SUPPLEMENTAL AGREEMENT
WHEREAS, State Street Bank and Trust Company, and each of its affiliates listed as a party to the agreements listed in Section 1 below (hereinafter collectively referred to as “State Street” for ease of reference), and Massachusetts Financial Services Company d/b/a MFS Investment Management, and each of its affiliates or Funds listed as a party to the agreements listed in Section 1 below (hereinafter collectively referred to as “MFS” for ease of reference), are parties to each of the valid and binding agreements listed in Section 1 (as may be amended or modified from time to time, and hereinafter collectively referred to as the “Agreements” for ease of reference); and
WHEREAS, State Street and MFS mutually desire to supplement the terms of each Agreement listed in Section 1 herein by incorporating into those Agreements each of the terms and provisions set forth in Section 3 of this Supplemental Agreement, except as otherwise noted herein;
THEREFORE, in consideration of the exchange of mutual covenants and agreements, the value and sufficiency of which are specifically acknowledged by the parties, State Street and MFS, intending to be legally bound by the terms herein, agree to amend the Agreements as set forth below.
1. AGREEMENTS TO BE SUPPLEMENTED:
A. Depositary Agreement between MFS Meridian Funds and Xxxxx Xxxxxx Xxxx Xxxxxxxxxx S.C.A., made on August 18, 2016.
B. Depositary Agreement between MFS Investment Management Company (Lux) S.à x.x. and Xxxxx Xxxxxx Xxxx Xxxxxxxxxx S.C.A., made on August 16, 2016.
C. Amended and Restated Custodian Contract among State Street Trust Company Canada (as Trustee), MFS Investment Management Canada Limited, and State Street Trust Company Canada (as Custodian) dated as of October 2, 2017.
D. Global Link User Agreement among FX Connect, LLC (as assignee of State Street Bank and Trust Company), State Street Bank and Trust Company, and MFS Investment Management a /d/b/a for Massachusetts Financial Services Company, dated May 1, 2006, and as amended by that certain letter re Notice of Reorganization and Assignment of FX Connect and/or FX Connect Trade Services subscription agreement dated May 2, 2017.
E. Collective Investment Trust Accounting Agreement between MFS Heritage Trust Company, acting solely as trustee of certain collective investment trusts listed on Appendix A and State Street Bank and Trust Company, dated November 22, 2006.
F. Custodian Agreement among MFS Heritage Trust Company, as Trustee, acting solely as trustee of certain collective investment busts listed on Appendix A to the Agreement, and State Street Bank and Trust Company as Custodian, dated November 22, 2006.
G. Custodian Agreement among Each of the Investment Companies listed on Appendix A to the Custodian Agreement and State Street Bank and Trust Company, dated December 18, 2006.
H. Funds Accounting Agreement among Each of the Investment Companies listed on Appendix A to the Funds Accounting Agreement and State Street Bank and Trust Company, dated December 18, 2006.
I. Securities Lending Agency Agreement among Each of the entities listed on Exhibit A to the Securities Lending Agency Agreement, acting on behalf of itself or, in the case of a series company, on behalf of one or more of its portfolios or series listed on Exhibit A and State Street Bank and Trust Company, dated January 5, 2007.
J. Transfer Agency and Service Agreement between State Street Bank and Trust Company, and MFS Heritage Trust Company, as Trustee of the MFS Heritage Trust Company Collective Investment Trust and certain collective investment trusts established thereunder as listed on Schedule A, dated as of January 18, 2011.
K. Investment Analytics Agreement between MFS Investment Management Company (Lux) Sa.x.x. and State Street Bank and Trust Company, dated July 1, 2012 (assigned to State Street Bank and Trust Company via amendment and assignment dated October 31, 2014), provided, however, that Sections 3(D), 3(E) and 3(F) of this Supplemental Agreement shall be inapplicable to such agreement.
L. Amended and Restated Trust Agreement between MFS Investment Management Canada Limited and State Street Trust Company Canada, dated as of October 2, 2017.
M. Investment Analytics Agreement between Massachusetts Financial Services Company and State Street Bank and Trust Company, dated June 30, 2014, provided, however, that Sections 3(D), 3(E) and 3(F) of this Supplemental Agreement shall be inapplicable to such agreement.
N. Registrar and Transfer Agency, Administration, and Paying Agency Agreement among MFS Investment Management Company (Lux) S.a.r.l., MFS Meridian Funds, and State Street Bank Luxembourg S.C.A. (formerly State Street Bank Luxembourg S.A.), dated October 31, 2014.
O. Administration Agency, Domiciliary, Corporate and Paying Agency, Registrar and Transfer Agency Agreement between MFS Investment Management Company (Lux) S.à x.x. (formerly MFS Investment Management Company (Lux) S.A.) and Xxxxx Xxxxxx Xxxx Xxxxxxxxxx S.C.A. (formerly State Street Bank Luxembourg S.A.) dated July 14, 2000.
P. Transfer Agency and Service Agreement between MFS Investment Management Canada Limited and State Street Trust Company Canada, dated as of October 2, 2017.
Q. Custodian Agreement between State Street Australia Limited and MFS International Holdings Pty. Ltd., dated as of 4 January 2019.
R. Form N-PORT and Form N-CEN Services Agreement between the Funds listed on Schedule A thereto and State Street Bank and Trust Company, dated as of June 1, 2018.
S. Regulatory Reporting Support Services Agreement between Massachusetts Financial Services Company and State Street Bank and Trust Company, dated as of February 24, 2014.
T. Money Market Services Agreement between the Funds listed on Schedule A thereto and State Street Bank and Trust Company, dated as of October 14, 2015.
U. Stress Testing Services Agreement between the Funds listed on Schedule A thereto and State Street Bank and Trust Company, made as of April 1, 2016.
2. INTENT AND CONSTRUCTION
A. Purpose: The purpose of this Supplemental Agreement is to incorporate the provisions set forth in Section 3 below into each of the Agreements. The parties agree that they are entering into this Supplemental Agreement in order to clarify and supplement the existing terms of each of the Agreements and that by entering into this Supplemental Agreement, the parties intend to abide, and be legally bound, by the terms herein as if they were fully set forth in each of the Agreements.
B. Construction: The parties intend for this agreement to be incorporated into, and become part of, each of the Agreements such that this Supplemental Agreement and each of the individual Agreements shall be read as one document. In the event of a conflict between this Supplemental Agreement and an Agreement related to the subject matters herein, the provisions of this Supplemental Agreement shall control.
C. Effective Date: This Supplemental Agreement shall be effective as of October 1, 2019 (“Effective Date”).
3. CONTRACTUAL PROVISIONS TO BE ADDED TO AGREEMENTS:
A. Data Security:
MFS and State Street agree that State Street shall maintain an information security policy as set forth in the State Street Client Information Security Addendum attached hereto (the “Information Security Addendum”) with respect to information, materials, documents or
other data, whether in hard copy or electronic format, provided by MFS, MFS’ affiliates (“MFS Affiliates”) or their agents to State Street (including without limitation confidential and proprietary information and personal information), in connection with the provision of services under the Agreements and to the extent the same is deemed confidential information under the terms of the applicable Agreement (collectively, “MFS Data”).
Subject to any national, federal, or state legal or regulatory requirements concerning record retention or to the extent required by its internal policies and in accordance with its customary practices for backup and storage, State Street shall, upon MFS’ request or the termination of the applicable Agreement promptly, in MFS’ sole discretion, either: (i) return MFS Data (including all copies thereof) to MFS in a format reasonably requested by MFS at no cost to MFS; or (ii) destroy all MFS Data; provided, however, State Street shall not be required to return or destroy any MFS Data that may be relevant to resolution of a legitimate dispute between the parties until such dispute has been finally resolved. Upon written request from MFS, State Street shall further verify and certify in writing to the destruction or return of all forms of MFS Data, whether in hard copy, electronic, or otherwise. Any destruction of MFS Data required hereunder shall be in accordance with then current Department of Defense (DoD) or similar industry standards, in a manner such that the data cannot be read, restored or retrieved, which at least comply with DoD 5220.22-M or NIST SP800-88. Other than in the event of termination of the applicable Agreement or as otherwise may be agreed upon by the parties in connection with the applicable services, in no event shall State Street destroy any MFS Data without MFS’ prior written consent.
B. Privacy:
State Street maintains policies and procedures that are reasonably designed to support State Street’s compliance with the requirements of all applicable state, national and international laws and regulations regarding the security, protection and confidentiality of personal information (“PI”), as amended from time to time, including, as may be applicable, Massachusetts General Law, c. 93H and implementing regulations thereunder, including 201 CMR 17.00 et. seq. (together with the laws and regulations referenced in the first sentence, collectively, the “Privacy Laws”). State Street agrees to notify MFS as promptly as possible in writing, to the extent required by law, of any failure, with respect to the PI of MFS or its Funds held by State Street, that State Street becomes aware of to comply with the Privacy Laws.
To the extent that MFS Affiliates provide State Street with or State Street has access to (either orally, in hard copy, electronic format or otherwise) any PI (as defined in the Privacy Laws), State Street agrees to limit disclosure of PI to only those employees and third parties who have a genuine business need for access to any particular item of PI for the purpose of meeting obligations under the applicable Agreement. State Street agrees to use PI only to the extent necessary to carry out the purposes for which MFS Affiliates disclosed the PI.
Without limiting any requirements under Privacy Laws, State Street’s policies and procedures with respect to PI shall address: (i) administrative, technical, and physical
safeguards for the protection of PI as defined herein; (ii) detection of any unauthorized access to or use of PI for unauthorized purposes; and (iii) the proper destruction of such materials so that the information contained therein cannot be practicably read or reconstructed.
Solely for those Agreements where MFS Affiliates provide State Street with or State Street has access to any PI, in order to aid MFS with its compliance with applicable Privacy Laws, State Street agrees to: (i) annually, upon MFS’s reasonable request, provide MFS’s Chief Information Security Officer or his or her designee with a copy of State Street corporate information security controls that form the basis for State Street’s Security Policy and an opportunity to discuss State Street’s information security measures with a qualified member of State Street’s information technology management team; and (ii) allow MFS Affiliates or their agents the right to audit State Street’s compliance, in accordance with Section 3D hereof, or such audit rights as may otherwise be set forth in the applicable Agreement.
With respect to PI provided by MFS to State Street, MFS represents and warrants that it has obtained all consents and approvals, as required by applicable Privacy Laws, necessary to disclose such PI to State Street, and as required in order for State Street to use, process, and disclose such PI in connection with the provision of services contemplated hereunder. MFS acknowledges that such PI may be used and disclosed outside of the jurisdiction in which it was initially collected, and as such, PI accessed or provided hereunder may be accessed by national security authorities, law enforcement and courts. State Street shall be without liability to MFS for any action taken or omitted by it in reliance upon this representation and warranty, including without limitation, any liability or costs in connection with claims or complaints for failure to comply with any Privacy Laws.
C. Subcontractors:
State Street may employ, engage, associate or contract with such person or persons, including, without limitation, affiliates and subsidiaries of State Street, as State Street may deem desirable to assist it in performing the services under an Agreement. Unless otherwise agreed to with MFS, the compensation of such persons shall be paid by State Street. State Street shall be as responsible for the acts and omissions of any such person or persons as State Street is for its own acts and omissions, subject to and in accordance with the terms of the applicable Agreement. From time to time, State Street may provide access to MFS Data or State Street’s network to a subcontractor or other third party; provided, that, such subcontractor or third party implements and maintains security measures that State Street believes are at least as stringent as those described in the Information Security Addendum. (1)
(1) With respect to the Securities Lending Agency Agreement referred to in Section 1.I, the following alternative language would be applicable in lieu of this Section 3(C): “State Street may use such agents, including such regulated clearing agents, securities depositaries, nominees, sub-custodians, third party custodians and State Street Affiliates, as State Street deems appropriate to carry out its duties under this Agreement. To the extent State Street Affiliates act as State Street’s agent hereunder, State Street agrees to be responsible for the acts and omissions of such State Street Affiliates as though performed by State Street directly. MFS agrees that State Street’s sole liability for the acts or omissions of any other agent shall be limited to liability arising from State Street’s failure to use reasonable care in the selection of such agent.”
D. Audit Rights:
i. MFS Right to Audit:
Upon reasonable prior notice from MFS, State Street will provide: (i) any governmental or regulatory agencies or authorities having jurisdiction over MFS Affiliates, including any direct or indirect majority shareholder (“Regulatory Authorities”); (ii) any of MFS Affiliates’ auditors; and (iii) MFS Affiliates (collectively, “MFS Monitors”) with reasonable access to State Street service location(s), State Street personnel, and State Street books and records as MFS Affiliates may reasonably request for the purpose of reviewing State Street compliance with the provisions of this Agreement (or as required by any Regulatory Authority). The foregoing audit rights shall include, without limitation, audits with respect to the services provided under the applicable Agreement(s): (i) of practices, policies and procedures; (ii) of books and records; (iii) of systems; (iv) the conformance of internal controls and security practices and procedures with information security best practice standards; (v) of business continuity and backup procedures; and (vi) as necessary to enable MFS Affiliates to meet applicable legal and regulatory requirements. In addition, State Street shall promptly respond to any specific written or verbal inquiries as may be reasonably posed by MFS Monitors regarding the foregoing. State Street, including both its internal and external auditors, shall provide reasonable cooperation to MFS Monitors during the exercise of these audit rights. State Street shall keep and maintain during the term of this Agreement and for a period of at least three (3) years following termination or expiration of this Agreement, complete and accurate books and records concerning its performance hereunder (including financial records in accordance with Generally Accepted Accounting Principles).
Furthermore, State Street will provide MFS Monitors with reasonable access to any records maintained by State Street relating to MFS’ clients and any records or other data of MFS provided to or shared with State Street during the term of this Agreement. If any review by MFS Monitors results in MFS Affiliates learning that State Street is not in compliance with this Agreement, MFS will communicate that to State Street and the parties will reasonably cooperate to develop any necessary remediation plan.
The parties shall develop and follow procedures for the sharing of audit and regulatory findings related to the provision or receipt of the services.
Any of the foregoing audits or access to records shall be conducted at MFS’ expense (which shall include costs related to providing materials, copying, faxing, retrieving stored materials, and similar expenses) and shall occur during State Street’s regular business hours and upon advance notice to State Street and, except as otherwise agreed to by the parties, no more frequently than once a year. Audits will be conducted with representatives of State Street present at all times. MFS’ representatives will comply with all standard safety, confidentiality and security procedures of State Street. In connection with such audits, MFS’ representatives shall not attempt to access, nor will
they review, the records of any other clients of State Street and MFS’ representatives shall conduct the visit in a manner that will not interfere with State Street’s normal and customary conduct of its business activities, including the provision of services to MFS and to other clients. State Street shall have the right to immediately require the removal of any MFS representatives from its premises in the event that their actions, in the reasonable opinion of State Street, jeopardize the information security of State Street’s systems and/or other client data or otherwise are disruptive to the business of State Street. State Street may require any persons seeking access to its facilities to provide reasonable evidence of their authority. State Street may also reasonably require any of MFS’ representatives to execute a confidentiality agreement before granting such individuals access to its facilities. Nothing contained herein shall obligate State Street to provide access to or otherwise disclose: (i) any information that is unrelated to State Street or MFS and State Street’s provision of the services to MFS; (ii) any information that is treated as confidential under State Street’s corporate policies, including, without limitation, internal audit reports, compliance or risk management plans or reports, work papers and other reports and information relating to management functions; (iii) any other documents, reports or other information that State Street is obligated to maintain in confidence by contract, by its regulators or otherwise as a matter of law, legal privilege or regulation; or (iv) access to the extent that such access would, in State Street’s reasonable opinion, compromise the security of its technology systems or the confidentiality of its customers. For the avoidance of doubt, State Street will not be obligated to provide any physical access to the data centers at which it stores or processes MFS Data that is collected or generated pursuant to the Global Link User Agreement referenced in Section 1.D hereof.
E. Service Organization Control Reports:
To the extent available, State Street shall provide MFS with a copy of a third party independent accountant report conducted and prepared in accordance with American Institute of Certified Public Accountants’ Statements on Standards for Attestation Engagements. A SOC 1, Type 2 audit report (“SOC Report(s)”) shall be prepared and provided on as specified at Exhibit A during the term of this Agreement for the services provided by State Street, for which the scope of the SOC Report(s) is inclusive of the products and services provided, along with the supporting processes, policies, procedures, personnel and operational activities that constitute State Street’s core activities that are relevant to said products and services, and provided within thirty (30) days after such SOC Report(s) is available to State Street. If: (i) a SOC Report(s) set forth on Exhibit A is not supplied by State Street in accordance with the foregoing; or (ii) if SOC Report(s) are provided but (a) the SOC Report(s) does not cover all aspects of the products and services covered by this Agreement, including without limitation all State Street operations globally; or (b) the user control considerations listed within the SOC Report(s) limit MFS’ ability to place appropriate reliance on State Street control environment; or (c) the results of the SOC Report(s) are qualified by the independent auditor, then MFS may, no more than once annually, request State Street to conduct, or if State Street does not agree to conduct then MFS may appoint independent auditors to conduct (or request MFS’ Internal Audit Department to conduct), an audit of the products and services provided by State Street to
MFS under this Agreement. MFS and State Street shall arrive at a mutually agreed prompt schedule for remedying any non-compliance issues identified in any SOC Report(s).
While State Street does not currently issue an AICPA Service Organization Control 2 report (“SOC2 Report”), if in the future State Street makes a SOC2 Report available to its clients, State Street shall make such SOC2 Report available to MFS.
F. Business Continuity and Disaster Recovery:
In order to prevent the disruption of services in the event of any reasonably foreseeable adverse event (such as terrorism or related threats to security, loss of electric power or communications lines, equipment failure, fire, water damage or severe weather conditions), State Street shall maintain at all times, at no additional expense to MFS, a complete business continuity, disaster recovery, business resumption and crisis management plan (“Business Continuity/Disaster Recovery Plan”) reasonably designed to safeguard from loss or damage attributable to terrorism or related threats to security, fire, flood, theft or any other cause the cash, security, other assets, records and other data of MFS and State Street’s records, data, equipment, facilities and other property used in the performance of its obligations under the Agreements. State Street shall maintain and keep current the Business Continuity/Disaster Recovery Plan and the capacity to execute such Business Continuity/Disaster Recovery Plan. State Street shall enter into and shall maintain in effect at all times during the term of this Agreement with appropriate parties one or more agreements making reasonable provision for (i) periodic back-up of the computer files and data with respect to MFS; and (ii) emergency use of electronic data processing equipment to provide services under this Agreement. Upon reasonable request, State Street shall discuss with senior management of MFS the Business Continuity/Disaster Recovery Plan and/or provide a high-level presentation summarizing the Business Continuity/Disaster Recovery Plan, including without limitation recovery time objectives. For the avoidance of doubt, the parties hereto agree that for purposes of the immediately preceding sentence, “reasonable” shall mean at least annually. In the event of equipment failure, work stoppage, governmental action, terrorism or related threats to security, communication disruption or other impossibility of performance beyond State Street’s control, State Street shall, at no additional expense to MFS, use commercially reasonable efforts to minimize service interruptions.
G. Use of Data
Notwithstanding any other data use provision contained in any of the Agreements:
(a) In connection with the provision of the services and the discharge of its other obligations under the Agreements and this Supplemental Agreement, State Street (which term for purposes of this Section includes each of its parent company, branches and affiliates (“Affiliates”)), may collect and store information regarding MFS and share such information with its Affiliates, agents and service providers only in order and to the extent reasonably necessary (i) to carry out the provision of services contemplated under this Agreement and other agreements between MFS and State Street or any of its Affiliates and (ii) to carry out the internal
management of its businesses, including, but not limited to, financial and operational management and internal reporting, and risk management, and for legal and regulatory compliance purposes.
(b) Notwithstanding the foregoing, State Street shall be permitted to utilize, publish or otherwise distribute MFS Data solely in connection with State Street’s institutional investor behavioural research maintained on State Street’s IR3 research portal (or any successor portal) and other works that are derived from such research, provided such data has been fully anonymized so that MFS Data (i) is not identifiable to any person or entity, (ii) does not contain any of MFS’ confidential information or intellectual property in raw or underived form, and (iii) is combined with similar data of State Street’s other customers or vendors. MFS makes no representations or warranties regarding the accuracy of MFS Data utilized under this Section. The MFS Data utilized pursuant to this Section shall remain the sole and exclusive property and confidential information of MFS and State Street’s rights in such MFS Data shall be limited as set forth in this Section and the applicable Agreement.
(c) Except as expressly contemplated by the Agreements and this Supplemental Agreement, nothing in this Section shall limit the confidentiality and data-protection obligations of State Street and its Affiliates under the Agreements, this Supplemental Agreement and applicable law. State Street shall cause any Affiliate, agent or service provider to which it has disclosed any data or other information pursuant to this Section to comply at all times with all confidentiality and data-protection obligations as if it were a party to the Agreements and/or this Supplemental Agreement.
4. GENERAL:
Except as otherwise agreed to in this Supplemental Agreement, all other terms and conditions of the Agreements shall remain in full force and effect. Each of the Agreements may be further amended by the parties thereto. Any further modifications to this Supplemental Agreement must be in writing signed by the parties hereto; provided that if MFS and State Street desire in the future that any additional agreement (“Additional Agreement”) be made subject to the terms of this Supplemental Agreement and become an Agreement hereunder, the applicable MFS and State Street parties to such Additional Agreement shall enter into an accession agreement in the form of Exhibit B attached hereto.
This Supplemental Agreement may be executed in multiple counterparts, each of which shall be deemed an original, but all such counterparts shall together constitute one and the same instrument. Signatures transmitted by facsimile or electronic mail (including, without limitation, electronic mailing of a PDF) shall be treated as and deemed to be original signatures for all purposes and will have the same binding effect as if they were original, signed instruments delivered in person.
[SIGNATURE PAGES FOLLOW]
IN WITNESS WHEREOF, each of the parties has caused this Supplemental Agreement to be signed and delivered by their duly authorized officers as of the Effective Date above.
AS TO:
Depositary Agreement between MFS Meridian Funds and Xxxxx Xxxxxx Xxxx Xxxxxxxxxx S.C.A., made on August 18, 2016.
|
Signed by, |
| |
|
for and on behalf of |
| |
|
MFS MERIDIAN FUNDS |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
|
| |
|
STATE STREET BANK LUXEMBOURG S.C.A. |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Depositary Agreement between MFS Investment Management Company (Lux) S.à x.x. and Xxxxx Xxxxxx Xxxx Xxxxxxxxxx S.C.A., made on August 16, 2016.
|
Signed by, |
| |
|
for and on behalf of |
| |
|
|
| |
|
MFS INVESTMENT MANAGEMENT COMPANY (LUX) S.À X.X. |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
|
| |
|
STATE STREET BANK LUXEMBOURG S.C.A. |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Amended and Restated Custodian Contract among State Street Trust Company Canada (as Trustee), MFS Investment Management Canada Limited, and State Street Trust Company Canada (as Custodian) dated as of October 2, 2017.
|
Signed by, |
|
|
for and on behalf of |
|
|
|
|
|
MFS INVESTMENT MANAGEMENT CANADA LIMITED |
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
|
|
Signed by, |
|
|
for and on behalf of |
|
|
|
|
|
STATE STREET TRUST COMPANY CANADA |
|
|
As Trustee and Custodian |
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Global Link User Agreement among FX Connect, LLC (as assignee of State Street Bank and Trust Company), State Street Bank and Trust Company, and MFS Investment Management a /d/b/a for Massachusetts Financial Services Company, dated May 1, 2006 , and as amended by that certain letter re Notice of Reorganization and Assignment of FX Connect and/or FX Connect Trade Services subscription agreement dated May 2, 2017.
|
Signed by, |
| |
|
for and on behalf of |
| |
|
|
| |
|
MASSACHUSETTS FINANCIAL SERVICES COMPANY |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
|
| |
|
STATE STREET BANK AND TRUST COMPANY |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
|
| |
|
FX CONNECT, LLC |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Collective Investment Trust Accounting Agreement between MFS Heritage Trust Company, acting solely as trustee of certain collective investment trusts listed on Appendix A and State Street Bank and Trust Company, dated November 22, 2006
|
Signed by, |
|
|
for and on behalf of |
|
|
MFS HERITAGE TRUST COMPANY |
|
|
NOT IN ITS INDIVIDUAL CAPACITY BUT ACTING SOLELY AS TRUSTEE TO EACH COLLECTIVE INVESTMENT TRUST LISTED IN APPENDIX A. |
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
|
|
Signed by, |
|
|
for and on behalf of |
|
|
STATE STREET BANK AND TRUST COMPANY |
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Custodian Agreement among MFS Heritage Trust Company, as Trustee, acting solely as trustee of certain collective investment busts listed on Appendix A to the Agreement, and State Street Bank and Trust Company as Custodian, dated November 22, 2006
|
Signed by, |
|
|
for and on behalf of |
|
|
MFS HERITAGE TRUST COMPANY |
|
|
NOT IN ITS INDIVIDUAL CAPACITY BUT ACTING SOLELY AS TRUSTEE TO EACH COLLECTIVE INVESTMENT TRUST LISTED IN APPENDIX A. |
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
|
|
Signed by, |
|
|
for and on behalf of |
|
|
STATE STREET BANK AND TRUST COMPANY |
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Custodian Agreement among Each of the Investment Companies listed on Appendix A to the Custodian Agreement and State Street Bank and Trust Company, dated December 18, 2006.
|
Signed by, |
| |
|
for and on behalf of |
| |
|
EACH OF THE INVESTMENT COMPANIES LISTED ON APPENDIX A TO THE CUSTODIAN AGREEMENT |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
STATE STREET BANK AND TRUST COMPANY |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Funds Accounting Agreement among Each of the Investment Companies listed on Appendix A to the Funds Accounting Agreement and State Street Bank and Trust Company, dated December 18, 2006.
|
Signed by, |
| |
|
for and on behalf of |
| |
|
EACH OF THE INVESTMENT COMPANIES LISTED ON APPENDIX A TO THE FUNDS ACCOUNTING AGREEMENT, ON BEHALF OF EACH OF THEIR RESPECTIVE PORTFOLIOS (EXCEPT MFS COMMODITY STRATEGY PORTFOLIO) |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
MFS COMMODITY STRATEGY PORTFOLIO |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
STATE STREET BANK AND TRUST COMPANY |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Securities Lending Agency Agreement among Each of the entities listed on Exhibit A to the Securities Lending Agency Agreement, acting on behalf of itself or, in the case of a series company, on behalf of one or more of its portfolios or series listed on Exhibit A and State Street Bank and Trust Company, dated January 5, 2007.
|
Signed by, |
| |
|
for and on behalf of |
| |
|
EACH OF THE ENTITIES LISTED ON EXHIBIT A TO THE SECURITIES LENDING AGENCY AGREEMENT, ACTING ON BEHALF OF ITSELF OR, IN THE CASE OF A SERIES COMPANY, ON BEHALF OF ONE OR MORE OF ITS PORTFOLIOS OR SERIES LISTED ON EXHIBIT A |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
STATE STREET BANK AND TRUST COMPANY, AS AGENT FOR THE FUNDS |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Transfer Agency and Service Agreement between State Street Bank and Trust Company, and MFS Heritage Trust Company, as Trustee of the MFS Heritage Trust Company Collective Investment Trust and certain collective investment trusts established thereunder as listed on Schedule A, dated as of January 18, 2011
|
Signed by, |
| |
|
for and on behalf of |
| |
|
MFS HERITAGE TRUST COMPANY |
| |
|
NOT IN ITS INDIVIDUAL CAPACITY BUT ACTING SOLELY AS TRUSTEE TO EACH COLLECTIVE INVESTMENT TRUST LISTED IN APPENDIX A. |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
STATE STREET BANK AND TRUST COMPANY |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Investment Analytics Agreement between MFS Investment Management Company (Lux) Sa.x.x. and State Street Bank and Trust Company, dated July 1, 2012 (assigned to State Street Bank and Trust Company via amendment and assignment dated October 31, 2014).
|
Signed by, |
| |
|
for and on behalf of |
| |
|
|
| |
|
MFS INVESTMENT MANAGEMENT COMPANY (LUX) SA.X.X. |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
|
| |
|
STATE STREET BANK AND TRUST COMPANY |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Amended and Restated Trust Agreement between MFS Investment Management Canada Limited and State Street Trust Company Canada, dated as of October 2, 2017
|
Signed by, |
| |
|
for and on behalf of |
| |
|
MFS INVESTMENT MANAGEMENT CANADA LIMITED |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
STATE STREET TRUST COMPANY CANADA |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Investment Analytics Agreement Massachusetts Financial Services Company and State Street Bank and Trust Company, dated June 30, 2014.
|
Signed by, |
| |
|
for and on behalf of |
| |
|
MASSACHUSETTS FINANCIAL SERVICES COMPANY |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
STATE STREET BANK AND TRUST COMPANY |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Registrar and Transfer Agency, Administration, and Paying Agency Agreement among MFS Investment Management Company (Lux) S.a.r.l., MFS Meridian Funds, and State Street Bank Luxembourg S.C.A. (formerly State Street Bank Luxembourg S.A.), October 31, 2014.
|
Signed by, |
| |
|
for and on behalf of |
| |
|
MFS INVESTMENT MANAGEMENT COMPANY (LUX) S.A.R.L. |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
MFS MERIDIAN FUNDS |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
STATE STREET BANK LUXEMBOURG S.C.A. |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Administration Agency, Domiciliary, Corporate and Paying Agency, Registrar and Transfer Agency Agreement between MFS Investment Management Company (Lux) S.à x.x. (formerly MFS Investment Management Company (Lux) S.A.) and Xxxxx Xxxxxx Xxxx Xxxxxxxxxx S.C.A. (formerly State Street Bank Luxembourg S.A.) dated July 14, 2000
|
Signed by, |
| |
|
for and on behalf of |
| |
|
MFS INVESTMENT MANAGEMENT COMPANY (LUX) S.A.R.L. |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
STATE STREET BANK LUXEMBOURG S.C.A. |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Transfer Agency and Service Agreement between MFS Investment Management Canada Limited and State Street Trust Company Canada, dated as of October 2, 2017.
|
Signed by, |
| |
|
for and on behalf of |
| |
|
MFS INVESTMENT MANAGEMENT CANADA LIMITED |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
STATE STREET TRUST COMPANY CANADA |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Custodian Agreement between State Street Australia Limited and MFS International Holdings Pty. Ltd., dated as of 4 January 2019.
|
SIGNED by STATE STREET |
) |
| |
|
AUSTRALIA LIMITED in accordance |
) |
| |
|
with subsection 127(1) of the Corporations |
) |
| |
|
Act: |
| ||
|
|
| ||
|
|
|
| |
|
Signature of director / company secretary * |
Signature of director | ||
|
|
| ||
|
|
|
| |
|
Name of director / company secretary * (block letters) |
Name of director (block letters) | ||
|
* delete whichever is not applicable |
| ||
|
|
| ||
|
|
| ||
|
SIGNED by MFS INTERNATIONAL |
) |
| |
|
HOLDINGS PTY LTD in accordance |
) |
| |
|
with subsection 127(1) of the Corporations |
) |
| |
|
Act: |
| ||
|
|
| ||
|
|
|
| |
|
Signature of director / company secretary * |
Signature of director | ||
|
|
| ||
|
|
|
| |
|
Name of director / company secretary * (block letters) |
Name of director (block letters) | ||
|
* delete whichever is not applicable |
|
AS TO:
Form N-PORT and Form N-CEN Services Agreement between the Funds listed on Schedule A thereto and State Street Bank and Trust Company, dated as of June 1, 2018.
|
Signed by, |
| |
|
for and on behalf of |
| |
|
EACH OF THE FUNDS LISTED ON SCHEDULE A TO THE FORM N-PORT AND FORM N-CEN SERVICES AGREEMENT |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
STATE STREET BANK AND TRUST COMPANY |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Regulatory Reporting Support Services Agreement between Massachusetts Financial Services Company and State Street Bank and Trust Company, dated as of February 24, 2014.
|
Signed by, |
| |
|
for and on behalf of |
| |
|
MASSACHUSETTS FINANCIAL SERVICES COMPANY |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
STATE STREET BANK AND TRUST COMPANY |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Money Market Services Agreement between the Funds listed on Schedule A thereto and State Street Bank and Trust Company, dated as of October 14, 2015.
|
Signed by, |
| |
|
for and on behalf of |
| |
|
EACH OF THE FUNDS LISTED ON SCHEDULE A TO THE MONEY MARKET SERVICES AGREEMENT |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
STATE STREET BANK AND TRUST COMPANY |
| |
|
|
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
AS TO:
Stress Testing Services Agreement between the Funds listed on Schedule A thereto and State Street Bank and Trust Company, made as of April 1, 2016.
|
Signed by, |
| |
|
for and on behalf of |
| |
|
EACH OF THE FUNDS LISTED ON SCHEDULE A TO THE STRESS TESTING SERVICES AGREEMENT |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
|
| |
|
Signed by, |
| |
|
for and on behalf of |
| |
|
STATE STREET BANK AND TRUST COMPANY |
| |
|
|
|
|
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
|
|
|
|
Name and Title |
|
EXHIBIT A: Third Party Attestation Reporting Service Schedule
|
Agreement |
|
Third Party Attestation Reporting |
|
|
|
|
|
Depositary Agreement between MFS Meridian Funds and Xxxxx Xxxxxx Xxxx Xxxxxxxxxx S.C.A., made on August 18, 2016. |
|
Semiannual SOC 1- Type II |
|
|
|
|
|
Depositary Agreement between MFS Investment Management Company (Lux) S.à x.x. and Xxxxx Xxxxxx Xxxx Xxxxxxxxxx S.C.A., made on August 16, 2016 |
|
Semiannual SOC 1- Type II |
|
|
|
|
|
Amended and Restated Custodian Contract among State Street Trust Company Canada (as Trustee), MFS Investment Management Canada Limited, and State Street Trust Company Canada (as Custodian) dated as of October 2, 2017. |
|
Semiannual SOC 1 - Type II |
|
|
|
|
|
Global Link User Agreement among FX Connect, LLC (as assignee of State Street Bank and Trust Company), State Street Bank and Trust Company, and MFS Investment Management a /d/b/a for Massachusetts Financial Services Company, dated May 1, 2006, and as amended by that certain letter re Notice of Reorganization and Assignment of FX Connect and/or FX Connect Trade Services subscription agreement dated May 2, 2017. |
|
[No SOC1 report will be provided for GlobalLink or FX Connect. GlobalLink can provide information regarding the SOC1 report for the data centers at which it hosts data and can provide a TVRA.] |
|
|
|
|
|
Collective Investment Trust Accounting Agreement between MFS Heritage Trust |
|
Semiannual SOC 1 - Type II |
|
Company, acting solely as trustee of certain collective investment trusts listed on Appendix A and State Street Bank and Trust Company, dated November 22, 2006. |
|
Semiannual SOC 1 - Type II |
|
|
|
|
|
Custodian Agreement among MFS Heritage Trust Company, as Trustee, acting solely as trustee of certain collective investment busts listed on Appendix A to the Agreement, and State Street Bank and Trust Company as Custodian, dated November 22, 2006. |
|
Semiannual SOC 1 - Type II |
|
|
|
|
|
Custodian Agreement among Each of the Investment Companies listed on Appendix A to the Custodian Agreement and State Street Bank and Trust Company, dated December 18, 2006. |
|
Semiannual SOC 1 - Type II |
|
|
|
|
|
Funds Accounting Agreement among Each of the Investment Companies listed on Appendix A to the Funds Accounting Agreement and State Street Bank and Trust Company, dated December 18, 2006. |
|
Semiannual SOC 1 - Type II |
|
|
|
|
|
Securities Lending Agency Agreement among Each of the entities listed on Exhibit A to the Securities Lending Agency Agreement, acting on behalf of itself or, in the case of a series company, on behalf of one or more of its portfolios or series listed on Exhibit A and State Street Bank and Trust Company, dated January 5, 2007. |
|
Semiannual SOC 1 |
|
Transfer Agency and Service Agreement between State Street Bank and Trust Company, and MFS Heritage Trust Company, as Trustee of the MFS Heritage Trust Company Collective Investment Trust and certain collective investment trusts established thereunder as listed on Schedule A, dated as of January 18, 2011. |
|
Annual SOC 1 - Type II (Institutional Transfer Agent) |
|
|
|
|
|
Investment Analytics Agreement between MFS Investment Management Company (Lux) Sa.x.x. and State Street Bank and Trust Company, dated July 1, 2012 (assigned to State Street Bank and Trust Company via amendment and assignment dated October 31, 2014). |
|
N/A |
|
|
|
|
|
Amended and Restated Trust Agreement between MFS Investment Management Canada Limited and State Street Trust Company Canada, dated as of October 2, 2017. |
|
Semiannual SOC 1 - Type II |
|
|
|
|
|
Investment Analytics Agreement between Massachusetts Financial Services Company and State Street Bank and Trust Company, dated June 30, 2014. |
|
N/A |
|
|
|
|
|
Registrar and Transfer Agency, Administration, and Paying Agency Agreement among MFS Investment Management Company (Lux) S.a.r.l., MFS Meridian Funds, and State Street Bank Luxembourg S.C.A. (formerly State Street Bank Luxembourg S.A.), dated October 31, 2014 |
|
Semiannual SOC 1 - Type II |
|
|
|
|
|
Administration Agency, Domiciliary, Corporate and Paying Agency, Registrar and Transfer Agency Agreement between MFS Investment Management Company (Lux) S.à x.x. (formerly MFS Investment Management Company (Lux) S.A.) and |
|
Semiannual SOC 1 - Type II |
|
Xxxxx Xxxxxx Xxxx Xxxxxxxxxx S.C.A. (formerly State Street Bank Luxembourg S.A.) dated July 14, 2000 |
|
|
|
|
|
|
|
Transfer Agency and Service Agreement between MFS Investment Management Canada Limited and State Street Trust Company Canada, dated as of October 2, 2017. |
|
Semiannual SOC 1 - Type II |
|
|
|
|
|
Custodian Agreement between State Street Australia Limited and MFS International Holdings Pty. Ltd., dated as of 4 January 2019. |
|
Semiannual SOC 1 - Type II |
|
|
|
|
|
Form N-PORT and Form N-CEN Services Agreement between the Funds listed on Schedule A thereto and State Street Bank and Trust Company, dated as of June 1, 2018. |
|
Semiannual SOC 1 - Type II |
|
|
|
|
|
Regulatory Reporting Support Services Agreement between Massachusetts Financial Services Company and State Street Bank and Trust Company, dated as of February 24, 2014. |
|
Semiannual SOC 1 - Type II |
|
|
|
|
|
Money Market Services Agreement between the Funds listed on Schedule A thereto and State Street Bank and Trust Company, dated as of October 14, 2015. |
|
Semiannual SOC 1 - Type II |
|
|
|
|
|
Stress Testing Services Agreement between the Funds listed on Schedule A thereto and State Street Bank and Trust Company, made as of April 1, 2016. |
|
Semiannual SOC 1 - Type II |
EXHIBIT B: FORM OF ACCESSION AGREEMENT
This Accession Agreement (this “Accession Agreement”) is entered into as of [DATE] pursuant to the terms of that certain Supplemental Agreement dated as of [May ], 2019 by and among the MFS and State Street parties thereto (the “Supplemental Agreement”). Capitalized terms used but not defined herein shall have the respective meanings ascribed to them in the Supplemental Agreement. By the execution of this Accession Agreement, the below MFS and State Street entities agree that [NAME AND DATE OF AGREEMENT] shall become an Agreement under the Supplemental Agreement and be subject to the terms and conditions of Section 3 of the Supplemental Agreement.
IN WITNESS WHEREOF, this Accession Agreement is executed for and on behalf of the undersigned as of the day and year first written above.
|
[Name of MFS ENTITY] |
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
Name and Title |
|
|
|
| |
|
[Name of STATE STREET ENTITY] |
| |
|
|
|
|
|
|
Signature |
|
|
|
|
|
|
|
Name and Title |
|
Xxxxx Xxxxxx Client Information Security Addendum
All capitalized terms not defined in this State Street Client Information Security Addendum (this “Security Addendum”) shall have the meanings ascribed to them in the Supplemental Agreement by and between State Street Bank and Trust Company (“State Street”) and Massachusetts Financial Services Company and its subsidiaries and affiliates (collectively, the “Client”) dated as of October 1, 2019 (the “Agreement”).
State Street and Client hereby agree that State Street shall maintain an information security policy (“Security Policy”) that satisfies the requirements set forth below; provided, that, because information security is a highly dynamic space (where laws, regulations and threats are constantly changing), State Street reserves the right to make changes to its information security controls at any time and at the sole discretion of State Street in a manner that it believes does not materially reduce the protection it applies to MFS Data.
From time to time, State Street may subcontract services performed under the Agreement (to the extent provided for under the Agreement) or provide access to MFS Data or its network to a subcontractor or other third party; provided, that, such subcontractor or third party implements and maintains security measures State Street believes are at least as stringent as those described in this Security Addendum.
1. Objective.
The objective of State Street’s Security Policy and related information security program is to implement data security measures consistent in all material respects with applicable prevailing industry practices and standards (“Objective”). In order to meet such Objective, State Street uses commercially reasonable efforts to:
a. Protect the privacy, confidentiality, integrity, and availability of all MFS Data;
b. protect against accidental, unauthorized, unauthenticated or unlawful access, copying, use, processing, disclosure, alteration, transfer, loss or destruction of the MFS Data;
c. comply with applicable governmental laws, rules and regulations that are relevant to the handling, processing and use of MFS Data by State Street in accordance with the Agreement; and
d. implement customary administrative, physical, technical, procedural and organizational safeguards.
2. Risk Assessments.
a. Risk Assessment - State Street shall, at least annually, perform risk assessments that are designed to identify material threats (both internal and external) against MFS Data, the likelihood of those threats occurring and the impact of those threats upon the State Street organization to evaluate and analyze the appropriate level of information security safeguards (“Risk Assessments”).
b. Risk Mitigation - State Street shall use commercially reasonable efforts to manage, control and remediate any threats identified in the Risk Assessments that it believes are likely to result in material unauthorized access, copying, use, processing, disclosure, alteration, transfer, loss or destruction of MFS Data, consistent with the Objective, and commensurate with the sensitivity of the MFS Data and the complexity and scope of the activities of State Street pursuant to the Agreement.
c. Security Controls Testing - State Street shall, on approximately an annual basis, engage an independent external party to conduct periodic reviews of State Street’s information security practices. State Street shall have a process to review and evaluate high risk findings resulting from this testing.
3. Security Controls. Annually, upon Client’s reasonable request, State Street shall provide Client’s Chief Information Security Officer or his or her designee with a copy of its corporate information security controls that
form the basis for State Street’s Security Policy and an opportunity to discuss State Street’s information security measures with a qualified member of State Street’s information technology management team. State Street shall review its Security Policy annually.
4. Organizational Security.
a. Responsibility - State Street shall assign responsibility for information security management to senior personnel only.
b. Access - State Street shall permit only those personnel performing roles supporting the provision of services under the Agreement to access MFS Data.
c. Confidentiality - State Street personnel who have accessed or otherwise been made known of MFS Data shall maintain the confidentiality of such information in accordance with the terms of the Agreement.
d. Training - State Street will provide information security training to its personnel on approximately an annual basis.
5. Asset Management.
a. Data Sensitivity - State Street acknowledges that it understands the sensitivity of MFS Data.
b. External Hosting Facilities — State Street shall implement controls, consistent with applicable prevailing industry practices and standards, regarding the collection, use, storage and/or disclosure of MFS Data by an external hosting provider.
6. Physical Security.
a. Securing Physical Facilities - State Street shall maintain systems located in State Street facilities that host MFS Data or provide services under the Agreement in an environment that is designed to be physically secure and to allow access only to authorized individuals. A secure environment includes the availability of onsite security personnel on a 24 x 7 basis or equivalent means of monitoring locations supporting the delivery of services under the Agreement.
b. Physical Security of Media - State Street shall implement controls, consistent with applicable prevailing industry practices and standards, that are designed to deter the unauthorized viewing, copying, alteration or removal of any media containing MFS Data. Removable media on which MFS Data is stored (including thumb drives, CDs, and DVDs, and PDAS) by State Street must be encrypted using at least 256 bit AES (or equivalent).
c. Media Destruction - State Street shall destroy removable media and any mobile device (such as discs, USB drives, DVDs, back-up tapes, laptops and PDAs) containing MFS Data or use commercially reasonable efforts to render MFS Data on such physical media unintelligible if such media or mobile device is no longer intended to be used. All backup tapes that are not destroyed must meet the level of protection described in this Security Addendum until destroyed.
d. Paper Destruction - State Street shall cross shred all paper waste containing MFS Data and dispose in a secure and confidential manner.
7. Communications and Operations Management.
a. Network Penetration Testing - State Street shall, on approximately an annual basis, contract with an independent third party to conduct a network penetration test on its network having access to or holding
or containing MFS Data. State Street shall have a process to review and evaluate high risk findings resulting from this testing.
b. Data Protection During Transmission - State Street shall encrypt, using an industry recognized encryption algorithm, personally identifiable MFS Data when in transit across public networks, and where technically feasible, confidential MFS Data. In cases where personally identifiable MFS Data and/or confidential MFS Data is being sent via email between Client and State Street, it is agreed that Transport Layer Security (TLS) will be is implemented and will be used between the parties in lieu of requiring data encryption. And, in cases where personally identifiable MFS Data and/or confidential MFS Data is being transmitted from a State Street application or system, it is agreed that Secure File Transfer Protocol (SFTP) will be used in lieu of requiring data encryption.
c. Data Loss Prevention - State Street shall implement a data leakage program that is designed to identify, detect, monitor and document MFS Data leaving State Street’s control without authorization in place.
d. Malicious Code — State Street shall implement controls that are designed to detect the introduction or intrusion of malicious code on information systems handling or holding MFS Data and implement a process for removing said malicious code from information systems handling or holding MFS Data.
8. Access Controls.
a. Authorized Access - State Street shall have controls that are designed to maintain the logical separation such that access to systems hosting MFS Data and/or being used to provide services to Client will uniquely identify each individual requiring access, grant access only to authorized personnel based on the principle of least privileges, and prevent unauthorized access to MFS Data.
b. User Access - State Street shall have a process to promptly disable access to MFS Data by any State Street personnel who no longer requires such access. State Street will also promptly remove access of Client personnel upon receipt of notification from Client.
c. Authentication Credential Management - State Street shall communicate authentication credentials to users in a secure manner, with a proof of identity check of the intended users.
d. Multi-Factor Authentication for Remote Access - State Street shall use multi factor authentication and a secure tunnel, or another strong authentication mechanism, when remotely accessing State Street’s internal network.
9. Use of Laptop and Mobile Devices in connection with the Agreement.
a. Encryption Requirements - State Street shall encrypt any laptops or mobile devices (e.g., Blackberries, PDAs) containing MFS Data used by State Street’s personnel using an industry recognized encryption algorithm with at least 256 bit encryption AES (or equivalent).
b. Secure Storage - State Street shall require that all laptops and mobile devices be securely stored whenever out of the personnel’s immediate possession.
c. Inactivity Timeout - State Street shall employ access and password controls as well as inactivity timeouts of no longer than thirty (30) minutes on laptops, desktops and mobile devices managed by State Street and used by State Street’s personnel.
d. State Street shall maintain the ability to remotely remove MFS Data promptly from mobile devices managed by State Street.
10. Information Systems Acquisition Development and Maintenance.
a. MFS Data — MFS Data shall only be used by State Street for the purposes specified in the Agreement.
b. Virus Management - State Street shall maintain a malware protection program designed to deter malware infections, detect the presence of malware within the State Street environment, and recover from any impact caused by malware.
11. Incident Event and Communications Management.
a. Incident Management/Notification of Breach - State Street shall develop and implement an incident response plan that specifies actions to be taken when State Street or one of its subcontractors suspects or detects that a party has gained material unauthorized access to MFS Data or systems or applications containing any MFS Data (the “Response Plan”). Such Response Plan shall include the following:
i. Escalation Procedures - An escalation procedure that includes notification to senior managers and appropriate reporting to regulatory and law enforcement agencies. This procedure shall provide for reporting of incidents that compromise the confidentiality of MFS Data (including backed up data) to Client via telephone or email (and provide a confirmatory notice in writing as soon as practicable); provided that the foregoing notice obligation is excused for such period of time as State Street is prohibited by law, rule, regulation or other governmental authority from notifying Client.
ii. Incident Reporting - State Street will use commercially reasonable efforts to promptly furnish to Client information that State Street has regarding the general circumstances and extent of such unauthorized access.
iii. Investigation and Prevention - State Street shall reasonably assist Client in investigating of any such unauthorized access and shall use commercially reasonable efforts to: (A) cooperate with Client in its efforts to comply with statutory notice or other legal obligations applicable to Client or its clients arising out of unauthorized access and to seek injunctive or other equitable relief; (B) cooperate with Client in litigation and investigations against third parties reasonably necessary to protect its proprietary rights; and (C) take reasonable actions necessary to prevent mitigate against loss from any such authorized access.
