Clearstream Your asset safety solution A briefing paper on how we protect customers’ assets 2 Clearstream: Your asset safety solution

Key benefits

Low-risk business Advanced operational market jurisdiction. We then always risk management keep your assets separately from As a market infrastructure, Clearstream’s to safeguard them Clearstream’s Central Securities To monitor and mitigate risks in the unlikely event that Clearstream, Depository systems are subject as far as possible, Clearstream its agent, custodian or depository to stringent EU legislation and applies an advanced operational risk should become insolvent. oversight to help protect your assets. management method as set out in the Basel II banking recommendations. Sound operations executed First-class AA risk ratings by industry professionals for our ICSD business Strict due diligence and transparency We prioritise the quality and reliability To achieve our first-class AA ratings of our operations. Our staff undergo from major international rating across our custody chains regular professional training and the agencies for risk management and average number of years’ experience operational efficiency, we adopt We operate secure and transparent working at Clearstream is high, such a holistic approach to asset safety. custody chains by carrying out strict as circa 13 years in the case of our IT As a Securities System, due diligence procedures concerning professionals. An annual client services our relatively low credit exposure our partners and suppliers and survey feeds into our continual and limited balance sheet contribute sharing information about our custody efforts to improve our operations to our AA ratings. chain setups with customers. and service offering.

Market and commercial Rigorous cyber neutrality and business continuity

Clearstream’s ownership model, management as part of the Deutsche Börse Group listed on the Frankfurt Stock Exchange, Our sound information security policy ensures that it takes a market neutral helps keep our infrastructure as secure position and acts in the best interest and resilient as possible. We take of all of its participants, free from any business continuity management commercial bias. seriously and have policies and systems in place to ensure optimal cyber security.

Account type choice and protection of your assets

A range of account types is available including a nominee account structure so that you can benefit from the strong Luxembourg and German asset protection laws no matter your home Clearstream: Your asset safety solution 3

Clearstream’s account protection policy triangle serves to keep your assets safe

What do we mean by asset safety? 2. Contractual rights and obligations Our definition is ultimately that asset as set out in Clearstream General safety is the ability for our customers Terms and Conditions, which to recover their assets, or equivalent, are published on the Clearstream held with us, in a timely fashion in the website. event of an insolvency of Clearstream or of one of our agents. 3. The legal environment under which the securities are held in the local To achieve asset safety at Clearstream, market. This is complemented all our customers’ assets are subject by our robust due diligence approach to the following safekeeping features, to doing business with our local which we refe r to as our asset protection custody chain partners, our global policy triangle: review, through local legal opinions in each market where we hold 1. The legal jurisdiction which governs assets, and the segregation of Clearstream’s business (as regulated Clearstream’s assets from those by respective local regulators of our clients. in Luxembourg and Germany).

Clearstream’s asset protection policy triangle

Legal jurisdiction

governing Clearstream business (Luxembourg

for our Luxembourg Central Securities

Depository services and International

Securities Depository; Germany for our German Central Securities Depository)

Clearstream:

Protecting

your assets

Contractual rights and obligations Legal environment

as set out in Clearstream under which the assets are held General Terms and Conditions, in the local market (when held

published on the Clearstream website through a domestic market link)

4 Clearstream: Your asset safety solution

Clearstream’s regulatory environment helps protect your assets

Some 70 central banks entrust According to this Collective Safe at a higher level in the custody their assets with Clearstream – Custody setup, in the unlikely event of chain. (This is legally referred to as collectively, a token of our solid asset an insolvency of Clearstream Banking being protected against “upper safety environment. Customers have Frankfurt, the investor or depositor tier attachment” and is set out in confidenc einthe fact that Clearstream’s retains asset ownership. In the case of Luxembourg securities settlement business, based in both Luxembourg an insolvency of Clearstream Banking system laws (Law of 1 August 2001 and Germany, is subject to regulatory Frankfurt, no customer securities would on the circulation of securities, and regimes which are amongst the most fall into the insolvency estate of this Grand Ducal Regulation of 13 July protective worldwide for the depositor CSD since, as a rule, customers have 2007 relating to organisational and end investor. proprietary-like rights on the customer requirements and rules of conduct assets and, therefore, such assets are in the financial sector). Under Luxembourg law (specifically, ring-fenced and can be separated from the Law of 1 August 2001 on those of the CSD’s by the customer More widely, in our investment funds the circulation of securities), our in the case of insolvency of Clearstream business, Clearstream’s interaction Clearstream Banking Luxembourg Banking Frankfurt. The depositors’ with fund agents is contractually (Clearstream Banking S.A.) customers entitlements are disconnected to any regulated and depositary banks benefit benefit from a "Jus in Rem" (Proprietary insolvency on our part and so can from reporting on registrars. Legal Right) entitling them to claim their be exercised independently from opinions on the domiciles of fund securities or equivalent securities the insolvency. registers assure customers that their deposited with Clearstream in the event beneficial ownership is recognised of bankruptcy. Thanks to Luxembourg and German in the markets where their assets are Proprietary Rights, when securities held. Our Delivery Versus Payment Similarly, customers holding assets are held by Clearstream in a nominee processing offers investor protection in our German Central Securities account or in a domestic market, by only transferring cash out of our Depository (CSD, Clearstream as long as the customer can prove that customer’s account once credited Banking AG or “Clearstream Banking the initial booking and records are with the fund shares. Further asset Frankfurt”) benefit from special with Clearstream, these securities are safety features for our Vestima Collective Safe Custody services protected according to the respective business are outlined in our Vestima – as governed by Section 9 of Luxembourg or German law. Asset Safety brochure. the German Safe Custody Act. The securities or equivalent securities would be retrievable in the event of a Clearstream bankruptcy.

Our customers’ assets cannot be seized or blocked in any way by a counterparty or any third party. Clearstream customers’ accounts are protected against any risk of being attached (transferred, as a legal process, to the creditor, or sold for the benefit of the creditor) by any third party creditor Clearstream: Your asset safety solution 5

Due diligence checks and continual market monitoring ensure you enjoy a transparent and secure custody chain

We apply a three-step approach to providing a transparent and secure custody network. We aim to continue this approach, continually building on our international standards together with any necessary adaptations to comply with and benchmark against the EU Central Securities Depositories Regulation (CSDR) requirements.

First, we carry out comprehensive and rigorous due-diligence checks when working with partners. Secondly, we continually monitor the activities of our custody chain participants and wider market developments. Thirdly, we equip you with the appropriate information for your own due diligence exercises.

Working with partners Our process for working with a custody Our network management team supplier (CSD, local custodian or agent carry out on-site due diligence visits. It is our policy to deposit customer bank) includes a formal request Following final approval from our assets at the upper tier level (issuer- proposal (RFP) or equivalent, depending executive management, we obtain CSD) wherever feasible. These direct on the institution in question, to leading a legal opinion from an external links to the local market infrastructure institutions in the target market, legal counsel. (CSD) give us a direct overview of that with criteria such as their credit market infrastructure. Where it is not rating, industry rank, management The local legal opinions we obtain possible to offer a direct setup (as not competences, liquidity and statements outline the extent to which the all domestic market regimes recognise of appropriate Anti Money Laundering Luxembourg or German asset market infrastructures located in other (AM L) measures. The operational protection laws are in line with the jurisdictions or maintain the necessary capacity, market reputation and local law in each domestic market rule of law to support compatibility), size of potential partners are also in which we hold customers’ assets. our careful and strict due diligence important factors. Where the local law does not approach to working with local partners reciprocate the strong Luxembourg as our indirect link into the market This RFP process ties together or German asset protection laws, is critical. a detailed operational review of each we seek to negotiate with the local individual business process of the partner. As a next step, internal legal, compliance and credit reviews check that the entities in question offer the most secure, sound and transparent settlement and asset services possible. 6 Clearstream: Your asset safety solution

CSD to achieve the same standards via contractual agreement. We flag up any areas where the legal characteristics in the given domestic market differ to the protection granted by Luxembourg or German law and publish this information for customers via our Market Link Guides on our website.

Local laws on relevant financial market topics are also taken into account in the legal opinion, to represent independent and neutral confirmation of the agent's ability to perform its functions towards Clearstream, and ultimately, to you.

Continual monitoring

Monitoring of both developments in the markets in which we offer services, and the activities of our partners, together with appropriate reporting, is paramount to minimise risk. Once the link is live, we collect and Transparency report statistics and incident data End-to-end internal and external testing regarding the operations of our custody Finally, we equip you with the relevant of direct domestic link operations suppliers, which we use in scheduled custody chain and market information takes place to provide a firm base, service reviews. We also closely to put you in the best position to manage before going live with any new link, monitor the quality of the market link your own risks. We request a Three for efficient systems performance and service, including via client feedback. Point Declaration (setting out reliable reporting. the underlying custody chain details) Following the launch of a link, we carry from all domestic and foreign out follow-up visits to our partners. custodians involved in our custody Continual monitoring of our suppliers’ chain. We publish these Three Point creditworthiness and credit lines Declarations on our website . enables us to identity and quickly take appropriate risk mitigation actions if we deem that the robustness of a supplier is changing. Clearstream: Your asset safety solution 7

Market information is easily available regulatory obligations they face, set out on our website. Updates are made in the Undertakings for Collective to our market profiles and Market Link Investment in Transferable Securities Guides as soon as our Network (UCITS V) directive and the Alternative Managers are informed by their network Investment Fund Manager Directive of local agents and contacts in each (AIFMD). It provides customers with respective domestic market. Email a view of the structure of our direct notifications are issued to your inbox and indirect custody links, indicators within 15 minutes of a page being of our relationship with CSDs or updated on the website. sub-custodians and risks at market, sub-custodian and CSD level and The Domestic Markets Monitoring so can also be of interest to non- Report (DMMR) offered by Clearstream depositary institutions. shows the custody chain below Clearstream that is applied to safekeep We also offer a specific Registrar securities in the domestic markets. Monitoring Report (RMR ) for securities The DMMR supports depositary banks held in the fund’s register kept in fulfilling the due diligence and by registrars and transfer agents.

Depository features explained entity safeguards the assets they Investor-CSD: Where we safekeep hold without these leaving the ICSD securities as investor-CSD, namely Issuer-CSD: For securities we issue in which they were deposited, meaning via links to other CSDs, our due and safekeep as issuer-CSD, customers no exposure to bank from diligence of our custody partners plays benefit from the fact that we are an asset protection perspective (and a fundamental role as well as our the top of the custody chain. We can vice-versa). To provide our customers local monitoring and understanding provide transparency to customers maximum flexibility in a common of the market environment which about the custody chain and we retain framework, including towards the governs the local CSD holding our full legal CSD responsibility for issuers, we rely on a network of customers’ assets. the safekeeping of their securities. service providers including Common Safekeepers, Common Depositories As we roll out our links to domestic International market: Clearstream, and Common Service Providers. markets in the TARGET2-Securities together with Euroclear Bank, acts as Asset protection obligations are (T2S) environment (for the centralised the issuer-CSD for the international constantly fulfilled within this context. settlement of securities in Europe), market (Eurobonds). The interlinkage For example, global notes are customers will benefit from between the two ICSD entities is immobilised at all times and we ensure enhanced and more direct links referred to as the Bridge. Each ICSD that finality on the Bridge is always to domestic markets. achieved in Clearstream’s books without any dependencies on Euroclear Bank or any other party within the common framework. 8 Clearstream: Your asset safety solution

Legal compliance and policing by regulators keeps your assets safe

Clearstream Banking Luxembourg Clearstream Banking Luxembourg As a CSD in Frankfurt meanwhile, is licensed as a bank by the Commission is also recognised as a Securities our business is regulated by the local de Surveillance du Secteur Financier Settlement System (SSS) and regulators in Germany (Bundesanstalt (CSSF), and has all the powers and is therefore subject to the oversight für Finanzdienstleistungsaufsicht responsibilities of a licensed credit of the Luxembourg (BaFIN)/Deutsche Bundesbank). institution under the Law. (Banque centrale du Luxembourg, BcL), in turn responsible for Further regulators policing our The CSSF is Luxembourg’s prudential implementing the monetary policy operations include the Monetary regulator with authority over all decided by the Governing Council Authority of Singapore, for our banks and financial services providers, of the European Central Bank (ECB). Singapore office, and the Financial payment institutions and investment BcL oversees the disposition of open Conduct Authority (FCA) of the Bank vehicles and managers, headquartered market operations, standing facilities, of England)/Prudential Regulation in Luxembourg. minimum reserves and instruments Authority (PRA) for our UK London available to the European System branch. In particular, the CSSF implements of Central Banks (ESCB) and the the legal framework and issues SSSs to ensure systemic stability of At group level, as part of the wider Circulars applicable to the supervised payment systems and Securities Deutsche Börse Group, the German entities. The CSSF also integrates Settlement Systems. Corporate Governance Code and the responsibilities of monitoring the German Sustainability Code are the stock markets and supervising key elements of our corporate culture. the Luxembourg Stock Exchange. Clearstream: Your asset safety solution 9

We also comply with international guidelines – the United Nations Global Compact and standards set by the International Labour Organisation. To be transparent about how we comply with such codes, we offer a corporate governance declaration in our annual report , published on our website.

Clearstream’s CSDs will soon be subject to the EU Central Securities Depositories Regulation (CSDR) . This regulation requires CSDs to obtain a specific CSDR license to operate based on minimum transparency requirements and enhanced capital requirements, as well as wider provisions aimed at enhancing CSD operational efficiency and asset protection throughout the value chain right through to the end investor. (Customers can learn more via our dedicated CSDR webpages .)

Another regulatory responsibility requires Clearstream to publicly disclose its risk management principles External endorsement Clearstream passed the related ECB in its Pillar III report , which we publish of Clearstream’s stability: stress test with very good results in all on our website for regulators, clients Successful stress-test scenarios. The extensive assessment and any other interested parties. by the European Central Bank included an examination of the balance sheet and a verification of equity Clearstream in addition publishes A particular external endorsement capital coverage levels, which led to its International Standard on Assurance of the safety of our systems came a confirmation by the ECB of the Engagements (ISAE) reports detailing in October 2014 in the form of institution’s high resilience. its controls, their design and operating the European Central Bank (ECB) effectiveness, including an independent published results of its stress test and assessment of whether the controls Comprehensive Assessment of banks. were placed in operation, suitably designed, and operating effectively. The ECB undertook a critical analysis The reports are intended for you of the balance sheets of 130 Eurozone as customers, your auditors and for banks and banking groups. This was the CSSF. part of the implementation of the Single Supervisory Mechanism (“banking union”), which established the ECB as the highest regulatory authority for banks in the Eurozone. 10 Clearstream: Your asset safety solution

Knowing our customers helps keep your assets safe

Know Your Customer (KYC) policies and A thorough approach We also examine and assess the due diligence processes are regulatory to getting to know geography and nature of your own duties and part of our business as usual respective clients, the products activities. The key aim is to establish our customers in your organisation that your accounts the optimal security of assets we hold at Clearstream will be supporting for customers by determining who As a customer, you will experience and an evaluation of your compliance is to access the Clearstream system and this KYC process via on-site visits and and control framework. for what purpose – seeking to minimise face to face meetings, which help us fraud or access by unethical market to fully understand the background Finally, in line with Anti Money participants. of your business, your business Laundering (AML) procedures, laws in general, and your desired activity and regulations, Clearstream We apply our KYC and due diligence with Clearstream in particular. screens every security and cash-related checks during the full lifetime instruction prior to releasing it into of the relationship with a customer – Our KYC checks include an assessment the processing lifecycle. We take from first contact to on-boarding and of the purpose of your account and appropriate measures immediately systematically thereafter during a detailed assessment of any client if and when any transaction is deemed the entire customer relationship. (or third party) assets that a prospective to potentially breach sanctions and customer intends to deposit embargo regimes or suggests money with Clearstream. laundering, market abuse or other compliance-related concerns. Clearstream: Your asset safety solution 11

A robust risk management strategy, verified by third parties, helps mitigate risk in all business areas

Clearstream applies an advanced operational risk management method set out in the Basel II banking recommendations – the Advanced Measurement Approach (AMA), which is subject to approval from our local regulators. We are continually reviewing our risk approach in line with regulatory standards such as the CSDR. Our risk management model is detailed in our Pillar III Disclosure Report , published on our website.

Clearstream’s Business Continuity Management (BCM) also forms an important risk mitigator. As clients, you are regularly invited to participate in our BCM practices to obtain first-hand experience and confidence in how these work.

Sound, tested crisis continued access to your securities Sound and robust management system should our business systems fail, information as well as dedicated backup sites for We offer customers a real-time alert operational functions and our data and cyber security system to help with incident centre, which mirror data in real time management. This is complementary so that we retain all data online even As a business based on IT systems to the 24-hour, 6-days-a-week if one data centre fails. and in charge of customers’ data, availability of our client services and Clearstream’s information security operational centres, which service Clearstream is either directly or via policy and standards are fundamental your needs at the touch of a button, its parent company Deutsche Boerse to our business and top of our agenda. no matter the time and no matter Group, an active member of the We also keep fiercely in line with all your time zone. following professional groups, which effective data protection laws so that helps us keep abreast of latest best while you share your data with us, Our BCM offers continuity of critical market practices in this field. you can rest assured we keep it safe operations in crisis scenarios. and secure. We offer several alternative connectivity – Operational Crisis Prevention Group options to ensure the resilience of of the Luxembourg Central Bank; your connectivity to our systems and – BCM working groups of the Federation of European Securities Exchanges (FESE), the German Financial Industry (BCMAKFI) and the companies listed in the DAX (BCM DAX30). Clearstream: Your asset safety solution 12

Our IT function, operations and polices We have security processes in place At industry level, we support the SWIFT are under scrutiny by our regulators. to cover user management (including Customer Security Programme (CSP), For example, the CSSF pays close the regular review of access rights) which aims to improve information attention to our IT security in its policing and incident detection and escalation. sharing throughout the community. of our operations. Clearstream publishes Information is only accessible internally For example, Clearstream plans an assurance report intended for the to those who need it to for their daily to complete the CSP self-attestations CSSF, our customers and their auditors, work. We also apply a strict “four-eyes” for all its active BICs at the earliest on the description of Clearstream’s principle to ensure data consistency. opportunity and is looking into giving system controls, design and operating permission to any customer or effectiveness. The report, known as the To help ensure an optimal cyber security counterparty with a legitimate interest International Standard on Assurance policy, our dedicated Clearstream to view the self-attestations via the Engagements (ISAE) report, No. 3402 Computer Emergency Response Team tools that the SWIFT CSP programme and published on our website includes (CERT) is in charge of proactively makes available. details about information and analysing major cyber incidents and cyber security policies and controls. determining and maintaining a picture of cyber situational awareness for review by senior management.

Contact information Frankfurt +49-(0 )69-211-12104 London +44-(0 )20-7862-7110 For further information, please Luxembourg +352-243-32795 contact your Relationship Manager: Hong Kong +852-2530-7404 www.clearstream.com Singapore +65-6597-1611

717 0/ 06 .17