Fund-manager custody controls and custodian oversight

A fund's manager may make investment decisions while a custodian safeguards the assets. Separating those functions can reduce operational and conflict risks, but outsourcing custody does not outsource the manager's oversight. The SFC Fund Manager Code of Conduct sets out duties around asset protection, custodian selection and ongoing monitoring.

Protect and reconcile the fund's assets

The Fund Manager Code expects the manager to ensure that assets entrusted to it are properly safeguarded and that assets belonging to each client are appropriately recorded, with frequent and appropriate reconciliations. Records and reconciliations help identify a missing asset, an incorrect position or a mismatch between internal books and custodian statements. The controls should match the fund structure and the custody chain, including any sub-custodians.

Use a functionally independent custodian

The manager should select and arrange for appointment of a custodian functionally independent from it. If the fund adopts self-custody, the manager should have policies, procedures and internal controls that keep the people doing custody work independent from those managing the fund. Self-custody is not a shortcut around segregation or client-asset rules; relevant requirements under the Securities and Futures Ordinance and subsidiary legislation still apply.

Select and monitor with due diligence

The manager should use due skill, care and diligence when selecting, arranging for appointment of and monitoring the custodian, and take reasonable steps to ensure it is properly qualified. Consider whether assets are segregated from the custodian, sub-custodian and other clients; whether the provider is legally authorized to perform custody; whether its financial resources and creditworthiness are adequate; and whether it remains suitable. A due-diligence file should record the assessment and the ongoing review, not just the initial vendor approval.

Account for fund structure and responsibility

A fund's governing body may formally appoint the custodian or make certain decisions, while the manager may still be responsible in substance for day-to-day operation. The SFC says the Code applies to licensed or registered persons acting as fund managers, with some provisions depending on who is responsible for the fund's overall operation. Analyze the manager's actual role and control rather than relying only on the organizational chart.

Exam checklist

• Safeguarding and reconciliation: are assets identified, recorded and checked frequently?
• Custodian independence: are custody and portfolio-management duties functionally separated?
• Due diligence: is the custodian qualified and authorized, with credible financial resources?
• Segregation: do controls follow assets through sub-custodians and omnibus structures?
• Ongoing monitoring: does the manager review continued suitability and performance?
• Self-custody: are independent personnel, procedures and SFO controls in place?

Key takeaway

A custodian can perform safekeeping, but the fund manager remains responsible for choosing and monitoring an appropriate arrangement and for keeping asset records and reconciliations effective.

Select a custodian for the actual portfolio

Due diligence should test whether a custodian can safely support the fund’s assets, markets, instruments and transaction volumes. Review authorization and regulatory status, ownership and financial condition, operating model, key personnel, technology, cyber resilience, disaster recovery, insurance, sub-custody chain and history of control failures. A glossy service description is not enough; the manager should understand where assets are held, who can move them and how the custodian proves ownership and reconciles positions.

Contract, segregation and monitoring

The custody agreement should define asset identification, segregation, settlement, corporate actions, income collection, reporting, reconciliations, permitted liens, liability, breach notification, audit access and termination. The manager should confirm that client or fund assets are distinguished from the custodian’s own assets and handled consistently with applicable law and the fund documents. Ongoing monitoring should include service-level reports, exception and break reports, control attestations, financial updates, incident notices and periodic site or independent-control reviews where warranted.

Sub-custody and concentration risk

Where a custodian appoints sub-custodians, due diligence should extend through the chain. Assess local legal protections, segregation, insolvency treatment, market practices, record access, reconciliation and the ability to transfer assets if a provider fails. Concentrating all assets with one group may create operational efficiency but also increases single-point-of-failure risk. A manager should set approval and concentration limits, document why the arrangement is acceptable, and maintain a contingency plan for replacing a provider or accessing records during disruption.

Example and exam focus

A fund invests in a market where its global custodian relies on a local agent. The manager should identify that sub-custodian, understand the legal and operational risks, review the control evidence and monitor the relationship. It cannot simply assume the global custodian’s brand eliminates local risk. The SFC Fund Manager Code expects appropriate custody arrangements and controls; exact duties depend on the manager’s role and the fund structure. In exam answers, name initial selection, written terms, segregation, ongoing monitoring and escalation—not merely “choose a reputable bank.”

Implementation and review

The manager should plan for exit before appointing the provider. Determine how quickly books, records and assets can be transferred, what cooperation the outgoing custodian must provide, whether liens or unpaid fees could delay release, and what temporary arrangement would protect investors. A provider change should include reconciled opening and closing positions, controlled transfer instructions, investor or trustee notifications where required, and post-migration testing. These steps convert due diligence from a procurement exercise into an ongoing protection of fund property.

A practical review checklist

The level of review should be proportionate to the assets and risks, but proportionality does not mean skipping the basics. A small private fund with illiquid assets may need deeper legal and operational analysis than a large liquid portfolio using a well-tested market infrastructure. Document what evidence was reviewed, what could not be independently verified and why residual risk is acceptable. Conditions imposed at appointment—such as extra reporting or concentration caps—should be tracked and reassessed as the portfolio evolves.