Outsourcing of Certain Tasks of the Central Administration Function

Pursuant to Article 41 of the amended Law of 5 April 1993 on the financial sector regarding professional secrecy (the “LFS”), and in accordance with Circular CSSF 22/806 on outsourcing arrangements, as amended, CF Fund Services S.A. (“CFFS”) outsources certain operational tasks relating to its central administration activities to CF Luxembourg Services, a BDO group entity located in Morocco.

CF Luxembourg Services is authorised to perform certain tasks relating to fund administration, transfer agency, registrar and corporate secretarial services on behalf of CFFS. CFFS was expressly added as a principal under the relevant outsourcing agreement, with the scope extended to “Fund Administration, Transfer Agent, Registrar and Corporate Secretary” activities.

The outsourced activities may include, in particular:

Fund administration activities, including the collection and preparation of banking and valuation data, accounting entries and data encoding, NAV calculation and preparation of financial and regulatory reports;
Transfer agency activities, including the processing of subscriptions and redemptions, maintenance of investor registers, preparation of payment instructions, capital calls and distributions, preparation of shareholder meetings, audit confirmations and FATCA/CRS reporting;
Registrar activities, including the collection of documentation, periodic reviews and updates, escalation of enhanced due diligence cases, reporting to Compliance in Luxembourg and KYA screening or due diligence; and
Corporate secretarial activities, including preparation of Board and shareholder meeting packs, drafting of minutes and resolutions, maintenance of legal registers and statutory information, RCS filings and management of client documentation.

CFFS retains full oversight and overall responsibility for the outsourced activities at all times.

In the course of performing these activities, CF Luxembourg Services may access information relating to CFFS clients, prospects, investors, directors, beneficial owners and related persons. Such information may include identification and contact data, financial and tax information, banking and transaction data, beneficial ownership information, national identification information and AML/KYC screening information, including World-Check results where relevant.

Access to the relevant personal data is performed remotely from Morocco. The data remain stored on the servers of the principals located in Luxembourg and no personal data are stored locally on servers in Morocco. Appropriate safeguards for such international access and transfer are implemented through the Binding Corporate Rules applicable within the BDO network.

Access to information is restricted to authorised personnel and is subject to applicable confidentiality, professional secrecy, data protection and information-security requirements.

IT Outsourcing

Pursuant to Article 41 of the LFS and in accordance with Circular CSSF 22/806 on outsourcing arrangements, as amended, CFFS outsources certain information technology activities to BDO Services Luxembourg S.A. (“BDO Services”), a Luxembourg entity belonging to the BDO Luxembourg group.

The IT services provided by BDO Services include governance and management services, solution delivery and application management, information-security management, operations management, service provisioning, support services and workspace/device services.

The arrangement includes information-security controls, access-right management, identity management, service continuity and disaster-recovery arrangements. User access rights are managed throughout their lifecycle, including the granting, denial and revocation of access privileges. Identity management covers authentication, authorisation, roles and privileges in order to protect information and IT assets against inappropriate or unauthorised access.

CFFS remains responsible for the management and approval of access rights to its secured file servers and fund-accounting applications. The IT environment provides secured remote-access mechanisms, including two-factor authentication, encryption of data in transit and encryption at rest.

In connection with the provision of these services, authorised BDO Services personnel may, where necessary, have access to information relating to CFFS, its clients and underlying investors, including personal data within the meaning of Regulation (EU) 2016/679 (the “GDPR”), accounting information, business information and other information processed within the CFFS IT environment.

CFFS retains full oversight and overall responsibility for the outsourced IT activities at all times.

Internal Audit Outsourcing

Pursuant to Article 41 of the LFS and in accordance with Circular CSSF 22/806 on outsourcing arrangements, as amended, CFFS has outsourced the operational performance of its internal audit function to HACA Partners, located in Luxembourg.

HACA Partners is responsible for designing the internal audit plan, preparing audit programmes for individual assignments, performing the internal audit work, issuing written internal audit reports, preparing the annual internal audit summary report and following up on recommendations issued in previous assignments. The internal audit plan remains subject to approval by CFFS Management and the Board of Directors.

For the purposes of performing the internal audit assignments, HACA Partners may be granted access to records, documentation and information necessary for the performance of its mandate, including, where relevant to the scope of an audit assignment, information relating to CFFS clients and their investors. CFFS remains responsible for establishing and maintaining its internal-control framework and retains oversight over the outsourced internal audit function.

HACA Partners is subject to professional secrecy obligations under Article 41 of the LFS. Access to information and systems is subject to the principles of “need to know” and “least privilege”, meaning that access is restricted to persons whose functions require it and that the related privileges are limited to the minimum necessary for the performance of their duties.

CFFS retains full oversight and overall responsibility for the internal audit function at all times.

Other Operational and Administrative Outsourcing

CFFS also relies on BDO Services Luxembourg S.A. for certain operational and administrative support services under a service level agreement concluded within the BDO Luxembourg group.

The services covered by this framework include, depending on the activity concerned, human resources, payroll administration, marketing and communication, facilities and logistics, financial services, data-protection support, information technology and knowledge-management services.

Where such services involve access to confidential or personal information, access is limited to what is necessary for the performance of the relevant activity and remains subject to the applicable confidentiality, professional secrecy, data-protection and information-security requirements.

CFFS retains oversight of the outsourced activities and remains responsible for the services provided to its clients.