Royal Decree approving the CBFA Regulation on organizational rules for investment service providers

FEDERAL PUBLIC SERVICE FINANCES
N. 2007 — 2722 [C − 2007/03335]
19 JUNE 2007. — Royal Decree approving the regulation of the Commission for the Banking, Finance and Insurance sectors regarding organizational rules for institutions providing investment services

REPORT TO THE KING

Sire,

Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments, amending Council Directives 85/611/EEC and 93/6/EEC and Directive 2000/12/EC of the European Parliament and of the Council and repealing Council Directive 93/22/EEC (hereinafter 'MiFID' or 'the Directive') must be transposed into Belgian law. The same applies to Commission Directive 2006/73/EC of 10 August 2006 implementing Directive 2004/39/EC of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and the definition of certain terms for the purposes of the said Directive (hereinafter 'the Implementing Directive').

Furthermore, the necessary adjustments must be made pursuant to Commission Regulation (EC) No 1287/2006 of 10 August 2006 implementing Directive 2004/39/EC of the European Parliament and of the Council as regards the obligations of investment firms regarding record-keeping, reporting of transactions, market transparency, admission of financial instruments to trading and the definition of terms for the purposes of the said Directive (hereinafter 'the Regulation').

MiFID replaces Directive 93/22/EEC on investment services, which was transposed into Belgian law by the Law of 6 April 1995 on the status of and supervision of investment firms, intermediaries and investment advisers (and its implementing decrees). The entry into force of MiFID is scheduled for 1 November 2007.

The decree submitted for Your signature aims, in accordance with Article 64 of the Law of 2 August 2002, to approve the regulation on organisational rules applicable to institutions providing investment services, adopted by the Commission for the Banking, Finance and Insurance sectors. This regulation aims to transpose MiFID and the Implementing Directive regarding a number of principles of appropriate organisation to be respected by investment firms, credit institutions and management companies of undertakings for collective investment. The regulation follows two Royal Decrees aimed at transposing MiFID:

the Royal Decree of 27 April 2007 aiming to transpose the European Directive concerning markets in financial instruments, which contains the legislative modifications necessary for transposition;
the Royal Decree of 3 June 2007 laying down further rules for transposing the Directive concerning markets in financial instruments.

For further explanation of this procedure and for an outline of the European framework, reference is made to the Report to the King preceding the first of these two decrees.

The regulation submitted for approval mainly implements certain rules established by Implementing Directive 2006/73/EC of 10 August 2006. These concern rules regarding:

general organisational requirements (Articles 4 to 7);
compliance (Articles 8 to 10);
risk management (Articles 11 to 13);
internal audit (Articles 14 and 15);
complaint handling (Article 16);
outsourcing of tasks and services (Articles 17 to 22);
record-keeping (Articles 23 to 25).

Reference is made in this regard to the 'Background note' drawn up by the European Commission on the Implementing Directive, in which these various components are explained.

The provisions of this regulation do not detract from the compliance with the circulars of the CBFA which clarify the legal and regulatory provisions.

It is indicated that institutions take the necessary measures, including training for their employees, to promote compliance with MiFID principles and rules. Training on these principles applicable when providing investment services is indeed one of the elements contributing to the qualifications, knowledge and expertise of the employees of investment firms as required by Article 4(d) of this Regulation.

Given their importance for the interpretation of the rules set out in the regulation, some of the recitals preceding the Implementing Directive are reproduced below.

The provisions on internal audit in the regulation (Article 14) are aligned with the directive text. These provisions also apply the principle of proportionality included in the directive to the specific Belgian context. In particular, the obligation of internal audit is declared in principle not applicable to portfolio management and investment advisory companies that only provide investment advice and/or services of receiving and transmitting orders, since this obligation is not considered proportionate for these institutions, taking into account the nature, scale and complexity of the business of these institutions, and the nature and range of investment services and activities carried out in the framework of their business.

It can further be mentioned that the possibility exists to outsource the internal audit function, subject to certain conditions.

The regulation provides for specific provisions regarding complaint handling (Article 16). In accordance with Article 10 of the Implementing Directive, these rules are only introduced for retail clients.

With regard to the rules on outsourcing of operational tasks and services (Articles 17 to 22), it should be kept in mind that the CBFA may not make the authorisation to provide investment services or activities subject to a general prohibition on outsourcing one or more critical or important functions or investment services or activities (see recital 18 of the Implementing Directive).

The institutions concerned must be allowed to outsource such activities if the outsourcing agreements of the institution meet certain conditions.

For the purposes of the conditions for outsourcing set out in this regulation regarding critical or important operational tasks or investment services or activities, any outsourcing where such extensive delegation of tasks takes place that the institution becomes a mailbox company, must be regarded as undermining the conditions that the institution must meet to obtain and maintain its authorisation (see recital 19 of the directive).

The outsourcing of investment services or activities or of critical and important tasks may constitute a material change in the conditions for the authorisation of the institution. If such outsourcing agreements are concluded after the company has been granted authorisation, the CBFA must be notified thereof in application of Article 81, second paragraph, of the Law of 6 April 1995.

The regulation obliges institutions wishing to conclude an agreement with a service provider in a third country to outsource the management of assets of non-professional clients to notify the CBFA in advance when certain conditions are not met. However, the CBFA is not expected to grant approval for or otherwise agree to such an agreement or its conditions. The notification should rather give the CBFA the opportunity to intervene where necessary. It is the responsibility of the institution to negotiate the conditions of an outsourcing agreement without formal intervention by the CBFA and to ensure that these are compatible with the obligations of the institution under this regulation (recital 21 of the Implementing Directive).

For the sake of regulatory transparency and to provide institutions with appropriate certainty, the Implementing Directive requires each competent authority to publish its policy statement on the outsourcing of the management of assets of non-professional clients to service providers in third countries.

This statement to be published by the CBFA will include examples of cases in which the CBFA is unlikely to object to such outsourcing, and will also explain why outsourcing in such cases is unlikely to impair the ability of the institution to comply with the general conditions to be observed in outsourcing under the law and the CBFA regulation. In this explanation, it will be indicated why

MONITOR BELGE — 27.06.2007 — BELGISCH STAATSBLAD 35001

indicated why outsourcing in the cases in question does not prevent effective access to all information on the outsourced service that the CBFA needs to exercise its supervisory tasks regarding the institution (see recital 22 of the implementing directive).

The regulation finally contains a number of provisions regarding the keeping of records (Articles 23 to 25).

The annex to the regulation includes an inventory of the data that institutions must keep. This inventory is based on the work carried out by CESR in this area within the framework of its Level 3 activities (CESR, Level 3 Recommendations on the list of minimum records in article 51 (3) of the MiFID Implementing Directive, CESR/06-552c).

The rules in the regulation concerning the functions of compliance, internal audit, and risk management apply only to the investment services and ancillary services of credit institutions. It is intended to further examine the alignment of rules applicable to other banking activities.

I have the honor to be,
Sire,
Of Your Majesty,
The very respectful and very faithful servant, The Deputy Prime Minister and Minister of Finance, D. REYNDERS

19 JUNE 2007. — Royal Decree approving the regulation of the Banking, Finance and Insurance Commission concerning organizational rules for institutions providing investment services

ALBERT II, King of the Belgians,
To all who are now and hereafter shall be, Our Greeting.

Having regard to the Act of 22 March 1993 on the status and supervision of credit institutions, in particular Article 20, amended by the Acts of 9 March 1999 and 19 November 2004, and Article 20bis, inserted by the Royal Decree of 27 April 2007;

Having regard to the Act of 6 April 1995 on the status and supervision of investment firms, in particular Article 62, amended by the Act of 9 March 1999, and Article 62bis, inserted by the Royal Decree of 27 April 2007;

Having regard to the Act of 2 August 2002 on the supervision of the financial sector and financial services, in particular Article 64, amended by the Royal Decree of 25 March 2003;

Having regard to the Act of 20 July 2004 on certain forms of collective management of investment portfolios, in particular Article 153, replaced by the Royal Decree of 27 April 2007, and Article 154, § 5, inserted by the Royal Decree of 27 April 2007;

Having regard to the Royal Decree of 20 December 1995 on foreign investment firms, in particular Article 5, 1°, amended by Royal Decree of 3 June 2007;

On the proposal of Our Minister of Finance,

We have decided and decide:

Article 1. The regulation of 5 June 2007 of the Banking, Finance and Insurance Commission concerning organizational rules for institutions providing investment services, attached as an annex to this Decree, is approved.

Art. 2. This Decree shall enter into force on 1 November 2007.

Art. 3. Our Minister responsible for Finance is charged with the execution of this Decree.

Given in Brussels, 19 June 2007.

ALBERT
By the King:
The Deputy Prime Minister and Minister of Finance, D. REYNDERS

outsourcing, in the considered cases, would not prevent the CBFA from having appropriate access to all information concerning the outsourced service necessary for it to exercise its supervisory mission regarding the institution (see recital 22 of the implementing directive).

The regulation finally includes some provisions regarding data retention (Articles 23 to 25).

An inventory of the data that must be retained by institutions is attached to the regulation. This inventory is based on the work carried out by CESR in this matter within the framework of its Level 3 activities (CESR, Level 3 Recommendations on the list of minimum records in article 51 (3) of the MiFID Implementing Directive, CESR/06-552c).

The rules in the regulation concerning the functions of compliance, internal audit, and risk management apply only to the investment services and ancillary services of credit institutions. It is planned to continue the examination of the alignment of rules applicable to other banking activities.

I have the honor to be,
Sire,
Of Your Majesty
The very respectful and very faithful servant, The Deputy Prime Minister and Minister of Finance, D. REYNDERS

19 JUNE 2007. — Royal Decree approving the regulation of the Banking, Finance and Insurance Commission concerning organizational rules applicable to institutions providing investment services

ALBERT II, King of the Belgians,
To all, present and future, Greeting.

Having regard to the Act of 2 August 2002 on the supervision of the financial sector and financial services, in particular Article 64, amended by the Royal Decree of 25 March 2003;

Having regard to the Royal Decree of 20 December 1995 on foreign investment firms, in particular Article 5, 1°, amended by the Royal Decree of 3 June 2007;

On the proposal of Our Minister of Finance,

We have decided and decide:

Article 1. The regulation of the Banking, Finance and Insurance Commission of 5 June 2007 concerning organizational rules applicable to institutions providing investment services, attached as an annex to this Decree, is approved.

Art. 2. This Decree shall enter into force on 1 November 2007.

Art. 3. Our Minister responsible for Finance is charged with the execution of this Decree.

Given in Brussels, 19 June 2007.

ALBERT
By the King:
The Deputy Prime Minister and Minister of Finance, D. REYNDERS

35002 MONITEUR BELGE — 27.06.2007 — BELGISCH STAATSBLAD

Annex to the Royal Decree approving the regulation of the Banking, Finance and Insurance Commission of 5 June 2007 concerning organizational rules for institutions providing investment services

Regulation of the Banking, Finance and Insurance Commission of 5 June 2007 concerning organizational rules for institutions providing investment services

THE BANKING, FINANCE AND INSURANCE COMMISSION,

Having regard to the Act of 2 August 2002 on the supervision of the financial sector and financial services, in particular Article 64, amended by the Royal Decree of 25 March 2003;

Having regard to the Royal Decree of 20 December 1995 on foreign investment firms, in particular Article 5, 1°, amended by the Royal Decree of 3 June 2007;

Having regard to the opinion of the Supervisory Board,

Decides:

CHAPTER I. — General Provisions

Article 1. This regulation aims in particular to transpose Directive 2004/39/EC and Directive 2006/73/EC.

Art. 2. For the purposes of this regulation, the following terms shall be understood as:

1° the Act of 2 August 2002: the Act of 2 August 2002 on the supervision of the financial sector and financial services;

2° the Act of 22 March 1993: the Act of 22 March 1993 on the status and supervision of credit institutions;

3° the Act of 6 April 1995: the Act of 6 April 1995 on the status and supervision of investment firms;

4° the Act of 20 July 2004: the Act of 20 July 2004 on certain forms of collective management of investment portfolios;

5° the Act of 11 January 1993: the Act of 11 January 1993 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing;

6° the Act of 8 December 1992: the Act of 8 December 1992 on the protection of privacy with regard to the processing of personal data;

7° Directive 2004/39/EC: Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments, amending Council Directives 85/611/EEC and 93/6/EEC and Directive 2000/12/EC of the European Parliament and of the Council and repealing Council Directive 93/22/EEC;

8° Directive 2006/73/EC: Commission Directive 2006/73/EC of 10 August 2006 implementing Directive 2004/39/EC of the European Parliament and of the Council as regards organizational requirements and operating conditions for investment firms and defined terms for the purposes of the said Directive;

9° the Regulation: Commission Regulation 1287/2006 of 10 August 2006 implementing Directive 2004/39/EC of the European Parliament and of the Council as regards the obligations of investment firms regarding record-keeping, transaction reporting, market transparency, admission of financial instruments to trading and definition of terms for the purposes of the said Directive;

10° the CBFA: the Banking, Finance and Insurance Commission;

Annex to the Royal Decree approving the regulation of the Banking, Finance and Insurance Commission of 5 June 2007 concerning organizational rules applicable to institutions providing investment services

Regulation of the Banking, Finance and Insurance Commission of 5 June 2007 concerning organizational rules applicable to institutions providing investment services

THE BANKING, FINANCE AND INSURANCE COMMISSION,

Having regard to the Act of 2 August 2002 on the supervision of the financial sector and financial services, in particular Article 64, amended by the Royal Decree of 25 March 2003;

Having regard to the Royal Decree of 20 December 1995 on foreign investment firms, in particular Article 5, 1°, amended by the Royal Decree of 3 June 2007;

Having regard to the opinion of the Supervisory Board,

Decides:

CHAPTER I. — General Provisions

Article 1. This regulation aims in particular to transpose Directives 2004/39/EC and 2006/73/EC.

Art. 2. For the purposes of this regulation, the following terms shall be understood as:

1° the Act of 2 August 2002: the Act of 2 August 2002 on the supervision of the financial sector and financial services;

2° the Act of 22 March 1993: the Act of 22 March 1993 on the status and supervision of credit institutions;

3° the Act of 6 April 1995: the Act of 6 April 1995 on the status and supervision of investment firms;

4° the Act of 20 July 2004: the Act of 20 July 2004 on certain forms of collective management of investment portfolios;

5° the Act of 11 January 1993: the Act of 11 January 1993 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing;

6° the Act of 8 December 1992: the Act of 8 December 1992 on the protection of privacy with regard to the processing of personal data;

9° the European Regulation: Commission Regulation 1287/2006 of 10 August 2006 implementing Directive 2004/39/EC of the European Parliament and of the Council as regards the obligations of investment firms regarding record-keeping, transaction reporting, market transparency, admission of financial instruments to trading and definition of terms for the purposes of the said Directive;

10° the CBFA: the Banking, Finance and Insurance Commission;

MONITEUR BELGE — 27.06.2007 — BELGISCH STAATSBLAD 35003

11° compliance: an independent function within the organization, focused on the examination and promotion of compliance by the institution with rules relating to:

the integrity of the institution's activities and
the management of the institution's reputational risk.
These rules arise both from the institution's policy referred to in Article 3 and from the institution's legal and regulatory status, as well as from other legal and regulatory provisions applicable to the sector of which the institution is a part;

12° internal audit: an independent assessment function within the organization, focused on:

the examination and evaluation of the proper functioning, effectiveness, and efficiency of internal control;
assisting the relevant persons referred to in 18° in the effective exercise of their responsibilities through analyses, evaluations, recommendations, advice, and information regarding the activities examined;

13° outsourcing: an agreement of any form between an institution and a service provider under which this service provider performs a process, service, or activity that would otherwise be performed by the institution itself;

14° critical or important operational task: a task whose inadequate or deficient performance would have significant adverse consequences for the institution's ongoing compliance with licensing conditions and obligations or other obligations to which it is subject under its legal framework, or for its financial results or the solidity or continuity of its investment services and activities. The following are not considered critical or important:
a) provision to the institution of:

advice and other services that do not form part of the institution's investment business, including the provision of legal advice to the institution;
services relating to the training of the institution's staff;
billing services;
services relating to the security of the institution's premises and staff;
b) the acquisition or provision of standardized services, including market and price information services;

15° legal framework:

for investment firms: the Act of 6 April 1995 and Chapter II of the Act of 2 August 2002, as well as the implementing provisions of both Acts;
for credit institutions: the Act of 22 March 1993 and Chapter II of the Act of 2 August 2002, as well as the implementing provisions of both Acts;
for management companies of collective investment undertakings: Part III of the Act of 20 July 2004 and Chapter II of the Act of 2 August 2002, as well as the implementing provisions of both Acts;

16° non-professional client: a client who is not treated as a professional client within the meaning of Article 2 of the Act of 2 August 2002;

17° third country: a country that is not part of the European Economic Area;

18° "relevant person", in connection with an institution referred to in Article 3: any of the following persons:
a) a director, partner, or person equivalent thereto, manager, or associated agent of the institution; b) a director, partner, or person equivalent thereto, or manager of an associated agent of the institution; c) an employee of the institution or of an associated agent of the institution, as well as any other natural person whose services are made available and are under the control of the institution or an associated agent and who is involved in the provision by the institution of investment services and activities;

11° compliance: an independent function within the organization, focused on the examination and improvement of compliance by the institution with rules relating to:

the integrity of the institution's activities and
the management of the institution's reputational risk.
These rules arise both from the institution's policy, referred to in Article 3, and from its legal and regulatory status and other legal and regulatory provisions applicable to the sector to which it belongs;

12° internal audit: internal audit is, within the organization, an independent assessment function with the object of:

examining and evaluating the proper functioning, effectiveness, and efficiency of internal control;
assisting the persons concerned, referred to in 18°, in the effective exercise of their responsibilities and providing, for this purpose, analyses, evaluations, recommendations, opinions, and information on the activities examined;

13° outsourcing: any agreement, whatever its form, between an institution and a service provider under which this service provider takes over a process, service, or activity that would otherwise have been taken over by the institution itself;

14° essential or important operational task: any task that, in the event of anomaly or failure in its performance, is likely to seriously harm the institution's ability to continuously comply with the conditions and obligations linked to its approval or other obligations incumbent upon it under the legal framework to which it is subject, or its financial performance, the solidity or continuity of its investment services and activities. The following tasks are not considered essential or important:
a) the provision to the institution of:

advisory services and other services not forming part of the institution's investment activities, including the provision of legal advice to the institution;
services relating to the training of the institution's staff;
billing services;
services relating to the security of the institution's premises and staff;
b) the acquisition or provision of standardized services, including services providing market information or price data feeds;

15° legal framework:

for investment firms: the Act of 6 April 1995 and Chapter II of the Act of 2 August 2002, as well as the provisions taken in implementation of these two Acts;
for credit institutions: the Act of 22 March 1993 and Chapter II of the Act of 2 August 2002, as well as the provisions taken in implementation of these two Acts;
for management companies of collective investment undertakings: Part III of the Act of 20 July 2004 and Chapter II of the Act of 2 August 2002, as well as the provisions taken in implementation of these two Acts;

16° retail client: any client who is not treated as a professional client within the meaning of Article 2 of the Act of 2 August 2002;

17° third country: any country not a member of the European Economic Area;

18° "person concerned", in the case of an institution referred to in Article 3, any of the following persons:
a) an administrator, partner, or equivalent, manager, or associated agent of the institution; b) an administrator, partner, or equivalent, or manager of any associated agent of the institution; c) an employee of the institution or of an associated agent of the institution, as well as any other natural person whose services are made available and placed under the control of the institution or an associated agent of the institution and who participates in the provision of investment services and the exercise of investment activities by the institution;

35004 MONITEUR BELGE — 27.06.2007 — BELGISCH STAATSBLAD

d) a natural person who, under an outsourcing agreement aimed at the institution providing investment services and activities, is directly involved in providing services for the institution or its associated agent.

Art. 3. This regulation applies to:

Belgian investment firms;
Belgian credit institutions providing investment services;
Branches established in Belgium of investment firms and credit institutions providing investment services, insofar as these branches are subject to the law of a country that is not a member of the European Economic Area;
Management companies of collective investment institutions, with the exception of Articles 17 to 22 regarding the outsourcing of management functions referred to in Article 3, 9°, of the Law of 20 July 2004.

For the purposes of this regulation, these companies are collectively referred to as "the institutions".

CHAPTER II. — Organisational Requirements
Section 1. — General Organisational Requirements

Art. 4. The institutions shall:
a) establish, implement and maintain an organisational structure that clearly and in a documented manner specifies reporting lines and the allocation of functions and responsibilities; b) ensure that relevant persons are aware of the procedures to be followed for the proper exercise of their responsibilities; c) establish, implement and maintain adequate internal control procedures to ensure that decisions and procedures are observed at all levels of the institution; d) employ staff who possess the necessary competence, knowledge and expertise to exercise the responsibilities entrusted to them; e) establish, implement and maintain effective internal reporting and communication of information at all relevant levels of the institution; f) keep appropriate and orderly records of their business and internal organisation; g) ensure that relevant persons holding multiple functions are not prevented or likely to be prevented from exercising any of these functions in a sound, honest and professional manner.

In doing so, the institutions take into account the nature, scale and complexity of their business and the nature and range of investment services and activities or management functions carried out within the framework of their business.

Art. 5. The institutions shall establish, implement and maintain adequate systems and procedures to ensure the security, integrity and confidentiality of information, taking into account the nature of the information in question.

Art. 6. The institutions shall establish, implement and maintain adequate business continuity policies to ensure that, in the event of an interruption of their systems and procedures, critical data and business functions are protected and their investment services and activities or management functions are continued, or — where this is not possible — that such data and business functions are restored as soon as possible and their investment services and activities are resumed as soon as possible.

Art. 7. The institutions shall monitor and periodically evaluate the adequacy and effectiveness of the systems, internal control procedures and arrangements they have introduced, and take appropriate measures to remedy any deficiencies.

MONITEUR BELGE — 27.06.2007 — BELGISCH STAATSBLAD 35005

Section 2. — Compliance

Art. 8. The institutions shall establish, implement and maintain adequate policies and sufficient procedures to identify risks of impairment of the integrity or reputation of the institution or of non-compliance with its obligations in the following areas:
1° Chapter II, Sections 7 and 9 of the Law of 2 August 2002 as well as the implementing decrees of this legislation; 2° rules concerning the management of conflicts of interest when providing investment services regarding financial instruments, including those applicable to investment advisory services and the production and dissemination of research on investments; 3° rules concerning personal transactions in financial instruments referred to in Article 78 of the Royal Decree of 3 June 2007 laying down detailed rules for the transposition of the directive concerning markets for financial instruments; 4° incompatibility rules applicable to the directors and effective managers of the institutions; 5° the Law of 11 January 1993 on the prevention of the use of the financial system for money laundering and terrorist financing; 6° privacy legislation as defined in the Law of 8 December 1992; 7° tax prevention policy; 8° areas designated by the administrative body or the effective management of the institution.

The integrity policy provides for appropriate measures and procedures that minimise the risks of non-compliance with the aforementioned obligations as well as related risks and enable the CBFA to effectively exercise its supervisory powers.

The institutions may take into account the nature, scale and complexity of their business and the nature and range of investment services and activities or management functions carried out within the framework of this business.

Art. 9. The institutions shall establish and maintain a permanent and effective compliance function that is independent and has the following responsibilities:
1° monitoring and periodically assessing the adequacy and effectiveness of the measures and procedures introduced in accordance with Article 8, as well as the measures taken to remedy any deficiencies in the institution's compliance with these obligations; 2° advising and assisting the relevant persons responsible for providing investment services and activities or management functions to comply with the obligations under the regulations referred to in Article 8.

Art. 10. § 1. To enable the compliance function to perform its responsibilities properly and independently, the institutions shall ensure that the following conditions are met:
a) the compliance function must have the necessary authority, resources, expertise and access to all relevant information; b) a compliance officer must be appointed who is responsible for the compliance function and for reporting on compliance to the effective management. The compliance officer heads the compliance cell in the event of need; c) the relevant persons involved in the compliance function must not be involved in the provision of services or activities on which they supervise; d) the manner in which the remuneration of the relevant persons involved in the compliance function is determined must not actually or potentially endanger their objectivity.

§ 2. An institution need not, however, comply with all the requirements set out in points c) and d) of § 1 if it can demonstrate that these are not proportionate given the nature, scale and complexity of its business and the nature and range of its investment services and activities or management functions, and that the effectiveness of its compliance function is guaranteed.

Section 2. — Compliance

Art. 8. The institutions shall establish, implement and maintain adequate policies and sufficient procedures to identify risks of impairment of the integrity or reputation of the institution or of failure to comply with its obligations in the following areas:
1° Chapter II, Sections 7 and 9 of the Law of 2 August 2002, as well as the implementing decrees of these provisions; 2° rules concerning the management of conflicts of interest when providing investment services regarding financial instruments, including those applicable when providing investment advisory services and when producing and disseminating investment research; 3° rules concerning personal transactions in financial instruments, as referred to in Article 78 of the Royal Decree of 3 June 2007 laying down the rules and procedures for transposing the directive concerning markets for financial instruments; 4° incompatibility rules applicable to the directors and effective managers of the institutions; 5° the Law of 11 January 1993 on the prevention of the use of the financial system for money laundering and terrorist financing; 6° privacy legislation, as provided for by the Law of 8 December 1992; 7° tax prevention policy; 8° areas designated by the administrative body or the effective management of the institution.

The integrity policy provides for appropriate measures and procedures to minimise the risks of non-compliance with the aforementioned obligations as well as ancillary risks and to enable the CBFA to effectively exercise its supervisory competence.

The institutions may, in this context, take into account the nature, scale and complexity of their activity, as well as the nature and range of investment services and activities or management functions provided or exercised within the framework of this activity.

Art. 9. The institutions shall establish and maintain a permanent and effective compliance function, operating independently and invested with the following missions:
1° monitor and, on a regular basis, assess the adequacy and effectiveness of the measures and procedures put in place in application of Article 8, as well as the actions taken to remedy any failure by the institution to comply with these obligations; 2° advise and assist the relevant persons responsible for investment services and activities or management functions, so that they comply with the obligations regarding the rules referred to in Article 8.

Art. 10. § 1. In order to enable the compliance function to perform its missions appropriately and independently, the institutions ensure that the following conditions are met:
a) the compliance function has the necessary authority, resources and expertise and access to all relevant information; b) a compliance officer is appointed; he is in charge of the compliance function and the reports relating to it to the effective management. If necessary, the compliance officer heads the "Compliance" cell; c) the relevant persons participating in the compliance function cannot be involved in the execution of the services and activities they control; d) the method of determining the remuneration of the relevant persons participating in the compliance function does not compromise and is not likely to compromise their objectivity.

§ 2. An institution may, however, be exempted from complying with certain of the obligations provided for in points c) and d) of § 1 if it is able to demonstrate that, taking into account the nature, scale and complexity of its activity, as well as the nature and range of its investment services and activities or management functions it exercises, these obligations are not proportionate and that its compliance function remains effective.

35006 MONITEUR BELGE — 27.06.2007 — BELGISCH STAATSBLAD

Section 3. — Risk Management

Art. 11. Institutions shall:
1° establish, implement and maintain adequate policies and sufficient procedures for risk management that identify the risks associated with the activities, processes and systems of the institution and, where necessary, determine the level of risk tolerance of the institution; 2° establish effective arrangements, procedures and mechanisms to manage the risks associated with the activities, processes and systems of the institution in light of this risk tolerance; 3° exercise supervision over:
a) the adequacy and effectiveness of the policies and procedures for risk management established by the institution; b) the extent to which the institution and its relevant persons comply with the arrangements, procedures and mechanisms established under point 2°; c) the appropriateness and effectiveness of the measures taken to address any deficiencies in these policies, procedures, arrangements, processes and mechanisms, such as failure by the relevant persons to comply with these arrangements, processes and mechanisms or to follow these codes of conduct and procedures.

Art. 12. The risks referred to in Article 11, 1°, shall also include the risks associated with the outsourcing of critical or important tasks or of investment services or activities. These shall also include the risks associated with the relationship between the institution and the service provider, as well as the potential risks that arise when outsourced activities of multiple institutions or other regulated entities are concentrated with a limited number of service providers.

Art. 13. Institutions shall, if appropriate and proportionate given the nature, scale and complexity of their business and the nature and range of investment services and activities or management tasks carried out within the framework of this business, establish and maintain an independent risk management function that ensures:
1° implementation of the policies and procedures referred to in Article 11, including identification, monitoring, evaluation and control; 2° reporting and advice to senior management.
Where an institution is not required under the first paragraph to establish and maintain an independent risk management function, it must nevertheless be able to demonstrate that the policies and procedures it has established in accordance with Article 11 meet the requirements described in that article and are always effective.

Section 4. — Internal Audit

Art. 14. Institutions shall, if appropriate and proportionate given the nature, scale and complexity of their business and the nature and range of investment services and activities carried out within the framework of this business, establish and maintain under the responsibility of senior management an internal audit function that is distinct and independent from the other functions and activities of the institution and that has the following responsibilities:
1° establishing, implementing and maintaining an audit plan based on a methodical risk analysis and covering all activities and entities of the institutions, in order to examine and assess the adequacy and effectiveness of the systems, internal control procedures and arrangements of the institution; 2° making recommendations based on the results of the work carried out in accordance with point 1°; 3° verifying whether these recommendations are followed; 4° reporting to senior management. The obligation provided for in the first paragraph regarding the internal audit function is presumed to be appropriate and proportionate for institutions within the meaning of Article 3 not referred to in the third paragraph. The obligation provided for in the first paragraph regarding the internal audit function is presumed not to apply to portfolio management and investment advisory companies that only provide investment advisory services and/or reception and transmission of orders services, unless the CBFA is convinced that such an obligation is appropriate and proportionate given the nature, scale and complexity of their business and the nature and range of investment services and activities carried out within the framework of this business.

Art. 15. Depending on the nature, scale and complexity of their business and the nature and range of investment services and activities or management tasks carried out within the framework of this business, the institution may decide to outsource the function referred to in Article 14. The first paragraph does not prejudice the possibility of outsourcing within a group context. Without prejudice to the provisions of Articles 17 to 22 of this regulation, the outsourcing agreement stipulates that:

senior management shall agree in advance to the risk analysis carried out by the expert and the plan drawn up;
senior management or its representative(s), the auditor(s) or his/her/their collaborators and the CBFA may at any time access any document of the expert relating to his/her mission, in particular his/her work programme and working papers.
Senior management of the institution shall continuously monitor the audit activity of the expert and determine who is responsible within the organization for monitoring his/her recommendations.
The appointed expert must be completely independent in all respects from the auditor or his/her office and from the group to which the auditor belongs.

Section 5. — Complaints Handling

Art. 16. Institutions shall establish, implement and maintain effective and transparent procedures regarding the handling of complaints from non-professional clients or potential non-professional clients.
These procedures shall ensure reasonable and rapid handling of these complaints.
Institutions shall keep records of these complaints and the measures taken to resolve them.

Section 6. — Outsourcing

Art. 17. In the event of outsourcing of critical or important operational tasks, or investment services or activities, institutions remain fully responsible for fulfilling all their obligations under their legal framework and shall in particular comply with the following conditions:
a) the outsourcing must not result in the delegation by senior management of its responsibility; b) the relationship and obligations of the institution towards its clients under the provisions of Articles 27 and 28 of the Law of 2 August 2002 must not be modified; c) the conditions that the institution must meet to obtain and retain its license must not be undermined; d) none of the other conditions under which the license was granted to the institution may be repealed or modified.

Art. 18. Institutions shall exercise due competence, care and vigilance when entering into, managing or terminating an agreement for the outsourcing of critical or important operational tasks, or investment services or activities to a service provider. Institutions shall in particular take the necessary measures to ensure that the following conditions are met:
a) the service provider must have the competence, capacity and any license required by law to perform the outsourced tasks, services or activities in a reliable and professional manner; b) the service provider must perform the outsourced services efficiently and for this purpose the institution must establish methods to assess the performance level of the service provider; c) the service provider must exercise adequate supervision over the performance of the outsourced tasks and manage the risks associated with the outsourcing in an appropriate manner; d) appropriate action must be taken if it appears that the service provider is not performing the tasks efficiently and in compliance with the applicable legal and regulatory provisions;

e) the institution must retain the necessary expertise to effectively supervise the outsourced tasks and manage the risks associated with outsourcing, and must supervise these functions and manage these risks; f) the service provider must inform the institution of any development that may have a significant impact on its ability to perform the outsourced tasks efficiently and in compliance with applicable statutory and regulatory provisions; g) the institution must be able to terminate the outsourcing agreement if necessary without adverse consequences for the continuity and quality of its services to clients; h) the service provider must provide all necessary cooperation to the CBFA regarding the outsourced activities; i) the institution, its auditor, the CBFA or, where applicable, other relevant competent authorities must have effective access to the data concerning the outsourced activities and to the business premises of the service provider. The CBFA must be able to exercise these access rights; j) the service provider must protect all confidential information concerning the institution and its clients; k) the institution and the service provider must establish, implement and maintain an emergency plan providing for the management of discontinuity risks and periodic monitoring of backup facilities when this is necessary given the outsourced function, service or activity.

Art. 19. In the event of outsourcing of critical or important operational tasks, or of investment services or activities, to a service provider, the respective rights and obligations of the institutions and the service provider must be clearly defined and recorded in a written agreement.

Art. 20. When the institution and the service provider belong to the same group, the institution may, for the purpose of complying with this section, take into account the extent to which the institution controls the service provider or can influence its actions.

Art. 21. Upon request of the CBFA, institutions must provide all information necessary for it to verify that the outsourced activities are carried out in accordance with the provisions of this regulation.

Art. 22. § 1. When an institution outsources the management of assets of non-professional clients to a service provider in a third country, that institution must additionally ensure that the following conditions are met:
1° the service provider must have a license or be registered in its home state for the provision of this service and be subject to prudential supervision; 2° there must be an appropriate cooperation agreement between the CBFA and the supervisory authority of the service provider.

§ 2. If one or both of the conditions mentioned in § 1 are not met, an institution may only outsource portfolio management services to a service provider in a third country if the institution concerned notifies the CBFA in advance of the outsourcing agreement and arrangement as well as all other useful information, and if the CBFA does not raise any objections to this agreement and arrangement within one month of receiving this notification.

§ 3. In accordance with Articles 20bis of the Law of 22 March 1993 and 62bis of the Law of 6 April 1995, a policy statement regarding outsourcing of portfolio management services covered by § 2 is published on the CBFA website. This statement includes examples of cases in which the CBFA will not, or will probably not, raise any objection to an outsourcing, even though one or both of the conditions mentioned in § 1, 1° and 2°, are not met. The statement specifies why the CBFA considers that outsourcing in such cases will not compromise the ability of institutions to fulfill their obligations under Articles 17 to 21.

§ 4. The CBFA publishes a list of supervisory authorities in third countries with whom it has concluded a cooperation agreement as referred to in § 1, 2°.

e) the establishment must retain the expertise necessary to effectively control outsourced tasks and manage the risks associated with outsourcing, and must control these tasks and manage these risks; f) the service provider informs the establishment of any event likely to have a significant impact on its ability to execute outsourced tasks efficiently and in compliance with current legal and regulatory provisions; g) the establishment must be able, if necessary, to terminate the outsourcing contract without harming the continuity or quality of services provided to clients; h) the service provider must provide all necessary cooperation to the CBFA regarding outsourced activities; i) the establishment, its auditor, the CBFA or, where applicable, other competent authorities under which the establishment falls must have effective access to data relating to outsourced activities and to the business premises of the service provider. The CBFA must be able to exercise these access rights; j) the service provider must ensure the protection of confidential information relating to the investment firm and its clients; k) the establishment and the service provider must design, implement and maintain an emergency plan for the management of discontinuity risks. This plan provides for regular monitoring of backup capabilities, in all cases where this appears necessary given the nature of the outsourced task, service or activity.

Art. 19. In the event of outsourcing of essential or important operational tasks or any other service or investment activity to a service provider, the respective rights and obligations of the establishment and the service provider are clearly defined and recorded in a written contract.

Art. 20. When the establishment and the service provider belong to the same group, the establishment may, for the purpose of complying with the provisions of this section, take into account the extent to which the establishment controls the service provider or can influence its actions.

Art. 21. Establishments provide the CBFA, upon request, all information necessary to allow it to verify that outsourced activities are exercised in accordance with the requirements of this regulation.

Art. 22. § 1st. Establishments that outsource the management of retail client portfolios to a service provider located in a third country must additionally ensure that the following conditions are met:
1° the service provider must be licensed or registered in its country of origin for the provision of this service and must be subject to prudential control; 2° there must be an appropriate cooperation agreement between the CBFA and the supervisory authority of the service provider.

§ 2. If one or both of the conditions mentioned in § 1st are not met, an establishment may only outsource portfolio management services to a service provider located in a third country after having previously notified the CBFA of the outsourcing contract and regime, as well as all other useful information, and on condition that the CBFA has not raised any objections to this contract and regime within a period of one month following receipt of the notification.

§ 3. In accordance with Articles 20bis of the Law of 22 March 1993 and 62bis of the Law of 6 April 1995, the CBFA publishes on its website a communication regarding its policy on outsourcing of portfolio management services covered by § 2. This communication contains examples of cases in which, in accordance with § 2, the CBFA will not, or will probably not, raise any objection to an outsourcing, even though one or both of the conditions referred to in § 1st, 1° and 2°, are not met. This communication will specify the reasons why the CBFA considers that in such cases, outsourcing is not likely to compromise the ability of establishments to fulfill their obligations under Articles 17 to 21.

§ 4. The CBFA publishes a list of supervisory authorities in third countries with whom it has concluded cooperation agreements provided for in § 1st, 2°.

MONITEUR BELGE — 27.06.2007 — BELGISCH STAATSBLAD 35009

Section 7. — Data Retention

Art. 23. Institutions must retain all data included in the annex to this regulation for a period of at least five years.
Data concerning the rights and obligations of the institution and the client within the framework of a service contract or concerning the conditions under which the company provides services to the client must be retained for at least the duration of the relationship with the client. The CBFA may, however, in exceptional cases, require institutions to retain some or all of the data for a longer period than specified, to the extent justified by the instrument or transaction, if this is necessary to enable it to exercise its supervisory functions. After the revocation of an institution's license, the CBFA may require the institution to retain the data for the remaining part of the five-year period prescribed in the first paragraph.

Art. 24. Data must be retained on a carrier that allows information to be stored in such a way that the CBFA can consult it later, and in such a form and manner that the following conditions are met:
1° the CBFA must be able to access the data easily. It must be able to reconstruct each significant stage of the processing of each transaction; 2° all corrections or other modifications, as well as the content of the data before such corrections or other modifications were made, must be easily traceable; 3° the data must not be manipulable or modifiable in any other way.

Art. 25. Articles 23 and 24 of this regulation also apply to:
1° Belgian branches of credit institutions and investment firms subject to the law of an EEA member state, for their transactions on Belgian territory; 2° Belgian branches of management companies for collective investment schemes, for their investment services.

CHAPTER III. — Final Provisions

Art. 26. This regulation enters into force on 1 November 2007.
Brussels, 5 June 2007.
The President,
J.-P. SERVAIS

Annex to the regulation of the Banking, Finance and Insurance Commission regarding organizational rules for institutions providing investment services
List of data to be retained by institutions

The identity of each client as well as the necessary information for client classification (professional client, non-professional client or eligible counterparty).
File with client contracts, documents referred to in these contracts, as well as the applicable general terms and conditions.
In the context of Article 27, §§ 4 and 5, of the Law of 2 August 2002, the following information regarding the client or potential client: their knowledge and experience, and for portfolio management and investment advice, their financial capacity and their objectives.
Data on all transactions in financial instruments, regardless of whether these transactions were carried out for own account or for the account of a client. In the case of transactions for the account of clients, the retained data include all information and details regarding the identity of the client and all information that must be provided under the Law of 11 January 1993.
For accepted client orders: the identity of the client, where a distinction can be made between portfolio management orders and non-portfolio management orders.

Section 7. — Data Retention

Art. 23. Establishments retain all data required by virtue of the annex to this regulation for a period of at least five years.
Data setting out the respective rights and obligations of the establishment and a client within the framework of a service contract or setting out the conditions applied by the company for the provision of services to the client are retained for at least the entire duration of the relationship with the client. However, the CBFA may, in exceptional circumstances, require establishments to retain all or part of these data for a longer period, within the limit justified by the nature of the instrument or transaction, if this is indispensable for exercising its supervisory functions. In the event of revocation of an establishment's approval, the CBFA may require the establishment to retain the data held until the expiry of the five-year period required in the first paragraph.

Art. 24. Data are retained on a support that allows information to be stored in such a way that it can be consulted subsequently by the CBFA and in a form and manner that satisfies the following conditions:
1° the CBFA must be able to access the data easily. It must be able to reconstruct each key stage of the processing of all transactions; 2° it must be possible to easily verify any correction or other modification, or the state of the data prior to these corrections or modifications; 3° it must not be possible to manipulate or alter the data in any other way.

Art. 25. Articles 23 and 24 of this regulation are also applicable to:
1° branches established in Belgium of credit institutions and investment firms subject to the law of a Member State of the European Economic Area, regarding their transactions carried out on Belgian territory; 2° branches established in Belgium of management companies for collective investment schemes, regarding the investment services they provide.

CHAPTER III. — Final Provision

Art. 26. This regulation enters into force on 1 November 2007.
Brussels, 5 June 2007.
The President,
J.-P. SERVAIS

Annex to the regulation of the Banking, Finance and Insurance Commission regarding organizational rules for institutions providing investment services
List of data to be retained by institutions

The identity of each client as well as the information necessary for his classification (professional client or retail client or eligible counterparty).
A file comprising contracts concluded with clients, documents referred to in these contracts as well as the applicable general conditions.
In the context of Article 27, §§ 4 and 5, of the Law of 2 August 2002, the following information concerning the client or potential client: his knowledge and experience and, for portfolio management and investment advice, his financial capacity and his investment objectives.
Data relating to all transactions on financial instruments, whether these transactions are concluded for own account or for the account of a client. In the case of transactions concluded for the account of clients, these records contain all information and specifics relating to the identity of this client as well as the information required under the Law of 11 January 1993.
Regarding client orders accepted by the establishment: the identity of the client; in this context, the establishment is free to distinguish between orders accepted in portfolio management and orders not related to portfolio management.

35010 MONITEUR BELGE — 27.06.2007 — BELGISCH STAATSBLAD

The basis on which client orders are allocated and processed such that reconciliation of transactions is always possible.
For executed orders: the identity of the client, the date and time of allocation of the transaction, the financial instrument concerned, and the amount.
The basis and reason when a transaction must be reallocated.
In accordance with the regulation: the data referred to in Articles 7 and 8 of the regulation.
Periodic reporting to clients.
Data and accounts concerning client funds and client securities prescribed by and under Articles 77 to 77ter of the Law.
Details of the client on whose instructions financial instruments were used, as well as the number of financial instruments used belonging to each client who has given his or her consent, in order to be able to allocate any losses correctly.
Publicity communications (except oral) communicated to non-professional clients or potential clients.
Investment research conducted by the institution and available on a durable carrier.
Data regarding the business and internal organization (organograms).
Essential compliance policies and procedures.
The list of detected or potential conflicts of interest that the institution must maintain in accordance with Article 84 of the Royal Decree of 3 June 2007 determining further rules for the implementation of the directive concerning markets for financial instruments.
Compliance reports.
Risk management reports.
Internal audit reports.
Registered complaints from non-professional clients.
Measures taken to handle complaints from non-professional clients.
In accordance with the regulation and during the period determined by the regulation: with systematic internalization: the data concerning the prices offered as referred to in Article 24, first paragraph, b) of the regulation.
Data on personal transactions of relevant persons.
Policy on conflicts of interest.
Order execution policy.
Warnings referred to in Article 27, §§ 5 and 6, of the Law of 2 August 2002.
Benefits communicated to the client within the meaning of Article 7 of the Royal Decree of 3 June 2007 determining further rules for the implementation of the directive concerning markets for financial instruments.
The fact that a non-professional client received investment advice along with the financial instrument that was advised.
Data concerning cases in which, in accordance with Directives 2004/39/EC and 2006/73/EC, the company must obtain the explicit agreement of the client.

Seen to be attached to the regulation of the Banking, Finance and Insurance Commission of 5 June 2007 regarding organizational rules for institutions providing investment services.
The President,
J.-P. SERVAIS.

Seen to be attached to Our decision of 19 June 2007.
ALBERT
By the King:
The Vice-Prime Minister and Minister of Finance, D. REYNDERS

The principles governing the allocation and processing of client orders. These principles must allow reconciliation of operations at all times.
For executed orders: the identity of the client, the date and time of allocation of the transaction, the financial instrument concerned and the amount.
When a transaction must be reallocated, the principles and reasons motivating this reallocation.
In accordance with the European regulation: the data referred to in Articles 7 and 8 of the European regulation.
Periodic reports to clients.
Data and accounts relating to client funds and client securities, provided for by and under Articles 77 to 77ter of the Law of 6 April 1995.
Data relating to clients whose instructions are at the origin of the use of financial instruments, as well as the number of financial instruments used belonging to each client who has given his consent, in order to allow correct allocation of potential losses.
Advertising communications (except oral communications) addressed to retail clients or potential clients.
Investment research produced by the establishment that is available on a durable support.
Data concerning the activities and internal organization (organograms) of the establishment.
Main compliance policies and procedures.
The list of detected or potential conflicts of interest, which the establishment maintains in accordance with Article 84 of the Royal Decree of 3 June 2007 laying down rules and procedures for transposing the directive concerning markets for financial instruments.
Compliance reports.
Reports relating to risk management.
Internal audit reports.
Registered complaints from retail clients.
Measures taken to handle complaints from retail clients.
In accordance with the European regulation and during the period provided for by this regulation: in the event of systematic internalization, the history of displayed prices referred to in Article 24, paragraph 1st, b), of the European regulation.
Data relating to personal transactions carried out by relevant persons.
Policy on conflict of interest.
Order execution policy.
Warnings referred to in Article 27, §§ 5 and 6, of the Law of 2 August 2002.
Benefits, within the meaning of Article 7 of the Royal Decree of 3 June 2007 laying down rules and procedures for transposing the directive concerning markets for financial instruments, of which the establishment has informed the client.
The fact that a retail client has benefited from investment advice, as well as the financial instrument advised.
Data concerning cases where, in accordance with Directives 2004/39/EC and 2006/73/EC, the establishment must obtain the express agreement of the client.

Seen to be annexed to the regulation of the Banking, Finance and Insurance Commission of 5 June 2007 regarding organizational rules for institutions providing investment services.
The President,
J.-P. SERVAIS.

Seen to be annexed to Our decision of 19 June 2007.
ALBERT
By the King:
The Vice-Prime Minister and Minister of Finance, D. REYNDERS

MONITEUR BELGE — 27.06.2007 — BELGISCH STAATSBLAD 35011

Royal Decree approving the CBFA Regulation on organizational rules for investment service providers

Lineage: In force

Similar documents from other regulators