CSSF Updated FAQs Obligations of Professional Secrecy

On 2 September 2019, the CSSF updated the below sets of frequently asked questions (the “FAQs”) for the purposes of, adding a new question regarding obligations to be complied with in case of data transfers by a central administration or a depositary to another service provider:

a. Frequently Asked Questions concerning Specialised Investment Funds (“SIFs”) under the Luxembourg law of 13 February 2007 and Investment Companies in Risk Capital (“SICARs”) under the Luxembourg law of 15 June 2004 that do not qualify as Alternative Investment Funds (“AIFs”);

b. Frequently Asked Questions concerning the Luxembourg law of 12 July 2013 on alternative investment fund managers as well as the Delegated Regulation (EU) 231/2013 of 19 December 2012 with regard to exemptions, general operating conditions, depositaries, leverage transparency and supervision; and

c. Frequently Asked Questions concerning the Luxembourg law of 17 December 2010 relating to undertakings for collective investment (“UCITS”).

The FAQs emphasize the need for a service provider (hereinafter the “Service Provider”) acting as the central administration or depositary bank to obtain the prior consent from the board of directors of the relevant fund or its management company or AIFM for further outsourcing certain assigned services (hereinafter the “Client Consent”). The Client Consent should refer to the Service Provider’s services to be outsourced, the scope of data to be transferred in light of such outsourcing arrangement as well as the country of establishment of such outsourcing third party(ies) pursuant to Article 41 (2a) of the law of 5 April 1993 on the financial sector, as amended.

Prior to granting such Client Consent to the Service Provider, it is vital for the relevant fund’s investors to have consented to the prospective transfers of their personal and confidential data in advance:

(i) through an explanatory letter by the fund to each of their existing investors including a possibility to object to such transfer within a reasonable timeframe,

(ii) through informative provisions to this end within the relevant subscription documents or the offering memorandum for future investors,

(iii) by modifying the prospectus at the first available occasion.

Before outsourcing the services, the Service Providers should obtain the commitment of the relevant fund or management company, where relevant, that investors have been informed of and consented to the transfer of their personal and confidential data.