Circular CSSF 21/765 — Update of Circular CSSF 01/27 and Circular CSSF 07/325 following amendments to CSSF Regulation No 12-02 — CSSF — LU

CIRCULAR CSSF 21/765
1/2
Circular CSSF
21/765
UPDATE OF CIRCULAR CSSF
01/27 AND CIRCULAR CSSF
07/325 FOLLOWING
AMENDMENTS TO CSSF
REGULATION NO 12-02

CIRCULAR CSSF 21/765
2/3
Circular CSSF 21/765
Re: Update of Circular CSSF 01/27 and Circular CSSF 07/325 following amendments to CSSF Regulation No 12-02 Luxembourg, 4 February 2021 To all credit institutions Ladies and Gentlemen,

The purpose of this circular is to update the content of Part 10 on the professional
obligations as regards the prevention of money laundering and terrorist financing of the long form audit report, as defined in Circular CSSF 01/27 on the practical rules concerning the role of réviseurs d’entreprises (statutory auditors), in order to take into consideration the amendments to Articles 49(2) and 49(3) of CSSF Regulation No 12-02 on the fight against money laundering and terrorist financing, as amended. It should be stressed that this update of Circular CSSF 01/27 only concerns AML/CFT elements and that the remaining part of Circular CSSF 01/27 will be fundamentally revised in 2021.
This circular also adapts, for branches of credit institutions authorised in another
Member State, the content of the report of the réviseur d’entreprises agréé (approved statutory auditor) relating to the specific areas for which the CSSF retains an oversight responsibility as host authority, notably compliance with the rules designed to prevent money laundering and terrorist financing, as defined in Circular CSSF 07/325.
As from the financial year ending on 31 December 2020, this circular shall define
Part 10 of the long form audit report as follows (cf. Annex 1 for details on the
amendments to Circular CSSF 01/27):
“The long form report must describe the procedures set up by the institution concerning the prevention of money laundering and terrorist financing as required for compliance with or as defined in: Chapter 5 of Part II of the law on the financial sector, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, the Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing, Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds, international acts on the fight against terrorist financing brought to the attention of the professionals through CSSF circulars, CSSF regulations on the fight against money laundering and terrorist financing and CSSF circulars in these matters. The long-form report shall provide, in particular:
In case of discrepancies between the French and the English text, the French text shall prevail.

CIRCULAR CSSF 21/765
3/4

the description of the AML/CFT policy set up by the professional in order to
prevent money laundering and terrorist financing, the verification of its compliance with the provisions of Part II, Chapter 5 of the Law of 5 April 1993 on the financial sector, as amended, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, the Grand-ducal Regulation, Regulation (EU) 2015/847, CSSF regulations and CSSF circulars relating to AML/CFT and the control of their sound application;
the assessment of the professional's analysis of money laundering and
terrorist financing risks to which it is exposed. The réviseur d'entreprises agréé (approved statutory auditor) must verify if the implemented procedures, infrastructures and controls, as well as the scope of the AML/CFT measures are appropriate considering the money laundering and terrorist financing risks to which the professional is exposed, particularly through its activities, the nature of its customers and the provided products and services;
a declaration on the performance of a regular audit of compliance with the
professional's AML/CFT policy by the internal audit function and the compliance officer in charge of the control of compliance with the professional obligations, as defined in Article 1(1) of CSSF Regulation 12-02 of 14 December 2012;
the verification of the training and awareness-raising measures for
employees as regards money laundering and terrorist financing, and, in particular, with respect to the identification of money laundering and terrorist financing transactions;
the historical statistics concerning the detected suspicious transactions which
indicate the number of suspicious transaction cases reported to the FIU by the professional, as well as the total amount of funds involved;
the control of the application of the provisions of Regulation (EU) 2015/847
by the professional, in its respective role, and the percentage of transfers of funds for which data on the payer or payee were missing or incomplete and the measures taken in this context by the professional.

CIRCULAR CSSF 21/765
4/5
The réviseur d'entreprises agréé shall state how the sample of reviewed files was selected, as well as the coverage ratio of the population (number of files reviewed / total number of clients; volume of deposits reviewed / total volume of deposits). Where the réviseur d'entreprises agréé identifies cases of non-compliance with the legal or regulatory provisions or deficiencies, the réviseur d'entreprises agréé shall give detailed indications enabling the CSSF to assess the situation (number of pending incomplete files as a percentage of the total number of reviewed files, details of the deficiencies identified, etc.). Note: It should be noted that the réviseurs d'entreprises agréés shall also inform the CSSF of all the denunciations made under Article 5 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, and which concern a professional of the financial sector under the supervision of the CSSF. Similarly, the réviseurs d’entreprises must inform the CSSF in case they deem that the professional should have made a denunciation but has not. Where applicable, the above-mentioned long form report must encompass the professional's branches and majority-owned subsidiaries abroad. It must cover, in particular, the branches' and majority-owned subsidiaries' compliance with the applicable provisions as regards the prevention of money laundering and terrorist financing and it must include, in that respect:

an analysis of money laundering and terrorist financing risks incurred by the
branches and majority-owned subsidiaries. This point should be covered in point 13 “branches abroad” either in Part IV “consolidated long form audit report” or in this section, respectively.
a description and assessment of the money laundering and terrorist financing
risk management in the branches and majority-owned subsidiaries. This point should be covered in point 13 “branches abroad” either in Part IV “consolidated long form audit report” or in this section, respectively.
the verification of the implementation of and compliance with the
professional's AML/CFT policy in the branches or majority-owned subsidiaries. This point should be covered in point 13 “branches abroad” either in Part IV “consolidated long form audit report” or in this section, respectively.“

In point 29 of Circular CSSF 07/325, the following paragraph shall be added (cf.
Annex 2 for details on the amendments to Circular CSSF 07/325):

CIRCULAR CSSF 21/765
5/6
“For the purpose of drawing up its report, the réviseur d’entreprises (statutory auditor) shall apply mutatis mutandis the provisions applicable to the establishment of the annual long form audit report to comply with the professional obligations as regards the fight against money laundering and terrorist financing and the conduct of business rules when providing investment services. The report of the réviseur d'entreprises includes a description of the procedures and controls in place within the branch as well as an appraisal by the réviseur d'entreprises. The descriptive parts of the reports shall be made available to the réviseur d'entreprises by the branches.” Yours faithfully, Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General
Annex 1: Circular CSSF 01/27, as amended by Circulars CSSF 08/340, CSSF 10/484,
CSSF 11/521 and CSSF 21/765
Annex 2: Circular CSSF 07/325, as amended by Circular CSSF 21/765

CIRCULAR CSSF 21/765
6/7
Annex 1 - Circular CSSF 01/27
as amended by Circulars CSSF 08/340, CSSF 10/484 and CSSF 11/521 Re: Practical rules concerning the role of réviseurs d'entreprises (statutory auditors) Ladies and Gentlemen, The purpose of this circular is to define the scope of the statutory audit mandate and the content of the audit reports to be prepared pursuant to Article 54(1) of the Law of 5 April 1993 on the financial sector, as amended (“law on the financial sector”). This circular replaces Circular IML 89/60 of 14 December 1989 which became outdated when new legal, regulatory and prudential provisions entered into force particularly as regards consolidated supervision, internal control, capital adequacy, market risks, as well as the prevention of money laundering and terrorist financing and the rules of conduct. This circular takes into account the broadening of the statutory mission of the réviseurs d'entreprises (statutory auditors) laid down in the Law of 29 April 1999 transposing Directive 95/26/EC (“post-BCCI Directive”), which requires réviseurs d'entreprises to report to the authority the situations that require particular intervention and follow-up and lays the foundations for a new relationship between the réviseurs d'entreprises and the Commission de Surveillance du Secteur Financier (“CSSF”). This circular defines the general role and mission of the réviseurs d'entreprises in the context of statutory audits given the recent national and international developments regarding the statutory audits and knowing that the audit reports of the réviseurs d'entreprises represent an important source of information for the banking supervisory authority when exercising its supervision. The provisions of this circular are applicable to Luxembourg credit institutions and to branches of non-EU credit institutions. Insofar as the branches concerned are in principle exempt from publishing annual accounts on their own activities, the term “annual accounts” as regards branches is to be understood as the final annual accounting information drawn up according to the Luxembourg statutory format for annual accounts. The provisions of this circular are not applicable to branches of EU credit institutions. Branches of EU credit institutions are branches of credit institutions whose head office is in an EU Member State. Credit institutions whose head office is in another country which is party to the European Economic Area Agreement shall be considered as EU credit institutions, within the limits set forth by this Agreement and related Acts . Luxembourg, 23 March 2001 To all Luxembourg credit institutions and branches of non-EU credit institutions

CIRCULAR CSSF 21/765
7/8
A separate circular will be intended for branches of EU credit institutions which shall get audited by a réviseur d'entreprises certain specific areas, for which the CSSF maintains a control responsibility as host authority. These specific areas are: liquidity risk, compliance with the rules relating to the prevention of money laundering and terrorist financing, some aspects of the internal control and the market risks, compliance with the rules of conduct and the security of the IT system. SUMMARY
I. Mandate
II. Report on annual accounts / consolidated accounts
III. Annual long form audit report
III.A. General Principles
III.B. Format of the long form report
III.C. Comments relating to the long form report schema
IV. Consolidated long form audit report
V. Reporting to the CSSF pursuant to Article 54(3) of the law on the
financial sector
VI. Final Provisions
VII. Annexes

List of the summary schedules of IRE
Questionnaire relating to the “group head” function carried out by a
Luxembourg bank
Summary table relating to the IT system
Breakdown schedules regarding credit risk / counterparty risk
Example of classification of loans

CIRCULAR CSSF 21/765
8/9
I. Mandate
The credit institutions must give a written and detailed mandate to their réviseur d'entreprises, containing at least the following provisions:

The audit of annual accounts must be carried out according to the
recommendations issued by the Luxembourg Institut des Réviseurs d’Entreprises (“IRE”). IRE notably provides for the application of the International Standards on Auditing (“ISAs”) published by IFAC (International Federation of Accountants), adapted to or supplementing, if necessary, legislation or national practice. The audit must cover all the areas specified under point 2. hereunder, through the application, where applicable, of the principles of the ISAE (International Standard on Assurance Engagements) of IFAC. The audit must particularly be based on IAPS 1006 (The Audit of International Commercial Banks) also issued by IFAC.
The audit must cover all the business areas of the credit institution, whether they
are recorded on the balance sheet or as off-balance sheet items. The mandate given to the réviseur d'entreprises must not exclude a type of activity, a category of transactions or a specific transaction from the scope of the audit. Furthermore, the audit must cover all the banking risks, as well as all financial, organisational and internal control-related aspects of the bank. The audit shall allow providing any information required in the long form report defined in this circular (cf.
Chapter III. below).
The mandate for the annual audit must expressly contain the following tasks:

verify compliance with Chapter 5 of Part II of the law on the financial sector, the
Law of 12 November 2004 on the fight against money laundering and terrorist financing, Grand-ducal regulation of 1 February 2010 providing details on certain provisions of the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing, Regulation (ECU) 17812015/2006847 of the European Parliament and of the Council of 15 November 200620 May 2015 on information accompanying transfers of funds, international acts relating to the fight against terrorist financing brought to the attention of the institutions through CSSF circulars, CSSF regulations as regards the fight against money laundering and terrorist financing, CSSF circulars in these matters, as well as the fair application of internal procedures regarding the prevention of money laundering and terrorist financing.
verify compliance with Article 37 of the law on the financial sector and the
principles laid down in Circular CSSF 07/307 (MiFID) concerning the conduct of business rules in the financial sector, as well as the fair application of internal procedures for the implementation of the conduct of business rules.
verify compliance with Titles III and IV of the law on payment services.

CIRCULAR CSSF 21/765
9/
10

verify the credit institution's compliance with all other CSSF circulars mentioned
in this circular.
assess the institution's analysis of the money laundering or terrorist financing risk
it faces and verify if the procedures, infrastructures and controls with respect to the fight against money laundering and terrorist financing set up by the institution, as well as the extent of the measures taken by the credit institution, are appropriate considering the money laundering and terrorist financing risk to which the institution is or might be exposed notably through its activities, the nature of its customers and the products and services offered.

The mandate for the annual audit of the credit institution must cover all the bank's
branches abroad.
As far as compliance with Luxembourg standards concerning money laundering and terrorist financing and conduct of business rules is concerned, the mandate must also cover all the subsidiaries of the credit institution established abroad.
The audit of annual accounts as defined above shall be documented, on the one
hand, with a report on annual accounts (cf. Chapter II. hereunder) and, on the other hand, with an annual long form audit report (cf. Chapter III. hereunder). 5a. The annual long form audit report must be based on the accounting situation prepared based on the instructions relating to tables B 1.1/B 1.6 and B 2.1/B 2.5 included in the Recueil des instructions aux banques.
In accordance with Article 111 of the Law of 17 June 1992 relating to the accounts
of credit institutions, as amended (“law on the accounts of banks”), the credit institution which prepares the consolidated accounts for publication must have them audited by the réviseur d'entreprises to whom the audit of the annual accounting documents has been entrusted. The audit of the consolidated accounts shall be carried out according to the recommendations of IRE regarding the audit of consolidated accounts. The audit shall lead to the drawing-up of a report on consolidated accounts (cf. Chapter II. hereunder) and of a consolidated long form audit report (cf. Chapter IV. hereunder). The consolidated long form audit report must be based on the consolidated accounting situation corresponding to the consolidated control exercised by the CSSF. The consolidated accounting situation must be based on the instructions relating to tables B 6.1/B 6.6 and B 6.2/B 6.7 included in the Recueil des instructions aux banques. However, the perimeter of the consolidation control applicable for the publication of accounts may also be used for the prudential financial reporting, provided the difference between them is not material. In such cases, the prior consent of the CSSF is required.

CIRCULAR CSSF 21/765
10/11
Moreover, it should be borne in mind that the credit institution which is the parent institution or which holds certain specific participations, shall, besides the annual report or, if not available, the annual accounts of the subsidiaries or the referred participations, provide the CSSF, where necessary, with the long form audit report of the undertakings concerned pursuant to the specific letters that the CSSF sends to credit institutions following a request to authorise a holding. The credit institutions referred to in this circular shall send a copy of the mandate, covering the above-mentioned requirements and entrusted to the réviseur d'entreprises for the audit of the annual and, where applicable, the consolidated accounts relating to the financial years starting after 31 December 2000 to the CSSF by 30 September 2001 at the latest. The credit institutions shall notify the CSSF of any change to this mandate or of any renewal under other terms as those initially communicated to the CSSF. In general, credit institutions must immediately inform the CSSF if the réviseur d'entreprises terminates his mandate before expiry of the term or if he decides not to renew his mandate. Credit institutions must also notify the CSSF of their duly justified intention to terminate the mandate of their réviseur d'entreprises or not to renew it. The CSSF will analyse, for each request to change the réviseur d'entreprises, the reasons for the envisaged change and will assess whether the credit institution has, during the selection procedure of the new réviseur d'entreprises, carefully assessed the adequacy of the competence and resources of the latter based on the type and volume of the bank’s activities and the nature and complexity of its internal systems. At the same time, the institutions shall transmit a copy of the mandate given to the new réviseur d'entreprises.
II. Report on annual accounts / consolidated accounts
The report on (consolidated) annual accounts contains the auditor's report (or short form report, attestation du réviseur d'entreprises, Bestätigungsvermerk). It is subject to statutory publication together with the (consolidated) annual accounts and the (consolidated) management report it covers, pursuant to Article 71 (Article 112) of the law on the accounts of banks. The réviseur d'entreprises certifies the (consolidated) annual accounts according to the ISA 700 as adopted by IRE.

CIRCULAR CSSF 21/765
11/12
The report on (consolidated) annual accounts must include the elements it refers to, i.e. the (consolidated) annual accounts and the (consolidated) management report. Pursuant to Article 2(1) (Article 85(1)) of the law on the accounts of banks, the (consolidated) annual accounts contain the (consolidated) balance sheet, the (consolidated) profit and loss account as well as the annexe. These documents shall constitute a composite whole. The (consolidated) management report is defined under
Article 70 (Article 110) of the aforementioned law.
In this context, it should be noted that the provisions of the law on the accounts of banks and the rules and instructions issued by the CSSF for the drawing-up of credit institutions' accounts shall be strictly complied with and that it is only allowed departing from them following the prior consent from the CSSF given in specific cases. Where a réviseur d'entreprises notifies the bank that he will give a qualified certificate or refuse to certify the accounts, the credit institution concerned must immediately inform the CSSF thereon (cf. also Chapter V. Reporting to the CSSF pursuant to Article 54(3) of the law on the financial sector hereunder). The report on annual accounts must be submitted to the CSSF before the ordinary general meeting of shareholders in the framework of the “VISA” procedure.
III. Annual long form audit report
III. A. General Principles
The long form report (compte rendu analytique, Prüfungsbericht) aims at describing and analysing the observations concerning financial and organisational aspects that the réviseur d'entreprises made during the course of her/his audit. The long form report that the institutions' réviseur d'entreprises prepare is not intended for the public. It is solely a source of information for the management and administrative bodies of the credit institutions concerned as well as for the supervisory authority.

CIRCULAR CSSF 21/765
12/13
The long form report must also be sufficiently exhaustive and transparent, providing detailed descriptions and assessments of every essential aspect, in order to allow a precise and informed judgement on the internal control's organisation and system, the financial situation and its evolution, as well as the risks incurred by the controlled institution, including those with respect to money laundering and terrorist financing. As regards the language used for the assessments, the long form report shall not include imprecise negative formulations (“We did not encounter serious weaknesses”) or global and approximative assessments (“We noted that most of the points comply with the laws and regulations”). The long form report shall rather provide a positive assessment for each area and subject by indicating each time its working method (use of the sample technique, method for selecting the sample, etc.) and, where applicable, the detail concerning the identified irregularities and weaknesses in order to allow the CSSF to better understand and judge the extent of the noticed problems. The availability of the basic information necessary to the drawing-up of the descriptions of the long form report is under the responsibility of the bank's management. The réviseur d'entreprises may include the descriptions of the management in her/his long form report but s/he must guarantee the adequacy of these descriptions. If need be, s/he must add the necessary amendments or supplements under her/his sole responsibility. However, the réviseur d'entreprises shall carry out, herself/himself and independently, an analysis and adapted audit works which will result in a detailed assessment of all the risks and financial and organisational aspects of the credit institution and an exhaustive documentation of this analysis. During her/his regular audits, the réviseur d'entreprises shall review the compliance with all the legal and prudential provisions applicable to the banking sector, including, in particular, the law on the financial sector, the law on the accounts of banks, the provisions of the Law of 10 April 1915 on commercial companies, as amended (“law on commercial companies”) which are applicable to banks and the CSSF instructions. The réviseur d'entreprises must verify if the control's organisation and procedure provide a reasonable guarantee that the institution has not infringed the legal or prudential provisions which could, on the one hand, affect the financial statements and, on the other hand, prejudice the repute of the credit institution or that of the financial centre. For the purposes of the audit, the réviseur (auditor) may refer to the works of the internal audit or the compliance function in accordance with the principles of the ISA 610 as adopted by IRE. The réviseur d'entreprises must carry out additional specific audits only if there are indications that the credit institution infringed the legal or prudential provisions. In this case, s/he shall
immediately inform the CSSF thereon (also refer to Chapter V. “Reporting to the CSSF pursuant to Article 54(3) of the law on the financial sector” below).

CIRCULAR CSSF 21/765
13/14
The réviseur d'entreprises must report in detail the weaknesses and points needing improvement that s/he observed during the course of his audit. This may be reported within the scope of the long form report or through a management letter addressed to the management of the institution concerned. The observations of the réviseur d'entreprises must come with comments of the bank's management. In case a management letter is drawn up, it must be appended to the long form report except under exceptional circumstances where, based on a duly justified request, the CSSF grants a deadline to transmit the management letter after the long form report. The réviseur d'entreprises must specifically mention if s/he does not issue a management letter. In addition, the réviseur d'entreprises shall mention the existence of all other documents that s/he issued during her/his annual audit and which concern a particular area covered in this circular. These documents are, notably, interim reports relating to specific activity areas as, for example, the audit of loans or the audit of the IT system. Only the general conclusion or, where applicable, the summary of the main points of such interim or partial reports shall be included in the long form report. The reports that the réviseur d'entreprises prepared in the framework of his advice mission are not assimilated to these documents. Besides the report on the annual accounts and the long form report, the credit institutions shall also spontaneously and without being specifically requested communicate to the CSSF all the other documents issued by the réviseur d'entreprises during her/his annual audit as referred above. Finally, it should be noted that, similarly to the report on the (consolidated) annual accounts, the (consolidated) annual long form audit report shall include the signature of the partner in charge of the mandate with the firme de révision (audit firm). The annual long form audit report must be submitted to the CSSF one month at the latest following the ordinary general meeting of the credit institution. Upon duly justified request, the CSSF may grant an additional deadline of one month. Interim or partial reports shall be communicated to the CSSF by the bank as soon as the latter received them. The credit institutions subject to consolidated supervision by the CSSF shall transmit to the latter three months at the latest following their ordinary general meeting:

the consolidated long form audit report; as well as, where applicable, in
accordance with the specific letters that the CSSF sends to the credit institutions following an authorisation request for a holding;
the long form audit reports of their subsidiaries included in the consolidated
supervision;
the long form audit reports of some specific non-consolidated holdings.

CIRCULAR CSSF 21/765
14/15
Upon duly justified request, the CSSF may grant an additional deadline of one month. Interim or partial reports shall be communicated to the CSSF by the bank as soon as the latter received them. The long form reports shall be transmitted to the CSSF in paper and electronic form. III.B. Format of the long form report The long form report must be drawn up according to the format below. This format corresponds to the missions of the réviseur d'entreprises at the Luxembourg credit institutions and branches of non-EU credit institutions. It shall be adapted to the volume and complexity of the activities and to the structure of the audited institution. Where applicable, the réviseur d'entreprises shall supplement the format by aspects s/he deems appropriate. Where a specific point of the format does not apply to a credit institution, the réviseur d'entreprises shall explicitly mention it under the point concerned. For banks issuing mortgage bonds, the long form report shall provide additional information and analyses corresponding to their specific activity. These elements will be specified in a separate circular.

Mandate
Significant events
Organisation and administration
3.1. General organisation
3.1.1. Description of the shareholders
3.1.2. Organisation chart of the bank
3.1.3. Executive and management bodies
3.1.4. Organisation of the operating network
3.1.5. Disaster recovery plan / Business continuity plan
3.1.6. Compliance with Circular IML 95/120
3.2. Administrative organisation
3.3. Accounting system
3.4. IT system
3.4.1. Summary table
3.4.2. Functional scheme of the flows

CIRCULAR CSSF 21/765
15/16
3.4.3. Risk analysis
3.4.4. Internet
3.4.5. IT back-up
3.4.6. Outsourcing
3.4.7. Insourcing
4. Internal control
4.1. Internal procedures
4.2. Internal IT and management control systems
4.3. Risk management
4.4. Audit committee
4.5. Internal audit
4.6. Compliance
5. Activities
5.1. Credits
5.1.1. Commercial and industrial credits
5.1.1.1. national
5.1.1.2. international
5.1.2. Retail credits (consumer credits, personal credits, credit cards, etc.)
5.1.2.1. national
5.1.2.2. international
5.1.3. Residential mortgage credits
5.1.4. Lombard loans
5.2. Deposit collection
5.3. Market activities (except securities activities: currencies, interest rates,
precious metals, commodities, derivative credits, etc.)
5.3.1. On own account (balance sheet - off-balance sheet)
5.3.2. On behalf of customers
5.4. Securities activities on own account (including derivatives)
5.4.1. Financial fixed assets portfolio: fixed-income and variable-yield

CIRCULAR CSSF 21/765
16/17
5.4.2. Investment portfolio: fixed-income and variable-yield
5.4.3. Trading book: fixed-income and variable-yield
5.5. Securities activities on behalf of customers
5.6. Private portfolio management
5.7. Activities relating to UCIs
5.7.1. Depositary bank
5.7.2. Central administration
5.7.3. Other activities
5.8. Corporate finance (advice in relation to capital structure, mergers and
purchase of undertakings, etc.)
5.9. Direct banking (phone banking, internet banking, etc.)
5.10. Payment systems and securities settlement
5.11. Other banking activities (domiciliation, insurance, insourcing, etc.)
6. Periodic reports to submit to the CSSF
7. Prudential ratios
7.1. Solvency ratio
7.2. Liquidity ratio
8. Analysis of annual accounts
9. Banking risks
9.1. Commercial policy and strategy in respect of risk management
9.2. Quantitative and qualitative analysis of the different banking risks
9.2.1. Credit risk / Counterparty risk
9.2.2. Market risk
9.2.3. Settlement risk
9.2.4. Foreign-exchange risk
9.2.5. Interest-rate risk
9.2.6. Liquidity risk

CIRCULAR CSSF 21/765
17/18
9.2.7. Profitability risk
9.2.8. Operational risk
9.2.9. Legal risk and reputational risk
9.2.10. Risk related to private portfolio management, activities relating to UCIs
and other management and service functions
10. Professional obligations as regards the prevention of money laundering and
terrorist financing
11. Professional obligations as regards the conduct of business rules and
provisions in Titles III and IV of the law on payment services.
12. Relations with affiliated undertakings
13. Branches abroad
14. Follow-up on issues raised in previous reports
15. General conclusion
III.C. Comments relating to the long form report schema

Mandate
The réviseur d’entreprises provides a summary description of her/his annual audit mandate. In the context of this point, the réviseur d’entreprises will also mention all other services that s/he herself/himself, her/his company or group have provided to the audited credit institution.

CIRCULAR CSSF 21/765
18/19
2. Significant events
This point indicates, where applicable, the significant events which took place during the year under review. These events are, for example: strategic decisions taken by the board of directors and the executive committee, at the beginning or the end of important reorganisations, the launching or discontinuation of an activity, the conclusion of extraordinary transactions or negotiations with other institutions or groups as regards mergers/acquisitions or cooperation. Where no significant events have taken place during the year under review, the réviseur d’entreprises shall specifically mention this fact.
3. Organisation and administration
This point shall provide an overview of the operational and decision-making structure of the credit institution. It shall allow drawing precise conclusions as regards compliance with the provisions of Circulars IML 95/120 regarding the central administration and 96/126 regarding the administrative and accounting organisation.
3.1. General organisation
3.1.1. Description of the shareholders and of the group
This point provides a description of the bank's direct shareholders and of the group to which it belongs. Where appropriate, this structure shall be presented in the form of an organisation chart.
3.1.2. Organisation chart of the bank
The organisation chart of the credit institution shall differentiate between the management and the different departments and services, indicating the corresponding number of staff, as well as the committees and represent the corresponding hierarchical and functional structures by indicating the general and particular delegations of power. In particular, the functions of risk manager, internal audit, compliance officer and EDP security officer shall be identified. The organisational structure should be submitted under the form of a chart including, if necessary, supporting comments. In case the structural organisation chart is different from the functional organisation chart, the two versions shall be included in the long form report.

CIRCULAR CSSF 21/765
19/20
3.1.3. Executive and management bodies
First the list of members of the executive bodies shall be indicated and especially those who are approved by the CSSF pursuant to Article 7(2) of the law on the financial sector (4-eye principle). This point will include a description of the powers of the executive bodies with a precise indication of the limits of these powers. As regards more particularly the management, the réviseur d’entreprises will indicate if:

the (at least) two members of the management were given their powers directly
by the board of directors, and
they have equal powers (which is a condition for a collegial management and which
shall be correctly reflected in the organisation chart of the bank). The long form report shall indicate if, besides the board of directors and the authorised management, other decision-making bodies exist: sub-committees of the board of directors (credit committee, etc.), internal local committees, group-level committees in which the institution participates (credit committee, treasury committee, etc.) If so, the réviseur d’entreprises shall indicate the composition and powers, as well as possible veto rights that the approved managers of the Luxembourg bank have towards these bodies. In addition, the long form report shall include the list of the persons, approved managers, responsible for certain functions, as referred to in Circular CSSF 2000/19. It will also state all the changes as regards these persons which occurred during the financial year. Since the referred persons may entrust members of staff with the exercise of certain practical tasks related to these functions, the long form report shall provide, where appropriate, a description and assessment of this cooperation.
3.1.4. Organisation of the operating network
The description of the operating network covers the network of national agencies, national and foreign subsidiaries, the branches abroad, the foreign representative offices, the direct banking installations such as the call centres, as well as all the cooperation agreements in relation to the distribution of the bank's products and services by partners or of products and services of other institutions. If the institution has branches and/or subsidiaries, the long form report must also describe and assess the integration of branches or subsidiaries in the organisational, functional and decision-making structure of the bank under this point. In order to do so, the réviseur d’entreprises will analyse the function “group head” exercised by the Luxembourg bank, by answering notably the questions laid down in the questionnaire relating to the function “group head” exercised by a Luxembourg bank available in the annexe.

CIRCULAR CSSF 21/765
20/21
A review of the organisation of the branches and their activities and an analysis of the risks will be provided in a separate chapter for every branch established abroad (cf. point 13 of the long form report). In case the bank has subsidiaries subject to consolidated supervision by the CSSF, a consolidated long form audit report shall be drawn up (cf. Chapter IV. “Consolidated long form audit report” below). The long form report shall also indicate under this point if the institution uses the services of external managers as regards the clients' assets and shall, where appropriate, provide a description and assessment of the manner in which these relations are managed and documented. Finally, the long form report shall also review any other type of cooperation agreement related to the organisation and administration, the internal control or the activities with affiliated or unaffiliated undertakings (e.g. with business providers). The réviseur d’entreprises shall also inform under this point of possible conflicts of the bank related to external managers or cooperation agreements.
3.1.5. Disaster recovery plan / Business continuity plan
A description and assessment of the global recovery plan that the credit institution drew up in case of disaster on its premises or in case the access to its premises is impossible (group solution, specialised undertaking, regular tests, security measures, etc.) shall be provided. As regards the security and IT back-up systems, reference should be made to point 3.4.5. of the long form report.
3.1.6. Compliance with Circular IML 95/120
The outcome of the controls carried out in order to verify the compliance with the principles regarding the central administration laid down in Circular IML 95/120 shall be presented in the annexe in the summary schedule “Compliance with Circular IML 95/120 regarding the central administration” of IRE. This IRE schedule1, which shall be filled in with the comments “yes”, “no” and “n/a” (non applicable), shall be completed, where applicable, by figures or supplementary explanations. The réviseur may also refer to the comments provided in other sections of the long form report. 1 available at the secretariat of IRE and on the website of IRE: http://www.ire.lu

CIRCULAR CSSF 21/765
21/22
3.2. Administrative organisation
This point shall provide a description and assessment of the administrative organisation and of its adequacy in view of the type and volume of the activities of the credit institution. The reconciliation system of the cash and securities accounts shall be described by indicating the number, amount and length of the outstanding. The procedures regarding reversals and transactions with retroactive effects shall be described; it shall be mentioned if the reasons for these transactions must be documented and if these transactions must be authorised by a senior manager. If the number of reversals is unusually high, the reasons for this high number shall be indicated. In addition, this point states the outcome of the controls carried out in order to verify the compliance with the principles relating to the administrative organisation laid down in Circular IML 96/126. The outcome shall be presented in the annexe in the summary schedule “Compliance with Circular IML 96/126 regarding the administrative and accounting organisation” of IRE. This IRE schedule1, which shall be filled in with the comments “yes”, “no” and “n/a” (non applicable), shall be completed, where applicable, by figures or supplementary explanations. The réviseur may also refer to the comments provided in other sections of the long form report.
3.3. Accounting system
This point shall include a description and assessment of the operation and adequacy of the accounting system. This point shall also include the outcome of the controls carried out in order to verify the compliance with the principles relating to the accounting system laid down in Circular IML 96/126. The outcome shall be presented in the annexe in the summary schedule “Compliance with Circular IML 96/126 regarding the administrative and accounting organisation” of IRE. This IRE schedule2, which shall be filled in with the comments “yes”, “no” and “n/a” (non applicable), shall be completed, where applicable, by figures or supplementary explanations. The réviseur may also refer to the comments provided in other sections of the long form report. 1 available at the secretariat of IRE and on the website of IRE: http://www.ire.lu 2 available at the secretariat of IRE and on the website of IRE: http://www.ire.lu

CIRCULAR CSSF 21/765
22/23
If the management information system (MIS) is included in the accounting function and is covered in detail under point 4.2. “Internal information and management control systems”, reference may be made totally or partially to the point in question. The long form report will explicitly review the adequacy of processing dormant accounts and the existence and adequacy of processing internal accounts.
3.4. IT system
This point of the long form report describes the IT systems and processing and assesses their reliability and the security of the processed data. In this context, the réviseur d'entreprises shall verify, in particular, if the credit institution observes the principles relating to the IT system laid down in point 4.5.2. of Circular IML 96/126. The outcome of these controls shall be presented in the annexe in the summary
schedule “Compliance with Circular IML 96/126 regarding the administrative and
accounting organisation” of IRE. This IRE schedule1, which shall be filled in with the comments “yes”, “no” and “n/a” (non applicable), shall be completed, where applicable, by figures or supplementary explanations. The réviseur may also refer to the comments provided in other sections of the long form report.
3.4.1. Summary table
The long form report includes a summary table (cf. example in the annexe) linking the main functions regarding the institution's activity and the IT elements which operate them. These IT elements are composed of software (IT applications or programme systems) and hardware (IT platforms and their operating system) elements.
3.4.1.1. The hardware elements (computers and peripheral equipment)
operating one or several main functions will be identified by their brand, model, operating system (including number of the version) and the logical name allowing their unambiguous identification. The workstation shall not be included in the description if they do not operate at least one main function of the activity. 1 available at the secretariat of IRE and on the website of IRE: http://www.ire.lu

CIRCULAR CSSF 21/765
23/24
3.4.1.2. The software elements operating one or several main functions will
be subject to a simplified description indicating at least the information regarding:

data management: type of management (database, indexed files,
sequential files, combination of different types) and name of the product;
the method of analysis and programming in order to clearly identify
the “object-oriented” developments. The programming languages or CASE tools will be indicated;
the processing mode: real-time, batch or mixed; the latter case shall
indicate the functions processed as batch;
the architecture: client-server and number of levels with an indication,
per level, of the functions used (for example client-server in three levels: presentation, application, data) and the identification of the material supporting each function;
development:
internal development (with or without the use of outsourcing);
software package (with the indication of the provider);
modified software package (if over 20% of the functionalities were
modified) with an indication of the participants in the modifications (internal, provider, mixed);
significant modifications made since the previous financial year.
3.4.1.3. In case of outsourcing of the IT systems or processing, the related
elements shall be clearly identified (cf. also point 3.4.6. below).
3.4.2. Functional scheme of the flows
The main links (interfaces) which exist between the functions and, consequently, the reported systems pursuant to point 3.4.1. shall be described in a functional scheme of flows. Where all functions are included within one single software functioning on a single hardware (it is the case for a banking software package), it is not necessary to detail the internal flows but only the flows entering and coming out of the system. In case the institution exercises functions linked to undertakings for collective investment (UCIs) (custodian, registrar agent, distributor, etc.), these functions shall be included in the summary table and functional scheme of flows with an indication if these functions are or are not outsourced.

CIRCULAR CSSF 21/765
24/25
In case of outsourcing of the IT systems or processing, the related elements shall be clearly identified (cf. also point 3.4.6. below).
3.4.3. Risk analysis
A risk analysis shall cover at least the following four points:

Information security: confidentiality, integrity and continuity criteria
(security, management and monitoring policy; physical security; logical security)
Development and maintenance of systems (quality and startup control;
documentation)
Operating procedures: management of batch processing; safeguards;
printing of reports; etc. (planning, scheduling and control; procedures for monitoring the exits and the processing, safeguarding, restoring and archiving procedures)
Technical support of the IT system (maintaining the basic software;
maintaining and administering databases; maintaining and supervising communication networks; assisting users and the computer related technology)
3.4.4. Internet
The services provided online shall be subject to a particular point in the long form report given the specificity of this communication or distribution method and the increase of related risks.
3.4.4.1. The long form report shall describe the website and specify its nature
(informative, consultative or transactional).
3.4.4.2. The long form report shall include a description of the security mechanisms
implemented on physical (firewall, rooter, etc.) as well as on logical (intruder detector, anti-virus, client authentication, communication confidentiality by encryption, electronic signature and key management, integrity and non-renouncing the transactions, etc.) and organisational (monitoring log history, configuration of the security equipment, generating keys or authentication certificates of client, monitoring systems outside the working hours, etc.) level.

CIRCULAR CSSF 21/765
25/26
3.4.5. IT back-up
The contingency plan allowing the credit institution to operate properly in case of a breakdown of its computer system including the internet connections shall be outlined.
3.4.6. Outsourcing
In case the credit institution outsources IT systems or processing, namely in the two cases set out in Circular IML 96/126, the long form report shall describe in detail the functioning of the transfer of these activities and comment the compliance with all the conditions provided for in points 4.5.2.1. or 4.5.2.2. of the above-mentioned circular, as well as, where applicable, compliance with the additional conditions laid down by the CSSF or the particular modalities agreed on by the credit institution concerned and the CSSF for specific cases. Moreover, points 3.4.1. to 3.4.5. and 3.4.7. remain applicable. In case the data is processed by an external IT processing centre, the réviseur d'entreprises shall review, in particular, the audits carried out on-site by the internal audit of the credit institution or the audits carried out by the réviseur d'entreprises herself/himself at this IT processing centre.
3.4.7. Insourcing
Where the credit institution is insourcing, namely where it provides services relating to IT systems and processing to third parties, the detail of the provided services and counterparties as well as their control in the institution providing these services shall be indicated.

CIRCULAR CSSF 21/765
26/27
4. Internal control
This point shall describe how the internal control system is organised within the bank and assess its appropriateness with respect to the business type and volume of the credit institution and the real and potential money laundering and terrorist financing risks to which the institution is exposed. Moreover, this point allows verifying compliance with the provisions of Circular IML 98/143 on internal control. The information in this respect shall be provided in the annexe in the summary schedule “Compliance with Circular IML 98/143 on the internal control” of IRE. This IRE schedule1, which shall be filled in with the comments “yes”, “no” and “n/a” (non applicable), shall be completed, where applicable, by figures or supplementary explanations. The réviseur may also refer to the comments provided in other sections of the long form report.
4.1. Internal procedures
This point provides an assessment of their appropriateness, functioning and compliance.
4.2. Internal IT and management control systems
This point provides a description and assessment of internal IT and management control systems and, in particular, a description and assessment of the management information system (MIS) and, more generally, of the internal communication system, a description and assessment of the risk management system with an analysis of the existing limits of management duly authorised and of control of their compliance. Where the MIS is covered in detail under point 3.3. “Accounting system”, it may be completely or partially referred to this point.
4.3. Risk management
The long form report shall indicate if a specific function of risk management exists in the bank. If yes, a description and assessment of the competences and functioning of this function shall be provided. 1 available at the secretariat of IRE and on the website of IRE: http://www.ire.lu

CIRCULAR CSSF 21/765
27/28
4.4. Audit committee
In case the bank established an audit committee, the long form report shall describe the composition, operating modalities and competences of the committee.
4.5. Internal audit
This point provides

an assessment on the appropriateness of and compliance with the internal audit
plan;
a description and assessment of the manner in which the internal audit operates
(inhouse, support of the parent company, use of an external expert in which case a review shall be carried out as regards the coordination with the head of the internal audit department, use of third-party professionals);
an assessment of this function's quality. The réviseur shall indicate, in particular, if
the internal audit of the institution observes the standards of the “Institute of Internal Auditors” (IIA Inc.);
for institutions having agencies or branches in the country or abroad, the
integration of these establishments in the audit plan;
an adequacy assessment of the monitoring of the internal audit department's
recommendations.
4.6. Compliance
The long form report shall indicate if a function of the compliance officer exists in the bank. If yes, a description and assessment of the competences and functioning of this function shall be provided.

Activities
The long form report shall provide a summarised description of the type of activities of the credit institution based on the indicated scheme under this point. Alternatively, the description of the activities may be based on the functional structure of the credit institution provided that all the activities are covered. Where a bank has no activity (or a limited activity) in a particular area, the long form report shall explicitly mention it. A change in the activities' structure, the cessation of an activity or the start of new activities or exceptional transactions during the year under review should be reported under point 2. “Significant events”.

CIRCULAR CSSF 21/765
28/29
6. Periodic reports to submit to the CSSF
6.1. The long form report shall describe and assess the systems and
infrastructures implemented in order to draw up periodic prudential reports for the CSSF and the internal control measures aiming to guarantee that the data submitted to the CSSF are complete, correct and drawn up according to the applicable rules. The réviseur d'entreprises shall carry out sampling tests, the methodology and the results of which he shall describe. Where applicable, explicit information must be provided on the integration of agency and branch data into the reporting. The long form report shall review the appropriate application of the provisions in relation to the transmission of periodic data to the CSSF in accordance with Circulars IML 93/92 on the computerised transmission of periodic data and IML 97/135 on the transmission of supervisory data and statistics by telecommunications media. The outcome of these controls shall be presented in the annexe in the summary schedules “Compliance with Circular IML 93/92 on the computerised transmission of periodic data” and “Compliance with Circular IML 97/135 on the transmission of supervisory data and statistics by telecommunications media" of IRE. These IRE schedules1, which shall be filled in with the comments “yes”, “no” and “n/a” (non applicable), shall be completed, where applicable, by figures or supplementary explanations. The réviseur may also refer to the comments provided in other sections of the long form report.
6.2. The réviseur d'entreprises shall also review the processing and monitoring
intended for the whole correspondence between the bank and the CSSF under this point. S/he will indicate if the institution keeps a centralised file on this subject as well as the name and function of the person in charge of this file. In case there is no centralised file in the bank, the réviseur shall review the manner in which the institution allows the complete consulting of the correspondence exchanges between the bank and the CSSF. 1 available at the secretariat of IRE and on the website of IRE: http://www.ire.lu

CIRCULAR CSSF 21/765
29/30
In case the credit institution has a subsidiary/branch abroad, the réviseur shall review, in particular, the processing and monitoring at the credit institution of the correspondence between the subsidiary/branch and the supervisory authority of the country where the latter is established. The réviseur shall note the significant points of the correspondence including, among others, all cases of non-compliance with the laws and regulations by the subsidiary or branch.
7. Prudential ratios1
7.1. Solvency ratio
The long form report shall provide a description and an assessment of the means implemented by the management of the bank in order to monitor and ensure compliance with the prudential solvency ratio. Moreover, the réviseur d'entreprises shall deal in particular with the following points:

confirm if the calculation of own funds representing the numerator in the
solvency ratio is correct;
provide in her/his long form report an assessment of the adequacy of and
compliance with the procedures on which the decision-making bodies of the institution decided as regards the inclusion and exclusion of particular trading book positions, pursuant to point 1.4. of Part II of Circular CSSF 2000/10 on the definition of capital ratios pursuant to Article 56 of the law on the financial sector;
The long form report shall include the main points of the procedures specifying
the criteria governing the inclusion and exclusion of the particular trading book positions which are laid down in detail and in writing by the responsible bodies of the credit institution;
provide a description and assessment of the systems implemented by the
institution pursuant to the points 23 and 24 of Part IV of Circular CSSF 2000/10 in order to cover the risks other than those taken into account in the integrated ratio or simplified ratio, respectively;
proceed to the verifications and review the compliance with the modalities
described under point 6.3.f) of the Part VII of Circular CSSF 2000/10 where a credit institution wishes to include the interim profit in the original own funds; 1 This point only deals with the solvency and liquidity ratio. The compliance with the prudential limits related to large exposures shall be separately analysed in the framework of the analysis of credit risk / counterparty risk (cf. point 9.2.1. of the long form report).

CIRCULAR CSSF 21/765
30/31

issue in her/his long form report an assessment of compliance with the
conditions listed under point 7.f) of Part VII of Circular CSSF 2000/10 and the appropriateness of the inclusion of these loans in the own funds during the inclusion of certain types of subordinated loans in the additional own funds;
issue in her/his long form report an assessment of the compliance with the
conditions listed under point 8.a) of Part VII of Circular CSSF 2000/10 and the appropriateness of the inclusion of these loans in the own funds during the inclusion of certain types of subordinated loans in the additional own funds;
in the event of an additional capital requirement owed as from the 11th
day following the occurrence of the excess over the limits to large exposures due to the trading book, verify and confirm in the long form report that the credit institution has not carried out transactions aiming to get around this requirement (point 21 of Part XIII of Circular CSSF 2000/10);
confirm if the measures for the internal control allow signalling the excess of de
minimis limits stated in the Recueil des instructions aux banques (Part IV, Report 1.4., pp. 4-10) in case the credit institution has the CSSF's authorisation allowing it to calculate a simplified ratio. The possible shortcomings shall be indicated. In addition, the excess of de minimis limits (amount, percentage, duration) as well as the measures implemented by the institution in order to comply with the new limits in question shall be indicated;
In case the credit institution has the CSSF's authorisation allowing it to calculate
its capital requirements for foreign-exchange risk, commodity risk, interest-rate risk or equity price risk pursuant to its own internal models of risk management, the réviseur d'entreprises shall state the appropriateness of the results of these internal models as well as the monitoring of the results and functioning of the internal models in the bank. A detailed description of the internal models used by the bank shall be provided under point 9. “Banking risks”.
7.2. Liquidity ratio
The long form report shall provide a description and assessment of the means implemented by the bank's management to monitor and ensure compliance with the liquidity ratio.

CIRCULAR CSSF 21/765
31/32
In addition, the réviseur d'entreprises shall check the compliance of the credit institution with the principles laid down in Circular IML 93/104 on the definition of a liquidity ratio to be observed by credit institutions. The outcome of these controls shall be presented in the annexe in the summary schedule “Compliance with Circular IML 93/104 on the definition of a liquidity ratio to be observed by credit institutions” of IRE. This IRE schedule1, which shall be filled in with the comments “yes”, “no” and “n/a” (non applicable), shall be completed, where applicable, by figures or supplementary explanations. The réviseur may also refer to the comments provided in other sections of the long form report.
8. Analysis of annual accounts
The long form report shall analyse annual accounts, including the specific comments and explanations on important items and significant developments of the financial situation. For example, the following elements shall be indicated:

comments on the significant increases or decreases of certain balance sheet or
off-balance sheet items;
amount of income received from the investment of own funds which shall also be
reported in the total amount of interest income or other income. Where the institutions do not explicitly identify the reinvestment of their own funds, it is allowed indicating the average return of their assets. This point does not refer to the ROE (return on equity). As regards the definition of “own funds”, reference may be made to the bank's internal definition. In any case, the analysis will be accompanied by a brief definition of the words used;
the comments on the reason for a significant decrease or increase of the interestrate margin, trading profit and loss account, commissions, general expenses,
value adjustments.
It should be noted that, instead of the annexe to the annual accounts, supplementary information and explanations shall be indicated under this point. The long form report also states items, of which the réviseur d'entreprises becomes aware after the closure and which may influence the assessment of the economic and financial situation of the credit institution. 1 available at the secretariat of IRE and on the website of IRE: http://www.ire.lu

CIRCULAR CSSF 21/765
32/33
9. Banking risks
9.1. Commercial policy and strategy in respect of risk management
The bank's management shall describe its commercial policies and strategies regarding the management of related risks. The management shall describe the internal assessment process in relation to capital adequacy and the allocation of the capital to the different risks incurred by the bank, as well as its strategy for maintaining the level of capital. It shall indicate the person or department in charge of the control of this process. In particular, it shall describe the bank's objectives concerning the level of economic capital and the level of the corresponding solvency ratio given the risk profile, the quality of the risk management process and the quality of its internal control environment. The management shall describe the means it intends to implement in order to follow up and ensure the compliance with these internal objectives. The réviseur shall assess, based on this description, if the bank has the financial resources and the appropriate infrastructure to control risks.
9.2. Quantitative and qualitative analysis of the different banking risks
The audit of the annual accounts implicitly includes a certain assessment of the credit institution's economic viability when considering the continuity of operation pursuant to professional standards generally used in this matter. This part of the long form report is considered as essential from the CSSF's prudential point of view. It shall include a detailed analysis of the credit institution's exposure to at least the following risks, the list of which shall be completed, where applicable, according to the activities and situation of the credit institution concerned:

Credit risk / Counterparty risk
Market risk
Settlement risk
Foreign-exchange risk
Interest-rate risk
Liquidity risk
Profitability risk
Operational risk
Legal risk and reputational risk
Risks linked to portfolio management, activities related to undertakings
for collective investment and other management and service functions The long form report includes, on the one hand, a quantitative and, on the other hand, a qualitative analysis for every listed risk:

CIRCULAR CSSF 21/765
33/34
The quantitative analysis shall indicate the scale of the risks (positions assessed at market value) and the related provisions and value adjustments (in absolute and relative terms), insofar as the risks are quantifiable. The qualitative analysis shall provide an analysis of the internal control of risks and notably:

the identification of risks originating from various activities of the bank;
the survey and introduction in the internal communication system;
the assessment systems of the positions and risk measurement;
the provisioning and accounting treatment policies;
the limitation systems (per counterparty, per instrument type, etc.) including also
a description of the stop loss limits;
the measures in case of excess of the limits;
the organisational framework (existence of an independent risk control unit);
the follow-up by the management and board of directors (management
information system: content, periodicity).
As regards the qualitative analysis, total or partial reference shall be made to point 3. of the long form report dedicated to the internal control, in case the above-mentioned aspects or certain aspects were dealt with in detail under the point in question. This point shall nevertheless provide essential conclusions.
9.2.1. Credit risk / Counterparty risk1
9.2.1.1. The long form report shall describe and assess the following elements:

the follow-up and management of credit risk/counterparty risk
(including, among others: internal models and statistical methods for the management of credit risk/counterparty risk);
the alarm functions (criteria for classifying debts as doubtful, non performing,
bad, etc.);
the provisioning policy (including, among others: trigger events, statistical
methods);
1 Reference is made to all transactions with a credit risk/counterparty risk pursuant to point 2.1. of Part XIII of Circular CSSF 2000/10.

CIRCULAR CSSF 21/765
34/35

the accounting treatment of interests on problematic debts (particularly,
it should be indicated if the accounting treatment in question complies with the instructions of the CSSF in Chapter XV.2. of the Preliminary definitions and comments of the Recueil des instructions aux banques);
the assessment and management of guarantees. The security margins
applied by the bank to the different types of cover assets (mortgage on residential real estate property, mortgage on commercial real estate property, government bonds, bank bonds, commercial bonds, new economy shares, etc.), the service in charge of the guarantee assessment, the frequency of assessment of the financial assets in question, the price used for the guarantee assessment and the banking procedures in case of value decrease of covered financial assets below the security margins set by the bank shall be indicated. In addition, the long form report shall indicate if the pledge agreements signed by the client correctly reflect the procedure which the bank must follow in case of value decrease of the guarantees below the limits set by the bank.
the quality of the loan files and general documentation adequacy.
9.2.1.2. The long form report shall describe the essential characteristics of the
transactions with a credit risk/counterparty risk.
The following transactions shall be broken down:
type of transaction (loan transactions: commercial and industrial loans,
retail loans, residential mortgage loans, Lombard loans, etc.; investments in asset backed securities; possible liabilities and off-balance sheet commitments: guarantees, repurchase transactions, etc.; derivative instruments: outrights, IRS, equity swaps, commodity swaps, credit default swaps etc.);
economic sector/counterparty type1 (cf. annexed schedule);
geographical area (cf. annexed schedule);
guarantee type, if this information is important for the credit institution
concerned.
The long form report shall also provide a breakdown according to maturity of credit risk/counterparty risk (cf. annexed schedule). 1 Reference shall be made to the internal classification of the bank.

CIRCULAR CSSF 21/765
35/36
In addition, the long form report shall indicate if the credit institution carried out credit risk/counterparty risk transfers by means of securitisation vehicles or derivative instruments, in which case the amount of the transactions in question shall be provided, as well as a description and analysis of the risks to which the bank is still keeping in the books (first loss credit enhancements, liquidity back-up, early amortisation clauses, repurchase notes, etc.). Moreover, the long form report shall indicate any other striking element.
9.2.1.3. The réviseur d'entreprises shall assess the risk of failure of counterparties,
guarantees, late payments and the particular risks in relation to transactions affected by a credit risk/counterparty risk. The risks which appeared during the year under review shall be indicated if the value adjustments or provisions are carried out for their coverage and if they are sufficient. Furthermore, the following details shall be provided:

breakdown of the total amount of debts and the related value adjustments
according to internal classification used by the bank (to be indicated under point
9.2.1.1. above) by distinguishing between the different transaction types (cf.
example in the annexe);
breakdown of the problematic debts according to the economic sector /
counterparty type1;
report of the amount of the problematic debts in the total amount of debts;
indication and comment of the global development of the value adjustments and
provisions;
the amount of the value adjustments and provisions to be reported, on the one
hand, in the total amount of problematic debts and, on the other hand, in the total amount of debts;
it should be noted that if new provisioning needs appeared after the end of the
financial year,
the long form report shall indicate the amount of (accrued, paid or unpaid)
interests which were counted in the profit and loss account and which were subject to value adjustments; 1 Reference shall be made to the internal classification of the bank.

CIRCULAR CSSF 21/765
36/37

the long form report also indicates the amount of (accrued, paid or unpaid)
interests which were not counted in the profit and loss account due to the fact that relevant loan was placed on a non accrual basis.
the amount of amortised debts and the related interests shall be separately
indicated.
The figures indicated under points 3, 4, 5, 7, 8 and 9 shall be provided for the three last financial years. The above-mentioned indications as regards country risks shall be separately indicated.
9.2.1.4. The long form report shall provide comments and an appraisal of the
calculation of large exposures and compliance with limits to large exposures according to Circular CSSF 2000/10. It should be notably confirmed if the amounts taken into account in the calculations are correct and particularly if the connected clients are correctly grouped. All cases of excess of the limits to large exposures shall be pointed out and the réviseur d'entreprises shall report on the existence of written waiver granted by the CSSF. All cases of unauthorised excesses of the limits to large exposures shall be described in detail, notably as regards counterparty, the maximum amount of risk, the development, the motivation, the duration of the excess, the reasons for a possible belated internal report and for the failure to mention to the CSSF, the corrective internal measures. In addition, a detailed (counterparty, country, nature, amounts, maturity, rate, guarantees, value adjustments, other comments, assessment) description of the following shall be provided:
the risks on the 15 most important debtors/groups of associated debtors;
the important commitments on shareholders having a qualified participation
in the credit institution;
the important commitments which have, in the opinion of the réviseur
d'entreprises, particular aspects notably concerning conditions, guarantees, file processing or any other aspect;
all doubtful commitments on a debtor/group of associated debtors
exceeding the smallest of the following two amounts: EUR 3 million or 10% of own funds. Reference is made to irretrievable commitments (with an indication of the value adjustments), as well as all other doubtful commitments categorised as performing and non-performing commitments by indicating every time the amount of value adjustments.

CIRCULAR CSSF 21/765
37/38
9.2.1.5. The country risk aspect shall be separately processed.
In particular, a description and appraisal shall be provided of the policy and management of country risk of the credit institution, of the existence of limits and guarantees and the related provisioning policy.
9.2.1.6. The réviseur d'entreprises shall indicate her/his method for selecting a
sample of the analysed transactions and the coverage ratio of the population.
9.2.2. Market risk
The long form report shall describe the market activities (securities, currencies, futures, options, etc.) by distinguishing between hedging activities/instruments and trading activities/instruments, as well as a description and appraisal of the system for assessing and controlling market risk implemented in the bank. Where the bank processes market activities on behalf of clients, a detailed description shall be provided of the processed activities, the internal management of the transactions in question (pricing, assessment, consequence of margin calls, etc.) and their accounting treatment, as well as the measures taken by the credit institution to cover related risks. In case a detailed description of the market activities is provided in point 4. “Activities”, reference may be made to the point concerned. In addition, this point shall include the result of the controls carried out for the verification of compliance with the rules set out in Circular IML 93/101 on rules concerning the organisation and internal control of the market activity of credit institutions and in Circular IML 95/119 on rules for the management of risks linked to derivative transactions. The outcome of these controls shall be presented in the annexe in the summary schedules “Compliance with Circular IML 93/101 on rules concerning the organisation and internal control of the market activity of credit institutions” and “Compliance with Circular IML 95/119 on rules for the management of risks linked to derivative transactions” of IRE. These IRE schedules1, which shall be filled in with the comments “yes”, “no” and “n/a” (non applicable), shall be completed, where applicable, by figures or supplementary explanations. The réviseur may also refer to the outcome of these controls in other sections of the long form report. 1 available at the secretariat of IRE and on the website of IRE: http://www.ire.lu.

CIRCULAR CSSF 21/765
38/39
9.2.3. Settlement risk
The long form report describes and assesses how the institution measures, controls and manages its settlement risk. Reference is made to the risk that the credit institution is exposed to as regards the global amount due to it where it irrevocably committed itself in a transaction until the final settlement of the latter.
9.2.4. Foreign-exchange risk
The long form report describes and assesses how the institution measures, controls and manages its global foreign-exchange risk.
9.2.5. Interest-rate risk
The long form report describes and assesses the credit institution's strategy as regards interest-rate risk and its system for internal management of interest-rate risk. In particular, an answer shall be given to the following questions:

Does the credit institution have a system to measure interest-rate risks which
takes into account all the elements sensitive to interest-rate risks (assets, liabilities and off-balance) and, in particular, does this system cover the trading and non-trading areas?
Do the systems for the assessment of interest-rate risks take into account each
different material source of interest-rate risk, including repricing risk, yield curve risk, basis risk and optionality?
Does the assessment system take into account at the same time the perspective
of the economic value impact and the perspective of the income impact;
Does the credit institution use:
a model based on maturity (gap analysis, duration, cash balance scheme (“Barwertmodell”) or a model based on the simulation approach?
What are the validation and stress testing procedures of the assessment
systems?
9.2.6. Liquidity risk
The long form report describes and assesses how the institution measures, controls and manages its liquidity risk. The long form report shall review, in particular, the diversification of the institution's refinancing sources.

CIRCULAR CSSF 21/765
39/40
9.2.7. Profitability risk
The long form report describes and assesses how the institution controls and manages its profitability risk, i.e. the risk of falling below the profitability level. The global analysis as well as the analysis per product, per activity, etc. shall also be indicated.
9.2.8. Operational risk
The long form report shall describe and assess the bank's approach as regards the identification, quantification and management of operational risks which are also defined as direct or indirect loss risks resulting from inadequate or defaulting internal procedures, persons and systems or possible external events. In particular, an answer shall be given to the following questions:

What are the procedures for identifying, categorising and managing events with an
operational risk?
Does the credit institution take into account the difference low frequency high
severity losses / high frequency low severity losses in its approach?
Did the credit institution implement a reporting system for losses incurred and a
database of operational losses realised in the past, per business line and in a global manner?
Does the credit institution use a model for calculating expected losses? If so, the
model shall be described and details on the different components (indicator of exposure to operational risk, probability of default, loss actually realised) shall be provided.
Does the credit institution use techniques for the transfer or reduction of
operational risks such as outsourcing or insurance contracts?
What is the coverage policy (specific and/or general provisions, immediate
amortisation) of the credit institution as regards losses linked to operational risks?
9.2.9. Legal risk and reputational risk
The long form report describes and assesses how the institution controls and manages its legal and reputational risk, including with respect to money laundering and terrorist financing.
9.2.10. Risks linked to private portfolio management, activities relating to
undertakings for collective investment and other management and service functions

CIRCULAR CSSF 21/765
40/41
9.2.10.1. Private portfolio management
This point shall describe the conditions and volume of the activities carried on, broken down in discretionary management (portfolio management) and non-discretionary management (portfolio advice) and possibly broken down per geographical origin of the clients, as well as assess the adequacy of the appropriate internal procedures and internal control systems for private portfolio management. The long form report states if the implemented systems ensure an adequate security with regard to the follow-up on contracts and delegated powers to managers within the scope of their relations with the customers, but also with regard to processed transactions for the account of members of personnel and the management of the institution concerned. The long form report shall describe how the managers are organised and the réviseur d'entreprises shall confirm the strict compliance with the principle of segregation of duties. The réviseur d'entreprises also issues an opinion on the appropriateness of hold mail procedures and of the follow-up of blocked dormant accounts, the existence and control of compliance with written mandates in case of discretionary management and the control of management performances. In case of existing relations between the financial intermediaries, the selection or acceptance procedures of intermediaries in question shall be described and the adequacy of the procedures that the bank has implemented to control the risks inherent to this type of cooperation shall be assessed. As regards the procedures relating to dormant accounts, reference may be made to point 3.3. “Accounting system”. The long form report shall also include a description and assessment of the system for sending account statements and of the system for managing the client identification. The long form report shall have a list of major events concerning this activity, including, among others, the client movements and the new offered products. In addition, it shall indicate the cases where the responsibility of the bank was or might be sanctioned by a compensation to be paid: the volume of the transaction involved, the amount of possible financial compensation and the provisions constituted or to be constituted.
9.2.10.2. Activities related to undertakings for collective investment
Preliminary observation: In case the credit institution had an audit according to the international ISA 402 , type B, or according to the American SAS 70 , type 2 or according to any other equivalent standard, and which covers all the aspects listed below with regard to the activities related to undertakings for collective investment, the long form report shall not include this point. The réviseur d'entreprises shall explicitly mention that such a control took place and the credit institution shall transmit a copy of it to the CSSF.

CIRCULAR CSSF 21/765
41/42 a) Description of the activity
Three aspects shall be developed as regards the description of the activity in order to assess its extent and measure the risks to which the institution is exposed. These elements relate to clients, services provided by the institution and the selection policy and the third-party quality. aa) Description of the clients This description covers the amount of “managed” assets and the number of legal structures (funds and/or sub-funds) that these assets represent. Moreover, the description shall indicate:

if the institution is only active on the Luxembourg UCIs market or if it also
includes UCIs incorporated under other laws among its clients;
the absolute volumes (NAV) and percentages of Luxembourg UCIs (Part I,
Part II of the Law of 30 March 1988 relating to UCIs, as amended) and foreign
UCIs with an indication of the home country of these UCIs;
the investment policy of the managed UCIs: classic products, geographical
locations, derivative products, non listed illiquid products, other sophisticated products. ab) Services provided by the bank A second aspect concerns the nature of the services provided by the bank:
promoter, UCI incorporation, domiciliation of funds, management companies, investment adviser, accounting agent, registrar agent, custodian. For each activity carried out by the institution, the long form report shall shortly describe the volume and types of UCIs concerned and the bank's functions. ac) Third parties The third aspect concerns the quality of the third parties with which the institution works, where applicable: promoters, managers, custodian, transfer agent, correspondents. The long form report shall describe the institution's policy as regards the selection criteria of these counterparties. The réviseur shall outline the third parties with which the institution is in a relationship (volume and quality) and s/he shall indicate if these counterparties were taken into consideration pursuant to the institution's policy. b) Organisation and means of the activity: General information The organisation and means aspect is dealt with according to two standpoints:
the general organisation and procedures and the information processing.

CIRCULAR CSSF 21/765
42/43 ba) General organisation and procedures The long form report shall indicate if the institution has a procedure manual describing the duties relating to each function carried out and if this manual includes the general procedures as well as the procedures specific to the diversity of the activity. It shall explain the segregation of duties especially between the custodian's duty and the accounting agent's duty. bb) IT system The description of the IT system shall deal with the level of integration of the system and the necessity to carry out double entry when the institution carries out several duties for one client. As regards the accounting system for the NAV calculation, the réviseur d'entreprises shall assess if the system is adapted to the type of investments subscribed by the UCIs by allowing their automatic assessment as far as possible. The manual writings or assessments and the relating specific control procedures shall also be pointed out. bc) Organisation and IT system adequacy The réviseur d'entreprises shall assess the adequacy of the IT system and of the human resources available in order to guarantee the good execution of the contractual obligations of the credit institution with respect to investment funds. c) Specific points ca) Some procedures shall be described in more detail by the réviseur who will also give her/his opinion on their efficiency. The specific procedures are the following:

control procedure of the investment policy and restrictions;
procedure for the assessment of the securities portfolio by the accounting
agent by distinguishing the different investment types and by insisting, in particular, on the non-listed and illiquid securities;
control procedure of the correctness of the net asset value calculation;
control procedure relating to the origin of the funds (anti-money laundering
and terrorist financing procedure) of the registrar agent. cb) The réviseur d'entreprises shall also establish a list of major events concerning the UCI activity, including the client movements, for example.

CIRCULAR CSSF 21/765
43/44 cc) In addition, s/he shall indicate the cases where the responsibility of the bank was or might be sanctioned by a compensation to be paid: the volume of the transaction involved, the amount of the possible financial compensation and the provisions constituted or to be constituted. S/he is particularly requested to establish a list of NAV errors during the current year by specifying the source of the error, the amount of the possible financial compensation and the provisions constituted or to be constituted.
9.2.10.3. Other management and service functions
This point shall describe the type and volume of the activities carried out (function of depositary of third-party assets, fiduciary function, function of council and administration, of incorporation, of domiciliation and preparation of companies' accounting records, as well as the function of companies' director, etc.) and assess the adequacy of the internal procedures and internal control systems of the different management or service functions. The long form report shall indicate if the credit institution neatly and professionally performs its other management and service functions with respect to which the credit institution may be held liable for negligence or non-compliance with its obligations. The long form report shall list the major events concerning the activities in question, including, among others, the client movements and the new products or services offered. In addition, it shall indicate the cases where the responsibility of the bank was or might be sanctioned by a compensation to be paid: the volume of the transaction involved, the amount of possible financial compensation and the provisions constituted or to be constituted.
10. Professional obligations as regards the prevention of money laundering
and terrorist financing
The long form report must describe the procedures set up by the institution concerning the prevention of money laundering and terrorist financing as required for compliance with or as defined in: Chapter 5 of Part II of the law on the financial sector, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, the Grand-ducal regulation of 1 February 2010 providing details on certain provisions of the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing, the Regulation (ECU) 17812015/2006847 of the European Parliament and of the Council of 15 November 200620 May 2015 on information accompanying transfers of funds, international acts on the fight against terrorist financing brought to the attention of the professionals through CSSF circulars, CSSF regulations as regards the fight against money laundering and terrorist financing, of CSSF circulars in these matters.

CIRCULAR CSSF 21/765
44/45
The long form report shall provide, in particular:

the description of the AML/CFT policy set up by the professional in order to
prevent money laundering and terrorist financing, the verification of its compliance with the provisions of Part II, Chapter 5 of the Law of 5 April 1993 on the financial sector, as amended, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, the Grand-ducal Regulation, Regulation (EU) 2015/847, CSSF regulations and circulars relating to AML/CFT and the control of their sound application;a description of the client acceptance policy;
the assessment of the professional’s analysis of money laundering and terrorist
financing risks to which it is exposed. The réviseur d'entreprises agréé (approved statutory auditor) must verify if the implemented procedures, infrastructures and controls, as well as the scope of the AML/CFT measures are appropriate considering the money laundering and terrorist financing risks to which the professional is exposed, particularly through its activities, the nature of its customers and the provided products and services;an assessment of the appropriateness of the bank's internal procedures concerning the prevention of money laundering and terrorist financing, as well as their compliance with the provisions of Chapter 5 of Part II of the law on the financial sector, the amended law of 12 November 2004 on the fight against money laundering and terrorist financing, the Grand-ducal regulation of 1 February 2010 providing details on certain provisions of the amended law of 12 November 2004 on the fight against money laundering and terrorist financing, the Regulation (EC) 1781/2006 of the European Parliament and of the Council of 15 November 2006 on information on the payer accompanying transfers of funds, international acts on the fight against terrorist financing brought to the attention of the institutions through CSSF circulars, CSSF regulations as regards the fight against money laundering and terrorist financing, CSSF circulars in these matters. The réviseur d'entreprises shall also review the proper implementation of the procedures concerned. Moreover, the outcome of these controls shall be presented in the annexe in the
schedule “Measures to combat money laundering and terrorist financing and on
the prevention of the use of the financial sector for the purposes of money laundering and terrorist financing” of IRE. This IRE schedule, which shall be filled in with the comments “yes”, “no” and “n/a” (non applicable), shall be completed, where applicable, by figures or supplementary explanations. The réviseur may also refer to the outcome of these controls in other sections of the long form report;
a declaration on the performance of a regular audit of compliance with the
professional’s AML/CFT policy existence of a regular control of compliance with procedures by the internal audit department function and the compliance officer in charge of the control of compliance with the professional obligations as defined in Article 1(1) of CSSF Regulation 12-02 of 14 December 2012;

CIRCULAR CSSF 21/765
45/46

employee the verification of the training and information on the detection of
awareness-raising measures for employees as regards money laundering and terrorist financing operations and, in particular, with respect to the identification of money laundering and terrorist financing transactions;
historical statistics concerning the detected suspicious transactions which indicate
the number of suspicious transaction reports filed by the bank to the State prosecutor (Financial Intelligence Unit) cases reported to the FIU by the professional, as well as the total amount of funds involved;
the control of the application of the provisions of Regulation (EU) 2015/847 by
the professional, in its respective role, and the percentage of transfers of funds for which data on the payer or payee were missing or incomplete and the measures taken in this context by the professional.assessment of the institution's analysis of money laundering and terrorist financing risks to which it is exposed. The réviseur shall verify if the procedures, infrastructures and controls with respect to combating money laundering and terrorist financing set up by the institution, as well as the extent of the measures taken by the institution, are appropriate considering the money laundering and terrorist financing risk to which the institution is or might be exposed notably through its activities, the nature of its clients and the products and services offered The réviseur d'entreprises agréé shall state how the sample of reviewed files was selected, as well as the coverage ratio of the population (number of files reviewed / total number of clients; volume of deposits reviewed / total volume of deposits). Where the réviseur d'entreprises agréé identifies cases of non-compliance with the legal or regulatory provisions or deficiencies, the réviseur d'entreprises agréé shall give detailed indications enabling the CSSF to assess the situation (number of pending incomplete files as a percentage of the total number of reviewed files, details of the deficiencies identified, etc.) (also refer to Chapter V. “Reporting to the CSSF pursuant to Article 54(3) of the law on the financial sector” below). Note: It should be noted that the réviseurs d'entreprises shall also inform the CSSF of all the denunciations made under Article 5 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended and which concern a professional of the financial sector under the supervision of the CSSF. Similarly, the réviseurs d’entreprises must inform the CSSF of cases where they deem that the professional should have made a denunciation but has not. Where applicable, the above-mentioned long form report shall encompass the professional's branches and majority-owned subsidiaries abroad. It must cover, in particular, the branches' and majority-owned subsidiaries' compliance with the applicable provisions as regards the prevention of money laundering and terrorist financing and it shall include, in that respect:

CIRCULAR CSSF 21/765
46/47

an analysis of money laundering and terrorist financing risks incurred by the
branches and majority-owned subsidiaries. This point should be covered in point 13 “branches abroad” either in Part IV “consolidated long form audit report” or in this section, respectively;
a description and assessment of the money laundering and terrorist financing risk
management in the branches and majority-owned subsidiaries. This point should be covered in point 13 “branches abroad” either in Part IV “consolidated long form audit report” or in this section, respectively;
the verification of the implementation of and compliance with the professional's
AML/CFT policy in the branches and majority-owned subsidiaries. This point should be covered in point 13 “branches abroad” either in Part IV “consolidated long form audit report” or in this section, respectively.

Professional obligations as regards the conduct of business rules and
provisions in Titles III and IV of the law on payment services.
The long form report shall describe and assess compliance with Article 37 of the law on the financial sector and principles laid down in Circular CSSF 07/307 (MiFID) concerning the conduct of business rules in the financial sector, as well as the fair application of internal procedures for the implementation of the conduct of business rules. In addition, this point shall include the outcome of the controls carried out for the verification of compliance with the conduct of business rules laid down in Circular CSSF 07/307 (MiFID) in the annexe in the summary schedule “Compliance with Circular CSSF 07/307 (MiFID) concerning the conduct of business rules in the financial sector” of IRE. This IRE schedule, which shall be filled in with the comments “yes”, “no” and “n/a” (non applicable), shall be completed, where applicable, by figures or supplementary explanations. The réviseur may also refer to the outcome of these controls in other sections of the long form report. The long form report shall also describe and assess compliance with Titles III and IV of the law on payment services. The long form audit report of the réviseur d'entreprises agréé (approved statutory auditor) shall explicitly indicate:

if the payment service provider observed the information requirements for
payment services as laid down in Title III of the law on payment services;
if the payment service provider observed the requirements as regards the
execution of payment transactions as laid down in Chapter 3 of Title IV of the law on payment services.

CIRCULAR CSSF 21/765
47/48
12. Relations with affiliated undertakings
Besides the information provided in the annexe to the annual accounts, the réviseur d'entreprises shall certify in the long form report that s/he examines the intragroup and specific transactions if they are carried out at arm's length. The réviseur d'entreprises shall indicate how the sample of audited transactions was selected and the coverage ratio of the population. The following shall notably be described and commented upon:

the policies and goals pursued by the bank in its relations with the affiliated
undertakings;
the type of executed intragroup transactions;
the guarantees issued to the benefit of/received by the affiliated undertakings
(circumstances, conditions, etc.);
the part of interests received from the affiliated undertakings, or the part of
interests paid to the undertakings respectively;
the prices charged for services provided or received;
the split of the margins received on clients transferred in the group, etc..

Branches abroad
The credit institution's branches abroad shall be included by the réviseur d'entreprises in the annual audit of the credit institution. This control shall be handled in a separate chapter in the long form report for every individual branch and must cover the prudential aspects (financial situation, risks, organisation) as well as compliance with the provisions applicable to the prevention of money laundering and terrorist financing, as well as conduct of business rules. For every branch, the following shall be provided in particular:

an organisation chart of the branch;
data on the activities structure and the development of the past and contemplated
activities structure;
analysis of risks incurred by the branch, including money laundering and terrorist
financing risk;
a description and assessment of the risk management in the branch, including as
regards money laundering and terrorist financing;
the verification of the implementation of and compliance with the professional's
AML/CFT policy in the branch;

CIRCULAR CSSF 21/765
48/49

a description and assessment of the procedures as regards internal control
implemented by the branch, the existence of an own internal audit function and the modes of integration of the branch in the examination of the internal audit service of the head office;
the serious deficiencies that the internal control at the branch may have revealed;
an assessment of the appropriateness of the administrative and accounting
organisation;
an assessment of the appropriateness of the infrastructure in the branch as
regards human and technical resources, information systems, management control and internal audit;
the implementation and verification of compliance with procedures as regards the
prevention of money laundering and terrorist financing in the branch;
the implementation and verification of compliance with Luxembourg procedures
as regards the conduct of business rules within the branch;
the integration of the branch from an accounting point of view;
a description of computer and processing systems of the branch and their
integration into the computer and processing systems of the head office. The long form report shall also indicate the legal and regulatory provisions that the branches established in another Member State of the European Community (including Iceland, Liechtenstein and Norway) shall comply with in the host country, notably as regards liquidity, as well as the compliance with those provisions by the institution concerned. The réviseur d'entreprises shall also review the compliance of the credit institution with Circular IML 93/99 on the provisions for Luxembourg credit institutions wishing to exercise banking activities in other EEC countries through the establishment of branches or under the freedom to provide services. The outcome of these controls shall be presented in the annexe in the summary schedule “Compliance with Circular IML 93/99 on the provisions for Luxembourg credit institutions wishing to exercise banking activities in other EEC countries through the establishment of branches or under the freedom to provide services” of IRE. This IRE schedule1, which shall be filled in with the comments “yes”, “no” and “n/a” (non applicable), shall be completed, where applicable, by figures or supplementary explanations. The réviseur may also refer to the outcome of these controls in other sections of the long form report. 1 available at the secretariat of IRE and on the website of IRE: http://www.ire.lu.

CIRCULAR CSSF 21/765
49/50
14. Follow-up on issues raised in previous reports
The réviseur d'entreprises indicates in this part of her/his report the follow-up on serious irregularities and weaknesses observed during the previous audits and described in detail either in the previous long form report, or in a separate management letter. (cf. also Chapter III.A. “General Principles” above)
15. General conclusion
The réviseur d'entreprises shall take position in the general conclusion on the essential points of her/his audit, so as to provide an overview of the situation of the audited credit institution. More generally, the réviseur d'entreprises shall summarise the main notes and conclusions of the report. S/he shall also indicate the main recommendations and observations for the management of the credit institution within the scope of the audit of accounting documents, as well as the management’s response thereon. In case the réviseur d'entreprises sends a separate recommendation letter to the management, the general conclusion may refer to this part of the document concerned which shall be included in the annexe of the long form report, except in exceptional cases following the CSSF's authorisation based on a duly justified request. (cf. also
Chapter III.A. “General Principles” above)
The réviseur d'entreprises shall indicate the complete list of all documents s/he issued during her/his audit of accounting documents of the financial year under review. (cf. also Chapter III.A. “General Principles” above) The réviseur d'entreprises shall describe the existence of any problems of the institution with foreign supervisory authorities.
IV. Consolidated long form audit report
The consolidated long form audit report shall be drawn up according to the same principles and format as the annual audit report. It shall however focus on the specific information regarding the consolidated situation. Where a Luxembourg credit institution subject to the consolidated audit of the CSSF is exempt from publishing consolidated accounts or where the perimeter of consolidation of the publication of consolidated accounts differs from the perimeter of consolidation of the supervision on a consolidated basis, the consolidated long form audit report shall be based on the accounting situation corresponding to the perimeter of consolidated supervision carried out by the CSSF. This consolidated accounting situation shall be drawn up based on the instructions of tables B. 6.1. and B. 6.2. included in the Recueil des instructions aux banques.

CIRCULAR CSSF 21/765
50/51
The aim of the consolidated long form audit report is to provide an overview of the situation of the group and give indications as to the management of the group and structure of the group’s risks. The consolidated long form audit report may refer to specific points of the annual long form audit report of one of the companies included in the consolidation, where the situation of the group as regards a specific point is mainly determined by the company concerned and provided that the consolidated long form audit report provides the essential information concerning this subject. The consolidated long form audit report shall particularly provide the following additional elements, specific to consolidated accounts:
Work premises:

an organisation chart of the group;
the perimeter of consolidation and the changes to the perimeter during the
financial year under review, with an indication by the réviseur d'entreprises responsible for the audit of annual documents of every consolidated participation;
the list of participations of the bank that are not or that are not any more included
in the consolidation, with an indication of the reasons;
the consolidation methods.
ad Organisation and administration:
an assessment of the adequacy of the group's organisation with CSSF circulars
and of the application of management principles drawn up by the group;
a description of the powers of the consolidated subsidiaries;
a description and assessment of the means of control of the subsidiaries (followup of the activity, profitability, management, risks): staff and implemented
technical means (from a management as well as accounting and IT point of view);
a description of the computer and processing systems of every subsidiary and
their integration in the computer and processing systems of the credit institution. ad Internal control:
The long form report shall review, on the one hand, the procedures as regards
internal control applied in the subsidiaries and the existence of an internal audit function in every subsidiary and, on the other hand, the modalities for integrating subsidiaries in the inspection plan of the internal audit department of the parent company.

CIRCULAR CSSF 21/765
51/52

The long form report shall indicate if the control of the subsidiaries by the internal
audit showed serious deficiencies which shall thus be reported. ad Activities:
The long form report shall describe the activities of every subsidiary and consolidated sub-subsidiary. ad Prudential ratios:
Whereas the liquidity ratio is not applicable at consolidated level, the solvency ratio shall be observed at individual as well as at consolidated level. The long form report shall describe and assess in detail the consolidated own funds calculation and the compliance with the solvency ratio defined in Circular CSSF 2000/10 at consolidated level. Reference shall be made to the instructions relating to the solvency ratio included in point 7.1. of the long form audit report. ad Analysis of consolidated accounts:
The long form report shall first describe the methodology used to establish the
consolidated accounting situation: collecting data necessary for the consolidation, group's accounting principles, eliminating operations between consolidated entities, consolidation restatement, etc..
The long form report shall indicate the contribution (in absolute and percentage
figures) to the consolidated accounting situation of every consolidated company.
As far as the comments on the different items of the consolidated accounting
situation is concerned, the long form report may refer, for further information, to comments of the items included in the annual long form audit report of one of the companies included in the consolidation but only where the company concerned mainly contributes to the total of most items. The consolidated long form audit report shall nevertheless comment the items which have a specific scope within the consolidation or the analysis principles of which as regards consolidation differ from those used for annual accounts. ad Banking risks:
The long form report shall describe and assess in detail the monitoring and
management of the different banking risks at group level, including with respect to money laundering and terrorist financing.

CIRCULAR CSSF 21/765
52/53

The long form report shall describe and assess in detail the calculation of large
exposures and the compliance at consolidated level with limits to large exposures laid down in Circular CSSF 2000/10. Reference shall be made to the instructions relating to the solvency ratio laid down in point 9.2.1. “Credit risk / Counterparty risk” of the annual long form audit report. The long form report may refrain from describing in detail the dubious important loans at consolidated level only where the loan activity is mainly determined by one of the consolidated companies and where the annual long form audit report of the company concerned allows a detailed and sufficient assessment of the global exposure. ad Professional obligations as regards the prevention of money laundering and terrorist financing:
The long form report shall provide information on the implementation and verification of compliance with procedures in the consolidated subsidiaries and provide a description and an assessment of the centralisation and monitoring in this respect at the parent-company level. With respect to majority-owned subsidiaries, the long form report must also include:
an analysis of money laundering and terrorist financing risks incurred by the
subsidiary;
a description and an assessment of the money laundering and terrorist financing
risk management in the subsidiary;
the verification of the implementation of and compliance with the professional's
AML/CFT policy in the subsidiary. ad Professional obligations as regards the conduct of business rules:
The long form report shall provide information on the implementation and verification of compliance with Luxembourg procedures in the consolidated subsidiaries and provide a description and an assessment of the centralisation and monitoring in this respect at the parent-company level. ad General conclusion:
The réviseur d'entreprises shall indicate, in the general conclusion of the consolidated long form audit report, if the risks are adequately managed and controlled at group level and if the group's structure and management are appropriate. In case some companies included in the consolidation entrusted the audit of their annual accounts to a different réviseur d'entreprises from the one in charge of the annual and consolidated accounts of the parent company, the réviseur d'entreprises shall also review her/his cooperation with the other réviseurs d'entreprises concerned.

CIRCULAR CSSF 21/765
53/54
Compliance with Circular IML 96/125 relating to the supervision of credit institutions on a consolidated basis:
The réviseur d'entreprises shall review the compliance of the credit institution with Circular IML 96/125. The outcome of these controls shall be presented in the annexe in the summary schedule “Compliance with Circular IML 96/125 relating to the supervision of credit institutions on a consolidated basis” of IRE. This IRE schedule1, which shall be filled in with the comments “yes”, “no” and “n/a” (non applicable), shall be completed, where applicable, by figures or supplementary explanations. The réviseur may also refer to the outcome of these controls in other sections of the long form report.
V. Reporting to the CSSF pursuant to Article 54(3) of the law on the financial
sector
Pursuant to Article 54(3) of the law on the financial sector, introduced by the Law of 29 April 1999, the réviseur d'entreprises is required to notify the CSSF without delay of any decision of which s/he becomes aware during the course of her/his audit of the annual accounting documents of a professional of the financial sector or another statutory mission, where this fact or decision:

concerns the professional of the financial sector and
is such as to:
constitute a serious breach of the provisions of the law on the financial
sector or the regulatory provisions for its implementation, or
prejudice the continuity of operation of the professional;
entail the refusal of the certification of accounts or the expression of
reservations thereon.
The réviseurs d'entreprises shall exercise a reporting function and, thus, participate in the prudential supervision of the CSSF. 1 available at the secretariat of IRE and on the website of IRE: http://www.ire.lu.

CIRCULAR CSSF 21/765
54/55
The mission of the réviseur d'entreprises shall be set in a perspective of prevention not only in the short term (as it is the case for the certification of annual accounts) but also in the medium and long term (objective of the prudential supervision). Consequently, the réviseur d'entreprises shall communicate to the CSSF the information of which s/he became aware while carrying out her/his mission and which is relevant from a prudential point of view and/or likely to require an urgent action by the CSSF. The réviseur d'entreprises is also required to report without delay to the CSSF any fact or decision meeting one of the three above-mentioned criteria, of which s/he became aware during the course of her/his audit of the annual accounting documents or another statutory mission at a company linked on an audit basis to the professional of the financial sector for which s/he carries out a statutory mission. The terms “linked on an audit basis” means the link between a parent company and a subsidiary in the cases laid down in Article 77 of the law relating to the accounts of banks in order to draw up consolidated accounts or through a similar relation between two natural or legal persons and an undertaking; any subsidiary undertaking of a subsidiary undertaking shall also be considered as subsidiary of the undertaking that is their original parent. Two or several natural or legal persons that are subsidiaries of the same parent company shall also be considered as being linked on an audit basis. The legal requirement to report “without delay” the relevant information to the CSSF does not prevent the réviseur d'entreprises to consult first the persons in charge of the professional concerned, provided that the latter are not implicated and that the discussion does not unduly delay the transmission of information to the CSSF. As regards the communication methods, it is agreed that:

the reporting of the réviseurs d'entreprises are carried out spontaneously, in
written or oral form; in case of serious problems, it is recommended that the oral communications be followed by a written confirmation as quickly as possible;
the reporting shall be primarily fast rather than precise and complete;
in the reporting to the CSSF, the réviseurs d'entreprises shall explicitly inform:
on the real or possible problems noted;
if possible, on the causes of these problems and give a reasoned opinion in
this matter.
“Another legal mission” means, among others:
a specific audit carried out at the professionals of the financial sector upon request
by the CSSF based on Article 54(2) of the law on the financial sector;
an intervention in the framework of a merger project of undertakings, pursuant
to the law on commercial companies;

CIRCULAR CSSF 21/765
55/56

an intervention in the framework of a split project of undertakings, pursuant to
the law on commercial companies;
an intervention when the share capital is being paid up with contributions other
than in cash, pursuant to the law on commercial companies.
Examples of facts or decisions falling or likely to fall under the reporting obligation to the CSSF

assessment problems in relation to credit risk;
frauds likely to generate important losses;
important disputes;
financial difficulties in the branch or subsidiary;
major event in the branch or subsidiary;
significant errors in the periodical statements;
granting of an interim dividend while the credit institution has insufficient or
barely sufficient own funds;
important and repeated exceeding of the internal limits;
activity change without appropriate infrastructure;
serious deficiencies in the internal control system;
important increase of the risks linked to the bank's activity;
important disposal of depositors likely to create a liquidity problem;
non-compliance with the professional obligations notably as regards the
prevention of money laundering and terrorist financing or the conduct of business rules;
breach by a director of the “four-eyes” principle (e.g. during a procedure for the
granting of credit);
major conflicts within the decision-making bodies of the institution;
unexpected departure of a manager of a key management position;
important dysfunctions in the IT organisation or infrastructure;
important reorganisation;
change in the shareholder with a qualifying holding without the prior approval of
the CSSF;
acquisition of a qualifying holding without the prior approval of the CSSF.

CIRCULAR CSSF 21/765
56/57
In return for this reporting requirement to the CSSF, the new Article 54(4) of the law on the financial sector, introduced by the above-mentioned Law of 29 April 1999, guarantees that the réviseur d'entreprises, who, in good faith, discloses confidential information pursuant to paragraph (3), is protected against any third-party claims.
VI. Final Provisions
a. Repealing provision
Circular IML 89/60 is hereby repealed. b. Transitional provisions In the first annual/consolidated long form audit report drawn up according to the instructions of this circular, the figures regarding the credit risk/counterparty risk required in point 9.2.1.3. may only concern two consecutive financial years. The deadline for the transmission to the CSSF of the first annual/consolidated long form audit report drawn up according to the instructions of this circular is extended by one month.
c. Entry into force
The instructions of this circular shall be binding in their entirety for the annual and consolidated accounting statements starting after 31 December 2000. Yours faithfully, COMMISSION DE SURVEILLANCE DU SECTEUR FINANCIER Charles KIEFFER Arthur PHILIPPE Jean-Nicolas SCHAUS Director General

CIRCULAR CSSF 21/765
57/58
Annex 2 - Circular CSSF 07/325 as amended by Circular CSSF 21/765
Re: Provisions relating to credit institutions and investment firms of EU origin established in Luxembourg by way of branches or exercising activities in Luxembourg by way of free provision of services Dear Sir, Madam, This circular is issued pursuant to the transposition into Luxembourg law of Directive 2004/39/EC of the European Parliament and of the Council on markets in financial instruments (“MiFID Directive”) through the Law of 13 July 2007 on markets in financial instruments (“MiFID Law”) amending the Law of 5 April 1993 on the financial sector (“LFS”) and updates the circulars that existed in this field (IML 93/100, IML 98/147). The purpose of this circular is to provide further details on the principle of freedom of establishment by way of branches and free provision of services for credit institutions and investment firms whose head office is in another Member State. The MiFID Directive incorporates the principles that had already been set down in Directive 93/22/EEC on investment services in the securities field, such as the single authorisation recognised in all the Member States of the European Union. Nevertheless, it raises the level of harmonisation in order to ensure increased investor protection and to allow credit institutions and investment firms to provide their banking and investment activities/services in all Member States based on the principle of supervision by the home supervisory authority. For branches of credit institutions and investment firms of EU origin, certain fields of supervision, however, fall within the remit of the supervisory authority of the host Member State, considered as the authority that is the closest to the branch and better placed to detect problems and intervene in order to ensure compliance with the rules imposed on branches. The purpose of this circular is to provide additional information on the role of the CSSF as host authority and to point out to credit institutions and investment firms whose head office is in another Member State the provisions that their Luxembourg branches must comply with under the new regime. Most of the requirements concern both credit institutions and investment firms. Nevertheless, in certain cases, the legislator purposely differentiated between both statuses. Luxembourg, 19 November 2007 To all credit institutions and investment firms

CIRCULAR CSSF 21/765
58/59
Table of contents
I. Scope 59
II. Luxembourg branches of credit institutions or investment firms whose head
office is in another Member State established in Luxembourg (“the branch” or “the branches”) 60 II.1. Notifications in connection with the establishment of a branch 60 II.1.1 Notification procedure for credit institutions or investment firms whose head office is in another Member State wishing to establish a branch in Luxembourg 60 II.1.2 Changes to the notification 60 II.1.3 Opening of additional places of business 61 II.2 Branch infrastructure 61 II.3 General legal framework 62 II.4. Supervision of the branch 62 II.4.1 General provisions 62 II.4.2 Scope of the CSSF’s supervision 63 II.4.3 Instruments of supervision 64

Periodic reports to provide to the CSSF 64
External audit 64
On-the-spot inspections by the authority of the home
country and the CSSF 65
II.4.4 Measures to be taken by the CSSF in case of non-compliance by the branch with the Luxembourg provisions or in case of emergency 65
III. Free provision of services in Luxembourg by credit institutions and
investment firms whose head office is in another Member State 66 III.1. Notifications relating to the freedom to provide services 66 III.2 Non-compliance with the Luxembourg provisions by credit institutions or investment firms performing activities/services under the freedom to provide services in Luxembourg 67
IV. Transitional provisions 67
V. Repealing provisions and entry into force 67

CIRCULAR CSSF 21/765
59/60
I. Scope

The circular concerns credit institutions whose head office is in another Member
State1 and which provide in Luxembourg, by way of a branch or by free provision of services, activities covered by their authorisation as defined in Annexe I to Directive 2006/48/EC relating to the taking up and pursuit of the business of credit institutions (“CRD Directive”). Pursuant to the aforementioned Annexe, the services and activities provided for in sections A and B of Annexe I to the MiFID Directive, when referring to the financial instruments provided for in section C of Annexe I of that Directive, are subject to mutual recognition in accordance with the CRD Directive.
The circular also concerns investment firms whose head office is in another
Member State and which provide in Luxembourg, by way of a branch or by free provision of services, investment services/activities covered by their authorisation as defined by section A of Annexe I to the MiFID Directive.
Where a credit institution or investment firm whose head office is in another
Member State appoints a tied agent (as defined in article 4(1)(25) of the MiFID Directive) established in Luxembourg, this tied agent shall be subject to the provisions of the LFS applicable to Luxembourg branches of credit institutions and investment firms of another Member State. For a credit institution or investment firm whose head office is in another Member State appointing a tied agent in Luxembourg while already having a branch there, the tied agent shall be considered as an additional business place of this branch, as described in point II.1.3. below. 1 In accordance with article 1(14) of the LFS, “Member State” shall mean a Member State of the European Union. The States that are contracting parties to the European Economic Area Agreement other than the Member States of the European Union, within the limits set forth by this agreement and related acts are considered as equivalent to Member States of the European Union. “Another Member State” shall mean a Member State other than Luxembourg.

CIRCULAR CSSF 21/765
60/61
II. Luxembourg branches of credit institutions or investment firms whose
head office is in another Member State established in Luxembourg (“the branch” or “the branches”) II.1. Notifications in connection with the establishment of a branch II.1.1 Notification procedure for credit institutions or investment firms whose head office is in another Member State wishing to establish a branch in Luxembourg
4. Article 30 of the LFS provides that credit institutions or investment firms whose
head office is in another Member State are permitted to establish themselves in Luxembourg by way of a branch after having performed in their home country the notification procedure as referred to in article 25 of the CRD Directive and article 32 of the MiFID Directive and provided that their services/activities are covered by their authorisation and fall within Annexe I to the CRD Directive or section A or B of Annexe I to the MiFID Directive. An authorisation from Luxembourg authorities is not required.
5. Unless there is reason to doubt the adequacy of the administrative structure or
the financial situation of the requesting professional, taking into account the activities envisaged, the authority of the home country shall communicate to the CSSF the notification file submitted to that authority by the notifying institution within three months of receipt of that file at the most. The CSSF shall inform the institution on how the supervision will be performed in the fields falling under its competence and shall draw its attention on the conduct of business rules, as well as on the rules of general interest governing the exercise of those services/activities. The branch may commence business on receipt of that information or, failing such information, within two months from the date of transmission of the communication by the authority of the home Member State. The branch informs the CSSF of the date at which business commences, which will be the date on which it will be registered on the official list of credit institutions and investment firms respectively. II.1.2 Changes to the notification
6. Any change to the information to be provided in a notification as mentioned below
(article 32(2) of the MiFID Directive and article 26 of the CRD Directive) shall be notified in writing at least one month before the change comes into force. The following information is concerned:
(a) the programme of operations stating the investment or banking services/activities as well as the ancillary services which the branch intends to perform, and the organisational structure of the branch and the use, where applicable, of a tied agent; (b) the address in the host Member State from which documents may be obtained; (c) the name of the person(s) responsible for the management of the branch.

CIRCULAR CSSF 21/765
61/62
7. In accordance with article 26(3) of the CRD Directive, credit institutions shall
notify any change referred to in point 6 to the competent authority of their home country as well as to the CSSF. On the other hand, in accordance with article 32(9) of the MiFID Directive, investment firms shall notify any change as referred to in point 6 solely to the competent authority of the home Member State which shall communicate the change to the CSSF. II.1.3 Opening of additional places of business
8. A credit institution or investment firm of EU origin having a branch in Luxembourg
may freely open additional places of business without having to use the notification procedure referred to in point II.1.1 of this circular. In accordance with article 1(32) of the LFS, several places of business established in Luxembourg by a credit institution or investment firm whose head office is in another Member State are regarded as a single branch.
9. The credit institution or investment firm EU origin shall designate one of the places
of business as the head office of the establishment in Luxembourg. The managers of this head office shall have authority over all the places of business established in Luxembourg and shall be the contacts of the CSSF. Where opening additional places of business constitutes a change of the programme of operations and/or implies a change in the address of the head place of business, the credit institution or investment firm of another Member State shall inform the competent authorities beforehand, in accordance with point 7 above, of the opening of additional places of business.
10. The head place of business shall transmit annually to the CSSF, by 31 January, a
list stating the addresses of the places of business that the branch has in Luxembourg. II.2 Branch infrastructure
11. As opposed to the freedom to provide services, the establishment of a branch
implies the existence in Luxembourg of an operational unit ensuring a permanent physical presence of the credit institution or investment firm.
12. On account of its geographical distance and its activity in specific markets, a
Luxembourg branch enjoys a certain functional independence from its head office in the home country. Moreover, in the exercise of its activities it shall comply with certain specific rules that apply under the Luxembourg legislation. These factors, together with the CSSF’s right to monitor as host authority in accordance with its residual competences, imply that the branch, as an entity, must meet certain organisational and infrastructure requirements, as described below.

CIRCULAR CSSF 21/765
62/63

The effective management of the branch must be exercised in Luxembourg in
accordance with the rules and instructions set out by the head office of the branch. The branch in Luxembourg represents an operational entity whose staff numbers depend on the activities carried on. Another entity of the group may by no means enter into transactions on behalf of the Luxembourg branch.
The credit institution or investment firm entrusts the management of the branch
to one or more managers, of whom at least one must reside in Luxembourg. Those persons must have adequate professional experience and competence.
Any branch established in Luxembourg must have an administrative structure.
All accounting and all transaction-related documents must be available at the branch. In accordance with article 45(5) of the LFS, the branch shall arrange for records to be kept of all services and transactions undertaken by it, in accordance with the period laid down in the Commercial Code, which shall be sufficient to allow the CSSF to monitor compliance with the requirements under the LFS and, in particular, its obligations towards clients or potential clients, without prejudice to the possibility for the competent authority of the home Member State to have direct access to these records. II.3 General legal framework

Branches shall respect the general legal framework (general laws, in particular as
regards civil law, commercial law, labour law and criminal law) applicable to all activities performed in Luxembourg. Moreover, by virtue of article 35(4) of the LFS, the branches are required to apply the Luxembourg standards adopted in relation to anti-money laundering and terrorist financing (cf. Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, and Circular CSSF 05/211) and in relation to professional secrecy.
Where a branch does not comply with these legal requirements, article 46(2) of
the LFS authorises the CSSF to take the necessary steps as described in point 34 below in order to remedy such situation. II.4. Supervision of the branch II.4.1 General provisions
The competent authorities of the home Member State shall be responsible for the
supervision of services/activities provided by the branch without prejudice to the provisions on the competences conferred upon the CSSF by the LFS.
The competent authorities of the home country and the CSSF shall actively
cooperate in the context of their respective supervisory missions; the arrangements for this cooperation may be fixed in bilateral Memoranda of Understanding between the authorities concerned.

CIRCULAR CSSF 21/765
63/64
II.4.2 Scope of the CSSF’s supervision
17. In accordance with article 45(4) of the LFS, the supervision of investment
services/activities which the branch provides in Luxembourg falls under the responsibility of the CSSF, which shall ensure that the branch complies with the obligations set out in articles 37-3 (conduct of business rules when providing investment services to clients), 37-5 (obligation to execute orders on terms most favourable to the client) and 37-6 (client order handling rules) of the LFS. Circular CSSF 07/307 provides further clarifications on this subject.
18. The CSSF is also competent to ensure that the investment services provided by
the branch comply with the obligations set out in articles 26 (obligation for systematic internalisers to publish firm quotes), 27 (post-trade disclosure by credit institutions and investment firms) and 28 (obligation to uphold integrity of markets, report transactions and maintain records) of the MiFID law.
19. In accordance with article 45(6) of the LFS, the branches shall provide the CSSF,
upon request, with the information necessary to the monitoring of their compliance with the standards applicable in Luxembourg for the cases provided for in points 17 and 18 above. The information to be provided by these branches is the same information as the CSSF requires for these purposes from credit institutions and investment firms authorised in Luxembourg.
20. The supervision of the CSSF as described above is a limited exception to the
principle of supervision by the competent home authority, which remains responsible for the supervision of services/activities of branches established in Luxembourg as regards the services/activities performed within the territory of the home Member State of the credit institution or investment firm and all services/activities provided in another Member State. Indeed, all services/activities provided by a branch outside the Luxembourg territory are considered as services/activities performed by the credit institution or investment firm, and not by the branch established in Luxembourg.
21. Branches dealing only with eligible counterparties, as defined in article 37-7 of
the LFS, are exempted from the application of articles 37-3 (conduct of business rules), 37-5 (best execution) and 37-6(1) (client order handling rules) of the LFS (cf. Circular CSSF 07/307, point 41).
22. As regards exclusively branches of credit institutions, article 45(3) of the LFS
entrusts the CSSF, in cooperation with the competent authority of the home Member State, with the supervision of the liquidity of these branches. For the performance of its responsibilities in this field, the CSSF requires these branches to provide it with the same information as provided by Luxembourg-incorporated credit institutions (article 45(6) of the LFS).

CIRCULAR CSSF 21/765
64/65
II.4.3 Instruments of supervision

Periodic reports to provide to the CSSF
(a) Requirement for branches to report transactions on financial instruments
In accordance with article 35(1) of the MiFID Law, the CSSF is the authority
competent for the investment services provided and the investment activities performed in Luxembourg by the Luxembourg branches of credit institutions and investment firms authorised in another Member State. These branches must report their transactions to the CSSF.
As per the provisions of article 32(7) of the MiFID Directive, these branches shall
report the transactions undertaken by them and considered as investment services provided outside Luxembourg to the competent authority of the home Member State. In accordance with CESR guidelines on reporting for branches (cf. Annexe 3: CESR Level 3 Guidelines on MiFID Transaction reporting published on 29 May 2007, ref. CESR/07-301), the branches concerned may however choose to report to the CSSF in its capacity as competent authority of the host Member State, all transactions, whether executed within the context of investment services provided in Luxembourg or outside the territory of Luxembourg. The CSSF will forward the appropriate information to the home Member State authority.
Circular CSSF 07/302 provides further clarifications on the obligation to report
transactions on financial instruments.
(b) Specific provisions relating to branches of credit institutions whose head office is in another Member State
In accordance with article 45(6) of the LFS, the details and procedures of the
reporting by branches are indicated in the summary of periodic information to be provided by credit institutions to the CSSF, under point I.3 of Annexe 3 of circular CSSF 07/316. (c) Specific provisions relating to branches of investment firms whose head office is in another Member State
In accordance with article 45(6) of the LFS, branches must submit a statistical
balance sheet (and off-balance sheet) and a statistical profit and loss account.
External audit
The procedure for the external audit of branches’ accounts falls under the
competence of the home authorities.

CIRCULAR CSSF 21/765
65/66
29. Branches are required, however, to have a review executed by an external auditor
for specific subjects on which the CSSF maintains a control responsibility as host authority, in particular as regards compliance with the rules on the prevention of money laundering and compliance with conduct of business rules when providing investment services to clients. For the purpose of drawing up its report, the réviseur d’entreprises (statutory auditor) shall apply mutatis mutandis the provisions applicable to the establishment of the annual long form audit report to comply with the professional obligations as regards the fight against money laundering and terrorist financing and the conduct of business rules when providing investment services. The report of the réviseur d'entreprises includes a description of the procedures and controls in place within the branch as well as an appraisal by the réviseur d'entreprises. The descriptive parts of the reports shall be made available to the réviseur d'entreprises by the branches.
30. In accordance with article 54(2) of the LFS, the CSSF has the right to appoint the
external auditor of the credit institution or investment firm to execute controls at the Luxembourg branch on subjects for which the CSSF is competent.
31. Where the CSSF decides to make use of this facility, it shall communicate to the
managers of the branch the terms of the mandate to be given to the auditors. The managers of the branch shall liaise with the auditor of the head office of the credit institution or investment firm or, where applicable, its local representative and organise the practical schedule of the audit. The branch shall communicate the audit report issued by the external auditor to the CSSF.
3. On-the-spot inspections by the authority of the home country and the CSSF
32. The competent home authorities may carry on on-the-spot controls at the
branches of credit institutions (article 45(7) of the LFS) and investment firms (article 45(9) of the LFS) established in Luxembourg whose head office is in another EU Member State, after having informed the CSSF. They may also request the CSSF to verify some information. In this case, the CSSF shall either carry out the verification itself or appoint an auditor or any other independent expert at the expenses of the branch. II.4.4 Measures to be taken by the CSSF in case of non-compliance by the branch with the Luxembourg provisions or in case of emergency
33. Article 46 of the LFS describes the precautionary measures available to the CSSF
as host Member State.

CIRCULAR CSSF 21/765
66/67
34. Paragraph (1) of that article provides that the CSSF shall refer to the competent
authority of the home Member State of the credit institution or investment firm whenever it has clear and demonstrable grounds for believing that one of its branches in Luxembourg is in breach of the obligations arising from the provisions of the LFS which do not confer powers on the CSSF. If the irregular situation persists, despite the measures taken by the competent authority of the home Member State of the credit institution or investment firm or because such measures prove inadequate, the CSSF may take, after informing the competent authority of the home Member State, all appropriate measures needed in order to protect investors or the proper functioning of the markets in Luxembourg.
35. If a branch does not comply with the requirements of the LFS which confer powers
on the CSSF, the latter may address an injunction to the credit institution or the investment firm as provided for in article 59 of the LFS. If the credit institution or investment firm concerned fails to take the necessary steps, the CSSF shall take all appropriate measures to ensure that the credit institution or investment firm puts an end to the irregular situation. The CSSF shall inform the competent authority of the home Member State of the measures taken. If, despite the measures taken, the irregular situation persists, the CSSF may take, after having informed the competent authority of the home Member State, the appropriate measures to prevent or penalise further irregularities, or even prevent the credit institution or investment firm from initiating any new transaction in Luxembourg. Such measures shall be notified to the European Commission.
36. Article 46(4) of the LFS provides that, in emergencies and before following the
procedure described in point 35 above, the CSSF may take any precautionary measures necessary to protect the interests of depositors, investors or others to whom services are provided. Such measures shall be notified to the European Commission and to the competent authorities of the home Member State.
III. Free provision of services in Luxembourg by credit institutions and
investment firms whose head office is in another Member State III.1. Notifications relating to the freedom to provide services
37. According to article 28(1) of the CRD Directive, any credit institution whose head
office is in another Member State wishing to exercise the freedom to provide services by carrying on its activities in Luxembourg for the first time shall notify the competent authorities of its home country of the activities it intends to carry on. These activities must be included in Annexe I to Directive 2006/48/EC.

CIRCULAR CSSF 21/765
67/68
38. According to article 31(1) and (2) of the MiFID Directive, any investment firm
authorised by the competent authority of another Member State may exercise the freedom to provide services/activities in Luxembourg by way of free provision of services provided that such services/activities are covered by its authorisation. The exercise of these services/activities is not subject to an additional authorisation by the CSSF. A mere communication to the competent authority of the home Member State is sufficient.
39. The authority of the home country shall transmit the notification of the institution
to the CSSF within one month. The credit institution or investment firm may commence the provision of its services/activities in Luxembourg as soon as it is informed of this transmission.
40. Any change in the initial details included in the notification must be notified in
writing to the authority of the home country at least one month before the implementation of this change, which will transmit it to the CSSF. III.2 Non-compliance with the Luxembourg provisions by credit institutions or investment firms performing activities/services under the freedom to provide services in Luxembourg
41. The provisions of point 34 of this circular also apply to credit institutions and
investment firms performing activities/services under the freedom to provide services in Luxembourg.
IV. Transitional provisions
42. Pursuant to article 71 of the MiFID Directive, credit institutions and investment
firms of another Member State, already authorised to provide investment services and activities in Luxembourg through the establishment of branches or by providing services may continue to perform their activities and provide their services in Luxembourg without having to submit a new notification at the entry into force of the MiFID law, on 1 November 2007.
43. However, where credit institutions or investment firms of another Member State
intend to exercise for the first time, as from 1 November 2007, new activities and services not covered by their existing passport in Luxembourg, they shall submit a notification for these new services/activities in accordance with articles 31 and 32 of the MiFID Directive to the competent authority of their home Member State.
V. Repealing provisions and entry into force
44. This circular enters into force on 19 November 2007. Circulars IML 93/100 and
IML 98/147 are repealed with effect on 19 November 2007.

CIRCULAR CSSF 21/765
68/69
Yours faithfully,
COMMISSION DE SURVEILLANCE DU SECTEUR FINANCIER Simone DELCOURT Arthur PHILIPPE Jean-Nicolas SCHAUS Director General

CIRCULAR CSSF 21/765
62
/69
Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1 - 1 direction@cssf.lu www.cssf.lu

Circular CSSF 21/765 — Update of Circular CSSF 01/27 and Circular CSSF 07/325 following amendments to CSSF Regulation No 12-02

Lineage: Superseded

Timeline