securities & markets supervision unit · mfsa malta financial services authority i 5 october...

MFSAMALTA FINANCIAL SERVICES AUTHORITY

I 5 October 2015 Securities & MarketsSupervision Unit

To: Collective Investment Schemes and Fund Managers Inc Tel: (+356) 21441155flI[ Fax: (+356) 21449308

Attn. The Directors and Compliance Officer

Dear Sir/Madam.

Re: Thematic Review on compliance with the requirements on Governance,

Compliance and Risk Management

During 2014 and 2015, the Securities and Markets Supervision Unit conducted 21 thematicreviews on governance, compliance and risk management through focused visits at the

offices of a number of collective investment schemes (“CISs”) and Fund Managers. A

broad range of licence holders varying in size, type and business model were selected in

order to obtain a representative picture of the whole sector. The Authority carried out other

onsite visits at other types of financial services entities, such as investment services

providers. A separate communication will be issued in due course identifying the findings

of these other inspections.

The visits were designed to verify the extent to which the selected licence holders have

proper governance, compliance and risk management procedures in place and the extent to

which these are being complied with and applied in practice. In the case of lund managers

which qualify as full scope Altemative Investment Fund Manager’ rAIFM”) pursuant to

Directive 201 1/61/EU the objectives of the onsite inspections also included a review of

compliance with the requirements on remuneration, delegation and valuation obligations.

The purpose of this letter is to inform the industry about the common findings of these 21

onsite visits in order to encourage licence holders to take corrective action and avoid the

common pitfalls in relation to lack of observance of regulatory and compliance standards.

In this regard, you are encouraged to consider carefully the key findings set out below and

undertake an assessment of your company’s compliance levels vis a vis these findings,

making sure that any remedial action is taken in a timely manner, whilst taking into

consideration the propor ionality of the business.

This letter consists of three sections:- ScctioriA outlines the findings which were Found common both in CISs as well as

fund managers:- Section B details the Findings identified during visits at CISs: and

- Section C is mostly applicable to fund managers.-

K

Notabile Road. Attard BKR 3000. MALTA. /Te1:(+356 2144 1155 Fax:(±356) 2144 88 Wehsite: wwwrnfsacomnZ

PF-’

vfl Jj

MACrA FINANCiAL SERVICES AUTHORITY

Section A - Common Findins/ Recommendations

I.

1.1 Conflict of Interest — Policy, Register & Disclosures

A common finding identified during the onsite visits at both CISs and Fund Managers was

related to the establishment and maintenance of the conflict of interest policy and the

conflict of interest register, as well as the reporting obligations of potential or actual

conflict of interest. These findings are summarised as follows:

- A number of licence holders failed to implement the necessary organisational and

administrative arrangements designed to prevent conflict of interest as required by

the applicable standard licencing conditions in the relevant MFSA rulebooks. The

requirement may be complied with by, inter aba, ensuring independence between

the Board members of CISs and those of the Fund Managers, the maintenance of

conflict of interest policy and! or contlict of interest register. The conflict of interest

register serves as a central log to record any potential or actual conflict of interest

identified for ease of reference, more accurate record keeping and easy retrieval in

case of need.

- Some directors failed to declare conflicts of interest during Board Meetings.

- All procedures and policies making reference to conflict of interest should be

collated into one policy! procedure for ease of reference.

- In other cases although the licence holders did establish a conflict of interest policy.

they failed to review the policy on a periodic basis, at least annually. The conflict

of interest policy should he approved by the Board of Directors. The reviewing

i’requency and the approving body of the conflict of interest policy should be

clearly indicated in such document.

- Although in some cases a conflict of interest register was created, this was: not

populated with potential. actual or declared conflict of interest, although the licence

holders were actually aware of such conflicts.

- The Authority recommends that a standard agenda item is included in the agenda of

Board meetings. i.e. declaration of conflict of interesC.

- In some instances the licence holders were not adhering to the conflict of interest

procedures outlined in their compliance manuals, conflict of interest polices or

constitutional documents.

1.2 Board of Directors Meetings Proceedings

During the visits MFSA Officials reviewed the licence holders’ Board packs and minutes.

The main deficiencies noted were as follows:

:42


- Board of Directors’ meetings were not held regularly. A number of licence holders

failed to hold regular Board meetings on at least on a quarterly basis, in line with

guidance 7.2 of the MFSAs Corporate Governance Manual for Directors of

Investment Companies & Collective Investment Schemes (‘Ike MFSA Governance

Manual”).- Board minutes failed to record discussions on the licence holders’ tinancial

position. any compliance issues or breaches of the standard licencing conditions.

- Board minutes did not adequately provide an audit trail of unresolved issues or

pending matters. Board Minutes should clearly document the person responsible for

the relevant action point and how such action points are implemented as recorded.

- Information Board packs were not presented at Board meetings as recommended in

guidance 8 of the MFSA Governance Manual.

2. Compliance

2.1 Breaches register & Breaches reporting

During [he visits MFSA Officials reviewed the breaches registers maintained by the

relevant licence holders. The below is a list of all the findings identified:

- Inadvertent breaches to the investment restrictions were not included in the

breaches register. Particularly in the case of Fund Managers. the breaches register

should include all breaches, irrespectively whether the breaches are in relation to

the standard licence conditions or breaches of internal limits. Fund managers are

recommended to maintain separate breaches logs; one which records their own

breaches, and a separate register which logs the breaches of the funds under

management (to the extent that breaches relate to investment management activity).

It is advisable to record contraventions arising from changes in market conditions

under a separate section of the breaches register of CISs.

- The material findings! recommendations included in the MFSA’s post-visit reports

are to be included in the breaches register.

- In sonic instance the breaches registers failed to include [he following details: i)

occurrence date: ui discovery date: iii) identified by and reported to; iv) the

classification of the breach and summary of the discussion with the Board of

Directors; v) whether the MFSA was notified of the breach (as applicable); vu

whether the Custodian! Depositary was notified of the breach(as applicable); vii)

details of the remedial action taken to rectify the breach as well as the action

implement to improve internal controls: viii) the extent of the investment

overexposure; and ix) status of breach.

- In other instances licence holders failed to identify, record and report breaches as

required. as follows: H the breaches register: ii) the compliance reports prepared by

the Compliance Officer: or iii) to the Authority. Licence holders are also epec9

3

Mi SAMALTA FiNANCIAL SERVICES AUTHORITY

to inform investors of any breaches committed and as a minimum a reference

should be made in the audited financial statements.

- The Compliance Manual of particular licence holders needed to be revised in order

to include the breaches procedure.

3. Disclosure & Transparency

Some licence holders were required to amend the Key Investor Information Document

(“KIID”) and ensure that all required information is properly and accurately docunwnted,

including the details of fund performance.

One particular licence holder made use of a website which marketed a wide range of

services which are more than the limited range of services which the entity is authorised to

provide. Licence holders are reminded to ensure that a fair, clear and transparent

representation of the services offered is provided at all times, including on websites.

Communication with actual or potential clients andlor investors should also be clearly

understandable and comprehensive to users enabling them to understand the nature and

risks of the investment services provided.

4. Procedures Manuals and Polices

During the visits MFSA Officials reviewed various agreements. manuals and policies

produced by the licence holders, including operational procedures. compliance. AML

manuals and other policy documents. The most common findings with respect to such

documents are the following:

- Procedures arid policies were not dated.

- The name of the individual(s) signing the agreements, manual and/or policies was

not specified.

- Procedures and policies were not approved by the Board of Directors,

- Compliance manuals made reference to the rules of another jurisdiction rather to

the relevant MFSA rulehooks.

- No audit trail was kept illustrating the changes made to the licence holders’

procedures and policies.

- Sonic procedures manuals were merely a replication of the applicable MFSA

rulebooks and/or were not tailored to reflect the specific needs and obligations of

the licence holders.

4

MFSAMALTA FINANCIAL SERVICES AuTHoRITY

Section B — CISs’ Key Findings! Recommendations

The following findings/ recommendations were identified during the onsite visits at CISs:

1. Compliance

1.1 Due diligence, Monitoring and Reliance on Service Providers

The majority of the CTSs inspected placed significant reliance on the internal control

processes and procedures of their service providers. i.e. the investment manager. the

administrator and the custodian (where applicable). Fur hermore, it was noted that the CISs

do not perform due diligence and monitoring on their service providers because they rely

on the fact that they have constant communication with them. It was also noted that the

ClSs have added comfort given that their service providers are reputable and renowned.

Moreover, in most of the cases the CISs do not check whether the Business Continuity

Policy (“BCP”) and Disaster Recovery Plan (“DRP”) of each of’ their respective service

providers are periodically updated. particularly those of the administrator, investment

manager and custodian, because they rely on the fact that these service provider are

regulated in reputable jurisdictions.

In other cases the CISs advised that they perform due diligence checks and monitoring on

their service providers on an ongoing basis: however such checks are not documented on

an ongoing basis.

It is rccommended that CISs conduct due diligence and onsite ongoing monitoring on their

service providers from time to time, which monitoring should be ibrmalised, properly

documented and presented to the Board of Directors. Written confirmations that main

service providers are actually updating and testing their BCP and DRP on a periodic basis

should be obtained.

1.2 Appointment of Compliance Officer and MLR()

In one particular instance, the appointed Compliance Officer of a CIS was not present

during the compliance visit and noted that the compliance duties were being carried out by

a different person. ‘lthough the compliance reports were signed off by the Compliance

Officer, In such circumstances, the MFSA expects the approved Compliance Officer to be

the person responsible for carrying out the compliance function, including the attendance at

Board meetings in order to keep abreast with the business being discussed, as well as to

present compliance findings to the Board. If the Compliance Officer intends obtaining

additional support, the arrangement should be approved by the MFSA.2

V

MFSAMALTA FINANCIAL SERViCES AuTH0RrTY

1.3 Compliance Reports

During the visits MFSA Officials reviewed the six monthly compliance reports prepared

and presented by the Compliance Officers to the Board of Directors. The following are the

most common issues arising from the review of these reports:

- Compliance reports failed to include a confirmation that all the local Prevention of

Money Liundering requirements have been satisfied.

- Although complaints received from unit holders of CISs were recorded in the

complaints register. these were not reported in the compliance reports. The

compliance reports should also indicate the manner in which the complaints were

handled.- Some compliance reports did not include the breaches of the investment restrictions

or standard licencing conditions.

- Some compliance reports were not signed by the compliance officers.

2. Governance

2.1 Shareholders meetings proceedings

During the visits MFSA Officials reviewed the agenda and minutes of shareholders annual

general meetings, as well as extraordinary meetings. Some of the CISs failed to convene

annual general meetings as required in terms of Article 128 of the Companies Act, 1995

and also in accordance with the respective clauses of their Articles of Association.

2.2 Record keeping and safekeeping of assets

In particular instances. CISs failed to produce accounting and other records, such as

evidence of ownership of certain investments as required in terms of SLC 4.14 of Appendix

Ito Part BlI of the Investment Services Rules for Professional Investor Funds.

2.3 High Total Expense Ratio

Another specific finding relating to CISs was the high Total Expense Ratio r’TER”) of

particular schemes or sub-funds. Significantly high TER makes the continued existence of

schemes and/or sub-funds no longer viable and such situation is definitely not in the best

interest of investors to remain invested in such schemes and/or sub-funds. In such

circumstances the CISs were strongly urged to discuss this situation at Board level and in

the absence of short term possible developments, consider the feasibility of the CISs as a

going concern. In this regard. additional financial strain caused by significant payments to

service providers should be a factor that needs to he given due consideration.

6

FSAMALTA FINANCIAL SERVICES AUTHORITY

3. Reporting from service providers

It is good governance practice for CISs to present information packs at Board meetings. As

indicated in Section 8 of the MFSA Governance Manual. information packs generally

include a) investment management reports: b) administrator reports: c) custodian reports

(where applicable): d) auditor report (where applicable): and e) any other documents as

requested by the Board such as risk management reports. In this respect. a number of CISs

failed to present any of these reports on periodic basis. Sections 9. 10. Il and 12 of the

MFSA Governance Manual indicate the genenc contents of such reports. It is also good

practice that service providers reports are adequately endorsed for a sufficient audit trail.

Section C — Fund Managers’ Key Findings

The following findings! recommendations were identified during the onsite inspections at

fund managers. i.e. UCITS management companies. deniinimis AIFMs and full AIFMs:

1. Governance

1.1 Substance

Most IC meetings should (to the greatest extent possible) be physically held in Malta in

order to ensure that management and control of their entities are effectively being

undertaken in Malta. Investment decisions and other commercial decisions are to he made

in Malta and records are to be maintained at the registered! operational office in Malta, to

the greatest extent possible. It is essential that operational set up arrangements approved by

the Authority at licensing stage are adhered to and if there are any changes these are

submitted to the Authority for approval. Moreover, it is also important that post licencing

conditions arc adhered to, whilst the applicability of any derogation should be reviewed by

the licence holders from time to time and at least on an annual basis.

1.2 Independence between the Manager and the Scheme

In certain cases it was noted that the Fund Managers were exerting undue pressure on the

Board of the CISs, limiting the independence of the Board of the CIS in its decision-

making process. Although the input of the Fund Manager is a key factor to the decision

making process of the Board of Directors of the CISs, the independence of such Board of

Directors should always be respected.

1.3 Investment Committee “JC”) Proceedings

During the visits MESA Officials reviewed the documentation related to IC proceedings.

such as IC agendas. IC minutes and IC packs. The main deficiencies noted were as follows:

A

MFSAMALTA FiNANCIAL SERVICES AUTHORITY

- IC meetings were not held on a quarterly basis as stipulated in the respective Terms

of Reference of the same committee.

- IC minutes failed to evidence the review of the performance of the CISs under

management.

- Supporting documentation and written analysis were not provided to IC Members

for their consideration.

- In some cases the discussions related to the investment management strategy

decisions were documented in the Board minutes rather than in separate IC

minutes. IC meetings should be held separately and prior to Board meetings.

Some ICs failed to determine strategic bands and other limits as may ordinarily be

required for the purpose of determining asset allocation and compliance with the

investment restrictions of the funds under management.

1.4 Training logs

Not all licence holders maintained training logs which document in an adequate manner the

training received by the officials and staff members. Directors and other officials of licence

holders are expected to keep abreast with regulatory developments.

1.5 Professional Indemnity Insurance

Some Fund Managers were recommended or required to take out and maintain a

professional indemnity insurance policy in terms of the applicable rules in the relevant

Pans of the Investment Services Rules for ISLHs.

2. Investment Management

2.1 Investment Process

During compliance visits the Fund Managers provided the MFSA Officials with a

walkthrough of the investment process. MFSA Officials also performed a limited review of

the policies and procedures related to the investment process. The following are sonic

deficiencies identified during these reviews:

A number of Fund Managers failed to document their investment process in a

formal procedure! policy. An investment policy should specify the procedure

adopted throughout the investment process. including but not limited to. pre- and

post- trade checking as well as the monitoring of investment policies and

restrictions.

- Sonic Fund Managers failed to implement a portfolio management tool with the

required controls to be used during the pre-trade checking and ongoing monitoring

of the investment restrictions.7

S


- In specific instances it was noted that tactical investment decisions were not being

duly recorded.- There were cases where staff members within the Fund Managers were granted

trading limits which authorised them to place orders. However, it was noted that

these trading limits were either not documented in the licence holders’ investment

procedures! policy, or not periodically reviewed (at least on art annual basis).

- A brief report! entry is to be raised as at end of each day listing the trades! orders

raised during the day and to include a brief note justifying each trade. This report!

entry should be signed off by another, preferably, senior official for dual control

purposes. The dual control! authorisation procedures should be implemented

throughout the entire investment process, particularly during the placement of

orders.- In some cases the checklists used by the Fund Managers during the investment

restrictions monitoring failed to capture all investment restrictions, including any

borrowing limits, applicable to the specific type of scheme being managed.

- Segregation of the investment management function from the back office and

middle office operations is essential to ensure effective Chinese walls.

- In one particular case, it was noted that the investment management policies and

procedures failed to ensure that investment restrictions are effectively monitored

and complied with.

2.2 Best Execution Policy & Order Allocation Policy

Some Fund Managers did not have in place adequate best execution policies and order

allocation policies as required by the applicable MFSA rulebooks. In fact in particular

instances the best execution policy failed to identify the entities with which orders may be

placed in respect of each class of instruments. Furthermore, certain Fund Managers

implemented an order allocation policy which did not provide sufficiently precise terms for

the fair allocation of aggregated orders. Some order allocation policies failed to indicate

how the volume and price of orders determine allocations and the treatment of partial

executions.

3. Business Continuity and Disaster Recovery

During the visits MFSA Officials reviewed the business continuity policy! plan (“BCP”)

and disaster recovery plan (“DRP”) of Fund Managers to assess the contingency

procedures in place which address events of an unexpected event or disaster. The main

deficiencies are noted below:

- In several cases Fund Managers failed to test their BCP and DRP. Others did not

document in an adequate and accurate manner such tests. Testing of both BCP and

DRP and review of these policies should be done periodically, preferably on an

annual basis.

MFSAMALTA FINANCIAL SERVICES AUTHOR [TY

- In cases where DRP testing is outsourced to third parties, the licence holder should

monitor the testing by obtaining confirmations that any issues arising from thistesting have been addressed.

- Several licence holders failed to make a distinction between business continuity

and disaster recovery.- In one particular instance, a licence holder indicated in its BCP that operations

would be relocated to the entity’s overseas branches. Licence Holders are required

to obtain the necessary authorisation in order to be able to operate in overseas

branches, even in the case of contingency.- BCP and DRP should be approved by the Board of Directors.- Fund Managers were recommended to revise their BCPs to include the three basic

components of a good BCP as indicated in the Guidance Notes to the InvestmentServices Rules for Investment Service Providers in order to ensure that their BCPreflects the minimum requirements.

- Other Fund Managers were required to refrain from specifying in any of theirdocuments sensitive information which may pose risk from an information securityperspective as specified in the relevant provisions of the MFSA rulehooks withrespect to the safeguarding of the integrity of information.

- It is important that data is backed up and mirrored in a contingency site which canbe easily accessed in a contingency event.

4. Compliance

During the visits MFSA Officials also reviewed compliance manuals, breaches registers,compliance monitoring reports and documentation related to due diligence and ongoingmonitoring on counterparties. The following are the main deficiencies identified in thisarea:

In several cases AIFMs failed to formally document the due diligence and ongoingmonitoring performed on the prime brokers and/or counterparties. In terms of SLC3.12 of Part Bill of the Investment Services Rules for Investment Services LicenceHolders (“ISLHs”), an AIFM “shall exercise due skill, care and diligence in the

selection and appointment of prime brokers with whom a contract is to he

concluded”.

Some Fund Managers failed to adopt and effectively implement a compliancemonitoring programme which assesses the compliance risks and tests the controlsin place to mitigate the identified risks.In other instances Fund Managers were requested to adopt a more holistic approachin implementing the compliance monitoring programme in order to include also therisks of non-compliance and alignment to AIFMD besides the monitoring of thepersonal dealing register, gifts register and quarterly monitoring of the delegatedfunction.

10


- It is recommended that Fund Managers carry out, at least on an annual basis, a

compliance risk assessment which evaluates the probability, impact and risk of

various risks, as the basis of the compliance monitoring programme.

- Compliance monitoring reports should be produced and presented by the

Compliance Officer to the Board of Directors, on a periodic basis (at least every six

months), specifying any material findings emanating from the compliance

monitoring checks. These reports should set a deadline by when such findings are

to be resolved and the Board of Directors is to ensure that the resolution of such

findings is actually implemented.

5. Remuneration

One of the main areas addressed during compliance visits at Fund Managers, particularly at

AIFMs was remuneration. MFSA Officials assessed various documents related to the

different remuneration obligations applicable to the different type of Fund Managers, such

as the remuneration policy and remuneration committee terms of reference. The main

findings are outlined below:

- Some AIFMs did not have in place a formal staff appraisal process which

documented in a transparent manner the criteria used in determining the staff’svariable remuneration. as required in terms of SLC 12.02.3 of Appendix 12 to Part

BIll of the Investment Services Rules for ISLHs.

- In some cases the A1FMs distributed the remuneration policy “only” to Identified

Staff and not to all staff members as required in line with SLC 12.02.1 of Appendix

12 to Part Bill of the Investment Services Rules for ISLHs.

- A number of Fund Managers were requested to amend their remuneration policies

following the identification of particular inconsistencies in these documents, mainly

related to the criterion adopted in the deferral process, as well as the performancerelated remuneration structure.

- The remuneration policy of particular A1FMs failed to state the person responsible

for overseeing the remuneration of the senior staff responsible for heading the

control functions.- Some AIFMs did not indicate in the remuneration policy the supervisory bodies

that approve and maintain such policy. The remuneration policy should also

indicate the frequency of reviewing, which should at least be held on an annual

basis.- AIFMs were also recommended to involve the person responsible for risk

management in the assessment of how the variable remuneration structure affects

the risk profile of the Fund Manager. It is good practice for the risk managementfunction to validate and assess risk adjustment data.

- Some remuneration policies were not in line with the AIFMD requirements,notwithstanding the fact that the relevant AIFMs had resolved that they had

“implemented a Remz.,neration Policy which is in line with the requirements

_____MFSA

MALTA FINANCIAL SERVICES AUTHoRiTY

stipulated in Annex II of the AJEM Directive”. Moreover, some remuneration

policies failed to specify the criteria for determining: a) the variable remunerationallocation; b) how balance between variable and fixed remuneration is achieved;

and c) how risk taking can be mitigated.

6. Delegation! Outsourcing

Another area covered during onsite inspections at Fund Managers was the delegation!outsourcing obligations. MFSA Officials went through delegation’ outsourcing agreements,

as well as documentation related to the monitoring performed on the delegated functions.The most common findings related to this topic are as follows:

- Certain delegation! outsourcing agreements did not specify the remuneration to bepaid to the delegated function for the services received by the Fund Managers.In some cases Fund Managers did not conduct ongoing monitoring on theirdelegated functions, with most of the time the reason being the fact that thedelegated function and the licence holder form part of the same group. FundManagers, particularly AIFMs are expected to refer to Section 4 of Part Bill of theInvestment Services Rules for ISLHs in relation to outsourcing and sub-delegation.

- Notwithstanding that AIFMs and the delegated functions may form part of the samegroup Fund Managers are recommended to conduct ongoing monitoring on thedelegated function in a formalised and documented manner and at least on anannual basis. These reports should be signed by the Compliance Officer andpresented to the Board of Directors.

7. Risk Management and Liquidity Management

During the review of the different risk management related documentation together withthe interviews held with the appointed person responsible for risk management, thefollowing deficiencies were noted:

— The appointed person responsible for risk management reported to the InvestmentCommittee. AIFMs must ensure complete segregation and independence betweenrisk and investment management, in accordance with SLC 2.04 of Part Bill of theInvestment Services Rules for ISLHs.

- All risks (including currency risk) should be documented, monitored and managedby the risk management function.

- It is good practice that Fund Managers, besides assessing investment related riskthey also formally conduct a proprietary risk assessment of the general risks of thebusiness, such as operational risks, so as to capture the various levels of risks of thebusiness.

- In contrast to the requirement of SLC 1.180) of Part Bill of the InvestmentServices Rules for ISLHs, not all risk managers were granted full approval by the

__


MFSA to perform risk management duties and present risk reports to the Board of

Directors at the time of the onsite inspections.

- Other Fund Managers did not inform the MFSA that the identified person

responsible for the risk management function had changed. It is advisable that

where a risk manager is not appointed, as permitted by the relevant MFSA

rulebooks. a member of the Board of’ Directors oversees the risk management of the

licence holder.- Not all risk reports were signed by the risk manager andlor indicated the authors’

name or to whom the reports were addressed. Risk reports should he produced by

the risk manager and presented to the Board of Directors.

- Sonic Fund Managers failed to record pre-deal communication exchanged between

the risk management function and the portfolio management function. Fund

Managers are required to keep documented evidence of any pre-deal checks

conducted by the risk manager to assess the eligibility of assets and compliance

with the investment restrictions, as well as pre-trade due diligence checks on

potential investments.- Where possible, subject to proportionality, and unless it is required by the

applicable MFSA rulebook, Fund Managers should ensure that Chinese walls are in

place between the portfolio management and risk management functions.

8. Internal Audit

In the majority of the cases the Fund Managers were granted derogation from establishing

an internal audit function in view of their size. nature and proportionality. Nevertheless the

Fund Managers are advised to revisit the implementation of this third line of defenceshould the Fund Manager’s assets under management grow in size. It is essential that when

Fund Managers opt not 10 establish an internal audit function. they specifically request such

derogation in writing derogation for the Authority’s consideration and approval.

In some cases where Fund Managers have an internal audit function it was noted that action

points from the previous internal audits were not being documented as completed or

followed up.

One particular Fund Manager failed to conduct a formal internal audit review although it

has established an internal audit function. In accordance with SLC 2.24 of Part BlI of the

Investment Services Rules for ISLHs, an audit plan should be raised, at least on an annualbasis, and an internal audit exercise should he conducted on the basis of this plan.

9. Valuation

Some Fund Managers did not have in place a valuation policy and procedures which cover

all material aspects of the valuation process and valuation procedure and controls as

__


required by SLC 2.10 and SLC 2.17 Part 811 and Part BITT of the Investment Services

Rules for ISLHs, respectively. In several cases the valuation policy did not:

- Indicate the secondary pricing sources for all instruments (to the extent possible).

- State the tolerance thresholds on the difference between the primary and the

secondary sources.- Include provisions related to the treatment of stale prices. illiquid and hard-to-value

assets.

10. Cyber Security

Whilst the issues of cyber security within the fund industry has not been so Car tackled and

tested during onsite compliance visits, we would like to take this opportunity to alert Fund

Managers on the need to assess the management of cyher security within their operational

risk framework. It is extremely important that licence holders ensure that confidential data

and intellectual property are duly protected by security processes and policies at all times.

It is recommended that such processes and policies are reviewed at Board of Directors level

and that staff members are informed of the relevant risks and actions that are required. The

Authority will be looking at this aspect of operations in future compliance visits.

Conclusion

We trust that the guiding principles outlined in this letter will help those CISs and Fund

Managers. which have not yet been visited, to identify common pitfalls that we have seen

in recent visits and to take the appropriate actions.

We remain committed to continue helping you in accomplishing your plans for adherence

to compliance and regulatory standards.

Should you have any queries regarding the above, please do not hesitate to contact: the MrJoseph J. Agius [[email protected]; Ms Jeanelle Newell [email protected]; or theundersigned.

Di

14

securities & markets supervision unit · mfsa malta financial services authority i 5 october...

Documents