurer must still pay regardless and the insurer can then claim from the reinsurer at a later stage. Schedule 2: 2. Insurer and Reinsurer Assessing, determining and deciding on claims. Assessing claims often requires input from certain Subject Matter Experts, in both short- and long-term insurance, despite the final decision to honor/decline a claim resting with the insurer/reinsurer. We propose removing assessing, retain determining and deciding. Declined, the insurer is accountable for the assessment process in all insurance claims. FirstRand Namibia Limited Schedule 2 For Insurers, the following principal business function or activity may not be outsourced: III. Assessing, determining and deciding on claims. IV. Assessing and deciding to accept or decline risk. Current practice is that when a client submits a claim, FNB Insurance can in certain instances appoint a Service Provider to assist with the assessment portion (vehicle, buildings, geysers, etc.). The final decision is however handled and communicated by an approved staff member of FNB Insurance. The same applies to risk acceptance, a committee that has subject matters experts from a group perspective might assist or provide guidance or advisory services and ultimately the decision will be taken by the in-country team. Can NAMFISA expand on the term “assessing” by explicitly stating how this will practically be performed? Clarification. Insurers may seek assistance in assessing the claim, however, the final decision must be done by the insurer. Namibia Insurance Association Schedule 2 Principal Business that may not be Outsourced Insurer: Current practice is that when a client submits a claim, an insurer can in certain instances appoint a Service Provider to assist with the assessment (vehicle, buildings, geysers, etc.) and determination of the value of a claim. The final decision is however handled and communicated by an approved staff member of the Insurer. It is proposed that the principal business be amended by deleting the words “assessing” and “determining” in respect of point (i) relating to claims, and “assessing” in respect of point (ii) relating to risk. The insurer and reinsurer will take the final decision and be accountable/ responsible. The wording to read as follows: Declined- the intention is that the insurer is accountable in every aspect – i.e assessing, determining and deciding on the claim.

21 i) Assessing, determining and deciding on claims Assessing and deciding to accept or decline risk. Reinsurer: i) Assessing, determining and deciding on claims ii) Assessing and deciding to accept or decline risk The same applies to risk acceptance, a committee that has subject matters experts from a group perspective might assist or provide guidance or advisory services and ultimately the decision will be taken by the in-country Insurer’s team. Not allowing a Service Provider to be appointed to assist in the assessment and determination of claims and risks and making a recommendation to the insurer/ reinsurer would be detrimental (financially, reputationally, ability to manage key risks) to the insurer, reinsurer, and the insured / consumer. It would also lead to forcing the insurer/ reinsurer to appoint more staff, which is difficult to do in Namibia due to supply of appropriate skills/ labour. Schedule 2 Principal Business that may not be Outsourced Insurer: i) Deciding on claims ii) Deciding to accept or decline risk. Reinsurer: i) Deciding on claims ii) Deciding to accept or decline risk. The assessment process may include consulting a third party but the decision to reject or accept the assessment findings is based on the insurer. The assessment is very important as it decides on whether the claim will ultimately be honoured or not. Renaissance Health Medical Aid Fund Schedule II For medical aid funds in Namibia which are not self-administered, the assessment and determination of claims has for many years been outsourced to the medical aid fund administrators who therefore, have the skill and employed the staff required to execute this function. In so far as the standard states that the assessing and determination of claims may not be outsourced, clarity is required in this regard. It is unclear whether RMA is expected to take over the claims and assessing function together with the staff or hire the requisite expertise. It should also be noted that the fund does not have access to a specialized system to process the claims and run it separately from the other functions of the fund such as member data and health management data which may create a risk to the fund. NAMFISA to provide clarity. Clarification, all the functions/activities outlined under item 7 of Schedule 2 of the Standard are the principle business of a medical aid fund cannot be outsourced. Yes, RMA is expected to take over all the functions under item 7 of Schedule 2 to comply with this Standard .. Renaissance Health Medical Aid Fund Schedule II Many of the services provided by medical aid fund administrators to medical aid funds are not available within the local context and may leave a gap in the industry creating a material risk of the inability to render services to members of medical aid funds. It appears that NAMFISA perhaps hasn’t taken into account the impact of the outright exclusion of the services outsourced to medical aid fund administrators who currently render the services to MAFs. 1.In so far as the regulator deems it appropriate to exclude offshore arrangements by medical aid fund administrators who currently engage in same, adequate time must be provided to enable the development of the requisite systems, services, skills and localization to enable RMA to bring these services which fall under the ambit of offshore arrangements in-house. 2.In the preferred alternative, an exemption should be allowed in terms of offshore arrangements in particular where the cost and capability in terms of system development would be crippling to enable offshore arrangements. 3.In addition, the Regulator must consider an exemption permitting the outsourcing of these services where they relate to those prohibited per Schedule II.

1. Clarification. A 12 month transitional period will be offered to allow existing arrangements time to comply with the Standard.
2. Rejected – the claims assessment must be done by the medical aid fund. 3.The Standard makes no provision for exemptions; exemptions must be sought in terms of the NAMFISA Act. Napotel Medical Aid Fund Schedule II In so far as the standard states that the assessing and determination of claims may not be outsourced, clarity is required in this regard. For medical aid funds in Namibia which are not self￾administered, the assessment and determination of claims has for many years been outsourced to the medical aid fund administrators who therefore, have the skill and employed the staff required to execute this function. The fund does not have access to a specialized system to process the claims and run it separately from the other functions of the fund such as member data and health management data which may create a risk to the fund. It is therefore uncertain whether Napotel is expected to take over the claims and assessing function together with the staff or hire the requisite expertise. NAMFISA to provide clarity. Clarification. A 12 month transitional period will be offered to allow existing arrangements time to comply with the Standard. Napotel Medical Aid Fund Schedule II It appears that NAMFISA perhaps hasn’t taken into account the impact of the outright exclusion of the services outsourced to medical aid fund administrators who currently render the services In so far as the regulator deems it appropriate to exclude offshore arrangements by medical aid fund administrators who currently engage in same, adequate time must be provided to Declined. 1 Off-shoring arrangements are permitted provided it is proven to NAMFISA that those

22 to MAFs. Many of the services provided by medical aid fund administrators to medical aid funds are not available locally and may leave a gap in the industry creating a material risk of the inability to render services to members of medical aid funds. Especially for smaller closed funds such as Napotel. enable the development of the requisite systems, services, skills and localization to enable Napotel to bring these services which fall under the ambit of offshore arrangements in-house. In the preferred alternative, an exemption should be allowed in terms of offshore arrangements in particular where the cost and capability in terms of system development would be crippling to enable offshore arrangements. In addition, the Regulator must consider an exemption permitting the outsourcing of these services where they relate to those prohibited per Schedule II. services cannot feasibly be performed in Namibia. Therefore, the onus is on the medical aid fund to demonstrate why that function/activity cannot be performed in Namibia. 2. The Standard makes no provision for exemptions; exemptions must be sought in terms of the NAMFISA Act. GEMHEALTH Medical Aid Scheme Schedule II In relation to medical aid funds in Namibia the GEMHEALTH is not self-administered. The administration process including and not restricted to the assessment and determination of claims is outsourced to the medical aid fund administrators. To ensure that the service meet the stingiest service requirements a well-defined tender document is prepared and shared with interested parties following onto a public invitation to tender for such services. Ever since inception the GEMHEALTH Scheme has gone out on tender with regular intervals and normally every 3 to 5 years. This resulted that due to the scale of economy the GEMHEALTH Scheme has not considered self-administration as a viable and economical option. The skill and staff required to execute the administration and managed care services function. The Administrators has built up and developed specialized skills and employ the duly qualified and expert staff to perform the services and that they apply across the membership base of all medical aids and or larger open medical aid funds. In the absence of the background and clarity in so far as the standard states that the assessing and determination of claims may not be outsourced further discussion is proposed and required in this regard. It is suggested that further consultation take place between NAMFISA and the GEMHEALTH Scheme and for that matter all medical aid funds to discuss the principle of self￾administration versus outsource administration services. There is definite pros and cons with regard to placing a restriction on medical aid funds (GEMHEALTH) on outsourcing of medical aid administration and or managed care services. The administration service include possible capital costs for investing in administration/managed care systems, IT maintenance and development costs and supporting services. In addition the Scheme will have to employ staff to manage the braid spectrum of administration and managed care services, financial, membership and other services. If it’s expected for funds to take over the claims assessing, administration, managed care and function together with the staff or hire the requisite expertise. In addition, the fund does not have access to a specialised system to process the claims and running it separately from the other functions of the fund, for instance, member data and health management data, will create large investment and furthermore can create risks to the fund. Declined. The expectation is for the GEMHEALTH to be capacitated so that it can perform all the functions under item 7 of Schedule 2. The size or lack of system cannot be the reason why the principal business should not be outsourced. The payment and assessment of claims is a very integral part of the business of a medical aid fund and apart from cost effectiveness it begs the question why they are unable to perform these functions. GEMHEALTH Medical Aid Scheme Schedule II An outright prohibition of the outsourcing of the services outsourced by a medical aid fund to a medical aid fund administrator fails to take into account that a lot of these service capabilities are not available within the local context of administration and may leave a vacuum in the fund administration. The industry at large may further be at a material risk of the inability to render specialized services to members of medical aid funds and the healthcare service provider community. In so far as the regular deems it appropriate to preclude offshore arrangements/outsource services by medical aid fund the Board of Trustees must be provided with guidance, timelines etc. to enable them to secure system providers and support services, employ skill staff to enable funds to become self-administered and to perform all services in-house. In the preferred alternative, an exemption should be allowed in terms of outsource service arrangements that are not available in Namibia. This in particular have to take into

1. Clarification. A 12 month transitional period will be offered to allow existing arrangements time to comply with the Standard.

23 consideration where the cost and capability in terms of system development would be adding costs to the total administration costs of a medical aid fund. Not restricted to, but some of these services include amongst others pharmaceutical benefit management services, digital interphase, case management, authorizations, etc. that all require high-level skill, state of the art systems and sharing of costs though or amongst larger pool of members and or participating client base. In addition, the Regulator must consider an exemption permitting the outsourcing of these services where they relate to those prohibited per Schedule II or that the fund cannot secure at a competing and fair rate for such services. 2. Declined. Claims assessment is the principal business of a medical aid fund and cannot be outsourced. 3. The Standard makes no provision for exemptions; exemptions must be sought in terms of the NAMFISA Act. Namibia Medical Care SCHEDULE 2 (to Standard GEN.S.10.10) The standard states that the following two functions cannot be outsourced by a medical aid scheme: i) Assessing and determining claims; and ii) Defraying healthcare related expenses on behalf of members. The assumption has been made that these two functions include the receipt of claims, assessment of these claims and then the payment of the claims to the providers / members. These functions are an integrated and material part of the administration of a medical aid scheme. If these are not allowed to be outsourced, then the following two issues would be of a concern:

1. The payment of claims function should be integrated with the membership administration to ensure that only claims are paid in respect of active and up-to-date members. If these two systems are split, or not fully integrated, then incorrect payments might be made.
2. If a fund is forced to handle this function by itself, without the ability to outsource to a specialist administrator, then funds would have to insource a significant part of the administration which would lead to large up-front system and establishment costs, and to a likely increase in the administration costs, especially for smaller funds. The establishment of a stand-alone in-house administration capability will result in the loss of possible economies of scale, again especially for smaller schemes, and could consequently result in a higher administration fee. These two functions should be defined as a material business function and a medical aid fund should be able to include these as part of the administration services outsourcing. If these are classified as a material business function, then it should operate under the controls designated by the standard. Declined. - the intention is that the medical aid fund is accountable in every aspect – i.e assessing, determining and deciding on the claim. The assessment process can be outsourced but the decision to reject or accept the assessment findings is based on the insurer. The assessment is very important as it decides on whether the claim will ultimately be honoured or not. FirstRand Namibia Limited Schedule 2 For Insurers, the following principal business function or activity may not be outsourced: I. Assessing, determining and deciding on claims. II. Assessing and deciding to accept or decline risk. Current practice is that when a client submits a claim, FNB Insurance can in certain instances appoint a Service Provider to assist with the assessment portion (vehicle, buildings, geysers, etc.). The final decision is however handled and communicated by an approved staff member of FNB Insurance. Can NAMFISA expand on the term “assessing” by explicitly stating how this will practically be performed? Declined. The intention is that the insurer is accountable in every aspect – i.e. assessing, determining and deciding on the claim. The assessment process can be outsourced but the decision to reject

24 or accept the assessment findings is based on the insurer. The assessment is very important as it decides on whether the claim will ultimately be honoured or not. Renaissance Health Medical Aid Fund Schedule II (7) The proposed standard stipulates that a Medical Aid Fund may not outsource “ii) benefit/product design”. These are services currently outsourced by some medical aid funds to administrators due to the absence of the capabilities within the Funds. In addition, it is important to note that product design is a multi￾disciplinary exercise, the groundwork commences with member wishes and designs being taken into account as well as the Funds strategy followed up by actuarial costing by the Funds Actuary prior to Board approval therefore due to the multi-faceted approach to product design it is imperative that clarity be provided as to how to ensure compliance with the wording. The current wording requires clarity as the impression created appears to suggest self-administration by medical aid funds which is not the current situation in Namibia. Whilst the Board of RMA approves the product prior to submission to NAMFISA it requires the input of many different departments as the Fund doesn’t have the requisite or actuarial skill to execute the process in insolation. The Regulator should kindly provide clarity as to whether or not this may be conducted as per the requirements of the Fund as long as the Fund benefit/product design is approved by the RMA Board of Trustees. Clarification. The funds will be required to capacitate themselves to be able to carry out benefit design. The benefit and product design must be performed by the medical aid fund because it is integrally linked to other functions such as claims management – thus how does one separate the business of the fund from benefit design? 2. It must be built inhouse because it affects risk management and governance and if the fund does not have a basic understanding of what it involves, how is the fund running its risks Renaissance Health Medical Aid Fund Schedule II (7) Executive Management and governance functions. Kindly clarify “executive management and governance functions” in order to clarify whether executive management constitutes the PO of the Fund (ex officio) and Fund Exco comprising of trustees. Further, clarify whether the executive management of the outsourced functions will be allowed. Declined. Executive management of the fund are those responsible for running the Fund i.e. senior management tea GEMHEALTH Medical Aid Scheme Schedule II (7) Executive Management and governance functions. Kindly clarify “executive management and governance functions” in order to clarify whether executive management constitutes the PO and Fund Exco comprising of trustees? Further, clarify whether the executive management of the outsourced functions will be allowed. Declined. The executive management of the fund are those responsible for running the fund – i.e senior management. Prosperity Health Namibia S17 read with Schedule II (7) Executive Management and governance functions. Kindly clarify “executive management and governance functions” in order to clarify whether executive management constitutes the PO of the Fund and Fund Exco comprising of trustees. Declined. The executive management of the fund are those responsible for will constitute those people running the fund – i.e. senior management. Napotel Medical Aid Fund Schedule II (7) The proposed standard stipulates that a Medical Aid Fund may not outsource “ii) benefit/product design”. These are services currently outsourced by some medical aid funds to administrators due to the absence of the capabilities within the Funds. In addition, it is important to note that product design is a multi￾disciplinary exercise, the groundwork commences with member Whilst the Board of Napotel approves the product prior to submission to NAMFISA it requires the input of many different departments as the Fund doesn’t have the requisite or actuarial skill to execute the process in insolation. The Regulator should provide clarity as to whether or not this may be conducted as per the requirements of the Fund as Clarification. The funds will be required to capacitate themselves to be able to carry out benefit design.

25 wishes and designs being taken into account as well as the Funds strategy followed up by actuarial costing by the Funds Actuary prior to Board approval therefore due to the multi-faceted approach to product design it is imperative that clarity be provided as to how to ensure compliance with the wording. The current wording requires clarity as the intention appears to suggest self-administration by medical aid funds which is not the current situation in Namibia. long as the Fund benefit/product design is approved by the Napotel Board of Trustees. The benefit and product design must be performed by the medical aid fund because it is integrally linked to other functions such as claims management – thus how does one separate the business of the fund from benefit design 2. It must be built inhouse because it affects risk management and governance and if the fund does not have a basic understanding of what it involves, how is the fund running its risks. GEMHEALTH Medical Aid Scheme Schedule II (7) The proposed standard stipulates that a Medical Aid Fund may not outsource “ii) benefit/product design”. These are services currently outsourced by some medical aid funds to administrators due to the absence of the capabilities within the Funds. In addition, it is imperative to note that product design is a multi￾disciplinary exercise, the groundwork commences with member and provider expressing ‘’wishes’’ of possible changes. This is formulated in terms of a ‘’benefit wish-list’’ that are further considered in line with the Board of Trustees and fund’s strategic intent. The various stages of product design is followed up by actuarial costing by the Funds Actuary. The ultimate product design for the next benefit year is only then submitted to the Board of Trustees for approval. Thus a multi-faceted approach to benefit and product design it is imperative before being submitted to the Board of Trustees. The Board of Trustees also need to ensure compliance with the required regulative and other requirements set by the authorities. The current wording requires clarity as the impression created appears to allude to self-administration by medical aid funds which is not done by any medical aid fund in Namibia. The Board of Trustees follow a well-defined product development process that are carried out by a multi￾functional team. The total process is managed, controlled and supervised under the authority of the Board of Trustees and stretch over a few months product development cycle. This from part of the fund’s annual budget process and the independent actuaries plays a critical role and is conducting ‘’what if’’ impact assessment studies on any propped changes in benefits structures for the next benefit year. This is then submitted to Namfisa for consideration and approval. Whilst the Board approves the product prior to NAMFISA it requires the input of many different disciplines as the Fund doesn’t have the requisite or actuarial skill to execute the preparation, review and formulation of the product and supervising the process alone. NAMFISA to provide clarity as to whether or not this may be conducted as per the requirements of the Fund. Clarification. The funds will be required to capacitate themselves to be able to carry out benefit design. The benefit and product design must be performed by the medical aid fund because it is integrally linked to other functions such as claims management – thus how does one separate the business of the fund from benefit design. 2. It must be built inhouse because it affects risk management and governance and if the fund does not have a basic understanding of what it involves, how is the Fund running its risks. Hollard Clause 16 There is nothing in the rest of the outsourcing standard requiring both an outsourcing agreement and a service level agreement. The minimum outsourcing obligations in Schedule 1 include many service levels that need to be dealt with in the agreement including “performance matrix referred to in (h)”. The outsourcing agreement will be sufficient. The reference to a service level agreement should be deleted. Accepted. Hollard Clause 17(2) It is always difficult to carry on business where prior written approval from a regulator is required for a normal business relationship. Delays in response can negatively impact business. A time limit of 10 business days should be set in which Namfisa makes a determination, failing which it is deemed to be given. Accepted. ,14 business days for NAMFISA to be given a determination. Therefore there is no deemed (automatic) approval.

26 GEMHEALTH Medical Aid Scheme S17 read with Schedule II (7) Some of the functions earmarked in this section are currently outsourced and performed by medical aid fund administrators. It is not clear whether the Standard establishes a point of departure toward self-administration of medical aid funds which constitutes an anomaly in Namibia. The Benefit and Product design process is already hosted, formulated, approved and signed off by the Board of Trustees. Clarity is therefore required as to:

1. Whether or not “assessing and determining claims” means that the medical aid fund must become self- administered?
2. Required to appoint a staff complement required to perform such services i.e. process and assess claims.
3. This will imply that these service or functions can no longer be outsourced or housed under the Administrator?
4. As indicated for a medical aid fund (MAF) to fulfil the service i.e. process and assess claims, it requires an IT System and Staff,
5. Currently the MAF currently does not own IT systems, but only the data.
6. This will all be an additional costs and is unsure whether this will be obtained at a more competitive and favorable rate.
7. If only part of the administration services are done in￾house and others member management, membership, credit control, queries, benefit health management etc. from the claims system it may well be an extra or additional cost to the MAF.
8. Some consideration will have to be give to the practicality of splitting the fund administration services? The core function of a medical aid fund as a mutual fund is to defray healthcare related expenses on behalf of members. As this constitutes a core component of MAFs this needs further clarification as to the performance of the financial reporting of the fund i.e. dome as in-house, outsource or a split responsibility?
9. With a separate bank accounts for the processing of claims from other financial functions of the fund this need some clarification.
10. Does it suffice within the intended interpretation that in so far as claims are paid from a bank account in the name of the MAF the requirement is met? Or is it intended that this finance function be executed directly by the MAF which then is required to hire and house the employees for same?
11. Benefit and product design: Whilst this is performed by the Board of Trustees it raise the question whether this may be contracted/outsourced to an administrator or other service provider?
12. The importance of the process cannot be over emphasized as it requires the role and services of the administrators’ operational staff, data experts and services of the actuaries. Clarification. Yes, the funds will be required to self administer because that is the principal business of a medical aid fund. . 2.Declined. It must be built inhouse because it affects risk management and governance and if the fund does not have a basic understanding of what it involves, how is the fund running its risks?
13. Yes, the principal business of a medial aid fund cannot be outsourced.
14. Noted. 5.The principal business function or activity of a Medical Aid Fund cannot be outsourced. For example, the principal business of Medical Aid Fund is to “assess and determine claims”. Therefore in that instance it does not need to own the system that assess and determine claims but it should have control over the system so that it can determine claims. 6.Noted.
15. Noted. The part of the administration services that are the principal business cannot be outsourced whereas those of the material business may be outsourced.
16. Financial reporting is a material business activity that may be outsourced.
17. The principal business function or activity cannot be outsourced. However, the IT system which enables the Medical Aid Fund to perform the principal business function or activity is a material business function that may be outsourced. Meaning, the MAF must administer the payment of claims from their bank account and not outsource this to the administrator.

27 5. MAF itself requires a skills gap compliment to effect the process, such as the actuarial costing etc? 6. Critical in the compilation Benefit wish list and design encompasses the Administrator gathering information from members through the day-to-day operations, client service interaction, healthcare provider interaction etc. and that from the base of the wish-list. The wish -list is the draft proposal to the Board of Trustees evaluating and discussing these. A comprehensive review and impact analysis process is followed with inputs from all. The fund actuary play a critical role in conducting the impact assessment and in setting and ultimately setting the fund operational budget, premium setting and operational performance criteria. Although many role-players are involved in the Benefit and Product design, it is the BOT that rives the process and that makes the final decisions, approval and sign-off for submission to Namfisa for final approval 7. Executive Management and governance functions: As fund or board policies are signed off by the MAF Board of Trustees it suffices to establish that the execution and compliance in this regard is wholly the responsibility of the Board. However, clarity is required whether the functions outsourced within the Administrators contract will have its own executive management or not? 8. Holding of contributions: Does it suffice that the funds are held in the account of the MAF or may the execution of finance function in terms of disbursing the funds be outsourced? 9. Operating system: For a MAF to process and assess claims, it requires an IT System and operational staff. Currently MAFs does not own IT systems it will be an additional cost to them, furthermore it is highly impractical to separate member management, membership, credit control, queries, benefit health management, etc from the claims system. 10. Awarding investments: Does it suffice for the MAF trustees continue to sign off and determine investment mandates? 10. The benefit and product design must be performed by the medical aid fund because it is integrally linked to other functions such as claims management – thus how does one separate the business of the fund from benefit design. 11. Noted. 12. Benefit design of products/services should be done by the medical aid fund. However, actuarial costing may be outsourced. 13.For us to understand your question, please provide a practical example of your question. 14. Holding of contributions must be in the bank account of the medical aid fund. 15. Yes, the expectation is for medical aid funds to capacitate themselves by having control over the systems that enable it to perform its principal business functions/ activities. 16. Yes, the trustees must award, assign and authorise investment mandates. Renaissance Health Medical Aid Fund S17 read with Schedule II (7) Some of the functions highlighted in this section are currently performed by medical aid fund administrators at present and it is unclear whether the Standard establishes a point of departure toward self-administration of medical aid funds which constitutes an anomaly in Namibia. NAMFISA to clarity kindly the below:

1. Whether or not “assessing and determining claims” means that the medical aid fund must obtain the staff complement required to process and assess claims and that this function 1.Clarification. The funds will be required to capacitate themselves to be able to carry out benefit design. Regarding IT systems, for example “assessing and determining claims” is

28 We support that the Benefit and Product design is approved and signed off by the BOT. therefore can no longer be housed under the MAF administration. As mentioned before, for a RMA to process and assess claims, it requires an IT System and Staff, and as MAF currently does not own IT systems it will be an additional cost to them, furthermore it is highly impractical to separate member management, membership, credit control, queries, benefit health management etc. from the claims system. 2. Defraying healthcare related expenses on behalf of members- this constitutes a core component of MAFs, does it suffice within the intended interpretation that in so far as claims are paid from a bank account in the name of the MAF the requirement is met? Or is it intended that this finance function be executed directly by the MAF which then is required to hire and house the employees for same? 3. Benefit and product design: May this be contracted to an administrator or service provider where the MAF itself requires a skills gap compliment to effect the process, such as the actuarial costing etc? Benefit design encompasses the Administrator gathering information from members through the day-to-day operations, proposals being set forward, and the Board of Trustees evaluating and discussing these with other inputs from their side and then submitting it to the Funds Actuary for costing. Although many role-players are involved in the Benefit and Product design, it is the BOT which makes the final decision and final approval. 4. Executive Management and governance functions: as board policies are signed off by the MAF it suffices to establish that the execution and compliance in this regard is wholly the responsibility of the Board, however, the clarity required is whether the functions outsourced within the Administrators contract will have its own executive management. 5. Holding of contributions: does it suffice that the funds are held in the account of the MAF or may the execution of finance function in terms of disbursing the funds be outsourced? 6. Awarding investments: does it suffice in terms of compliance, for the RMA trustees to sign off and determine investment mandates? the principal business of a Medical Aid Fund. Therefore in that instance, the expectation is for the Medical Aid Fund to have control over the system so that it can assess or determine claims. 2. Claims should be paid from the bank account of the medical aid fund. 3.The funds will be required to capacitate themselves to be able to carry out benefit design. The benefit and product design must be performed by the medical aid fund because it is integrally linked to other functions such as claims management – thus how does one separate the business of the fund from benefit design. 4. The regulation will be over the regulated entity, thus whatever measures or functions are required on the other entities part must be in place in order to comply with the standard. 5. No, defraying (paying) the healthcare costs cannot be outsourced. 6. It should be all the listed functions, i.e awarding, assigning and authorizing investment mandates. Prosperity Health Namibia S17 read with Schedule II (7) Some of the functions earmarked in this section are currently performed by medical aid funds at present and it is unclear whether the Standard establishes a point of departure toward self-administration of medical aid funds which constitutes an anomaly in Namibia. Clarity is therefore required as to: (i) Whether or not “assessing and determining claims” means that the medical aid fund must obtain the staff compliment required to process and assess claims and that this function Clarification. 1. The funds will be required to capacitate themselves to be able to carry out benefit design.

29 therefore can no longer be housed under the MAF administration. (ii) Defraying healthcare related expenses on behalf of members- this constitutes a core component of MAFs, does it suffice within the intended interpretation that in so far as claims are paid from a bank account in the name of the MAF the requirement is met? Or is it intended that this finance function be executed directly by the MAF which then is required to hire and house the employees for same. (iii) Benefit and product design: May this be contracted to an administrator or service (vi) provider where the MAF itself requires a skills gap compliment to effect the process? Executive Management and governance functions: as board policies are signed off by the MAF it suffices to establish that the execution and compliance in this regard is wholly the responsibility of the Board, however, the clarity required is whether or not the secretariat of the MAF must be housed within the funds thus the MAF now need to source the requisite employees to execute same. Holding of contributions: does it suffice that the funds are held in the account of the MAF or may the execution of finance function in terms of disbursing the funds be outsourced? Awarding investments: does it suffice for the MAF trustees to sign off and determine investment mandates? The funds will be required to capacitate themselves to be able to carry out benefit design. The benefit and product design must be performed by the medical aid fund because it is integrally linked to other functions such as claims management – thus how does one separate the business of the fund from benefit design. It must be built inhouse because it affects risk management and governance and if the fund does not have a basic understanding of what it involves, how is the fund running its risks. Prosperity Health Namibia S17 read with Schedule II In relation to the business of a Medical Aid Fund Administrator that currently engages in Off shoring arrangements as highlighted in s17, when the provisions of off shoring arrangements are read in conjunction with Schedule 2 to Standard Gen.S.10.10 in particular at 6(7) and 8 entitled “Fund Administrator” it states at (i) “Functions and duties outsourced to a Fund Administrator may not be outsourced”- the issue that arises is that certain services currently outsourced to Fund Administrators are in turn outsourced under Offshoring arrangements as these capabilities are not available in the Namibian local context. NAMFISA – see NAMFISA must kindly provide clarity in this regard as s17 r/w schedule 2 creates confusion, the clarity required, to wit, either (i) Administrators may enter into off shore arrangements per s17 in executing functions outsourced to Medical Aid Fund administrators on condition that such off-shore arrangement complies with the Standard or (ii) Medical Aid Fund Administrators per Schedule II are prohibited from outsourcing the functions and duties outsourced to a medical aid fund administrator period. Clarification. NAMFISA may approve off-shoring arrangements provided the medical aid fund justifies that the function/activity cannot feasibly conducted in Namibia. Therefore the onus is on the medical aid fund to justify the need for entering into an off￾shoring arrangement.

1. The purpose is to prohibit a fund administrator from outsourcing an already outsourced function.
2. Thus, both options apply, this is to prevent the surcharge the MAF has to experience. If the Administrator is unable to render the service, then the fund must procure itself directly. .

30 Prosperity Health Namibia S17 read with Schedule II (6 and 8) An outright prohibition of the outsourcing of the services outsourced by a medical aid fund to a medical aid fund administrator fails to take into account that a lot of these service capabilities are not available within the local context and may leave a vacuum in the industry creating a material risk of the inability to render services to members of medical aid funds. In so far as the regulator deems it appropriate to preclude offshore arrangements by medical aid fund administrators who currently engage in same, adequate time must be provided to enable the development of the requisite systems, services, skills and localization to enable medical aid fund administrators to bring these services which fall under the ambit of off shore arrangements in-house. In the preferred alternative, an exemption should be allowed in terms of offshore arrangements in particular where the cost and capability in terms of system development would be crippling to enable offshore arrangements, for example medicine benefit management platforms. Declined. The Standard makes no provision for exemptions; exemptions must be sought in terms of the NAMFISA Act. Prosperity Health Namibia S17 read with Schedule II (7) The proposed standard stipulates that a Medical Aid Fund may not outsource i) Assessing and determination of claims services currently outsourced by some medical aid funds to administrators due to the absence of the capabilities within the Funds. In addition, it is imperative to note that product design is a multi￾disciplinary exercise, the groundwork commences with member wishes and designers being taken into account as well as the Funds strategy followed up by actuarial costing by the Funds Actuary prior to Board approval therefore due to the multi-faceted approach to product design it is imperative that clarity be provided as to how to ensure compliance with the wording. Clarification. The funds will be required to capacitate themselves to be able to carry out benefit design. The benefit and product design must be performed by the medical aid fund because it is integrally linked to other functions such as claims management – thus how does one separate the business of the fund from benefit design. It must be built inhouse because it affects risk management and governance and if the fund does not have a basic understanding of what it involves, how is the Fund running its risks. The costing and formulation thereof must be done locally or in house. The designing must be carried out by the fund as it is a core function of the existence of the fund. Hollard Group Namibia Clause 18(2) The requirement to notify Namfisa in writing not later than 30 business days after an extension, renewal or amendment of an outsourcing agreement, of such extension, renewal or amendment is very taxing. We suggest that the clause is reworded to rather submit a register once a year, for practical reasons. Declined. The intention of this clause is for NAMFISA to be regularly updated on extensions, renewals or amendment of an outsourcing agreement therefore once a year is insufficient. Hollard Group Namibia Clause 19 There is no transitional provision Many of the requirements for outsourcing cannot be met retrospectively. Laws can only be applied to future conduct. The simple statement that the Standard applies to all existing outsourcing arrangements is not a reasonable and rational regulation under administrative law. NAMFISA has no authority over non-financial institutions who are parties to A transitional clause should be drafted. Clarification. A 12 month transitional period will be offered to allow existing arrangements time to comply with the Standard

31 outsourcing arrangements and NAMFISA cannot oblige such parties to change existing agreements. In addition, NAMFISA has no power to order Financial Institutions to breach agreements by prematurely terminating them because a new Standard has come into place. Hollard Group Namibia Clause 3 & Schedule 2 These prohibitions are unusual because, universally, insurers enter into binding arrangements with third parties who have authority to bind insurers in respect of claims within certain limits and to accept risks under specific circumstances. Such a prohibition in a Standard change the lawful practices of the insurance industry in a material respect. Provided the insurer sets rational limits which comply with the detailed requirements for outsourcing, it is efficient to allow the outsourcing in terms of a binder agreement to persons competent to deal with claims. This is particularly the case in volume business such as motor insurance or householder policies. To take a few examples: 1.Geyser Claims A person of competence is sent to a scene to assess and decide whether or not it is a valid geyser claim. There are many claims decisions that need to be taken as soon as possible. Referring back to the insurer every time for volume claims will not promote the fair treatment of customers. 2.Specialized Claims In some instances, special assessors are appointed, therefore a blanket prohibition will negatively affect this type of scenario. i.e Aviation specialists, engineers for turbine assessments for complex claims with huge quantum where liability, if any, needs to be accurately determined. 3.Surveyors Surveyors are appointed to assist with determining and advising to accept risk. i.e building surveyors who look at various factors playing a role for the insurer in accepting risk. Rather layout principles that Financial Institutions should adhere to when outsourcing Principal Business. Alternatively, Namfisa should clearly define what is meant with “Assessing” and “Determining” of claims and risk. Declined. This is a principle based standard and for that reason Schedule 2 sets out the ambits of what would be considered as principle business. Please refer to the ordinary or literal meaning of the process, thus the assessment or determination of the claim. Further, how can the insurer provide assurance that the decision was made independently of the assessor's influence? We seek to avoid a process that merely serves as a formality. Assessment and determination are interlinked because the assessment requires application of the mind. For e.g – the decision should not be with the assessor, the recommendation must simply come from the assessor and the decision must be made by the insurer. Allow the assessment to be done by a 3 rd party but the insurer must apply themselves to the recommendation and show cause as to why they are accepting or declining the claim. We are guarding against cases where the insurer blindly accepts the assessors report without applying themselves and at claims stage they are unable to explain it to the client when they repudiate the claim to the client. Eg, all claims below N$30 000 may not require further assessment by the insurer or scrutinizing by the insurer. But anything above that, an assessment report is required that is duly considered by the insurer. Hollard Group Namibia Clause 6(2) (j) All outsourcing will have an impeding effect to some extent. This may be the case, for instance, with off-shoring arrangements. The wording should be changed to refer to an arrangement which “materially impedes” those supervisory powers. Declined, this is to the Regulator’s discretion.

32 Renaissance Health Medical Aid Fund General Schedule II on Medical Aid Fund Broker Medical Aid Fund Broker NAMFISA to kindly clarify whether RMA will be liable to make payments, when a third-party Broker agrees with a Member to provide financial advice. It is expected that the parties who contract should also be the ones making payment or performing the contracted services. The Fund will not be able to verify or manage such services or contracts, and cannot be expected to blindly make payment for such contracts. The Member who receives the service should be the one to measure the service against the agreed services and if in agreement, make the required payment. NAMFISA to provide clarity as to whether the Administrator may continue with the sales function through appointed Agents. Clarification. The modalities around medical aid fund brokers will be contained in the standards that are yet to be drafted. Also refer to the definition of medical aid fund broker in FIMA. GEMHEALTH Medical Aid Scheme Medical Aid Fund Broker If a Medical Aid Fund Broker – comment not complete from Entity Clarity to be provided as to whether the Fund will be liable to make payments, when a third-party Broker agrees with a member or employer group to provide financial, product, benefit and or any other advice. It strongly advised that the party(ies) who contract a Broker should also be the ones making payment for performing the contracted services. The Fund will not be able to verify or manage such services or contracts, and cannot be expected to blindly make payment for such contracts. The fund operates as a mutual and solidarity fund belonging to all members and those members who contract Brokers for external services should carry the costs. Those and probably the majority of members that do not contact Brokers should not be expected to subsidize the Brokers service costs. The member who opt and that receives the service should be the one to measure the service against the agreed services and if in agreement, make the required payment for his/her own pocket or to be carried by the employer group. Clarity is also to be provided as to whether the Administrator may continue with the sales function trough their appointed Agents. You also have to clarify whether a Broker and or agent can only market the service and or offering from one medical aid fund? Can a broker offer objective services of not accredited by all medical aid funds and or be allowed to compare products of other medical aid funds for whom they not appointed a Brokers? Simply if a Broker is not accredited and received training on a specific fund benefit and product how can they be allowed to objectively give advice to their client? Clarification. The modalities around medical aid funds brokers will be contained in the standards that are yet to be drafted also refer to the definition of medical aid fund broker in FIMA.

33 Napotel Medical Aid Fund General Schedule II on Medical Aid Fund Broker Medical Aid Fund Broker NAMFISA to kindly clarify whether Napotel will be liable to make payments, when a third-party Broker agrees with a Member to provide financial advice. It is expected that the parties who contract should also be the ones making payment or performing the contracted services. The Fund will not be able to verify or manage such services or contracts, and cannot be expected to blindly make payment for such contracts. The Member who receives the service should be the one to measure the service against the agreed services and if in agreement, make the required payment. NAMFISA to provide clarity as to whether the Administrator may continue with the sales function trough appointed Agents. Clarification. The modalities around medical aid fund brokers will be contained in the standards that are yet to be drafted also refer to the definition of medical aid fund broker in FIMA. GENERAL COMMENTS

34 Methealth Namibia Administrators 1.Methealth extends its appreciation to the Regulator for considering its previous comments herein. However, there still remain a number of key concerns with this third draft, which we firmly believe can only be resolved in a meaningful manner with in-person discussions and/or engagements. Such in-person engagement will allow industry to better articulate the practical implications and consequences of implementing the Standard in its current form and will enable industry and the Regulator to collaborate more effectively to achieve the strategic goals that this Standard proposes to achieve. 2.In addition to requesting for in-person engagements, it is also our belief that every entity impacted by this Standard faces unique challenges in complying therewith, but also that every entity has considered unique proposals to address these challenges. It is therefore critical that NAMFISA be willing to engage with each entity separately to consider these. Every industry participant has a different business and operating model, and it is suggested that, in line with the risk based approach, the regulator reach an agreement with each participant around timelines and manner of implementation of the Standard. We therefore recommend adopting a flexible approach to implementation that considers the size and risk profile of each institution. 3.The FIMA seeks to introduce a risk-based approach to supervision. The Outsourcing Standard largely aligns with such an approach insofar as entities are expected to implement Outsourcing Risk Management frameworks and principles in respect of material functions that are outsourced. This is very much aligned with International best practice and standards. Methealth does not object to the introduction of a risk-based approach. It is rather the blanket prohibition on outsourcing of principal business that is problematic and that does not align with international practice. 4.By following the same materiality and risk-based test as is introduced for material business functions – it is our respectful view that we will be able to manage the risks related to outsourcing of principal business functions and that the regulator will be able to effectively supervise those functions under the same framework introduced for material business functions. It is our proposal to treat principal business in the same/similar vein as material functions – ie. that there should not be an outright prohibition, but rather that a risk-based approach be employed in this regard as well. 5.The potential consequences of the blanket prohibition on outsourcing of principal business include, but is not limited to:- • Localizing functions is expensive. To achieve skills development and a local talent pool at the scale required to consistently and reliably perform these functions autonomously within the borders of Namibia, requires time and significant investment/resources. • Given the skills shortage of certain functions, it places industry at a significant risk if any of these functions are no longer available. 6.Consideration for economies of scale should be part of the regulator’s RBS framework. In-sourcing of principal business (ie. outsourcing between entities of the same group of companies) should be allowed given the economies of scale benefit obtained from shared resources as well as protection afforded to investors/customers for services performed within the same group of companies. The benefits of economies of scale in successfully running any business should not be overlooked. Consideration should be given to industry size, business size and type of specialized skills required. 7.Even if specialized skills are developed, many smaller entities will still face “key-man” risk as entities will only have one or two key individuals, performing these specialized roles, due to economies of scale and the size of the economy. 8.Lastly, we request that NAMFISA define and set a clear transition period for all existing outsourcing arrangements, within which financial institutions or intermediaries can put in place the necessary measures to achieve compliance. Unfortunately, it is not possible for most institutions to perform the principal business currently outsourced, often within a greater group structure, without a certain amount of planning and in-country skills development. Without a sufficient grace period within which to prepare for localizing principal functions, it could well be that institutions are unable to comply. It will take time to identify which services may not be outsourced, then assess how to perform the functions and negotiate existing contracts.

1. We are open to considering face-to-face consultations with industry before finalizing the feedback, provided that these consultations focus on refinement rather than altering the core policy objective of the Outsourcing Standard.
2. Each entities application will be dealt with on the merits and thus on a case-by-case basis.
3. Declined. Outsourcing of principal business is prohibited because a regulated entity obtains a license to conduct its principal business which inherently carries regulatory obligations. Therefore, these regulatory obligations cannot be delegated to a third party. This is in line with international best practice.
4. As explained in point 3 above Principal business should not be outsourced. The intention or expectation is that they get capacitated and the size or lack of system cannot be the reason why the principal business should not be outsourced. We also want to combat issues around entities with no/minimal operational activity , thus if all services are outsourced, who is actually running the core business?
5. Clarification. A 12-month transitional period will be offered to allow existing arrangements time to comply with the Standard. .
6. This is one of the modalities of building capacity in house or in country that will be rectified over time as scale increases. 8.Clarification. A 12 month transitional period will be offered to allow existing arrangements time to comply with the Standard. .

35 MMN Group 1.The MMN Group extends its appreciation to the Regulator for considering its previous comments herein. However, there still remain a number of key concerns with this third draft, which we firmly believe can only be resolved in a meaningful manner with in-person discussions and/or engagements. Such in￾person engagement will allow industry to better articulate the practical implications and consequences of implementing the Standard in its current form and will enable industry and the Regulator to collaborate more effectively to achieve the strategic goals that this Standard proposes to achieve. 2. In addition to requesting for in-person engagements, it is also our belief that every entity impacted by this Standard faces unique challenges in complying therewith, but also that every entity has considered unique proposals to address these challenges. It is therefore critical that NAMFISA be willing to engage with each entity separately to consider these. Every industry participant has a different business and operating model, and it is suggested that, in line with the risk based approach, the regulator reach an agreement with each participant around timelines and manner of implementation of the Standard. We therefore recommend adopting a flexible approach to implementation that considers the size and risk profile of each institution. 3. MMN has undertaken an Outsourcing Assessment to identify those key areas under its current business model that are impacted by this Standard and have considered potential proposals to the Regulator that will enable MMN to be largely compliant with this Standard, and that will also demonstrate to the Regulator our commitment to local capacity building and skills development. MMN herewith kindly requests that NAMFISA avail itself for receipt of such individual proposals and to consider these, in order to minimize the impact of this Standard on industry. 4.The FIMA seeks to introduce a risk-based approach to supervision. The Outsourcing Standard largely aligns with such an approach insofar as entities are expected to implement Outsourcing Risk Management frameworks and principles in respect of material functions that are outsourced. This is very much aligned with International best practice and standards. MMN does not object to the introduction of a risk-based approach. It is rather the blanket prohibition on outsourcing of principal business that is problematic and that does not align with international practice. By following the same materiality and risk-based test as is introduced for material business functions – it is our respectful view that we will be able to manage the risks related to outsourcing of principal business functions and that the regulator will be able to effectively supervise those functions under the same framework introduced for material business functions. It is our proposal to treat principal business in the same/similar vein as material functions – ie. that there should not be an outright prohibition, but rather that a risk-based approach be employed in this regard as well. 5.The potential consequences of the blanket prohibition on outsourcing of principal business include, but is not limited to:- • Localizing functions is expensive. To achieve skills development and a local talent pool at the scale required to consistently and reliably perform these functions autonomously within the borders of Namibia, requires time and significant investment/resources. • 6.Given the skills shortage of certain functions, it places industry at a significant risk if any of these functions are no longer available. For example, it remains a fundamental risk that where an investment manager loses its portfolio manager or an insurer loses a specialized risk expert and there is no option to outsource the function, albeit for a short period, the absence of these specialized skills will adversely affect the investors and clients. 7.Consideration for economies of scale should be part of the regulator’s RBS framework. In-sourcing of principal business (ie. outsourcing between entities of the same group of companies) should be allowed given the economies of scale benefit obtained from shared resources as well as protection afforded to investors/customers for services performed within the same group of companies. The benefits of economies of scale in successfully running any business should not be overlooked. Consideration should be given to industry size, business size and type of specialized skills required. 8. Even if specialized skills are developed, many smaller entities will still face “key-man” risk as entities will only have one or two key individuals, performing these specialized roles, due to economies of scale and the size of the economy. 9.With regard to localization of portfolio management, the challenge largely stems from the small size of the Namibian market. In 2023 the industry total AuM in Namibia was approximately a mere N$ 200 Billion. This total AuM is managed by over 20 or so locally registered Asset Managers in Namibia. On average therefore, give or take, a single fund manager manages about 10 billion in Namibia. In absolute terms, there are fund managers locally which manage as little as N$1 billion or less. Compare this to our SA counterparties’ AuM, where an average fund manager typically manages in excess of 500 Billion each. A large sized fund manager in SA manages more than double the total Namibian AuM size. The margins are very low in investment management, and as such – economies of scale are critical in ensuring that the front office, middle office and back-office functions are executed in line with international best practices.

1. The Registrar may consider face to face consultations with industry before final feedback is published.
2. Each entities application will be dealt with on the merits and thus on a case-by-case basis.
3. Accepted. A meeting to be scheduled.
4. Declined. Outsourcing of principal business is prohibited because a regulated entity obtains a license to conduct its principal business which inherently carries regulatory obligations. Therefore, these regulatory obligations cannot be delegated to a third party. This is in line with international best practice.
5. Noted. The Registrar appreciates that localisation is expensive and has balanced this cost aspect with the policy objective of the Standard.
6. Noted. The Registrar appreciates that entities will be competing for talent.
7. Please note that in-sourcing of principal business is allowed for material business functions.
8. Noted. The Registrar appreciates that entities will be competing for talent.
9. Noted. Overall the investment management industry has made marginal progress to upskill local talent despite various succession plans in place. Further it is possible to perform the portfolio management function locally as some investment managers are doing so ie it is not

36 Therefore, whereas localization is encouraged, a complete divorce of co-functions such as portfolio management will have significant impact on the industry. Complete localization will impact the quality of the execution of portfolio management, and will compromise the benefit currently enjoyed of economies of scale in co-managing SA funds. As such, we strongly advise a middle ground: where companies employ local resources to work with SA/London/Singapore/Isle of Man etc. teams and not a complete divorce as the market size is not sufficient to enable such. 10. Lastly, we request that NAMFISA define and set a clear transition period for all existing outsourcing arrangements, within which financial institutions or intermediaries can put in place the necessary measures to achieve compliance. Unfortunately, it is not possible for most institutions to perform the principal business currently outsourced, often within a greater group structure, without a certain amount of planning and in-country skills development. Without a sufficient grace period within which to prepare for localizing principal functions, it could well be that institutions are unable to comply. It will take time to identify which services may not be outsourced, then assess how to perform the functions and negotiate existing contracts. impossible to do. NAMFISA must balance the economies of scale against having no local capacity for portfolio management functions. 10. A 12 month transitional period will be offered to allow existing arrangements time to comply with the Standard. NASIA 1. (a) The Financial Institutions and Markets Act, 2021 (“the Act”) seeks to introduce a risk-based approach to supervision. The draft proposed Standard No. GEN.S.10.10 published on 16 April 2024 (“the Standard”) largely aligns with such an approach insofar as entities are expected to implement outsourcing risk management frameworks and principles in respect of material business functions or activities that are outsourced. Industry does not object to the introduction of a risk-based approach as it is very much aligned with international best practice and standards. It is rather the blanket prohibition on outsourcing of principal business that does not align with international practice and is problematic. We are majorly concerned with regards to the damage such a blanket approach, although well intended, can have on investors trust in the local industry and especially on the medium and smaller firms in the industry which currently don’t have the financial resources to undertake principal business fully within Namibia. (b) It is our understanding that the regulator aims to drive the development of local skills through this standard. We are of the opinion that that goal can be achieved in a different way that will have a less severe impact on industry and skills development and are amenable to co-create (together with the regulator) a concrete industry plan that sets out the current skills shortages, localization of functions, clear targets and timelines within which to achieve the set targets. We believe that commitment at industry level (i.e. through an industry apprenticeship program) will have more (and faster) impact in creating a continuous pipeline of much needed specialized skills in the industry. (c) Given the regulator’s adoption of the Risk Based Supervision (RBS) framework, it is our respectful view that an outright prohibition on the outsourcing of principal business function is not aligned with the RBS framework. We therefore strongly propose that NAMFISA follows (for principal business function) the same materiality and risk-based test as is introduced for material business functions. This will ensure that NAMFISA will still be able to effectively supervise those functions under the same framework introduced for material business functions. Furthermore, to support local skills development, we propose that in￾sourcing of principal business functions be allowed in instances when the outsourcing is to a service provider located in Namibia. See our proposed changes under clause 3. 2. More specifically, we wish to stress the negative effects this Standard will have on the industry in its current form (i.e. the blanket prohibition on outsourcing of principal business). As an example, it remains a fundamental risk that where an investment manager loses its two portfolio managers or an insurer loses a specialized risk expert and there is no option to outsource the function, albeit for a short period, the absence of these specialized skills will adversely affect the investors and clients and mostly the trust which is a key ingredient of the financial services industry. In this instance, in-sourcing arrangements (whether they classify as off-shoring arrangements or not), implemented under the conditions in terms of the Standard would remediate the loss of specialized skills for a bridging period until those skills are hired again. This is an important part of risk management and in the best interest of investors and clients in an industry that is relatively small (i.e. the number of in-house experts that any entity can employ is a function of Assets Under Management and or Insurance Premium Income) when compared to other jurisdictions. Consideration for economies of scale should therefore be part of the regulator’s RBS framework. In such instances, outsourcing of principal business should be allowed (for a bridging period and through an application process that would be approved by the regulator) between entities of the same group of companies given the economies of scale benefit obtained from shared resources as well as protection afforded to investors/customers for services performed within the same group of companies. 3. Our proposed changes to the draft standards below endeavour to address these concerns and should be regarded holistically as changes have been carefully considered in such a holistic manner and should be read as such and as mostly stress our opinion to meet the desired outcomes of NAMFISA but at the same time ensure a gradual approach and in so doing retain the trust hard-gained by the industry, especially NaSIA members. We wish to once again confirm our support for the standard however we understand as an industry that a fine balance between localization, enabling a globally competitive industry and maintenance of trust is essential. General comment: Please confirm whether the Schedule Part 1: Preliminary published before the other Standards under Chapter 10 which contains definitions, remains a part of the regulations issued by NAMFISA under FIMA. For clarity, they appear on page 421 of the STANDARDS UNDER THE FINANCIAL INSTITUTIONS AND

1. (a) Comment on why principal business must not be outsourced. (b) We take note and will appreciate the suggested interventions. The intention is not just to create capacity but to manage risks associated with outsourcing and to ensure consumers have access to quick recourse locally. (c) The standard looks at a variety of issues, such as avoiding entities with no/minimal operational activity, capacitating of skills as opposed to just looking at it from a purely risk￾based perspective.
2. A short-term intervention would be the fund applying for an exemption in terms of the NAMFISA Act.
3. Declined this is the current version of the Standard.

37 MARKETS ACT, 2021 (ACT NO. 2 OF 2021) SCHEDULE PART I: PRELIMINARY published on NAMFISA’s website on 10 February 2022. If indeed it remains part, the schedule includes definitions, namely “material business function”, “outsourcing”, “outsourcing arrangement”, “outsourcing agreement”, and “service provider” which are now duplicated, which will create confusion if different definitions exist under the standards.