Operational risks in Custody

• Professionals involved in custody and safekeeping activities
• Teams interacting with asset servicing, reconciliation and custody controls
• Risk, compliance and control functions overseeing custody operations
• Managers and stakeholders exposed to digital asset custody considerations

Over recent years, the investment fund industry has continued to evolve in response to changing market dynamics, regulatory expectations and technological innovation. These developments have significantly reshaped custody activities, impacting the way custodians safeguard assets, manage risks, implement regulatory requirements and interact with key stakeholders across the investment fund value chain.

This transformation is further accelerated by the emergence of digital assets, which introduce new custody models, operational challenges and risk considerations. The increasing use of advanced IT solutions, automation and distributed ledger technologies (DLT) is redefining traditional custody frameworks and expanding the scope of operational risk management.

Our training is designed to help participants better understand and assess the operational risks inherent to custody activities, including those related to digital assets, within an evolving regulatory and technological environment.

By the end of this session, participants will have developed a structured understanding of operational risks related to custody activities, including digital assets, and their key drivers across people, processes, systems and external events.

This training introduces the core principles of risk management as applied to custody activities, providing a clear positioning of operational risk within the broader risk landscape of the investment fund industry.

It focuses on operational risk in a custody context, including its definition and main drivers, with particular attention to how risks may arise from custody processes, systems, people and external factors. The session also addresses the specific operational risk considerations introduced by digital assets, without entering into technical implementation details.

Participants are introduced to a structured Operational Risk Management (ORM) perspective, covering the key stages of the risk management cycle and the role of governance frameworks such as the Three Lines of Defense model, while leaving room for practical illustrations and discussion during the training.

This training is coordinated by Toufik Chaib, Partner and Julia Collura, Director at PwC Luxembourg.

• Toufik Chaïb is a partner leading the Trust and Transparency Solutions team at PwC Luxembourg, specialising in bridging operational and external stakeholder requirements with a focus on IT, including ISAE 3402/3000, SOC2, and other ISAE IT-based solutions. He leads PwC’s task force on controls and processes for Sustainable Finance and supports clients with ESG product distribution. Previously, Toufik was Head of the PwC Luxembourg desk in Hong Kong/China, serving as Market Leader for clients operating between Luxembourg and China. He also leads the AWM APAC team for PwC Luxembourg, advising financial institutions in Asia Pacific on European asset management strategies. His expertise covers Asset & Wealth Management, fund distribution strategy, risk assurance, regulatory compliance (UCITS & AIFMD), and audit matters, with notable clients including Goldman Sachs, JP Morgan, BNP Paribas, and others.
• Julia Collura is a director at PwC with 13 years of experience in the financial sector, specialising in business and Information Technology controls within the Asset Management industry, including Fund Administration, Management Companies, Depositary Bank, and Custody. She possesses deep knowledge of local regulatory requirements, risk and controls assessment, and security configurations, with expertise in controls reporting for standards such as ISAE 3402/3000 and SOC2 across various industries including Asset Management, Telecom, and Fintech. Julia has led significant projects, notably managing a full control framework implementation for a telecommunications company, and is skilled in IT audit, risk assessments, business process reviews, and AML/CTF reviews.