Citco announces completion of the Citco Fund Services SOC 2 Type 2 Attestation Report with first-year ISO22301:2019(E) mapping

New York, 18 November 2026 – The Citco group of companies (“Citco”) is pleased to announce that, for the year ended September 30, 2026, the various Citco Fund Services companies (“CFS”) have successfully received a System and Organization Controls 2 (“SOC 2”) Type 2 Attestation Report from an independent service auditor. For the first time, the report also includes mapping relevant controls to ISO 22301:2019 (E) Security and Resilience - Business Continuity Management Systems - Requirements, providing stakeholders with additional transparency over Citco’s operational resilience framework. The examination covered systems, processes, and controls, within CFS and resulted in an unqualified service auditor’s opinion.

The 2026 SOC 2 Type 2 Attestation Report was prepared in accordance with the Statements on Standards for Attestation Engagements (“SSAEs”) issued by the American Institute of Certified Public Accountants (“AICPA”) and International Standard on Assurance Engagements (“ISAE”) 3000, together with their related amendments and interpretations.

The overall scope of the 2026 SOC 2 Type 2 Attestation Report covers Citco’s information security posture and control processes designed to protect customer data and support system availability. The report covers key services within CFS and their supporting applications: 

• Fund Administration (supported by Æxeo®, Æxeo® Investor (“AXI”), Æxeo® Treasury, Investran and Yardi applications, and reporting supported by CitcoOne™); and

• Investor Relations (supported by the AXI and Investran applications, and reporting supported by CitcoOne™)

The independent examination evaluated the design and operating effectiveness of Citco’s control environment against the Security and Availability Trust Services Criteria and related internal control principles.

• Security (Common Criteria)

  + + -

  Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the confidentiality, integrity, and availability of information or systems and affect the entity’s ability to achieve its objectives.

  • Control Environment
  • Information and Communication
  • Risk Assessment
  • Monitoring of Controls
  • Control Activities Related to the Design and Implementation of Controls
  • Logical and Physical Access Controls
  • System Operations
  • Change Management
  • Risk Mitigation
• Availability

  + + -

  Information and systems are available for operation and use to meet the entity’s objectives.

  • Business Continuity

  • Disaster Recovery

  • Backup Management

  • Capacity Management

• ISO 22301:2019 (E) Security and Resilience - Business Continuity Management Systems (BCMS) - Requirements Mapping

  + + -

  As a key enhancement for 2026, the report includes cross-references between relevant CFS controls and ISO 22301:2019 (E) requirements, providing clients with greater transparency into how Citco's control activities align with globally recognized business continuity and resilience practices. This additional insight demonstrates Citco’s commitment to operational resilience, effective response and recovery capabilities, and the ongoing availability of critical systems and services that support its clients’ business objectives.

  Relevant controls have been mapped to the following ISO 22301:2019 (E) clauses:

  • Context of the Organization

  • Leadership

  • Planning

  • Support

  • Operation

  • Performance Evaluation

  • Improvement