Outsourcing has become the operating model for most small fund managers in Malta, and for good reason. It gives a board access to specialist people and systems it could not justify hiring for one or two funds. The MFSA accepts this. Its letter acknowledges that, with the right pre-appointment checks, outsourcing brings expertise that small managers would otherwise lack.

What the regulator has now made clear is that outsourcing is a process to be governed, not a contract to be signed. The review followed each arrangement through its life, from the decision to outsource, through selection and due diligence, to ongoing oversight and, eventually, termination. At each stage it found practice that relied on familiarity and reputation rather than documented judgement.

The six findings, in plain terms

1Selection criteria were generic

Most managers had some criteria for choosing a provider, but they were often broad, informal and not tailored to the manager’s own business. Operational risk tended to be assessed at a high level, without looking separately at cyber security, data protection or business continuity. Critically, the same approach was used whether the function was peripheral or central to the licence. The MFSA expects a documented, risk-based selection process that distinguishes critical from non-critical functions and compares providers on consistent information.

2“In-house” was being used loosely

This is the finding with the sharpest consequences. Nearly every manager in the sample struggled to distinguish an in-house function from an outsourced one. Individuals engaged through a service agreement were described as in-house because they were local, familiar or closely integrated. The MFSA’s position is that the contract decides: a function is in-house only where it is performed by an employee of the fund manager or by someone seconded to it. Anything delivered under a service agreement is outsourcing, however embedded the person may be.

The letter then states a clear requirement. At least one of the investment management and risk management functions must be performed in-house. If investment management is the in-house function, all portfolio managers must be employed by the fund manager. If risk management is, the person carrying out day-to-day risk management must be employed. Where a committee performs the function collectively, most of its members should be employees. Some managers in the review had outsourced both, which the MFSA regards as a letter-box structure.

3Conflicts of interest were assessed too narrowly

Managers generally made sure that the people managing investments were not the people managing risk or valuation. Beyond that, there was little analysis. Two situations were largely ignored: using the same provider for several functions, and using a provider that serves competing managers with the same service. The MFSA does not treat either as a problem in itself, but it expects managers to look at the practical risks, such as how the provider allocates resources under pressure, the risk of information leaking between clients, and services becoming so standardised that they stop fitting the individual fund. It also notes that in very small providers, where one person holds several roles, separation can be hard to achieve and must be examined rather than assumed.

4Due diligence leaned on reputation

Some managers did little due diligence at all, relying instead on how well known a provider was. The MFSA expects a substantive assessment of a provider’s governance, staffing, controls, financial position, cyber security, continuity arrangements and compliance history, repeated over time. It specifically expects periodic on-site reviews of providers, built into the compliance monitoring plan, with a frequency that reflects how critical the service is.

5Boards were not seeing enough

Governing bodies often received only a high-level view of their outsourced providers, and there was little record of how boards evaluated or challenged them. The MFSA now expects a written report on each outsourced provider, covering performance, costs, due diligence findings, risk rating, compliance matters and conflicts, and a documented performance assessment of every key provider at least once a year. It also asks boards to give outsourcing proper time on the agenda, especially where core functions such as risk management are concerned.

6Contingency plans depended on the provider

Most managers’ contingency planning amounted to checking, once a year, that the provider had its own business continuity plan. The MFSA wants managers to have their own fallback: identified alternative providers, internal procedures if a provider fails for an extended period, a tested transition plan, and periodic simulation of those scenarios.

What this means for a self-managed scheme

For a self-managed PIF, AIF or UCITS, the in-house requirement is the first thing to check, because it shapes every other decision. A scheme whose portfolio managers are its own employees can outsource risk management, provided it governs that arrangement properly. A scheme that has delegated investment management to an external manager needs its risk management performed in-house, whether by an employee or through a secondment. Getting this wrong is not a documentation issue; it goes to whether the scheme has substance at all.

The second point is that the MFSA has raised the bar for evidence. A board that has chosen a good provider but cannot show how it chose, what it checked and how it monitors performance is now exposed, even if nothing has gone wrong.

A six-point gap analysis for your next board meeting

The gap analysis itself should be minuted and kept, because the MFSA has said it may ask to see it and verify it in future supervisory engagements.

Questions worth asking any risk provider

The same standards apply when a board appoints a risk manager, including us. Ask for the provider’s organisation chart and the named individual who will perform the function, their other roles and time commitment, how the provider separates its services from any competing business, what the board will actually receive each month, how breaches are escalated between reports, what audit and access rights you will have, and how an exit would work. A provider that answers these clearly, in writing, makes your own gap analysis easier to evidence.