Financial Crime World

Luxembourg Bank Secrecy Laws Get Update: New FAQs Introduced for Specialized Investment Funds and Depositaries

Update on Obligations for Data Transfers

The Commission de Surveillance du Secteur Financier (CSSF), Luxembourg’s financial regulator, has recently updated its frequently asked questions (FAQs) to clarify the obligations of specialized investment funds and depositaries in relation to data transfers. The new FAQs aim to ensure that fund investors’ personal and confidential data is protected when outsourced to third-party service providers.

Key Changes and Requirements

According to the revised FAQs, depositaries or central administration acting on behalf of a Luxembourg-based fund must obtain prior consent from the fund’s board of directors or management company before outsourcing certain services to another provider. This consent should specify the scope of data to be transferred and the country in which the outsourcing third party is established.

Fund Investor Consent

Moreover, the CSSF emphasizes that fund investors must also provide their explicit consent for the transfer of their personal and confidential data before it can take place. To achieve this, funds are advised to:

  • Send Explanatory Letters: Send explanatory letters to existing investors informing them of the potential data transfers and providing an opportunity to object within a reasonable timeframe.
  • Include Informative Provisions: Include informative provisions on data transfers in subscription documents or offering memoranda for new investors.
  • Update Prospectus: Update their prospectus at the first available occasion to reflect these changes.

Depositaries’ Obligations

Prior to outsourcing services, depositaries or central administration must obtain a commitment from the fund or management company that investors have been informed of and consented to the transfer of their personal and confidential data. This move underscores Luxembourg’s commitment to maintaining high standards of financial regulation and protecting the confidentiality of its citizens’ data.