mebs & Thomas Murray present Thomas Murray Fund Solutions

Good morning everyone. I am Christopher Born, member of TMFs and member of the executive committee at MAPS. I am delighted to welcome you all to the first webinar of Thomas Murray Fund Solutions. Today we are going to discuss a topic that is of growing importance for our industry: due diligence, whether it is for delegates or service providers. Over the next half hour we will discuss the various challenges that we may encounter in our aim to perform sound due diligence. I'm sure we all have some good examples of the difficulties we faced in this process. Well, today we would like to shed some light on a solution that can help you overcome these challenges. At the end of the discussion there will be time for a Q&A. Let me introduce you to our panelists today, who have many years of experience in this field: Ross Whitehill and Carlos Ross. If you can say a word on your background.

Christoph, thank you very much. Good day ladies and gentlemen. Ross Whitehill is my name. I'm currently the Chief Executive at Thomas Murray. I've spent much of my life involved in due diligence and monitoring of third parties, service providers, and delegates. I in fact began life as a regulator with a Reserve Bank in Australia, and I think that gives me reasonable qualifications and background for this industry right now. Thank you, Christoph. Over to you, Carl.

Thank you, Christoph. Thank you, Ross. Hi everybody, my name is Carl Hasser. I'm the Clients Manager at Demi Business Solutions. I have over 11 years experience in the Luxembourg fund industry, holding various positions, and due diligence is part of my life today and part of the struggle that all of us probably face as well. So thank you for being with us.

Thank you. It's great to have you both here today to share some very interesting insight on this due diligence exercise. Can I start by asking Carl a very trivial question, but which may make sense to set the scene: why do we perform due diligence?

Well, Christoph, as you know, it is a regulatory requirement in Luxembourg to perform initial and periodic due diligence on our delegates. The initial due diligence allows us to identify, assess, and later also manage all of the risks arising from a delegation, for example operational, ML/CTF, financial, legal, and of course reputational risks. It also helps us assess whether a potential delegate is qualified and capable of performing the function we wish to delegate to them. We also want to know whether they are also capable of providing reporting to us on these delegated functions in order to satisfy our ongoing monitoring requirements on this delegated activity.

Thank you, Carl, for this very nice introduction to due diligence. Based on your practical experience, what are the challenges which the industry faces with regard to due diligence?

Yeah, there are quite a few number of challenges that we in the industry are faced with. We have first of all a lack of substance in the due diligence questionnaires. Much too often do management companies just not have access to proper entity-specific due diligence questionnaires, nor do they have standardized scoring methodologies in place. Next one would be the data collection is often ineffective. Respondents may have various internal parties involved in providing responses to specific due diligence questions, which takes time. It's very time consuming and not very efficient use of time. In very few cases is one single person responding to the whole due diligence questionnaire. We're talking about 30-something pages sometimes. It takes a lot of input that goes in there, and what's missing is a centralized platform to get this all across. Then we have an opaque process, the result lacking a centralized and systematic approach. There's also a lack of transparency, pardon me, on the progress of the due diligence process, whether it is from a sender or respondent's point of view. Often becomes problematic: where do we stand? What's the status? These are common questions that we hear every single day. And then we also have the inappropriate data assessment. It is currently short of a proven assessment protocol. Data is often misrepresented or misinterpreted, and this could lead to compliance and also operational issues. A big one is also the absence of a proper reporting framework. Current due diligence results are either incomplete or not properly formatted for external review. Then we have data management which is quite often poor as well. Data is ineffectively processed, thus making benchmarking and the extraction of data next to impossible. And then we all know this one very well: inefficient resource management. The complexity and the time required within a due diligence process, I mean one single due diligence is often completely underestimated, which leads to inappropriate resource allocation, a problem we all struggle with. Nobody has enough time anymore. And finally, there are alternatives but they're expensive. With a lack of an in-house systematic approach, alternative solutions are only available at a significant disproportionate cost. And to this end, together with Thomas Murray, we developed Thomas Murray Fund Solutions, which capitalizes on Thomas Murray's renowned technology platform, Supplier Select for Financial Services.

Thank you, Carl. So as we can see, there are a number of challenges that we have to come across when it comes to due diligence, which can be summarized in terms of data transparency, quality of the reporting. In that respect, I'm turning to you now, Ross. Thomas Murray Fund Solutions and why now?

Christoph, thank you. I think we saw some time back an opportunity to leverage the technology that we'd built within Thomas Murray over the last 20 years of gathering data, issuing questionnaires to global custodians, regional custodians, sub-custodians, CCPs, CSDs, prime brokers, transfer agents. So we built up a massive amount of experience and libraries of questions that people wanted to ask as part of their due diligence and monitoring exercises. And I think when we came across MEB Business Solutions, we saw an expertise there, a compliance and understanding of a different universe of counterparties or delegated entities within the fund management world. And we said, why don't we combine our technology capabilities and questionnaire robust scoring methodologies that we've embedded into the technology with MEB Business Solutions' compliance expertise and local knowledge? And I think this strategic partnership is the combination of two very specific competencies that create an extraordinary opportunity for ourselves and for the industry to resolve some of the problems that Carl just identified. And I think many of those would resonate with the people that we're talking to today. I think the difficulty of getting comparative data from a counterparty is often very, very difficult. We find over the years of experience that we have that people will answer various questions in ways that are very much opaque, or they'll decide to withhold information, saying the response to this question is effectively confidential information, which of course most times is not. And when it is confidential, we're obviously here embraced with the duty of care and confidentiality over client documentation. So I think what we saw was the expertise that MEB Business Solutions and Thomas Murray had made sense to create this strategic partnership. And it comes at a time when regulatory interest in due diligence and monitoring is at an all-time high. We've seen, if you look at CP 18 698, the terms and conditions laid out, notably clause 420 onwards, which is super prescriptive. We see that many groups actually need the support of groups like Thomas Murray Fund Solutions. And then if you look in other jurisdictions, we know that the regulators are set to their regulated entities: we see you guys have a plan but you're not executing it, and we want to see you executing it. And we think that there are a couple of very good reasons for combining MEB Business Solutions' compliance expertise with perhaps Thomas Murray's legacy 20 years working in the technology sphere. That's probably a very long answer to a short question, Christoph. I'm sorry.

No, thank you, Ross. I think it was a very interesting point of view and it sounds very promising. So elaborating on what you've just said, what are the advantages of using Thomas Murray Fund Solutions?

Yeah, it's interesting actually. When you go back to Carl's earlier points, I think it's the process, it's the technology, it's the compliance understanding. I think if we start with the technology, we've obviously got the technology platforms. The questionnaires are embedded in that technology. There's a robust scoring methodology also within the technology platform. So when respondents answer, the system helps us to score those responses. It doesn't remove the need for intellectual firepower from yourself, Christoph, Carl, and your teams, but I think some of the advantages are very clear. Often we neglect the people who are responding. So we think it's right to be intrusive, just as the regulators are, and ask difficult questions, but we often forget how difficult it can be in terms of time commitment, which Carl highlighted, for people to respond. The technology we have allows people to import previous responses. So let's say a transfer agent in the year 2021 responds to one of our questionnaires. Next year or two years, three years time, whatever, they can import their previous response. The technology allows us to determine where the response may have changed, and the scores will be adjusted accordingly. So I think there's a real efficiency for people who use the platform to respond. I think if we go through the process very quickly, what we do with our clients at TMFS is agree a questionnaire, launch that to the appropriate delegates, and then the managed service would facilitate them responding. So if people come back and say attach an insurer certificate from say 2003, the technology picks that up, it flags it to our team here who then say actually this is an old insurance certificate or your ISA 3402 is out of date. So that managed service allows us to follow up with the respondents. Once the responses are in, we process them, we put them through the automatic scoring, we validate the scores and the responses. Carl and his compliance executives go through the unscored questions and validate the responses and assign a score to it, and then produce a report back to the client. I think that's at its simplest how the platform works.

Thank you. As you have underlined, there is a part related to technology, so sometimes it can be a bit frightening for some of our audience. Concretely, how does TMFS work? As you say, it's user-friendly or it has been designed to be user-friendly, but concretely how does it work?

Yeah, very simply, just agreeing the question up front. So clients will determine whether they want to use the existing questionnaires that we have or whether they'd like to supplement. I mean, typically what we've seen over the decades that we've been issuing questions is that everyone has a particular way of working and one wants to ask supplementary questions. We do try and keep those to a minimum because obviously it becomes then a challenge of managing multiple different questionnaires, and it can be very often difficult for the recipients of those questionnaires. So that's the first thing: get your questionnaire right so you know you're asking the right questions that will ultimately mean that you can satisfy your regulatory obligation. Once the questionnaire is issued, we typically leave it in the market for between four to five weeks. Often people say no, you should only keep it a very short period, maybe two weeks, because that keeps the respondent sharp. Others will say no, the longer the better. I think what we've found is that if it's too short, you get poor responses. If you leave it too long, it's a bit like university students, if I may say, they don't do the assignment till Sunday evening. So typically we find if you leave it too long, people don't start responding until five weeks and six days, then you get equally poor responses. So the questionnaire is typically around four weeks in the market. Generally it would take us about a week to score the responses and prepare the report. Ultimately it depends on the number of delegates that we're looking at and the complexity of the responses. But that's essentially how it works. And then Carl and his team would be responsible, Christoph, for signing off on the report and saying this looks good, these people appear to be compliant. And where they're not, I think Carl you're better able to explain this than me, but Carl would ideally be going back and saying look, we've identified a problem with this distributor, we recommend that you take them into due diligence. But that's a whole different subject, on-the-ground due diligence, which I guess you want to address at some point, Christoph.

Thank you, Ross. We said in the introduction that there is a wide range of different service providers or delegates using TMFS. On which type of delegates or service providers can you perform a due diligence?

Well, there's a range. We've got eight questionnaires currently embedded. So they cover groups like central administrator, transfer agent, depository, risk manager, investment advisor, portfolio manager. Who have I left out?

The IT service provider.

Yeah, sorry, Carl. The IT service provider. But you know, we're not locking it down to that. We've got people saying to us already: we have a property fund, we need your assistance with the valuation of property valuation manager. Do you have a questionnaire for that? Thankfully we've got the competence and expertise within MEB Business Solutions that can help us with that. More recently, Christoph, and I think you brought this one to us, people looking at ManCos now actually want to start performing due diligence on management companies. So yeah, we know that this is going to expand. But we've got a library, as I say earlier, from global custodian, CSD, CCPs, TAs, prime brokers, pretty much everyone in the financial services space. Now as part of what we're doing in terms of third party risk management and risk monitoring, we're looking at any counterparty that you care to mention, because that's really what the regulators require. It's pretty clear with CP 18698 that the regulators expect due diligence first of all, and then they're very, very prescriptive on the monitoring.

So as we have seen, the solution is already covering a wide range of service providers, at least the key ones. Is it fair to say that it's an iterative process and other questions are in the pipe?

Yeah, there are absolutely other questionnaires in the play. And like Ross has mentioned, with the due diligence questionnaires on ManCos, on possible real estate valuers, the sky's the limit. And as we all know, the regulatory environment is constantly changing. We have faced new challenges, there are new demands, and we want to be prepared for that. And I think it's a very interesting point also that Ross has talked about: the solution is not only designed for management companies, but it can also be of use for boards of funds which need to perform due diligence. Absolutely, a management company and why not on other types of provider.

Absolutely. Yeah, Christoph, I'd add to that. I think the regulators look at this as a matter of risk and say if there's a risk exposure, we want to minimize that risk. I mean, I think when you look at the success of USATS and AFM, the regulator is not going to allow that to be compromised. I think we've seen challenges over previous decades, and Christoph, we don't want to see those events happen again. And equally, the regulators don't want to be at the pointy end of the investors' eye because they didn't properly monitor their regulated entities.

Thank you, Ross. It's absolutely true. There is also one point that we've touched upon because we are talking about the technology with the underlying digitalization behind, but we all know that digitalization is not almighty. So basically, is Thomas Murray Fund Solutions also able to perform on-site visits?

We absolutely can. This is part of the service that we provide. And MEB has compliance and subject matter experts who will come in and perform the on-site due diligences on behalf of potential future Thomas Murray Fund Solutions clients.

Thank you, Carl. I started this webinar with a very frequent question. I will certainly end up with also another trivial question: what happens if we are not performing any due diligence?

Well, it is a regulatory requirement to perform due diligence, and we have to perform initial and periodic due diligences, and they have to be documented. They must be safe kept at the company's offices. And if this is not the case, the CSSF may impose an administrative fine. This has happened, we've seen it happen, and unfortunately this company has been published by the CSSF. This company was named and shamed for not respecting certain aspects of the due diligence requirements.

Yeah, Christoph, can I just add to that? I think our experiences of due diligence are actually quite interesting. Carl and I were speaking yesterday about some of the experiences we've had. And I think there was one situation where we were looking at a service provider, very big name in the industry, and we were being told in the questionnaire responses and even in subsequent meetings that this was a core business for them and they invested a lot of money, a very significant amount of money being invested in the business. And there were a few things that just didn't stack up. We said to our client, we think it's worth doing some on-the-ground due diligence, going and testing some of the things they've been saying to us. And what we found was that their technology platforms, the old CRT screens, the cathode ray tubes, were what they were using. So this is not that many years ago, but their available desktop technology was really outdated. And the screens were sitting on people's desks on six or seven telephone books so they were at eye height. And we asked and said, if this is an important business, it doesn't look as if it's being properly resourced in terms of your basic working environment for people. And that really showed us that we were being told something that wasn't actually exactly true. Another situation, we were being told that there was adequate BCP and DR sites available. This was all well described in the responses, but we never got any very clear indications as to where the DR site was. When we got on site, we found it was in a separate room in the same building. So there was a five-bro wall between the main operating site and the disaster recovery. You think, how can this be? These are things you wouldn't discover unless you actually did the due diligence. So we were talking yesterday about the trust but verify mantra. And I think there's one also in German which Carl's better able to recite than I am: 'Vertrauen ist gut, Kontrolle ist besser.'

Thank you, Carl. I won't translate that one. As I've been able to do so, that's very interesting because we see and I think we have illustrated also the fact that due diligence is a dynamic process. Not I'm doing it once and for all. I'm doing my initial due diligence, I have selected my provider, and then it's fine. And then you have to do the ongoing, as you say, and also you have to adapt the questionnaire regularly to the regulatory requirements that may change over time. Thank you, gentlemen. It is now time for us to move to the Q&A section of this webinar and address the questions from our audience.

So we have the first questions coming from our audience, very good questions straight to the point: does your service meet the requirements of the CSSF Circular 18698, the famous one?

Thank you, Christoph. A great question there. Our obligation is to do whatever we could determine as best market practice, and we rely upon our good friends in MEB and their competence, with our experience of 20 years of asking these types of questions that are deeply penetrating and performing on-the-ground due diligence. Always remember though, the obligation rests with the regulated entity. What we've done is we've combined the best expertise that we can find in the market with the technology to enable the ManCos, for example, the regulated entities, to meet the requirements that they have to satisfy the regulators that they've done appropriate monitoring and due diligence so that they can comply with 18698, as we've described already.

Thank you, Ross. So basically we can say that the questions have been not only incurred in our own experience and practice but also has been aligned with the regulatory requirements. Maybe a second question that we can pick up. Very good question also because as we have said, time is of the essence when it comes to due diligence. So the question is: how long does this due diligence process take?

Well, I think this is something that Carl and I have been working on recently, and I think we agreed, as we said earlier, it's probably sensible to leave a questionnaire in the market once it's been agreed with the client. It's left in the market for about four weeks, and we have our managed service people that follow up to make sure that responses are in that period of being properly completed. The technology allows us to view what is going on, the progress that's being made, and our people intervene if they see that maybe if the 60 or 70 questions that are there, there's no progress being made within the first week or two. Our managed service executives get on the telephone, call up the respondent, and say: is there anything that we can do to help you? Can we walk you through this process so you understand how to respond? Or do you just have an issue with the technology platform or the complexity of the questions? So that managed service actually works during those four weeks. When the questionnaires are responded to, they come back in. We proof those again to make sure, as I said earlier, that the insurance certificates are correct, that the ISA 3402 is attached where that's appropriate. And we then put it through the scoring module and methodology. The questions that are not scored are then referred to Carl's compliance team to go through and do the additional scoring, while they also validate the responses and the scores assigned to these particular questions. And typically we think that's going to use another week of time. If there's on-the-ground due diligence, and Carl maybe you should cover this because it will vary. You have much more experience at doing on-the-ground due diligence with some of the delegates that we're talking about here.

Yes, indeed. This completely depends on the findings that come out from the initial report that the system has generated and that the compliance team has worked on. This could take anywhere from half a day to a full day just onsite interviewing people, doing sample checks, and finally writing up a report.

Thank you. Another question. Oh, I'm seeing that we have a very good audience with very straight-to-the-point questions, but also showing that they have listened to the challenges that due diligence may pose to us. This service sounds comprehensive, thorough, but how much will this service cost?

Ross? It's always great to be put on the spot. Thank you, gentlemen. Well, it really depends. I think what we've tried to do from the beginning of putting this strategic partnership together is to work on a solution that means this is cost effective for groups. So yeah, people not having to spend a lot of time on it, they're not having to spend a lot of money on it. Typically, I think where we'd see the questionnaires running out depends again on the complexity, but we're aiming to make the full end-to-end service available, this is pre-due diligence, but aiming to make that available for between sort of five and six thousand euros per service provider. There are going to be times when it'll be less than that, there'll be times when it's more expensive than that. But if that gives people a sort of range for the service provider, the more groups that we work with, i.e. the more service providers, obviously the less it becomes because that initial phase of discovery working with the other client reduces. But it's that order of magnitude.

Thank you, Ross. Another question, maybe yes, there is one. Ah, Carl, I think you have anticipated that one by speaking German. The question is: which languages do these due diligence reports come in at the moment?

The due diligence questionnaires and the due diligence reports are all in English. But I think it is perhaps something that we can address in the future if the demand is there. And there is another question which also may be underlined: does TMFS also cover other jurisdictions?

Well, at this stage, Christoph, what we wanted to do was just to focus on where we think the need is the greatest. And what we found is that Luxembourg is really looking for a powerful automated solution with superior compliance competence. So we're focusing very much on the Luxembourg regulatory environment in the first instance. But we've got inquiries coming in from other jurisdictions. And clearly, you and MEB have got clients right across the European theater. It doesn't take anyone with a great deal of experience to work out that places like Ireland, Guernsey, Switzerland, they're all now being asked to cover those jurisdictions. So we'll see that coming in time, I think.

Thank you, Ross. I'm looking if there is any other questions coming to us, but apparently not. So I think we can now close the webinar. Thank you all for attending. And should you want to contact us, please email us at the address that will be displayed: [email protected]. Thank you. And thank you to our panelists, who I think shared with us very interesting insights. And I hope this has been useful to you. And do not hesitate to contact us. It will be our pleasure to answer any questions you may have.

Indeed, thank you, Christoph. Thank you, Ross. And thank you to all of our participants today.

Thank you. I add my thanks to that. Thank you, Christoph. Thank you, Carl. Goodbye everybody.