Data Protection Law and practical steps to be taken – Guernsey Press

This is a copy of our Article that was featured in the Guernsey Press (28/02/2018)

GDPR / Data Protection Law and practical steps to be taken

New data protection requirements, both the EU’s GDPR and the new Guernsey law, and the fines that may be imposed have caused significant concern within organisations. There are some simple steps that can be taken towards compliance with the new requirements.

  • Data Audits

The starting point – a list of personal data held within an organisation, answering the following:

  • What types of personal data do we hold/process?
  • Where do we hold it?
  • Why do we hold/process it?
  • Who can access/use the data?
  • How long do we keep it for?
  • Privacy Impact Assessment

This helps to determine what the risk of processing the personal data is and should contain:

  • A description of the processing
  • The need for the processing
  • The risks posed is processing the data
  • Whether processing complies with relevant codes
  • Safeguards and security measures in place to protect the data
  • Lawful processing

There has been a lot of talk about consent; the common misunderstanding is that consent is required for any processing of data. This is not true as there are other mechanisms that also result in processing being lawful – for example fulfilling a contract with a client.

  • Governance

This relates to the directors (or other governing body) of the organisation. They should review the output from the previous sections to understand the data processed by the organisation and risks associated with it. Governance should ensure that the “tone from the top” results in good data protection practice feeding down through the organisation.

  • Policies

There are two policies that an organisation should have relating to data protection:

  • Data Protection Policy
  • Data/Document Retention Policy

These are approved by the directors, driven by the data audit and privacy impact assessment, and set the high-level approach to data protection within the organisation.

  • Processes & Procedures

The processes and procedures used by the organisation on a day-to-day basis should be reviewed and updated to reflect the policies. This means that compliance with data protection requirements becomes embedded in the practices of the organisation.

  • Training

Training is important at all levels. All staff have responsibility for ensuring data is protected and should receive training. Directors and senior managers should have a greater level of awareness of the responsibilities of the organisation, whilst the data protection officer, or other responsible person, should receive detailed training on the requirements and their role.

  • Re-Assess

Once all measures have been put in place go back over the steps and see whether further improvements can be made.

Measures taken to comply with data protection should be proportional to the business and the categories/volume of personal data held. If you need help, there is training available and consultants available to assist you. Nobody wants to be the first breach under the new law.

Selling Funds into the UK

Often, we take it for granted that people understand that companies selling funds internationally must follow the laws and regulations of the countries in which those funds are sold. Each country has its own restrictions and requirements for the selling of foreign funds; in some cases, restrictions are so severe that active sale is not possible.

In this article we are going “back to basics” and looking and one of the traditional markets for offshore funds – the United Kingdom.

Determining your market

It is not enough to say “I want to sell into the UK”, what is important is to determine whether your target market is purely institutional or whether registration for sale to retail investors is required.

The requirements for selling to institutional investors comes from the Alternative Investment Fund Managers Directive (AIFMD). AIFMD deals primarily with sales to “professional investors”, which includes all regulated entities, governmental bodies, large companies and can include “sophisticated” individuals. There are two Articles of AIFMD that deal with sales of non-EU/EEA funds:

  • Article 36 deals with the sales of non-EU/EEA funds that have a manager in the EU/EEA
  • Article 42 deals with the sales of non-EU/EEA funds that have a manager outside the EU/EEA or that are self-managed

Both Articles leave it to an EU country to set their own requirements for allowing fund sales to professional investors in that country under a National Private Placement Regime (NPPR).

Institutional investors – UK NPPR

The UK NPPR is a straightforward notification regime, requiring:

  • Completion of a short excel template form, to be forwarded to the Financial Conduct Authority (FCA)
  • Payment of an application fee within 30 days – maximum £250

The form and fee will vary depending on whether the marketing will be under Article 36, Article 42 or by a sub-threshold manager. The manager will receive a notification email within a day of submitting a properly completed form – following receipt of this marketing can commence.

There are initial and ongoing disclosure and reporting requirements:

  • Initial disclosures, normally included as an annex to the offering document or as a separate supplement
  • Ongoing disclosures, normally disclosed in the annual report and accounts
  • Regulatory reporting, which will be on an annual, semi-annual or quarterly basis depending on the assets under management of the manager

There will also be an annual fee payable.

Retail investors

If the manager wants to sell to fund to the public in the UK, there are a set of requirements in addition to those covered under NPPR above. Until the advent of AIFMD, there was specific recognition of Guernsey Class “A” Schemes under section 270 of the Financial Services and Markets Act 2000 (FSMA) and a designation order by Her Majesty’s Treasury. Now Guernsey Class “A” Schemes are treated the same as any other foreign funds and require individual recognition under s272 of FSMA.

Registration under s272 of FSMA includes requirements for:

  • A completed form 272 (25 pages)
  • Constitutional documents for the fund
  • Offering document for the fund
  • Latest annual financial statements and any subsequent semi-annual report
  • Legal comparison of the scheme against the nearest UK-authorised comparable scheme
  • Management agreement and details of the management relationship
  • Potential independence issues between the scheme and its service providers
  • Details of adequate investor protection
  • Business plan (unless fund is older than three years)
  • Marketing arrangements
  • Payment of an application fee (£8,000)

In addition to the disclosures and reporting required under NPPR, there will also be the requirement for a Key Information Document (KID) under the EU’s Packaged Retail Investment and Insurance Products (PRIIPs) Regulation.

The Guernsey funds industry has one wish for the post-Brexit world – reinstatement of s270 of FSMA accompanied by recognition of appropriate Guernsey retail funds. This would put Guernsey back on par with the EU when selling retail funds into one of our largest traditional markets.

Midshore Consulting offer the Compass:Funds service, providing guidance and assistance in registering funds for cross-border sale into various markets. For further information about this service please contact us.

Distribution of Guernsey Funds

The following article reproduces the information from my presentation at the GIFA Technical Townhall event on 18th January 2018 with a few additions and extra notes.

What this article will not be covering

The first topic I won’t cover here is the National Private Placement Regime (NPPR) under the Alternative Investment Fund Managers Directive (AIFMD). This topic has been discussed many times before, and is likely to be revisited in the future.

The other thing I won’t deal with here are the many other countries/jurisdictions that are already known as places that Guernsey funds can be sold into. This list is not exhaustive, but includes:

· Switzerland · Australia · Bahrain
· Hong Kong · Botswana · Macau
· Jersey · Chile · Taiwan
· Turkey · Singapore · South Africa

European Union (EU)/European Economic Area (EEA) – Retail Funds

Whilst the sale of Guernsey funds to institutional investors under AIFMD NPPR is a well-known and well-trodden path, what is not often thought about are the EU/EEA countries that accept registration for retail funds sale from Guernsey. Sale of non-EU funds to retail investors is permitted under Article 43 of AIFMD. Both whether retail sale is permitted and the precise requirements for such retail sale are left to the discretion of the Member State.

Just a reminder to all businesses considering such retail sale into the EU – please remember to issue a Key Information Document (KID) under the EU Packaged Retail Investment and Insurance Products (PRIIPs) Regulation.


  • Funds from Guernsey, Jersey and the USA are recognised for retail sale
  • The registration fee is the same for a Guernsey funds as it is for an EU UCITS fund
  • Unlike an EU UCITS fund there is no requirement for a Guernsey fund selling retail in the Netherlands to appoint a Dutch representative and paying agent – making indirect costs cheaper than for a Guernsey fund


  • There is a scheme for recognition of Alternative Investment Funds for retail sale in Belgium, this would include Guernsey funds
  • There is a requirement for a Belgian representative for both an EU UCITS fund and a Guernsey fund
  • There are fees attached to registering an EU UCITS fund (€300 registration fee and €2,055 annual fee) but no such fees for the Guernsey fund; this makes the costs for selling a Guernsey fund into Belgium cheaper than an EU UCITS fund


  • Both Guernsey funds and EU UCITS funds require both a depositary and a Danish representative
  • The registration fee for an EU UCITS fund is DKK 5,585; for a Guernsey fund there is no such fee
  • The annual fee for an EU UCITS fund is DKK 17,872; for a Guernsey fund it is DKK 4,468


  • Both EU UCITS funds and Guernsey funds require an Irish facilities agent to sell into Ireland
  • There are no registration or annual fees for either an EU UCITS fund or a Guernsey fund
  • Ireland has specific recognition of the Guernsey Class “A” Scheme for retail registration

Whilst clearly retail investors can only be accessed in some countries of the EU/EEA, there are circumstances where registering a Guernsey fund could be more cost-effective than setting up and registering an EU UCITS fund to market to a restricted number of countries.


Whilst there are still complexities in dealing with China, the regulatory memoranda of understanding in place between the Guernsey Financial Services Commission (GFSC) and the various Chinese regulators do allow investors participating in certain programmes to invest into Guernsey funds.

Qualified Domestic Institutional Investors (QDIIs)

Chinese investors participating in the QDII programme can all be marketed to due to the various MOUs as referred to above.

  • Chinese banks and trust companies can invest by virtue of the MOU the GFSC has with the Chinese Banking Regulatory Commission (CBRC)
  • Chinese insurance companies can invest due to the MOU with the Chinese Insurance Regulatory Commission (CIRC)
  • Chinese investment managers can invest as a result of the MOU between the GFSC and the Chinese Securities Regulatory Commission (CSRC)

Qualified Domestic Limited Partnerships (QDLPs) & Qualified Domestic Investment Enterprises (QDIEs)

QDLPs (from Shanghai) and QDIEs (from Shenzhen) may both invest or feed into Guernsey funds and here the MOU between the GFSC and the CSRC again comes into play. It is also worth noting that whilst the issuing of investment quotas to QDLPs was unofficially suspended in late 2015, this is expected to recommence in quarter 1 of 2018.

Future: Qualified Domestic Individual Investors (QDII2)

Whilst called QDII2, this is a completely separate initiative from QDII aimed at allowing overseas investment by high net worth individuals rather than regulated companies. This was originally scheduled to come about a couple of years ago, however the rumour-mill now indicates a 2018 launch for this programme.

It is expected that QDII2 will initially launch in six cities (Shanghai, Shenzhen, Tianjin, Chongqing, Wuhan and Wenzhou). The definition of “High Net Worth” is alleged to be individuals with at least one million Renminbi and the scheme will allow individuals to invest up to 50% of their assets overseas.

Future: Mutual Fund Recognition

In May 2015 both the CSRC and the Hong Kong Securities and Futures Commission (SFC) announced a Mutual Recognition of Funds between the mainland and the Hong Kong Special Administrative Region. This has always been seen by the mainland as a pilot programme set to be followed with such recognitions with other jurisdictions.

Guernsey is well-placed to take advantage of such extension of mutual recognition by China to other countries. Unlike such EU jurisdictions as Luxembourg or Dublin, Guernsey is not hampered by restrictive EU directive (UCITS and AIFMD) in dealing with other non-EU countries such as China.

It is important to recognise the work that Guernsey Finance, specifically Wendy Weng and Kate Clouston, have done to keep Guernsey at the forefront of awareness of Chinese authorities and regulators. Long may this continue.


As a quick aside here, according to the PwC statistics on global fund distribution in 2016, Curacao was the third most prolific jurisdiction in the Americas as a target for cross-border fund distribution (after Chile and Peru).

Curacao (and Sint Maarten) have a list of “approved jurisdictions” from which funds can be sold into the island with reduced requirements. This is a limited list consisting of:

  • The Netherlands
  • Luxembourg
  • Guernsey
  • Jersey
  • United States of America

Challenge Guernsey: India

At this point, I would like to move from countries Guernsey funds can be sold into to countries that no funds can be sold into… India.

There are many good reasons to have India as a key target for fund distribution:

  • 2nd largest population in the world (after China)
  • 3rd largest Gross Domestic Product by Purchasing Power Parity (after China and the USA)
  • 4th by number of billionaires (after China, the USA and Germany)
  • 200,000 high net worth individuals

Whilst India is clearly a key potential target, there are many restrictions in place:

  • Foreign funds cannot register for sale into India
  • Private placement can be used to sell into India, however this is limited to an “offer to less than 200 legal or natural persons” (natural persons should be “sophisticated investors”)
  • ALL Indian funds in aggregate can invest US$ 7 billion in overseas securities (including funds)
  • Indian individuals may only make foreign remittances to a maximum of US$ 250,000 per year (including for investment purposes)

Clearly trying to choose potential investors for the 199-offer limit with a potential 200,000 high net worth individuals (in a population of 1.3 billion) plus an unknown number of companies makes decision-making for sales teams hard. Furthermore, trying to choose individuals who will continue to invest to their annual limit makes the task even more difficult.

Let’s just step back for a moment and consider – what would it be like if Guernsey was the first foreign fund jurisdiction to be recognised by the Indian authorities. With Prime Minister Modi saying that he will relax restrictions on the Indian investors this may not be limited to the distant future.

Unite States of America

Moving back from future possibilities into the present, we now turn our attention to America. Whilst no fund manager in their right mind would seek full retail recognition for their fund with the Securities and Exchange Commission (SEC) under the Investment Companies Act of 1940, exemption by reason of private placement is possible. This is under Regulation D Section 506 of the Securities Act of 1933.

Regulation D s506 is an exemption from registration under the Securities Act due to private placement of the securities (or funds). This is done by submitting a Form D registration by notification for the exemption. The investors limits of using this route are 35 non-accredited investors plus an unlimited number of accredited investors. There are known examples of funds from the Cayman Islands utilising such registration without any specific agreement or memorandum of understanding with the United States or the SEC.

Exemption from registration is at the federal level; individual State regulators cannot block this but can themselves require notification or place some small amount of investor restrictions in place.

The SEC and most State regulators require submission 15 after the first sale of a security (fund)

  • New York requires notification the day before the first offer/sale
  • Illinois required notification within 12 months after the first sale

SEC fees for Form D submission vary between US$ 1,500 to US$ 3,000; State regulator fees vary:

  • Lowest: Illinois & Indiana – nil
  • Highest: New York US$ 1,385 (US$ 2,135 for a real estate fund)

There are other examples of differences between States, for example:

  • SEC registration requires annual renewal and notification of updates
  • State registration varies from annual renewal to 4 years (New York) to indefinite; not all States require updates
  • Florida may require sales people to become an “agent of issuer” (cost US$50 per agent)
  • Some States require paper submissions, others electronic
  • Some States (e.g. New York and New Jersey) require their own form; most will accept a copy of SEC Form D
  • Some States don’t require notification under certain limits

However, as can be seen in the following table, Private Placement under Regulation D has more harmonisation and allows greater access than European NPPR under AIFMD.

USA Regulation D section 506 AIFMD NPPR Article 42
Significant harmonisation at federal level No harmonisation at Union level
Notification only Mix of notification and authorisation
States cannot “opt out” Member States can “opt out”
Can access all 50 States, the District of Columbia, the US Virgin Islands and Puerto Rico Can only access around two-thirds of EU/EEA Member States

Recognition: Not Just About Funds

The same principles of recognition, registration, exemption from registration or registration for exemption could be applied to many difference financial products and services beyond funds. Such examples include investment services, pension schemes and life products & platforms.

Investment Services

With the advent of the Markets in Financial Instruments Directive II (MiFID II) and the Markets in Financial Instruments Regulation (MiFIR) in the European Union it is important to note that investment services, such as management and advice, may be recognised or registered in certain jurisdictions.

  • European Union: under MiFID II and MiFIR there are third country provisions (Article 39 of MiFID II and Article 46 of MiFIR) for providing investment services into the EU
  • At least one Guernsey investment firm has registered to provide investment advice and management into South Africa under the Financial Advisory and Intermediary Services Act (FAIS)
  • The USA operates a Registered investment Advisor (RIA) regime, which can be accessed by foreign providers; a recent article cited 93 Swiss firms as being RIAs, however there are currently no known examples of Guernsey firms registering as an RIA

Key message: We can do more than we think we can…. We only have to discover what we can do!

Postscript: Canada

Whilst I forgot to mention this during the townhall presentation, I should now highlight that there is also a private placement regime available in Canada following registration with the Canadian Securities Administrators (CSAs – the regulators in each province and territory). More detail to follow on this in the future.

Postscript: Kuwait

Thank you to one attendee at the townhall presentation, who informed me afterwards that Guernsey funds have successfully registered for sale in Kuwait. Following research, I can advise that this is registration for a private placement regime to professional investors and requires the appointment of a Kuwaiti licensed entity as a subscription agent. Another one for the “can do” list!

Data Protection Awareness module now live!

Today we have officially launched our Data Protection Awareness online training module.

The module is aimed to give all staff members the basic knowledge they need in regards to data protection. And with today’s announcement that Emma Martins will be our Data Protection Commissioner, what better time would there be to brush up your skills.

Read more about the module here.

If you are interested in booking the module, please contact me (