Regulation on the Performance of Depositary Services for UCITS Funds - Unofficial Consolidated Text (Official Gazette 41/17, 139/20, 155/25 and 66/26)

Croatian Financial Services Supervisory Agency, 10000 Zagreb, Franje Račkoga 6, P.O. Box 164, Croatia t: 01 6173 200, f: 01 4811 507, e: info@hanfa.hr, OIB: 49376181407, MB: 02016419, w: www.hanfa.hr

REGULATION
ON THE PERFORMANCE OF DEPOSITORY SERVICES
FOR UCITS FUNDS
(“Official Gazette” No. 41/17, 139/20, 155/25 and 66/26 – Unofficial Consolidated Text)

PART ONE
COMMON PROVISIONS

Article 1. (Official Gazette 66/26)
This Regulation prescribes:

1. the procedure and conditions for issuing approval for the change of a depositary and material amendments to the agreement on the performance of depositary services,
2. the method and timeframes within which the depositary informs the Agency about identified irregularities in the operation of a UCITS fund,
3. the manner of conduct of the management company and the depositary in cases where the issued approval for the choice of a depositary ceases to be valid when the Agency revokes the issued approval for the choice of a depositary,
4. acceptance of notifications regarding violations of the Law and/or subordinate regulations adopted on the basis of the Law and conduct in connection with the submitted notification,
5. the content of the application for issuing approval to an investment company for the performance of depositary services, criteria for assessing the conditions for performing depositary services,
6. additional content of the activity program for an investment company performing depositary services.

PART TWO
PROCEDURE, CONDITIONS AND METHOD OF CHANGING THE DEPOSITORY AND AMENDMENTS TO THE AGREEMENT ON THE PERFORMANCE OF DEPOSITORY SERVICES

Change of Depositary

Article 2.
(1) The management company is obliged to submit an application to the Agency for the issuance of approval for the change of depositary, which contains:
a) the agreement on the performance of depositary services and the price list for performing depositary services, if the price list does not form an integral part of the agreement, b) for a depositary under Article 216, paragraph 4, points 1 and 3 of the Law – a copy of the authorization for work issued by the Croatian National Bank, c) for a depositary under Article 216, paragraph 4, point 3 of the Law – a copy of the extract from the court or other relevant registry of a third country for the founder of the branch, d) a declaration by the depositary that there are no legal obstacles within the meaning of Article 229, paragraphs 4 and 5 of the Law, e) the name of the depositary manager and his/her deputy, and confirmation by the depositary from which it follows that the depositary manager meets the conditions from paragraph 2 of this Article regarding relevant experience, f) a copy of the positive opinion on the audit of the depositary’s financial reports for the last three business years, g) additional documentation upon request by the Agency. (2) Relevant experience from Article 216, paragraph 7 of the Law means that the depositary manager must have a completed master’s degree in accordance with regulations governing scientific activity and higher education, as well as relevant professional qualifications, capability, and at least three years of experience in depositary or similar services. (3) All foreign documents from paragraph 1 of this Article must be translated by an authorized court interpreter for the Croatian language, and foreign documents from paragraph 1, point c) of this Article must also be certified in accordance with the law and international regulations (Apostille – The Hague Convention of 5 October 1961 Abolishing the Requirement of Legalisation for Foreign Public Documents).

Amendments to the Agreement on the Performance of Depositary Services

Article 3.
(1) Material amendments to the agreement on the performance of depositary services requiring Agency approval are considered:
a) changes to the description of services performed by the depositary and procedures to be adopted for each type of asset into which the UCITS may invest and which is entrusted to the depositary, and b) changes to the description of the manner in which storage and supervision services are performed regarding each individual type of UCITS fund asset and the geographical area into which UCITS fund assets are invested. (2) Regarding other amendments to the provisions of the agreement on the performance of depositary services, the management company will notify the Agency, without which such amendments cannot enter into force.

Article 4.
(1) The documentation from Article 2, paragraph 1 and Article 3 of this Regulation may be submitted by the management company in the manner and in accordance with the Technical Instruction for Using the Web Form Entry Service and Submission of Documentation in Electronic Form and the Instruction for Filling Out Web Forms for Management Companies. (2) It is considered that the management company has submitted the documentation from Article 2, paragraph 1 and Article 3 of this Regulation at the moment when the documentation is recorded on the server for sending such documentation.

PART TWO (A)
CONDITIONS FOR AN INVESTMENT COMPANY TO PERFORM DEPOSITORY SERVICES FOR UCITS FUNDS

Article 4.a
An investment company may perform depositary services for a UCITS fund if it meets the conditions prescribed by the provisions of the Law and this Regulation for performing depositary services.

Organizational Conditions

Article 4.b
(1) The depositary is obliged to establish, apply, and regularly update, assess, and supervise, taking into account the type, scope, and complexity of operations and the type of UCITS funds for which it performs depositary services, effective and appropriate internal acts governing:

1. the internal organizational structure of the unit performing depositary services, and the mutual relationship and manner of communication, flow of information and data between that organizational unit and other parts of the depositary,
2. the job classification of the organizational unit performing depositary services with specific job tasks, responsibilities, and authorities,
3. the physical separation of the organizational unit performing depositary services from other organizational units of the depositary,
4. the manner of performing depositary services under Article 218 of the Law,
5. the internal control system ensuring compliance with internal decisions and procedures,
6. the manner of ensuring the security, integrity, and confidentiality of data, taking into account their type.
   (2) The depositary is obliged to notify Hanfa of a change in the depositary manager, no later than within 7 days from the date of such change, in the manner prescribed by the provisions of Article 4 of this Regulation.

Technical Conditions

Article 4.c
It will be considered that the depositary meets the technical conditions for performing depositary services if it possesses at minimum:

1. an adequate network and information system,
2. software support for performing depositary services,
3. established communication links for receiving instructions and general communication with clients via SWIFT, telefax, telephone, and internet,
4. established written procedures and processes for receiving client instructions for the disposal of financial instruments and monetary funds.

Criteria for Assessing Conditions for an Investment Company to Perform Depositary Services for a UCITS Fund

Article 4.d
(1) An investment company must meet the conditions prescribed by Article 216.a, paragraph 3 and Article 216.d of the Law and the conditions for performing depositary services prescribed by this Regulation, and depositary managers must meet the conditions from the Law and the conditions prescribed in Article 2, paragraph 2 of this Regulation. (2) Hanfa, when deciding on the application for issuing approval for performing depositary services by an investment company, will take into account all elements that may affect the assessment of whether the investment company meets the established conditions for performing depositary services.

Application for Issuing Approval to an Investment Company to Perform Depositary Services

Article 4.e
(1) An investment company is obliged to submit an application to Hanfa for the issuance of approval for performing depositary services, which contains:

1. contact details of the investment company,
2. an extract from the court registry for the investment company,
3. evidence of meeting the conditions from Article 216, paragraph 4, point 4 of the Law relating to the required share capital, regulatory capital, and type of services the investment company is authorized to perform in accordance with the provisions of the law governing the capital market,
4. evidence of meeting the conditions relating to additional organizational and technical requirements from Article 216.d of the Law and this Regulation,
5. for the person of the depositary manager: name and surname, residence, citizenship, OIB (Personal Identification Number), and the following attachments:
   a) curriculum vitae for the depositary manager with detailed data on education, professional training, data on knowledge, skills, and work experience related to performing depositary services, b) certified copy of evidence of completed appropriate level of education for the depositary manager, c) document recognizing foreign higher education qualification issued by the competent authority in the Republic of Croatia, where applicable, d) confirmation from the employer regarding the previous work experience of the depositary manager (company name, period of work, description of jobs and duties), e) certificate of no criminal or misdemeanor proceedings issued by the competent authority of the Republic of Croatia, or for a foreign citizen, an extract/certificate from the competent authority of the state of which they are a citizen (not older than 3 months),
6. description of organizational and technical conditions with the following content:
   – description of infrastructure for storing UCITS fund assets for which depositary services will be performed, – description of administrative and accounting procedures, description of internal control mechanisms, risk assessment procedures, and description of monitoring and data processing system protection mechanisms, all related to performing depositary services, – description of organizational and management systems for taking all reasonable measures aimed at preventing conflicts of interest that may arise from performing depositary services, – description of record-keeping for all services, activities, and transactions intended to be performed as part of depositary services, – description of measures to ensure continuity and regularity in performing depositary services with a description of resources and procedures,
7. activity program of the depositary with the prescribed content from Article 216.a, paragraph 6 of the Law and Article 4.f of this Regulation,
8. declaration of the investment company regarding the fulfillment of conditions prescribed by the law governing the capital market related to performing additional activities,
9. proof of paid fee,
10. additional documentation upon request by Hanfa.
    (2) Foreign documents from paragraph 1 of this Article are submitted as prescribed in Article 2, paragraph 3 of this Regulation.
    (3) The application and documentation from paragraph 1 of this Article may be submitted in the manner prescribed in Article 4 of this Regulation.

Additional Content of the Activity Program for an Investment Company Performing Depositary Services

Article 4.f
In addition to the mandatory content prescribed by Article 216.a, paragraph 6 of the Law, the depositary’s activity program must include the following:
– description of planned activities on how the investment company will supervise the performance of delegated services, where applicable – description of the planned method of storing documentation and keeping records of identified irregularities and/or illegality in the operation of the management company – description of the method of keeping or mechanism for storing data on unit holders, their units, and payments and withdrawals, which the depositary is obliged to keep as business secrets.

PART THREE
NOTIFICATION OF IDENTIFIED IRREGULARITIES AND/OR ILLEGALITY IN THE OPERATION OF A UCITS FUND

Article 5.
(1) The depositary is obliged to prescribe and apply a procedure for conduct in cases where, in performing services under Article 218 of the Law, it identifies irregularities and/or illegality in the operation of the management company. (2) Through the procedure from paragraph 1 of this Article, the depositary will provide for the storage of documentation and keeping records of identified irregularities and/or illegality in the operation of the management company, which contains data from paragraph 5 of this Article, as well as information on the method and time when the identified irregularity and/or illegality was removed. (3) The warning to the management company regarding identified irregularities and/or illegality from Article 228, paragraph 2 of the Law must contain a deadline by which the Agency will be informed about the identified irregularities and/or illegality. (4) If the management company does not remove the identified irregularity and/or illegality within the given time limit, the depositary will immediately inform the Agency about it. (5) The notification from paragraph 4 of this Article is sent to the Agency in writing or electronically, and contains the following data:

1. the name of the UCITS fund to which the identified irregularities relate,
2. a description of the identified irregularities/illegality, citing the provision of the Law, subordinate act, prospect, and/or rules of the UCITS fund against which action was taken,
3. the date of occurrence of the identified irregularity and/or illegality,
4. the date of identification of the irregularity and/or illegality,
5. where applicable, an assessment of any damage caused to investors in the UCITS fund, or consequences that might occur for investors due to the resulting illegality and/or irregularity,
6. documentation on the basis of which the mentioned irregularity/illegality was identified, or from which it follows that the mentioned irregularity/illegality occurred.
   (6) The depositary may submit the documentation from paragraph 5 of this Article to the Agency in the manner and in accordance with the Technical Instruction for Using the Web Form Entry Service and Submission of Documentation in Electronic Form and the Instruction for Filling Out Web Forms for Depositaries. (7) It is considered that the depositary has submitted the documentation from paragraph 5 of this Article at the moment when the documentation is recorded on the server for sending such documentation.

PART FOUR
CONDUCT OF THE MANAGEMENT COMPANY AND DEPOSITARY WHEN THE DEPOSITARY’S AUTHORIZATION IS REVOKED, OR CONSENT TO THE CHOICE OF DEPOSITARY IS WITHDRAWN

Article 6.
(1) When the approval for the choice of depositary ceases to be valid, or when the management company’s approval for the choice of depositary is revoked under Article 237 of the Law, the management company is obliged, within 30 days from the cessation of validity or revocation of the approval for the choice of depositary, to conclude an agreement with another depositary and submit an application for the issuance of the corresponding approval to the Agency in accordance with the provisions of the Law and this Regulation. (2) The depositary with respect to whom the approval for the choice of depositary has ceased to be valid, or for whom the approval previously issued to the management company has been revoked, is obliged to continue providing depositary services for all services provided for in the agreement and/or Law, for the continuation of which:
– there are no legal obstacles, depending on which of the reasons for revoking the approval for the choice of depositary under Article 237 of the Law is applicable in the specific case – there are no circumstances indicating that the continuation of performing such services would endanger the interests of the UCITS fund or investors in the fund, depending on which of the reasons for revoking the approval for the choice of depositary under Article 237 of the Law is applicable in the specific case (for example, the interests of the UCITS fund could be endangered by holding the fund’s monetary funds on accounts opened at a depositary against whom compulsory liquidation proceedings have been initiated). (3) The depositary with respect to whom the approval for the choice of depositary has ceased to be valid, or with respect to whom the approval for the choice of depositary for the management company has been revoked, is obliged to continue providing services from paragraph 2 of this Article until:
– the expiration of the time limit from Article 1 of this Regulation, if the management company does not conclude an agreement with another depositary and does not submit an application for the issuance of the corresponding approval to the Agency, or – the expiration of the time limit from Article 237, paragraph 5 of the Law or the day of issuing Agency approval for the choice of a new depositary, if such approval is issued before the expiration of the time limit from Article 237, paragraph 5 of the Law. (4) The agreement on the performance of depositary services under Article 216, paragraph 1 of the Law regulates, among other things, the scope and manner of performing services from paragraph 2 of this Article and liability for damage in case the depositary fails to fulfill the obligation to continue providing services from paragraph 2 within the time limits from paragraph 3 of this Article. (5) If the depositary fails to fulfill the obligation to continue providing services from paragraph 2 of this Article, or if it cannot provide them to the extent necessary to ensure the continuity of UCITS fund operations, its legal compliance, and investor protection, the management company is obliged to consider whether it is necessary to suspend the issuance and redemption of UCITS fund units to protect investors, in which case Article 8, paragraph 1 of this Regulation applies.

Article 7.
In the event of a case from Article 6 of this Regulation, the depositary is obliged to transfer all UCITS fund assets for storage and administration to another depositary with whom the management company has concluded an agreement, immediately upon concluding the same, at which time it must also hand over account books, records, and all other documents and materials essential for the operation of the UCITS fund for which it had performed depositary services up to that point, in written or electronic form, depending on the manner of keeping the mentioned data.

Article 8. (Official Gazette 66/26)
(1) To protect investors, in the case from Article 237 of the Law, the management company will suspend the issuance and redemption of UCITS fund units until:
– the expiration of the time limit from Article 1 of this Regulation, if the management company does not conclude an agreement with another depositary and does not submit an application for the issuance of the corresponding approval to the Agency, or – the expiration of the time limit from Article 237, paragraph 5 of the Law or the day of issuing Agency approval for the choice of a new depositary, if such approval is issued before the expiration of the time limit from Article 237, paragraph 5 of the Law. (2) The management company is obliged, in the case from Article 7 of this Regulation, to submit a notification to the sub-depositary regarding the same.

PART FIVE
Deleted.

Article 9.
Deleted.

Article 10.
Deleted.

Article 11.
Deleted.

Article 12.
Deleted.

PART SIX
NOTIFICATION OF VIOLATION OF REGULATIONS

Information on Submitting Notifications of Violation of Regulations

Article 13.
(1) The Agency will publish information on its website regarding the method of receiving notifications of violation of regulations.
(2) The information from paragraph 1 includes the following:
a) communication channels for receiving notifications of violation of regulations and further handling of such notifications, including:
– telephone numbers, with a notice regarding whether conversations on these telephone lines are recorded, – special electronic and postal addresses for contacting authorized Agency employees, b) procedures applied to notifications of violation of regulations, in accordance with the provisions of Article 13 of this Regulation, c) the confidentiality regime applied to notifications of violation of regulations, in accordance with the provisions of Article 18 of this Regulation, d) procedures for protecting employees who report violations of regulations, e) a statement containing a clear warning that persons who report violations of regulations to the Agency are not considered to violate any limitation related to the publication of information imposed by contract, law, or other regulations, and that they do not bear any responsibility in connection with such publication.

Procedure for Submitting Notifications of Violation of Regulations

Article 14.
(1) A notification of violation of regulations submitted to the Agency contains the following:
a) contact details of the complainant (name and surname and postal address, or company and seat if it concerns legal entities, electronic address, telephone number), b) data on the person responsible for the illegality, if such data are available to the complainant, c) the subject of the notification of violation of regulations, d) accompanying documentation available to the complainant. (2) The Agency is obliged to receive a notification of violation of regulations submitted by an anonymous complainant, in which case the protective measures from Articles 17, 18, and 19 of this Regulation will apply if the anonymous complainant subsequently reveals their identity to the Agency. (3) The Agency may request clarification of information from the notification or submission of additional information from the complainant. Depending on the circumstances of the case, and guided by the principles of efficiency and protection of the complainant, an authorized Agency employee will contact the complainant in writing or by telephone, unless the complainant has requested otherwise.

Special Communication Channels

Article 15.
(1) The Agency will establish communication channels for receiving notifications of violation of regulations that ensure the protection of personal data.
(2) The Agency receives notifications of violation of regulations through one of the following communication channels:
a) in written form directly (by registration or orally on the record) or by mail, with the notation on the envelope: «do not open – funds – violation of regulations», b) by electronic mail to the special electronic mail address: «povreda.propisa@hanfa.hr», c) by oral report of the violation by telephone call to a special number published on the Agency’s website, d) in a meeting with authorized Agency employees. (3) The Agency is obliged to provide the person submitting the notification with the information from Article 13, paragraph 2 of this Regulation before receiving the notification of violation of regulations or no later than upon its receipt. (4) A notification of violation of regulations not received through the special communication channels from this Article is immediately and without alteration forwarded to authorized Agency employees using special communication channels.

Handling Notifications of Violation of Regulations

Article 16.
(1) Upon receiving a written notification of violation of regulations, the Agency will confirm receipt to the postal or electronic address provided by the complainant, unless the complainant explicitly stated otherwise or if the Agency reasonably believes that confirming receipt would endanger the protection of the complainant’s identity. (2) If a telephone line on which conversations are recorded is used for submitting a notification of violation of regulations, the Agency has the right to document the oral notification in the following forms:
a) audio recording of the conversation in permanent and accessible form, or b) a complete and accurate transcript of the conversation prepared by an authorized Agency employee.
(3) If the complainant of the notification of violation of regulations from paragraph 2 of this Article has revealed their identity, the Agency is obliged to enable that person to verify and correct the transcript of the telephone conversation and to express consent with it by signature. (4) If a telephone line on which conversations are not recorded is used for submitting a notification of violation of regulations, the Agency is obliged to document the oral report in the form of a conversation record compiled by an authorized Agency employee. If the complainant has revealed their identity, the Agency is obliged to enable that person to verify and correct the record of the conversation and to express consent with it by signature. (5) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (6) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (7) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (8) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (9) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (10) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (11) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (12) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (13) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (14) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (15) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (16) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (17) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (18) The Agency is obliged to keep the records of conversations and
transcripts of conversations for a period of five years from the date of their creation. (19) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (20) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (21) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (22) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (23) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (24) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (25) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (26) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (27) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (28) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (29) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (30) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (31) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (32) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (33) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (34) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (35) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (36) The Agency is obliged to keep the records of
conversations and transcripts of conversations for a period of five years from the date of their creation. (37) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (38) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (39) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (40) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (41) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (42) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (43) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (44) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (45) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (46) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (47) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (48) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (49) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (50) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (51) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (52) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (53) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (54) The Agency is obliged to keep
the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (55) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (56) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (57) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (58) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (59) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (60) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (61) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (62) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (63) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (64) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (65) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (66) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (67) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (68) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (69) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (70) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (71) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (72) The Agency is
obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (73) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (74) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (75) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (76) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (77) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (78) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (79) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (80) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (81) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (82) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (83) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (84) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (85) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (86) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (87) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (88) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (89) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (90)
The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (91) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (92) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (93) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (94) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (95) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (96) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (97) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (98) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation. (99) The Agency is obliged to keep the records of conversations and transcripts of conversations in a secure manner, ensuring that only authorized employees have access to them. (100) The Agency is obliged to keep the records of conversations and transcripts of conversations for a period of five years from the date of their creation.

identity, the Agency is obliged to enable that person to verify and correct the minutes of the telephone conversation and to express consent thereto by their signature.

(5) If a person requests a meeting with an authorized employee of the Agency for the purpose of submitting a notification of a violation of regulations, in accordance with Article 15, paragraph 2, point c) of this Regulation, the Agency is obliged to ensure minutes of the meeting documented in one of the following forms:
a) audio recording of the conversation in a permanent and accessible form, or b) minutes of the meeting compiled by an authorized employee of the Agency.

(6) The Agency shall enable the submitter referred to in paragraph 5 of this Article to verify and correct the compiled minutes of the meeting and to express consent thereto by their signature.

Protection of Workers
Article 17.

(1) The Agency shall exchange information and cooperate with other competent authorities participating in the protection of workers who report violations of regulations from retaliation, discrimination, or other types of unfair treatment that may occur due to the report of a violation of regulations or in connection with it.

(2) A statement made by a person acquainted with confidential information in a notification of a violation of regulations shall not be considered a breach of the duty to keep business secrets, nor shall it be considered a violation of any restrictions on the disclosure of information determined by contract, law, or other regulations.

Procedures for the Protection of Personal Data
Article 18.

The provisions of laws governing the collection, use, and protection of data for the purposes of criminal proceedings apply in an appropriate manner to the collection, use, and protection of personal data concerning the person who submitted the notification and the person allegedly responsible for the illegality, in accordance with the notification.

Forwarding of Data Within and Outside the Agency
Article 19.

(1) The provisions of laws governing the protection of personal data, as well as their collection, processing, and use in the Republic of Croatia, apply to the protection of personal data of the complainant and the reported person.

(2) Authorized employees of the Agency must not disclose, directly or indirectly, the identity of the complainant or the reported person, or any other indication of circumstances from which the identity of the complainant or the reported person could be established.

(3) Exceptionally, data concerning the identity of the complainant or the reported person, or any other indication of circumstances from which the identity of those persons could be established, may be forwarded within or outside the Agency when:
a) it is necessary in connection with the initiation and/or commencement of misdemeanor or criminal proceedings, b) it is necessary to prevent the commission of a criminal offense, or c) the consent of the complainant has been given.

PART SEVEN
FINAL PROVISIONS
Article 20.

With the entry into force of this Regulation, the Regulation on the Performance of Depositary Activities of UCITS Funds ("Official Gazette", nos. 93/2013 and 140/2014) ceases to be valid.

Article 21.

This Regulation shall be published in the "Official Gazette" and shall enter into force on May 1, 2017.

Transitional and Final Provisions
Regulation on Amendments and Supplements to the Regulation on the Performance of Depositary Activities of UCITS Funds (Official Gazette 139/20), entered into force on December 22, 2020.
Article 3.

Management companies are obliged to align their contracts for the performance of depositary services referred to in Article 216, paragraph 1 of the Law with the provisions of Article 1 of this Regulation and to notify the Agency of such amendments within four months from the entry into force of this Regulation.

Article 4.

This Regulation shall enter into force on the eighth day from the date of publication in the "Official Gazette".

FINAL PROVISION
Regulation on Amendments and Supplements to the Regulation on the Performance of Depositary Activities of UCITS Funds (Official Gazette, no. 155/25), entered into force on December 31, 2025.
Article 4.

This Regulation shall enter into force on the eighth day from the date of publication in the "Official Gazette".

FINAL PROVISION
Regulation on Amendments to the Regulation on the Performance of Depositary Activities of UCITS Funds (Official Gazette, no. 66/26), entered into force on July 2, 2026.
Article 4.

This Regulation shall enter into force on the eighth day from the date of publication in the "Official Gazette".