Corporate Governance Policy for Trust, Investment Business and Fund Administration Providers (Revised August 2022)

Summary

This is a Bermuda Monetary Authority policy paper setting out corporate governance expectations for entities licensed or registered under the Trusts (Regulation of Trust Business) Act 2001, the Investment Business Act 2003, and the Fund Administration Provider Business Act 2019. It does not create new statutory requirements but is used by the BMA to assess whether such firms meet the existing statutory minimum criterion of having adequate corporate governance policies and procedures. The Policy sets out nine principles covering board practices, senior management, risk management and reporting, applied proportionately based on an institution's size, complexity, structure and risk profile.

• Board role and structure: The board holds ultimate responsibility for strategy, risk, financial soundness and key policy approval, including oversight of outsourced functions; its size and composition should reflect the scale and complexity of the business.
• Director qualification and conduct: Directors must be fit and proper, act honestly and in the institution's best interests, keep skills and knowledge current, disclose other commitments, and manage conflicts of interest under a formal written policy.
• Senior management: Senior management, who must also be fit and proper, are accountable to the board for day-to-day management; at least two individuals (or two partners, except for sole traders in limited-scale businesses) must effectively direct the business.
• Risk management: The board must set a risk appetite, ensure policies to identify and control material risks, and where appropriate establish a resourced, sufficiently independent risk management function with access to the board.
• Periodic reviews: The board should review the risk management framework, business continuity and contingency plans, and the internal control framework at least annually.
• Reporting: The board must ensure timely, quality information for its own decision-making, meet all statutory disclosure and regulatory reporting obligations, and maintain appropriate reporting mechanisms to shareholders and other stakeholders.

The Policy applies to fund administrators licensed under the Fund Administration Provider Business Act 2019 but not to investment funds themselves. Unincorporated licensees (partnerships, sole traders) should apply the principles with references to the board substituted by partners or owners as applicable, and Bermuda-regulated subsidiaries of foreign groups must ensure group-level practices do not breach Bermuda law or this Policy.

Key obligations

• Implement corporate governance policies and procedures meeting the statutory minimum criterion under the applicable regulatory act
• Ensure the board approves key policies on risk management, internal controls and compliance, and retains oversight of outsourced material functions
• Maintain a formal written conflicts of interest policy with an objective compliance process
• Ensure directors and senior management are and remain fit and proper, with directors regularly updating their skills and knowledge
• Ensure at least two individuals (or two partners) effectively direct the business, except sole traders with limited scale/scope
• Establish and document a risk appetite, risk policies and procedures, and at minimum maintain a risk register of material risks
• Review the effectiveness of the risk management framework at least annually
• Review business continuity and contingency plans at least annually
• Approve and review the appropriateness of the internal control framework at least annually
• Ensure remuneration arrangements are consistent with effective risk management and do not incentivise inappropriate risk-taking
• Meet all applicable statutory disclosure and regulatory reporting requirements
• Provide shareholders and other relevant stakeholders with sufficient information to assess board and senior management effectiveness

Applies to

Licensed or Registered Persons under the Trusts (Regulation of Trust Business) Act 2001, Licensed or Registered Persons under the Investment Business Act 2003, Fund administrators licensed under the Fund Administration Provider Business Act 2019

Deadlines

• at least annually: Board should assess the effectiveness of the institution's risk management framework and make necessary changes
• at least annually: Board should review business continuity and contingency plans
• at least annually: Board should approve and review the appropriateness of the internal control framework