Update of Circular CSSF 12/552 on central administration, internal governance and risk management

CIRCULAR CSSF 20/759
1/109
Circular CSSF
20/759
UPDATE OF CIRCULAR CSSF
12/552, AS AMENDED BY
CIRCULARS CSSF 13/563,
CSSF 14/597, CSSF
16/642, CSSF 16/647,
CSSF 17/655, CSSF
20/750 AND CSSF
20/759, ON THE CENTRAL
ADMINISTRATION, INTERNAL
GOVERNANCE AND RISK
MANAGEMENT

CIRCULAR CSSF 20/759
2/109
Ladies and Gentlemen,

1. By way of this circular, the CSSF, in its capacity as competent authority,
   complies with the guidelines of the European Banking Authority listed in point
2. The CSSF has integrated these guidelines into its administrative practice
   and regulatory approach with a view to promote supervisory convergence in this field at European level.
3. The following guidelines are concerned:
   (1) on internal governance (EBA/GL/2017/11) and (2) Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders (EBA/GL/2017/12); (3) on the application of the definition of default under Article 178 of Regulation (EU) No 575/2013 (EBA/GL/2016/07); (4) on specification of types of exposures to be associated with high risk (EBA/GL/2019/01); (5) on the management of interest rate risk arising from non-trading book activities (EBA/GL/2018/02); (6) on corrections to modified duration for debt instruments under the second subparagraph of Article 340(3) of Regulation (EU) 575/2013 (EBA/GL/2016/09).
4. The above-mentioned guidelines have been incorporated into Circular CSSF
   12/552 on central administration, internal governance and risk management. At the same time, the terminology and definitions of the circular have been reviewed and some provisions have been specified. A version of the circular which allows retracing the changes made is appended to this circular.
5. The main changes concern:
   a. Extension of the scope to financial holding companies and mixed financial holding companies; b. Specification of the concept of proportionality by linking it to the notion of systemic institution within the meaning of the Law of 5 April 1993 on the financial sector; Circular CSSF 20/759 Re: Update of Circular CSSF 12/552, as amended by Circulars CSSF 13/563, CSSF 14/597, CSSF 16/642, CSSF 16/647, CSSF 17/655, CSSF 20/750 and CSSF 20/759, on the central administration, internal governance and risk management Luxembourg, 7 December 2020 To all credit institutions and professionals performing lending operations In case of discrepancies between the French and the English text, the French text shall prevail. We inform you that point 182 (8th indent) of the Annex to Circular CSSF 20/759 as well as point 184 (8th indent) of Annex 1 to Circular CSSF 20/757 have been updated on 11 December 2020.

CIRCULAR CSSF 20/759
3/109
c. Clarifications regarding the application of proportionality when
implementing the internal control functions; d. Strengthening of the management body, in its supervisory function, via enhanced provisions with respect to diversity and independence; e. Consideration of environmental, social and governance (ESG) risk factors with a view to ensuring viability of the business model; f. Introduction of a summary chapter dedicated to the activity of depositary bank.
5. Circular CSSF 12/552, as amended, shall be applicable in its entirety to credit
institutions and in part to professionals performing lending operations. Henceforth, a separate circular applies to investment firms.
6. This circular shall apply as from 1 January 2021.
Claude WAMPACH
Director
Marco ZWICK
Director
Jean-Pierre FABER
Director
Françoise KAUTHEN
Director
Claude MARX
Director General
Annex

CIRCULAR CSSF 20/759
4/109
Circular CSSF 20/759
Re: Central administration, internal governance and risk management 1 Ladies and Gentlemen, Articles 5(1a) and 17 (1a)38-1 of the Law of 5 April 1993 on the financial sector (“LFS”), supplemented by Regulation CSSF No 15-02 relating to the supervisory review and evaluation (“RCSSF 15-02”) require credit institutions and investment firms to have robust internal governance arrangements, which shall include a clear organisational structure with well-defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks to which they are or might be exposed, adequate internal control mechanisms, including sound administrative and accounting procedures and remuneration policies and practices that are consistent withallowing and promotepromoting sound and effective risk management, as well as control and security mechanisms offor their IT systems. In the past, as a result of the regulatory developments at international level and the local needs, the CSSF specified the procedures for implementing these articles in various circulars. The addition of new circulars transposing the guidelines of the European Banking Authority (EBA) on internal governance of 27 September 2011 ("EBA Guidelines on Internal Governance (GL 44)") and those of the Basel Committee on Banking Supervision (BCBS) on internal audit of 28 June 2012 ("The internal audit function in banks") would have resulted in significant redundancies and a multiplication of the terms used. Thus, the CSSF decided to bring together all the key implementing provisions on internal governance in one single circular. This circular reflects the above-mentioned EBA and BCBS guidelines supplementing them by the additional provisions included in Circulars IML 96/126, IML 98/143, CSSF 04/155, CSSF 05/178 and CSSF 10/4662. Furthermore, in order to provide an overview, this circular includes, by reference to Articles 5 (1) and 17 (1) of the law of 5 April 1993 on the financial sector, the implementing procedures on central administration as specified in Circular IML 95/120. 1 To professionals performing lending operations as defined in Article 28-4 of the Law of 5 April 1993 on the financial sector, Chapter 3 of Part III, with the exception of Sub-chapter 3.4 “Exposures associated with particularly high risk” shall apply. Chapter 2(12) of Part III shall also apply. 2 Circulars IML 96/126 regarding the administrative and accounting organisation, IML 98/143 regarding the internal control, CSSF 04/155 regarding the Compliance function, CSSF 05/178 regarding the administrative and accounting organisation; outsourcing of IT services and CSSF 10/466 regarding disclosures in times of stress. Luxembourg, 7 December 2020 To all credit institutions and professionals performing lending operations1 In case of discrepancies between the French and the English text, the French text shall prevail. The color code used for the “track changes” version is as follows:

• Red for addition/deletion
• Green for text movement

CIRCULAR CSSF 20/759
5/109
Consequently, Circulars IML 95/120, IML 96/126, IML 98/143, CSSF 04/155, CSSF 05/178 and CSSF 10/466 shall be repealed for credit institutions and investment firms.3 Finally, the purpose of this circular is also to gather all the provisions on risk management. This circular represents a first step on the way to a consolidated regulatory collection in respect of internal governance in a broad sense. It does not include all the targeted areas, such as for example remuneration which is covered by the CRD standards ("Capital Requirements Directive" - Circulars CSSF 06/273 and CSSF 07/290) and by Circular CSSF 11/505 providing details on the principle of proportionality as regards remuneration. The same applies to risk. This circular essentially transposes the CEBS guidelines and the EBA guidelines dated 2 September 2010 on concentration risk ("CEBS Guidelines on the management of concentration risk under the supervisory review process (GL31)"), the guidelines dated 27 October 2010 on liquidity pricing ("Guidelines on Liquidity Cost Benefit Allocation"), the EBA guidelines of 22 May 2015 on the management of interest rate risk arising from non-trading activities (EBA/GL/2015/08) and the EBA guidelines of 14 December 2015 relating to the limits on exposures to shadow banking entities which carry out banking activities outside a regulated framework under Article 395(2) of Regulation (EU) No 575/2013 (EBA/GL/2015/20). Moreover, the circular highlights the basic principles of prudence in the field of credit granting and private wealth management. As far as CRR institutions4 are concerned, this circular shall be read in conjunction with CSSF Regulation N° 15-02 relating to the supervisory review and evaluation process that applies to CRR institutions. The various existing circulars relating to risks and their management will be brought together in a subsequent version of this circular. Where, as a result of international regulatory developments or local needs, the CSSF is called upon to specify the requirements in this circular, it will update this circular.
Part IV of the circular includes a chronology of the updates which enables the reader
to track the changes operated by the successive updates.
3 Circulars IML 95/120, IML 96/126, IML 98/143 shall remain applicable for PFS other than investment firms, as well as Circular CSSF 17/656 which repeals and replaces Circular CSSF 05/178. These circulars together with Circular CSSF 04/155 shall remain applicable for payment institutions and electronic money institutions. 4 The term “CRR institution” is defined in Article 1(1) of CSSF Regulation N° 15-02.

CIRCULAR CSSF 20/759
6/109
This Circular specifies the measures credit institutions must take pursuant to the provisions of the LFS and RCSSF 15-02 as regards central administration, internal governance and risk management. It reflects the European and international principles, guidelines and recommendations which apply in this respect, translating them, in a proportionate way, in the context of the Luxembourg banking sector. Where, due to the size, the nature and the complexity of the activities and the organisation, the application of the principle of proportionality requires enhanced central administration, internal governance or risk management, the credit institutions shall refer to the principles set out in Chapter 2 of Part I and to the guidelines and recommendations listed in Part IV of this Circular for guidance on this implementation. This concerns especially the European Banking Authority (“EBA”) Guidelines on internal governance (EBA/GL/2017/11) and the joint EBA and the European Securities and Markets Authority (“ESMA”) Guidelines on the assessment of the suitability of members of the management body and key function holders (EBA/GL/2017/12). The principles and good practices arising from other sources already included in the previous versions of the Circular have been maintained in so far as they have not become obsolete. As regards the appointments of members of the management body and key function holders, this Circular should be read in conjunction with the Prudential Procedure in this respect published on the CSSF website. The Circular is divided into four parts: the first part establishes the scope, the second
part is dedicated to the central administration and internal governance requirements,
the third part covers specific risk management requirements and the fourth part provides for the entry into force and the transitional measures and repealing provisions. The table of contents is as followshistory of the updates, allowing the reader to retrace the amendments entailed by the successive updates. The boxes which appear in the circular include the remarks and clarifications which serve as guidance to update the requirements included in this circular.

CIRCULAR CSSF 20/759
7/109
Table of contents
Part I - Definitions and Scope 13
Chapter 1. Definitions and abbreviations 13
Chapter 2. Scope and proportionality 15
Part II. Central administration and internal governance
arrangements 18
Chapter 1. Central administration 18
Chapter 2. Internal governance arrangements 19
Chapter 3. General characteristics of “robust” central
administration and internal governance arrangements 21
Chapter 4. Supervisory body and authorised
management 23
Sub-chapter 4.1. Supervisory body 23
Section 4.1.1. Responsibilities of the supervisory body 23
Section 4.1.2. Composition and qualification of the
supervisory body 28
Section 4.1.3. Organisation and functioning of the supervisory
body 30
Section 4.1.4. Specialised committees 31
Sub-section 4.1.4.1. Audit committee 33
Sub-section 4.1.4.2. Risk committee 35
Sub-chapter 4.2. Authorised management 37
Section 4.2.1. Responsibilities of the authorised management
37
Section 4.2.2. Qualification of the authorised management
41
Chapter 5. Administrative, accounting and IT
organisation 43
Sub-chapter 5.1. Organisation chart and human resources 43 Sub-chapter 5.2. Procedures and 44 internal documentation 46 Sub-chapter 5.3. Administrative and technical infrastructure48
Section 5.3.1. Administrative infrastructure of the business
functions 48
Section 5.3.2. Financial and accounting function 49
Section 5.3.3. IT function 50
Section 5.3.4. Communication and internal and external alert
arrangements 51
Section 5.3.5. Crisis management arrangements 51
Chapter 6. Internal control 52
Sub-chapter 6.1. Operational controls 53
Section 6.1.1. Day-to-day controls carried out by the
operating staff 53
Section 6.1.2. Ongoing critical controls 53
Section 6.1.3. Controls carried out by the members of the
authorised management on the activities or functions which fall under their direct responsibility 54

CIRCULAR CSSF 20/759
8/109
Sub-chapter 6.2. Internal control functions 55
Section 6.2.1. General responsibilities of the internal control
functions 55
Section 6.2.2. Characteristics of the internal control functions
56
Section 6.2.3. Execution of the internal control functions' work
58
Section 6.2.4. Organisation of the internal control
functions 59
Section 6.2.5. Risk control function 62
Sub-section 6.2.5.1. 62
Scope and specific responsibilities of the risk control function 62 Sub-section 6.2.5.2. Organisation of the risk control function 65
Section 6.2.6. Compliance function 66
Sub-section 6.2.6.1. Compliance charter 67 Sub-section 6.2.6.2. Scope and specific responsibilities of the compliance function 68 Sub-section 6.2.6.3. Organisation of the compliance function 70
Section 6.2.7. Internal audit function 71
Sub-section 6.2.7.1. Internal audit charter 71 Sub-section 6.2.7.2. Specific responsibilities and scope of the internal audit function 73 Sub-section 6.2.7.3. Execution of the internal audit work 75 Sub-section 6.2.7.4. Organisation of the internal audit function 76
Chapter 7. Specific requirements 77
Sub-chapter 7.1. Organisational structure and legal entities (Know-your-structure) 77
Section 7.1.1. Complex structures and non-standard or
potentially non-transparent activities 78
Sub-chapter 7.2. Management of conflicts of interest 78
Section 7.2.1. Specific requirements relating to
conflicts of interest involving related parties 80 Sub-chapter 7.3. New Product Approval Process 81 Sub-chapter 7.4. Outsourcing 82
Section 7.4.1. General outsourcing requirements 83
Section 7.4.2. Specific IT outsourcing requirements
85
Sub-section 7.4.2.1. IT system management/operation services 86 Sub-section 7.4.2.2. Consulting, development and maintenance services 86 Sub-section 7.4.2.3. Hosting services and infrastructure ownership 87
Section 7.4.3. Additional general requirements 88
Section 7.4.4. Documentation 89
Chapter 8. Legal reporting 90

CIRCULAR CSSF 20/759
9/109
Part III. Risk management 90
Chapter 1. General principles as regards risk
measurement and risk management 90
Sub-chapter 1.1. Institution-wide risk management framework 90
Section 1.1.1. General information 90
Section 1.1.2. Specific (risk, capital and liquidity)
policies 90
Section 1.1.3. Risk identification, management,
measurement and reporting 92
Chapter 2. Concentration risk 93
Chapter 3. Credit risk 93
Sub-chapter 3.1. General principles 93
Sub-chapter 3.2. Residential real estate mortgage credit to individuals 95 Sub-chapter 3.3. Credits to real estate developers 96 Sub-chapter 3.4. Exposures associated with particularly high risk 97 Sub-chapter 3.5. Non-performing and forborne exposures 97
Chapter 4. Risk transfer pricing 98
Chapter 5. Private wealth management
(“private banking”) 99
Chapter 6. Exposures to shadow banking
entities 100
Sub-chapter 6.1. Implementation of sound internal control principles 100 Sub-chapter 6.2. Application of quantitative limits 101
Chapter 7. Asset encumbrance 102
Chapter 8. Interest rate risk 103
Sub-chapter 8.1 Interest rate risk arising from non-trading book activities 103 Sub-chapter 8.2. Corrections to modified duration for debt instruments 103
Chapter 9. Risks associated with the custody of
financial assets by third parties 104
Part IV. Chronology 104
Part I - Definitions and Scope 7
Chapter 1. Definitions and abbreviations 7
Chapter 2. Scope and proportionality 9
Part II. Central administration and internal governance
arrangements 11
Chapter 1. Central administration 11
Chapter 2. Internal governance arrangements 11
Chapter 3. General characteristics of “robust” central
administration and internal governance arrangements 13
Chapter 4. Supervisory body and authorised
management 14
Sub-chapter 4.1. Supervisory body 14
Section 4.1.1. Responsibilities of the supervisory body 14

CIRCULAR CSSF 20/759
10/109
Section 4.1.2. Composition and qualification of the
supervisory body 18
Section 4.1.3. Organisation and functioning of the supervisory
body 19
Section 4.1.4. Specialised committees 20
Sub-section 4.1.4.1. Audit committee 22
Sub-section 4.1.4.2. Risk committee 23
Sub-chapter 4.2. Authorised management 25
Section 4.2.1. Responsibilities of the authorised management
25
Section 4.2.2. Qualification of the authorised
management 29
Chapter 5. Administrative, accounting and IT
organisation 29
Sub-chapter 5.1. Organisation chart and human resources 29 Sub-chapter 5.2. Procedures and internal documentation 30 Sub-chapter 5.3. Administrative and technical infrastructure 31
Section 5.3.1. Administrative infrastructure of the
business functions 31
Section 5.3.2. Financial and accounting function 32
Section 5.3.3. IT function 34
Section 5.3.4. Communication and internal and
external alert arrangements 34
Section 5.3.5. Crisis management arrangements 35
Chapter 6. Internal control 35
Sub-chapter 6.1. Operational controls 36
Section 6.1.1. Day-to-day controls carried out by
the operating staff 36
Section 6.1.2. Ongoing critical controls 36
Section 6.1.3. Controls carried out by the members
of the authorised management on the activities or functions which fall under their direct responsibility 37 Sub-chapter 6.2. Internal control functions 38
Section 6.2.1. General responsibilities of the internal control
functions 38
Section 6.2.2. Characteristics of the internal control functions
39
Section 6.2.3. Execution of the internal control
functions' work 40
Section 6.2.4. Organisation of the internal control functions
41
Section 6.2.5. Risk control function 45
Sub-section 6.2.5.1. Scope and specific responsibilities of the risk control function 45 Sub-section 6.2.5.2. Organisation of the risk control function 47
Section 6.2.6. Compliance function 48

CIRCULAR CSSF 20/759
11/109
Sub-section 6.2.6.1. Compliance charter 48 Sub-section 6.2.6.2. Scope and specific responsibilities of the compliance function 49 Sub-section 6.2.6.3. Organisation of the compliance function 51
Section 6.2.7. Internal audit function 51
Sub-section 6.2.7.1. Internal audit charter 51 Sub-section 6.2.7.2. Specific responsibilities and scope of the internal audit function 53 Sub-section 6.2.7.3. Execution of the internal audit work 54 Sub-section 6.2.7.4. Organisation of the internal audit function 55
Chapter 7. Specific requirements 56
Sub-chapter 7.1. Organisational structure and legal entities (Know-your￾structure) 56
Section 7.1.1. Complex structures and non-standard or
potentially non-transparent activities 56
Sub-chapter 7.2. Management of conflicts of interest 57
Section 7.2.1. Specific requirements relating to conflicts of
interest involving related parties 58
Sub-chapter 7.3. New Product Approval
Process 59
Sub-chapter 7.4. Outsourcing 59
Section 7.4.1. General outsourcing requirements 60
Section 7.4.2. Specific IT outsourcing
requirements 62
Sub-section 7.4.2.1. IT system management/operation services 63 Sub-section 7.4.2.2. Consulting, development and maintenance services 63 Sub-section 7.4.2.3. Hosting services and infrastructure ownership 64
Section 7.4.3. Additional general requirements 65
Section 7.4.4. Documentation 66
Chapter 8. Legal reporting 66
Part III. Risk management 67
Chapter 1. General principles as regards risk
measurement and risk management 67
Sub-chapter 1.1. Institution-wide risk management framework 67
Section 1.1.1. General information 67
Section 1.1.2. Specific (risk, capital and liquidity) policies
67
Section 1.1.3. Risk identification, management,
measurement and reporting 68
Chapter 2. Concentration risk 69
Chapter 3. Credit risk 70
Sub-chapter 3.1. General principles 70

CIRCULAR CSSF 20/759
12/109
Sub-chapter 3.2. Residential real estate mortgage credit to individuals 71 Sub-chapter 3.3. Credits to real estate developers 71 Sub-chapter 3.4. Exposures associated with particularly high risk 72 Sub-chapter 3.5. Non-performing and forborne exposures 72
Chapter 4. Risk transfer pricing 73
Chapter 5. Private wealth management (“private
banking”) 73
Chapter 6. Exposures to shadow banking entities 75
Sub-chapter 6.1. Implementation of sound internal control principles 75 Sub-chapter 6.2. Application of quantitative limits 75
Chapter 7. Asset encumbrance 77
Chapter 8. Interest rate risk 77
Sub-chapter 8.1 Interest rate risk arising from non-trading book activities 77 Sub-chapter 8.2. Corrections to modified duration for debt instruments 78
Chapter 9. Risks associated with the custody of
financial assets by third parties 78
Part IV. Chronology 78

CIRCULAR CSSF 20/759
13/109
Part I. - Definitions and Scope
Chapter 1. Definitions and abbreviations

1. For the purposes of this Circular:

1. "board of directors" shall mean the body or, failing that, the persons who,
   under company law, monitor the management by the authorised management. The term is not to be understood in its legal sense as banks and investment firms can also take a legal form which does not provide for a "board of directors" within the meaning of company law. For instance, when there is a board of supervisors, the latter shall assume the responsibilities that this circular assigns to the "board of directors";
2. "“competent authority” shall mean the European Central Bank (“ECB”) for
   significant credit institutions (“significant institutions”, “SI”) or the Commission de Surveillance du Secteur Financier (“CSSF”) for less significant credit institutions (“less significant institutions”, “LSI”)5 and branches established in Luxembourg of third-country credit institutions. Moreover, as host authority of Luxembourg branches of credit institutions authorised in another Member State, the CSSF retains the responsibility for the oversight of certain areas outside the banking prudential supervision, i.e. the fight against money laundering and terrorist financing, the rules applicable to the provision of investment services and the enforcement of the requirements applicable to Luxembourg UCI depositaries.
3. “authorised management" shall mean ” or “authorised managers” shall be
   deemed the management body in its management function in accordance with the EBA Guidelines on internal governance (“EBA/GL/2017/11”). The authorised managers shall be the persons referred to in ArticlesArticle 7(2) and 19 (2) of the law of 5 April 1993 on the financial sector. These persons are referred to as "authorised managers"; 1)2) "institution" shall mean an entitythe LFS and the senior management as defined in Chapter 2Article 3 of Part I;CRD IV. 5 In accordance with Council Regulation (EU) No 1024/2013 of 15 October 2013 (“SSM Regulation”) conferring specific tasks on the ECB concerning policies relating to the prudential supervision of credit institutions and with Regulation (EU) No 468/2014 of the European Central Bank establishing the framework for cooperation within the Single Supervisory Mechanism between the European Central Bank and national competent authorities and with national designated authorities (“SSM Framework Regulation”).

CIRCULAR CSSF 20/759
14/109
"key function": any function the exercise of which may haveFrom a prudential standpoint, the authorised management shall be in charge of the day-to-day management of an institution, in accordance with the strategic directions and the key policies approved by the supervisory body. In a one-tier system, the authorised managers may also be members of the Board of Directors, while in a two-tier system, the authorised management corresponds strictly to the Executive Board;
3) “institution” shall mean credit institutions incorporated under Luxembourg law,
including their branches, Luxembourg branches of third-country credit institutions and Luxembourg branches of credit institutions authorised in another Member State;
4) “significant institution” shall mean systemically important credit institutions in
accordance with Article 59-3 of the LFS and, if applicable, other credit institutions determined as such by the competent authority based on the assessment of the institutions’ size and internal organisation as well as the nature, the scale and the complexity of their activities;
5) “management body” shall mean the management body, in accordance with
the definition of the LFS, and shall be the management body in its supervisory function and in its management function in accordance with the EBA Guidelines on internal governance (“EBA/GL/2017/11”). It shall refer to the Board of Directors and the authorised management of an institution with a one-tier structure or the Supervisory Board and the Executive Board of an institution with a two-tier structure;
6) “supervisory body” shall correspond to the management body in its
supervisory function in accordance with the EBA Guidelines on internal governance (“EBA/GL/2017/11”) and to the members of the management body who do not perform any executive function within the meaning of the LFS. According to the financial sector regulation, boards of directors and supervisory boards of credit institutions are assigned responsibilities as regards the supervision and control, as well as the determination and approval of strategies and key principles;
7) “related parties” shall mean the legal entities (structures) which are part of
the group to which the institution belongs as well as the staff members, shareholders, managers and members of the management body of these entities;
8) “Prudential Procedure” shall mean the prudential procedure for the
appointment of members of the management body and key function holders in credit institutions;

CIRCULAR CSSF 20/759
15/109
2)9) “key function holders” shall mean the heads of functions whose performance allows a significant influence onover the conduct or monitoring of the activities. These key functions of the institutions. They include at least, in particular, the directors, authorised managers and the persons in chargeheads of the three internal control functions in accordance with point 105 (i.e.all institutions, i.e. the Chief Risk Officer (“CRO”) for the risk control function, the Chief Compliance Officer (“CCO”) for the compliance function and the Chief Internal Auditor (“CIA”) for the internal audit function);, as well as the head of the financial function (Chief Financial Officer, “CFO”) in significant institutions;
10) "CEBS shall mean the Committee of European Banking Supervisors;
11) CRD IV shall mean Directive 2013/36/EU of 26 June 2013 on access to the
activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC;
12) CRR shall mean Regulation (EU) No 575/2013 of 26 June 2013 on prudential
requirements for credit institutions and investment firms;
13) EEA shall mean the European Economic Area;
14) ICAAP shall mean the Internal Capital Adequacy Assessment Process;
15) ILAAP shall mean the Internal Liquidity Adequacy Assessment Process;
3)16) LFS" shall mean the Law of 5 April 1993 on the financial sector, as amended;
3) "related parties" shall mean the legal entities which are part of the group to
which the institution belongs as well as the employees, shareholders, managers and members of the board of directors of these entities.
17) MiFID shall mean the Markets in Financial Instruments Directive.
Chapter 2. Scope and proportionality
2. This Circular shall apply to credit institutions and investment firms governed
byincorporated under Luxembourg law, including their branches, as well as their Luxembourg branches of third-country credit institutions and investment firms originating outside the European Economic Area. .

CIRCULAR CSSF 20/759
16/109
In respect of the areas for which the CSSF retains an oversight responsibility as host authority – i.e. and as authority in charge of an area outside the banking prudential supervision, respectively - i.e. anti-money laundering and counter terrorist financing measures in the fight against money laundering and terrorist financing, markets in financial instruments and liquidity – Luxembourg branches of credit institutions and , rules applicable to the provision of investment firms originating from a Member State of the European Economic Areaservices and requirements applicable to UCI depositaries – Luxembourg branches of credit institutions authorised in another Member State, in coordination with this institution, shall establish central administration and, internal governance arrangements as well asand risk management arrangements which are comparable to those provided for in this Circular. All entities mentioned in the preceding paragraphs are referred to hereafter as "institutions". In respect of professionals performing lending operations as defined in Article 28- 4 of the LFS, only Chapter 3 of Part III of This Circular shall apply.
Chapter 6 of Part III of this circular applies only to credit institutions.
2. The circular shall apply to institutions, on a single stand-alone sub-consolidated
and consolidated basis.
3. Where there are legal entities, whether consolidated, to financial holding
companies or not, whose mixed financial holding companies referred to in Article 21a(1) of CRD IV and to credit institutions referred to in Article 21a(4)(c) of CRDI IV. If the institution is a parent undertaking is the institution within the meaning of the LFS, the term "institution" shall refer to the "group", i.e. the entire group represented by the parent undertaking (the "group head") and the legal entities whose parent undertaking is the institution within the meaning of the LFS. (group head), the Circular shall then apply to “the "group"” as a whole,: to the parent undertaking and the various legal entities that are part of it,this group - whether or not they are included in the scope of prudential consolidation according to the CRR - including their possiblethe branches, as well as the relationships between these legal entities, in compliance with the national laws and regulatory provisions which apply to the legal entities in question. In the case of legal entities in which the institution holds an interest of between 20% and 50% but whose parent undertaking is not the institution within the meaning of the LFS, the institution - group head - together with the other shareholders or partners concerned shall do their utmost to make sure that central administration and internal governance arrangements as well as risk management arrangements are implemented within these legal entities. These arrangements shall meet standards which are comparable to those provided for in this circular and comply with the laws and regulatory provisions applicable at national level.

CIRCULAR CSSF 20/759
17/109
Regardless ofThus, whatever the organisational and operational structure of the institution or a group, the implementation of this Circular enablesshall enable the institution to have complete control over its activities and the risks to which it is or may be exposed, irrespective ofincluding the location of theseintra-group activities and risks. and regardless of the location of the risks.
3. Proportionality shall apply to the implementing measures, which the institutions
take pursuant to this Circular, having regard to the nature, scale and complexity of thetheir activities, including the risks and organisation of the institution. . In practice, the application of the principle of proportionality implies that the largest, most complex or riskiest institutions shallwhich are more significant, complex or riskier have in place enhanced central administration and, internal governance and risk management arrangements. These enhanced arrangements shall include, for example, the establishment of specialised committees pursuant, the appointment of independent members additional to Section 4.1.4. Howeverthe supervisory body or additional authorised managers to facilitate the day-to-day management. Conversely, for institutions which are smaller in size and internal organisation, whose activity is less diversified, significant or complexactivities are minor in terms of nature, scale and complexity, the principle of proportionality could be applied less strictly.downward. Thus, these institutionsan institution with limited activities of low complexity may operate properly within the meaning of this Circular with by designating heads of compliance and risk control functions assumed on a part-time basis (cf. points 129 and 141), with an outsourcedwithout questioning the principle of permanence of the function) or by fully or partially outsourcing the performance of the operational tasks of the internal audit (point
117) or through the use of external experts in order to carry out some internal
control tasks (point 118).. The less stringentdownward application of the principle of proportionality is limited, in particular, by the principle of segregation of duties under which the duties and responsibilities shall be assigned so as to avoid conflicts of interest involving the same person (cf. point 71). At the level of the authorised management, this principle is balanced with the principle of overall responsibility of the authorised management (cf. point 72). While the division of duties. While the allocation of tasks within the authorised management is done in compliance with the principle of segregation of duties, joint liabilityresponsibility shall be maintained. In application The implementation of the principle of proportionality, where an institution does not require more than two authorised managers, shall take account of the effective division of duties is not always compatible with a strict segregation of duties within this management. For instance, in this case, following:

CIRCULAR CSSF 20/759
18/109 a. the same member of the authorised management may be in charge of both the administrative, accountinglegal form and IT organisationthe ownership and funding structure of the institution; b. the internal control functions (cf. point 63). business model and risk strategy;
c. the size of the institution and its subsidiaries as well as the nature and
complexity of the activities (including the type of customers and the complexity of the products and contracts); d. the nature and complexity of the organisational and operational structure, including the geographic footprint, the distribution channels and the outsourced activities; e. the nature and state of the IT systems and continuity systems. Regardless of the organisation adopted organisation, the arrangements in this respect shall enable the institution to operate in full compliance with the provisions of Chapter 3 of Part II. Part II of this Circular. The institutions shall document their proportionality analysis in writing and have their conclusions approved by the supervisory body.
Part II. Central administration and internal
governance arrangements
Chapter 1. Central administration

1. The institutions shall have a robust central administration in Luxembourg,
   consisting of a "their “decision-making centre"” and an "their “administrative centre".”. The central administration, which comprisesshall comprise, in a broad sense, the executive, management, execution and control functions, shall enable the institution to retain control over all of its activities.
2. The concept of "decision-making centre" does not only comprise shall include the
   authorised management’s activities pursuant to Articles 7 (2)management and 19 (2) of the LFS but also thatheads of the persons in charge of the various business, functions, the support and control functions orand the various business units (services, departments or positions) existing within the institution.

CIRCULAR CSSF 20/759
19/109
3. The administrative centre shall include in particular a soundthe administrative,
accounting and IT organisation which ensuresshall ensure, at all times, proper administration of securities and assets, properadequate execution of operations, accurate and complete recording of operations and production of accurate, complete, relevant and understandable management information available without delay. In this respect, it shall include the administrative infrastructure of the business functions (Section 5.2.1), the support functions, in particular in the financial and accounting field (Section 5.2.2) and the IT field (Section 5.2.3) as well as the internal control (Chapter 6).
4. Where the institution is the group head pursuant to point 3, the central
administration shall enable the institution to concentrate allany management information necessary to manage, monitor and control , on an ongoing basis, the activities of the group in, on an ongoing basis, within its registeredhead office in Luxembourg. Similarly, the central administration shall enable the institution to reach all legal entities and branches which are part of the group in order to provide them with any requirednecessary management information. The concept of management information shall be understood in the broadest possible sense, including financial information and the prudentiallegal reporting.
Chapter 2. Internal governance arrangements
5. Internal governance is a limited but crucial component of the corporate
governance framework, focusingfocussing on the internal structure and organisation of an institution. Corporate governance is a broader concept which may be described as the set of relationships between an institution, its board of directorssupervisory body, its authorised management, its shareholders and the other stakeholders. Internal governance shallmust ensure in particular a sound and prudent business management of the activities, including the risksof inherent in them. In order to achieve this objective, the institutions shall establish risks. The internal governance arrangements which are consistent with the three-lines-of-defence model. The first line of defence consists of the business units that take or acquire risks under a predefined policy and limits and carry out controls as described under
Section 6.1.1.
“The second line is formed by the support functions, including the financial and accounting function (Section 5.2.2 of this circular), and the compliance and risk control functions (Sub-chapter 6.2 and Sections 6.2.5 and 6.2.6 of this circular and guideline 3.36 implemented by Circular CSSF 20/750 on the information and 6 Guideline 1.3 in the French version.

CIRCULAR CSSF 20/759
20/109 communication technology (ICT) and security risk management framework) which contribute to the independent risk control.”7 The third line consists of the internal audit function which, pursuant to Sub-chapter
6.2 and Section 6.2.7, provides an independent, objective and critical review of
the first two lines of defence.
6. The three lines of defence are complementary, each line of defence assuming its
control responsibilities regardless of the other lines. The controls carried out by the three lines of defence shall include the four levels of control provided for in point 100.:
4. In essence, and for the purpose of complying with the objectives laid down in the
preceding point, the internal governance arrangements shall include in particular:

• a clear and consistent organisational and operational structure includingwith
  decision-making powers, reporting and functional linkslines and segregationshare of dutiesresponsibility which are clearly well-defined, transparent, consistent, complete and free from conflicts of interest (Sub￾chapters 5.1, 7.1 and 7.2);;
• adequate internal control mechanisms which comply with the provisions of
  Chapter 6. of this part. These mechanisms shall include sound administrative,
  accounting and IT procedures and remuneration policies and practices allowing and promoting sound and effective risk management by applying the rules laid down in Circulars CSSF 06/273, CSSF 07/290 and CSSF 11/505, in line with the institution’s risk strategy, as well as control and security mechanisms for the management information systems. The concept of management information system shall include the informationIT systems (Sections 5.2.1;
• a clear risk-taking process including a risk appetite that is formally and
  precisely defined in all the business areas, a rigorous decision-making process and quality and limit analyses;
• processes to identify, measure, report, manage, mitigate and control the risks
  to which the institutions are or may be exposed;
• a management information system, including as regards risks, as well as
  internal communication arrangements comprising an internal alert procedure (whistleblowing) which enables the institution’s staff to draw the heads’ attention to 5.2.3, Sub-chapters 5.3 and 7.4);all their significant and legitimate concerns about the internal governance of the institution;
• a formal escalation, settlement and, where appropriate, sanction procedure
  for the problems, shortcomings and irregularities identified through the internal control mechanisms, including the internal control functions under Sub-chapter 6.2and alert mechanisms; 7 Amended by Circular CSS 20/750.

CIRCULAR CSSF 20/759
21/109

• processes to identify, measure, report, manage and mitigate as well as
  monitor the risks institutions are or may be exposed to pursuant to Chapter 1 of Part III;
• a management information system, including as regards risks, as well as
  internal communication arrangements including internal whistleblower procedure which enables the staff of the institution to draw the attention of those responsible to all their significant and legitimate concerns related to the internal governance of the institution (Section 5.2.4);
• business continuity management arrangements aimed to limit the risks of
  serious severe business disruption of business activities and to maintain the key operations as defined by the board of directorssupervisory body upon proposal of the authorised management. These arrangements shall include a business continuity plan which describes the actions to be put in placetaken in order to continue to operate in case of an incident or disaster (Sections 5.2.3 and 7.4); ;
• crisis management arrangements which ensure appropriate responsiveness in
  casethe event of a crisis, including a business recovery plan. These arrangements shall meet in accordance with the requirements set out in
  Section 5.of Chapter 2.5 of Part IV of the LFS.

7. The institutionsAny institution shall promote an internal risk and
   controlcompliance culture in order to ensure that all the institution’s staff of the institution take an active part in the internal control as well as in the identification, reporting and monitoring of the risks incurred by the institution and develop a positive approach to the internal control as defined in Chapter 6. This strong and ubiquitous overall risk and compliance culture must also be reflected in the strategies, policies and procedures of the institution, the training offered and the messages brought to staff members as regards the risk-taking and the risk management within the institution. Such culture shall be characterised by the example the management body sets (“tone from the top”) and requires all staff members to be accountable for their acts and behaviour, an open and critical dialogue and the absence of an incentive for inappropriate risk￾taking.
   Chapter 3. General characteristics of "“robust"” central
   administration and internal governance arrangements
8. Central administration and internal governance arrangements shall be developed
   and implemented so that they:

• fully operate with “integrity.”. This part includes both the management of
  conflicts of interest and the security, in particular, as regards information systems;

CIRCULAR CSSF 20/759
22/109

• are reliable and operate on an ongoing basis ("(“robustness").”). Pursuant to
  the principle of continuity, institutionsany institution shall also establish arrangements aimed to restore the operation of the internal governance arrangements in case of discontinuity;
• are effective ("(“effectiveness").”). Effectiveness is given, in particular, when
  risks are effectively managed and controlled; monitored;
• meet the needs of the institution as a whole and of all its organisational and
  business units ("(“adequacy");”);
• are consistent as a whole and in itstheir parts ("(“consistency");”);
• are comprehensive ("(“comprehensiveness").”). In respect of riskrisks,
  comprehensiveness shall mean that all risks shallmust be included within the scope of the internal governance arrangements. This scope isshall not (necessarily)be limited to the sole (consolidated) prudential or accounting scope; it. This scope shall enable the institution to have a thorough overview of all its risks, in terms of their economic substance, taking into accountconsidering all the interactions existing throughout the institution. In respect of the internal control, the principle of comprehensiveness implies that the internal control shall apply to all areas of operation of the institution;
• are transparent ("(“transparency").”). Transparency shall include a clear and
  visible assignment and communication of the roles and responsibilities to the different staff members, the authorised management and the business and organisational units of the institution.;

5. In application of an organisation chart (Sub-chapter 5.1), the institution shall have
   in its registered office in Luxembourg, in its branches as well as all in the different legal entities which are part of the group, a sufficient number of human resources with appropriate individual and collective professional skills as well as the necessary and sufficient administrative and technical infrastructure to carry out the activities which it wishes to perform. These human resources and this infrastructure shall comply with the provisions of Sub-chapters 5.1 and 5.2. Outsourcing is possible under the conditions laid down in Sub-chapter 7.4.
6. Institutions shall set out in writing all the central administration and internal
   governance arrangements as well as all their activities (operations and risks) pursuant to Sub-chapter 5.3.

• comply with the legal and regulatory requirements, including with the
  requirements of this Circular (“compliance”).

9. In order to ensure and maintain the soundnessrobustness of the central
   administration and internal governance arrangements, these shall be subject to objective, critical and regular review at least once a year. This review shouldshall consider all internal and external changes which may have a significant adverse effect on the soundnessrobustness of these arrangements as a whole and on the risk profile, and in particular on the institution’s ability to manage and bear its risks.

CIRCULAR CSSF 20/759
23/109
10. The institutions shall publishdisclose the key elements of theiron internal
governance arrangementsand risk management in complianceaccordance with the rules governing Part XIX of Circular CSSF 06/273 ("Pillar 3"). This publication shall comprise provisions of the organisational and operational structure, including as regards the internal control, risk strategy as well as risk profile. This information shall describe the current situationCRR (Article 435 and its expected development in a clear, objectiveTitle I of Part Eight) and relevant manner.the EBA Guidelines on disclosure requirements under Part Eight of Regulation (EU) No 575/2013 (“EBA/GL/2016/11”).
Chapter 4. Board of directorsSupervisory body and authorised
management
Sub-chapter 4.1. Board of directorsSupervisory body
Section 4.1.1. Responsibilities of the board of directorssupervisory
body
11. The board of directorssupervisory body shall have the overall responsibility for
the institution. It shall ensure execution of activitiesdefine, monitor and preserve business continuity by way of sound bear responsibility for the implementation of robust central administration, governance and internal governance arrangements pursuant to the provisions of this circular. To this end, in compliancecontrol arrangements, which shall include a clearly structured internal organisation and independent internal control functions with the legal and regulatory provisionsappropriate authority, stature and resources with respect to their responsibilities. The implemented framework must ensure the sound and prudent management of the institution, preserve its continuity and protect its reputation. To this end, after having heard the authorised management and the persons in chargeheads of the internal control, and for functions, the purpose of protecting the institution and its reputation, the board of directorssupervisory body shall approve and lay down, in writing, notably the following key elements of the central administration, internal governance and risk management arrangements:
 the business strategy (business model) of the institution taking into account , considering the institution’s long-term financial interests, solvency and, liquidity situation;

• the institution’s and risk strategy, including the risk tolerance and the guiding
  principles governing the risk identification, measurement, reporting, management and monitoringappetite. The development and maintenance of a sustainable business model requires that account be taken of all material risks, including environmental, social and governance risks;
• the risk strategy of the institution, including the risk appetite and the overall
  framework for risk-taking and risk management of the institution;

CIRCULAR CSSF 20/759
24/109

• the strategy of the institution with respect to regulatory and internal own
  fundscapital and liquidity reserves;
• the guiding principles of a clear and consistent organisational and operational
  structure which governsshall govern, in particular, the creation and maintenance of legal entities (structures) by the institution as well as;
• the guiding principles as regards information systems, technology and security
  in accordance with Circular CSSF 20/750, including the security aspect, and internal communication and alert arrangements, including the internal whistleblower procedure;
• the guiding principles relating to the internal control mechanisms, including
  the internal control functions and remuneration policy, ;
• the guiding principles forrelating to the remuneration policy;
• the guiding principles relating to professional conduct, corporate values and
  the management of conflicts of interest;
• the guiding principles relating to escalation, settlement and sanctions the
  purpose of which is to ensure that any behaviour which does not comply with the applicable rules shall beis properly investigated and sanctioned, as well as the guiding principles of professional conduct ("internal code of conduct") and corporate values, including as regards the management of conflicts of interest;
• the guiding principles as regardsrelating to the central administration in
  Luxembourg, including:
• the human and material resources which are required for the
  implementation of the organisational and operational structure as well as the institution’s strategies, the guiding principles as regards the administrative, accounting and IT organisation, the guiding principles as regards outsourcing, including IT-related outsourcing relying on a cloud computing infrastructure or not, as well as the guiding principles governing the change in activity (in terms of coverage of markets and customers, new products and services) and the approval and maintenance of "non-standard" or "non-transparent" activities;
• an administrative, accounting and IT organisation with integrity, and
  complying with the guiding principles applicable laws and standards;
• the guiding principles relating to outsourcing, including IT-related
  outsourcing, whether or not it is based on a cloud computing infrastructure, and
• the guiding principles governing the change in activity (in terms of
  market coverage and customers, new products and services) and the approval and maintenance of non-standard or potentially non￾transparent activities;
• the guiding principles relating to business continuity management and crisis
  management arrangements and ;
   the guiding principles ongoverning the appointment and succession of individuals withto the management body and to key functions in the institution, as well as the procedures governing the composition of the

CIRCULAR CSSF 20/759
25/109 supervisory body, including the aspects of diversity, responsibilities, organisation and, operation of the board of directors, and individual and collective assessment of its members. 8 The guiding principles governing the appointment and succession of individuals with key functions in the institution provide that, in this regard, the institutionaspects of diversity shall comply with the requirements of this circular, the prudential authorisation procedure of key function holders as published on the CSSF’s website as well as the guidelines published byrefer to the EBA on 22 November 2012 (Guidelines on the assessment of characteristics of the suitability of members of the management body and key function holders – EBA/GL/2012/06). 8 In complianceaccordance with the corporate governance, the guiding principles and procedures applicable to the members of the board of directorssupervisory body are, where appropriate, to be submitted, where applicable, to the shareholders for approval. , under the Prudential Procedure as published on the CSSF website.

CIRCULAR CSSF 20/759
26/109

• The board, including their age, gender, geographical origin and educational
  and professional background. The promotion of diversity shall be based on the principle of directorsnon-discrimination and on measures ensuring equal opportunities.

12. The supervisory body shall entrust the authorised management with the
    implementation of the internal governance strategies and guiding principles referred to in point 17 through the internal written policies and procedures, (except for the guiding principles governing the appointment and succession of individuals to the board of directors.within the supervisory body and the procedures determining its operation).
13. The board of directorssupervisory body shall monitor the implementation by the
    authorised management of its internal governancethe strategies and guiding principles. To this end, it shall in particular and approve the policies laid downestablished by the authorised management pursuant to point 18. according to these strategies and principles.
14. The board of directorssupervisory body shall critically assess, adapt, where
    necessary, and re-approve, aton a regular intervals,basis and at least once a year, the internal governance arrangements of the institution., including the key strategies and guiding principles and their implementation within the institution, the internal control mechanisms and the framework for risk-taking and risk management. These assessments and re-approvals aim to ensure that the internal governance arrangements continue to comply with the requirements of this Circular and the objectives of effective, sound and prudent business management. Comment:
    The EBA guidelines on the assessment of the suitability of the key function holders provide in particular that the institutions shall:
     identify all key functions (cf. also point 1 in this regard);  define the criteria (in terms of professional standing, professional skills and personal qualities) under which the key function holders are assessed. These criteria are consistent with the criteria provided for in points 13 to 15 of the aforementioned EBA guideline;  require that the key function holders are of good repute and have the professional skills and personal qualities required to fulfil their duties;  assess in writing the suitability of the key function holders, prior to their appointment, on a regular basis, during their mandate and on an ad hoc basis where such an assessment is imposed;  define policies and procedures for selecting key function holders who comply with the principles of robust internal governance (in accordance with points 7 and 8 of the aforementioned EBA guidelines.

CIRCULAR CSSF 20/759
27/109
The board of directorsassessment and re-approval by the supervisory body shall relate, in particular, assess and approveto the following:

• the correlation ofbetween the risks incurred withrisks, the institution’s ability
  to manage these risks and the internal and regulatory own fundscapital and liquidity reserves, taking into accountin line with the strategies and guiding principles laid downestablished by the board of directors,supervisory body and the existingapplicable regulations and in particular, including Circular CSSF 11/506;
• the strategies and guiding principles in order to improve them and to adapt
  them to internal and external, current and anticipated changes, as well as to the lessons learnt from the past;
• the manner in which the authorised management meets theits responsibilities
  set out in Sub-chapter 4.2.and the performance of its members. In this context, the board of directorssupervisory body shall ensurecritically and constructively review and assess the actions, proposals, decisions and information provided by the authorised management and shall, in particular, ensure that the authorised management promptly and effectivelyefficiently implements the required corrective measures required to address the problems, shortcomings and irregularities identified by the internal control functions, the réviseur d'entreprises agréé (approved statutory auditor) and the CSSF, pursuant to the last two paragraphs of point 57competent authority;
• the adequacy of the organisational and operational structure. The board of
  directors shallsupervisory body must fully know and understand the organisational structure of the institution, in particular in terms of the underlying legal entities (structures), of their raison d'être, the intra-group links and interconnections between theminteractions as well as the risks related thereto. It shall verify that the organisational and operational structure complies with the strategies and guiding principles referred to in point 17, that it enables a sound and prudent business management which is transparent and free from undue complexity, and that it remains justified in relation to the setassigned objectives. This requirement shall apply, in particular, to "non￾standard" or "potentially non-transparent" activities;
• the efficiency and effectiveness and efficiency of the internal control
  mechanisms put in place by the authorised management.
  The assessments in question may be prepared by thespecialised committees established in accordance with point 33. These assessments shall, in particular, be based on the information received from the authorised management (point 61),, the audit reports issued by the réviseur d'entreprises agréé (reports on the annual accounts, long -form reports and, where appropriate, the management letters), the ICAAP report (point 61) and the summaryILAAP reports and the reports of the internal control functions (point 116) which the board of directorssupervisory body is called upon to approve on this occasion.

CIRCULAR CSSF 20/759
28/109
15. The board of directors issupervisory body shall be in charge of promoting an
internal risk and compliance culture which heightensraises the awareness of the institution’s staff as regards the requirements of a sound and prudent risk management and which fosters a positive attitude vis-à-vistowards internal control and compliance. It shall also be in charge of stimulating the development of the internal governance arrangements which allow reaching these objectives. In respect of the internal control functions, the board of directorssupervisory body shall ensure that the taskswork of these functions are executedis performed in compliance with the recognised standards. Moreover, and under the board of directors approves the internal audit plan pursuantapproved policies.
16. The supervisory body shall ensure that sufficient time is devoted to point 151risk
issues.
17. Where the board of directorssupervisory body becomes aware that the central
administration or internal governance arrangements no longer enableensure a sound and prudent business management or that the risks incurred risks are or will no longer be properlyadequately borne by the institution’s ability to manage these risks, by theown funds or regulatory or internal own funds or liquidity reserves, it requires the authorised management to provide it , without delay, with the corrective measures, without delay, and to inform the CSSFcompetent authority thereof forthwith. The requirementobligation to notify the CSSFcompetent authority also relates toconcerns all information which casts doubt on the qualification or professional standinggood repute of a member of the board of directorsmanagement body or the authorised management or a person in charge of an internal controlhead of a key function.
Section 4.1.2. Composition and qualification of the board of
directorssupervisory body
18. The number of The members of the board of directors shallsupervisory body must
be in sufficient number and the board of directors, as a whole shall, must be properly composed adequately so that itthe supervisory body can fully meet its responsibilities. The adequacy of the composition of the board of directorssupervisory body refers, in particular, to professional skills (qualifications (adequate knowledge, understanding skills and experience), as well as to the personal qualities of the members of the board of directors.supervisory body. Moreover, each member shallmust demonstrate his/her professional standingrepute. The guiding principles governing the electionappointment and succession of the directorsmembers of the supervisory body explain and determineprovide for the abilities deemed necessary to ensure an appropriate composition and qualification of the board of directorssupervisory body.
19. The board of directors as a whole shallThe supervisory body must collectively
have appropriate knowledge, skills and experience with regard to the nature, scale and complexity of the activities and the organisation of the institution.

CIRCULAR CSSF 20/759
29/109
The board of directors, as a collectiveCollectively, the supervisory body, shall must fully know and understand all the activities (and inherent risks) as well as the economic and regulatory environment in which the institution operates. Each member of the board of directorssupervisory body shall have a completefull understanding of the internal governance arrangements and of his/her responsibilities within the institution. The members shall control the activities which fall within their areas of expertise and shall have a soundgood understanding of the other significant activities of the institution.
20. The members of the board of directorssupervisory body shall ensure that their
personal qualities enable them to properly perform their director’s mandate effectively, with the required commitment, availability, objectivity, critical thinking and independence of mind. In this respect, the board of directorssupervisory body cannot have among its members a majority of persons who take on an executive role within the institution (authorised managers or other employeesstaff members of the institution, with the exception of staff representatives elected in accordance with the applicable regulations). The members of the board of directors make suresupervisory body shall ensure that their director’s mandate is and remains compatible with any other positions, mandates and interests they may have, in particular in terms of conflicts of interest and availability. They shall inform the board of directorssupervisory body of the mandates they have outside the institution.
21. The terms and conditionsof reference of the directors’ mandates shallmust be laid
down so as to enablethat the board of directors tosupervisory body may fulfil its responsibilities effectively and on an ongoing basis and effectively.. The renewal of the existing directors'members' mandates shallmust, in particular, be based on their past performance. Continuity in the functioning of the board of directors shallsupervisory body must be ensured.
22. The guiding principles governing the appointment and succession of the members
of the board of directorssupervisory body provide for the measures required in order for these members to be and remain qualified throughout their mandate. These measures shall include professional trainingsa specific initiation to understand the structure, the business model, the risk profile and the governance arrangements, and then vocational training programmes which enable the members of the boardsupervisory body, on the one hand, to understand the operations of directorsthe institution, their role and, on the other hand, to update and develop their required skills.
23. Each institution should appoint at least one member to its supervisory body who
may be considered as “independent member”.

CIRCULAR CSSF 20/759
30/109
An independent member of the supervisory body shall not have any conflict of interest which might impair his/her judgement because s/he is or has been, in the recent past, bound by any professional, family or other relationship with the institution, its controlling shareholder or the management of either. As to the assessment of “being independent”, the institutions shall apply the criteria of
Section 9.3 of EBA/GL/2017/12 as provided for in Annex I.
The significant institutions or the institutions whose shares are admitted to trading on a regulated market shall ensure that their supervisory body has a sufficient number of independent members, considering their organisation and the nature, the scale and the complexity of their activities.
Section 4.1.3. Organisation and functioning of the board of
directorssupervisory body
7. The board of directorssupervisory body shall regularly meet on a regular basis in
order to effectively performfulfil its duties.
23.24. responsibilities. The workorganisation and functioning of the board of
directorssupervisory body shall be documented in writing. This documentation shall include the agenda of the meeting, the minutes of the meeting as well as the decisions and measures taken by the board of directorsThe objectives and responsibilities of its members shall also be documented by way of written mandates.
25. The board of directorsThe work of the supervisory body must be documented in
writing. This documentation shall include the agenda and minutes of the meetings as well as the decisions and measures taken by the supervisory body. The minutes are an important tool which must, on the one hand, help the supervisory body and its members monitor the decisions and, on the other hand, enable the body and its members to be accountable to the shareholders and the competent authorities. Thus, the routine items may be included in the minutes of a meeting succinctly, in the form of a simple decision, while important items on the agenda involving risks for the institution or jointly discussed must be reported in more detail, allowing readers to follow the discussions and to identify the positions taken.
8. The supervisory body shall assess, on a regular basis, the procedures governing
the board of directors, its operating mode of functioning and its work in order to regularly improve them, to ensure their effectiveness and to verify whether the applicable procedures are complied with in practice.

CIRCULAR CSSF 20/759
31/109
24.26. The chairman of the board of directors is in charge of promoting,It shall ensure
that all its members have a clear picture of their obligations, responsibilities and allocation of tasks within the board of directors, a culture of informed and contradictory discussion and to propose the election of independent directors. An independent director shall be a director who does not have any conflict of interest which might impair his/her judgement because s/he is bound by a business - family or other9 - relationship with the institution, its controlling shareholder or the management of either.supervisory body and specialised committees that depend on it. The CSSF recommends larger institutions to have one or several independent directors.
9. The mandates of authorised manager and chairman of the board of directors
cannot be combined.
27. The chairperson of the supervisory body shall ensure a balanced composition
thereof, in particular in terms of diversity, to ensure its proper functioning, to promote a culture of informed discussion in which all parties are heard within the supervisory body and to propose the appointment of independent members. The chairperson of the supervisory body shall not exercise executive functions within the institution, save in exceptional situations to be authorised by the competent authority.
Section 4.1.4. Specialised committees
28. For the purpose of increasing its effectiveness, the board of directorsThe
supervisory body may be assisted by specialised committees notably, in particular, in the fields of auditing, riskaudit, risks, compliance, remuneration, human resources (notably through the intervention of a nomination committee of the key function holders) as well as and appointments or internal governance, and professional ethics, according to its needs and compliance whereconsidering the organisation, nature, scale and complexity of the institution and its activities so require. These committees shall include directors who are not members either of the authorised management or of the institution’s staff. They may also include, if need be, external independent experts of the institution.activities. Their mission ismissions shall be to provide the board of directorssupervisory body with critical assessments in respect of the organisation and operationfunctioning of the institution in the aforementionedtheir specific areas in order to enable theof competence.
29. The significant institutions must put in place an audit committee, risk committee,
nomination committee and a remuneration committee.
9 Including an employment relationship.

CIRCULAR CSSF 20/759
32/109
30. In accordance with the principle of proportionality, the institutions that are not
significant may put in place dedicated committees combining different areas of responsibility, for example, an audit and risk committee, an audit and compliance committee or a risk and remuneration committee. The members of such committees must possess the necessary knowledge, skills and experience to perform their functions, both individually and collectively.
31. Without prejudice to the specific legal and regulatory requirements in this respect,
the permanent members of the boardspecialised committees shall be, as the case may be, members of the supervisory body who do not perform any executive function within the institution or independent members. Each committee shall be composed of at least three members whose knowledge, skills and expertise are in line with the missions of the committee. Where there are several specialised committees within an institution and in so far as the number of non-executive and independent members of directors to fulfil their supervisory mission and to the supervisory body allows it, the institution should ensure that the members of the respective committees are different. Moreover, the institution should try to ensure a rotation of the chairpersons and members of the committees, considering the specific experience, knowledge and skills required on an individual and collective basis.
32. The specialised committees shall be chaired by one of their members. These
committee chairpersons shall have in-depth knowledge in the area of activities of the committee they chair and shall ensure a critical and constructive debate within the committee.
33. The CSSF recommends that the significant institutions’ risk committee have a
majority of independent members, including its chairperson.
25.34. The specialised committees shall meet on a regular basis in order to discharge
their tasks and work assigned to them or to prepare the meetings of the supervisory body. According to their needs, they may be assisted by external experts independent of the institution, and may involve, in their work, the réviseur d’entreprises agréé, the authorised managers, the other specialised committees, the heads of the internal control functions and the other persons working for the institution, provided that these persons are not members and do not take on their responsibilities pursuant to this circularpart in the recommendations of the committee.

CIRCULAR CSSF 20/759
33/109
26.35. The board of directorssupervisory body shall lay down, in writing:, the
mandatemissions, composition and working procedures of the specialised committees. Pursuant toUnder these procedures, the specialised committees shall receive regular reports from the internal control functions on the development in the institution’s risk profile, the breaches of the regulatory framework, the internal governance and the risk management as well as the concerns raised through the internal alert arrangements and the remedial actions. The specialised committees must be able to request any document and information they deem necessary to fulfil their mission. Moreover, the The committees shall document the agendas of their meetings as well as the findings and recommendations according to the same principles as in point 25. Furthermore, the procedures shall provide for the conditions under which the réviseur d’entreprises agréé as well as any person belonging to the institution, including the authorised management, are associated withexternal experts provide their assistance and the terms under which other persons are involved in the work of the specialised committees.
27.36. The board of directorssupervisory body shall ensure that the variousdifferent
committees interact effectively interact , communicate with each other, with the internal control functions and the réviseur d'entreprises agréé, and report to the board of directorssupervisory body on a regular basis.
10. The board of directorssupervisory body cannot delegate its decision-making
powers and responsibilities to specialised committees pursuant to this Circular.
11. to the specialised committees are chaired by one of their members. These
committee chairmen shall have in-depth knowledge in the area of activities of the committee they chair.
28.37. . Where the board of directorsit is not assisted by specialised committees, the
tasks referred to in Sub-sections 4.1.4.1 and 4.1.4.2 shall be directly incumbent upon the board of directors.it. Sub-section 4.1.4.1. Audit committee10
29.38. The purpose of the audit committee isshall be to assist the board of
directorssupervisory body in the areas of financial information, internal control, including internal audit as well as the controlaudit by the réviseur d'entreprises agréé.
12. The CSSF recommends larger Without prejudice to the other provisions of Section
4.1.4, the institutions tomust establish an audit committee in order to facilitate effective supervision of the activitieswhen imposed by the board of directors. 10 In respect of institutions which shall have an audit committee pursuant to the law of 18 December 2009 concerning the audit profession, this circular shall apply without prejudice to the codified provisions of Article 74 ("Audit Committee") of this law.

CIRCULAR CSSF 20/759
34/109
30.39. The audit committee shall comprise at least three members and its
composition shall be determined in accordance with its missions and its mandate pursuant to points 33 and 34. The collective competencesArticle 52 of the members of the audit committee shall be representative of the activities and risks of the institution and include specific competences regarding audit and accounting. The audit committee can involve the person in charge of the internal audit function as well as the réviseur d'entreprises agréé of the institution in the work of the authorised management. These persons can attend the committee's meetings; they are not members of it.Law of 23 July 2016 concerning the audit profession, as amended (“Audit Law”).
31.40. The functioning of The audit committee, in particular in terms shall be in charge
of the process of frequencyappointment, reappointment, revocation and durationremuneration of the meetings, shall be determined in relation to its mandate and its mission to assist the board of directors. réviseur d’entreprises agréé.
32.41. The audit committee shall confirm the internal audit charter (point 144).as well
as the multi-annual audit plan and its reviews. It shall assess whether the human and material resources used for the internal audit are sufficient and shall make sure that the internal auditors have the required skills (point 111) and that the independence of the internal audit function is safeguarded.
13. The audit committee shall confirm the internal audit plan (point 151) confirmed by
the authorised management. It shall take note of the information on the state of the internal control provided by the authorised management at least once a year pursuant to point 61 of this circular.
14. The audit committee shall deliberate, on a regular basis, on11:
42. the follow-up of The audit committee shall regularly and critically deliberate on
the following12:

• the compliance with the accounting rules and the financial reporting process;
• the state of the internal auditcontrol and the compliance with the rules set in
  this respect in this Circular on the basis, in particular, on the basis of the internal audit function reports;
• the quality of the work carried out by the internal audit function and the
  compliance with the rules set in this respect in this circular (cf. Sections
  6.2.3 and 6.2.7.3);
• the appointment, renewal, revocation and remuneration of the réviseur
  d’entreprises agréé;
  11 Annex 2 of the BCBS guidelines on the internal audit function in banks dated 28 June 2012 includes a more comprehensive list of tasks generally assigned to the audit committee. 12 Annex 2 of the BCBS guidelines on the internal audit function in banks dated 28 June 2012 (“The internal audit function in banks”) includes a more comprehensive list of tasks generally assigned to the audit committee.

CIRCULAR CSSF 20/759
35/109

• the quality of the work carried out by the réviseur d’entreprises agréé, his/her
  independence and objectivity, his/her compliance with the applicable rules of professional ethics applicable to the audit area.as well as the scope and frequency of the audits. In this respect, the audit committee shall critically analyse and assess the audit plan, the reports on the annual accounts, the management letters, the long form reports and, where relevant, the appropriateness of the services other than those related to the audit of accounts that have been provided by the réviseur d’entreprises agréé;
• the annual accounts, the management letters as well as the long-form
  reports drafted by the réviseur d’entreprises agréé and shall examine and monitor the independence of the réviseur d’entreprises agréé or the cabinet de révision agréé (approved audit firm), in particular, in respect of the provision of additional services to the institution;
• the appropriate and timely follow-up without undue delay by the authorised
  management of the recommendations of the internal audit function and the réviseur d’entreprises agréé aimed to improve the organisation and internal control;and the actions taken to address the identified problems, shortcomings and irregularities.
• the actionsWhen reporting to be taken in case of the supervisory body as a
  whole, the audit committee shall propose the necessary measures to promptly address the identified problems, shortcomings and irregularities identified by the internal audit department and the réviseur d’entreprises agréé;
• the compliance with. The audit committee shall inform the legal and
  statutory provisions as well as with supervisory body of the CSSF rules for the draftingconclusions of the individual and, where appropriate, consolidated annual accounts, and on the relevanceexternal audit, of its work to ensure the accounting policies adopted.
  33.43. The audit committee may also be in chargeintegrity of the compliance function
  without creating a separate compliance committee.legal reporting and of its role in this case, the mandate and the composition of the audit committee shall reflect these new tasks. In particular, the persons associated with the audit committee pursuant to point 39 shall include the Chief Compliance Officer pursuant to point 105process. Sub-section 4.1.4.2. Risk committee
  34.44. The purpose of the risk committee isshall be to advise the supervisory body
  on aspects related to the overall risk and risk appetite strategy and also to assist the board of directors in its mission to assess the adequacy it in assessing the correlation between the risks incurred risks, the institution’s ability to manage these risks, and the internal and regulatory own fundscapital and liquidity reserves.

CIRCULAR CSSF 20/759
36/109
35.45. The CSSF recommends largersignificant institutions as well as institutions with
a higher or more complex risk profile to createmust establish a risk committee in order to facilitate the effective risk control by accordance with the boardprovisions of Article 7 of directors. RCSSF 15-02.
15. The risk committee can involve the authorised management as well as the persons
in charge of the internal control in its work. These persons can attend the committee's meetings; they are not members of it.
36.46. The risk committee shall confirm the specific policies of the authorised
management in accordance with Section 4.2.31.1.2 of Part III. It shall assist the supervisory body in its supervisory mission, i.e. implementing the risk strategy, the overall risk-taking and risk management framework and the adequacy of all the incurred risks relating to the strategy, the risk appetite and the risk mitigation measures of the institution.
37.47. The risk committee shall assess whether the human and material resources,
as well as the organisation of the risk control function (Section 6.2.5) are sufficient and shall ensure that the members of the risk control function have the required skills.
48. The risk committee shallThe risk committee shall advise and assist the
supervisory body in the recruitment of external experts that the supervisory body would hire to provide advice or support.
49. The risk committee shall regularly and critically deliberate, on the following:

• the risk profile of the institution, its development as a regularresult of internal
  and external events, its adequacy in relation to the approved risk strategy, the risk appetite, the policies and the risk limit systems and the ability of the institution to manage and bear these risks on an ongoing basis, on:considering its internal and regulatory capital and liquidity reserves;
• the stateadequacy of the risk-taking and risk management and compliance
  withframework in relation to the prudential rules laid down in this respectstrategy and the business objectives, the corporate culture and the framework of the institution’s values;
• the quality of the work carried out by the risk control function and the
  compliance with the rules laid down in this respect in this respect in this circular (cf. Section 6.2.3 and in particular Section 6.2.5);
• the risk situation, its future development and its adequacy with the risk
  strategy of the institution;
• the adequacy of the risks incurred with the current and future institution’s
  ability to manage these risks and the internal and regulatory own funds and liquidity reserves, taking into account the results of the stress tests in accordance with Circular CSSF 11/506; ;
• the assessment, through stress scenarios and stress testing, of the impact of
  external and internal events on the risk profile of the institution and the ability of the institution to bear its risks;

CIRCULAR CSSF 20/759
37/109

• the appropriate and timely follow-up without undue delay by the authorised
  management of the recommendations of the risk control function;
• and the actions to be taken in case of to address the identified problems,
  shortcomings and irregularities identified by the risk control function.;
• The risk committee shall advise the board of directors on the definitionthe
  compliance and the pricing of the overallproducts and services offered to customers with the business model and the approved risk strategy;
• without prejudice to the responsibilities of the remuneration committee, the
  appropriateness of the benefits provided for in the remuneration policies and practices, considering the risk level of the institution, including its current and future risk toleranceinternal and regulatory capital and liquidity reserves as well as its profitability. The risk committee shall report the outcome of its deliberations to the supervisory body as a whole, by proposing the necessary measures to promptly address the identified problems, shortcomings and irregularities.
  38.50. The chairperson of the risk committee cannot be, at the same time, the
  chairperson of the supervisory body or of any other specialised committee. Sub-chapter 4.2. Authorised management
  Section 4.2.1. Responsibilities of the authorised management
  39.51. The authorised management isshall be in charge of the effective, sound and
  prudent day-to-day businessmanagement of the activities (and inherent risk) management.risks). This management shall be exercised in compliance with the strategies and guiding principles laid downapproved by the board of directorssupervisory body and the existingapplicable regulations, taking into accountby considering and safeguarding the institution’s long-term financial interests, solvency and liquidity situation. TheThe authorised management shall constructively and critically assess all the proposals, explanations and information submitted to it for decision. The authorised management shall document its decisions by way of minutes of meetings, which must, on the one hand, help it monitor the decisions and, on the other hand, enable it to account for its management to the supervisory body and the competent authorities. Thus, the routine items may be included succinctly in the minutes of a meeting, in the form of a simple decision, while important items on the agenda involving risks for the institution or jointly discussed must be reported in more detail, allowing readers to follow the discussions and to identify the positions taken by the authorised management in these areas shall be duly documented. .

CIRCULAR CSSF 20/759
38/109
40.52. Pursuant to ArticlesArticle 7 (2) and 19 (2) of the LFS, the members of the
authorised management shallmust be authorised to effectively determine the business direction effectively. Consequently, where management decisions are taken by larger management committees which are larger rather than solely by the authorised management, at least one member of the authorised management shallmust be part of it and have a veto right.
41.53. The authorised management shall, in principle, perform its duties as a
permanent function within the institution; it must be permanently on -site. Any exemption to this principle shall be authorised by the CSSF.
42.54. The authorised management shall implement, through written internal written
policies and procedures, all the strategies and guiding principles laid down by the board of directorssupervisory body in relation to central administration and internal governance, in compliance with the legal and regulatory provisions and after having heard the internal control functions. The policies shall include detailed measures to be implemented; the procedures shall be the work instructions which govern this implementation. The term "“procedures"” is to be taken in the broad sense, including all the measures, instructions and rules governing the organisation and internal functioning. ItThe authorised management shall ensure that the institution has the necessary internal control mechanisms, technical infrastructures and human resources to ensure a sound and prudent businessmanagement of the activities (and inherent risk) management risks) within the context of robust internal governance arrangements pursuant to this Circular.
55. Pursuant to point 18Under the guiding principles of professional conduct,
corporate values and management of conflicts of interest laid down by the supervisory body, the authorised management shall define an internal code of conduct applicable to all the persons working in the institution. It shall ensure its correctproper application on the basis of regular controls carried out by the compliance and internal audit functions. The purpose of this code of conduct must be the prevention of operational and reputational risks which the institution may incur as a result of administrative or criminal sanctions, restrictive measures imposed on a regular basis. it or legal disputes, the damage to its corporate image or the loss of the trust of its customers and the consumers. The code of conduct should remind the staff and the members of the management body of the compliance with the applicable regulations, the internal rules and limitations, the principles that underlie honesty and integrity in their behaviour as well as the cases of inappropriate conduct and the sanction measures arising therefrom.

CIRCULAR CSSF 20/759
39/109
43.56. The authorised management shallmust have an absolutea full understanding
of the organisational and operational structure of the institution, in particular, in terms of the underlying legal entities (structures), of their raison d'être, the intra￾group links and interconnections between theminteractions as well as the risks related theretorisks. It shall ensure that the required management information is available, in due time, at all decision-making and control levels of the institution and legal structures which are part of it.
44.57. In its day-to-day management, the authorised management shall take into
accountconsider the advice and opinions provided by the internal control functions. Where the decisions taken by the authorised management have or could have a significant impact on the risk profile of the institution, the authorised management shall first obtain the opinion of the risk control function and, where appropriate, of the compliance function. The authorised management shall promptly and effectively implement the corrective measures to address the weaknesses (problems, shortcomings and, irregularities or concerns) identified throughby the internal control functions and, the réviseur d’entreprises agréé by taking into account theiror through the internal alert arrangements, by considering the recommendations issued in this respect. This approach shall be laid down in a written procedure which the board of directorssupervisory body shall approve upon proposal of the internal control functions. According to this procedure, the internal control functions shall prioritise the various weaknesses they identified and set, upon approval of the authorised management, the (short) deadlines by which these weaknesses shall be remedied. The authorised management shall designate the business units or persons in charge of the implementation of the corrective measures by allocating the resources (budgetsbudget, human resources and technical infrastructure) required in this respect.for that purpose. The internal control functions areshall be in charge of monitoringfollowing up on the implementation of the corrective measures. The authorised management shall inform the board of directors about Any significant delay in the implementation of the corrective measures as it shallshall be notified by the authorised management to the supervisory body which must authorise time extensions for the implementation of the correctivethese measures. The institution shall establish a similar procedure, approved by the board of directorssupervisory body, which appliesshall apply where the CSSFcompetent authority requests the institution to take (corrective) measures. In this case, any significant delay in the implementation of these measures is to be notified by the authorised management to the board of directors and the CSSF. The CSSF authorises time extensions as regards implementation.supervisory body and the competent authority.

CIRCULAR CSSF 20/759
40/109
45.58. The authorised management shall verify the implementation of and compliance
with internal policies and procedures. Any violationbreach of internal policies and procedures shall result in prompt and adapted corrective measures.
46.59. The authorised management shall verify the soundnessrobustness of the
central administration and internal governance arrangements on a regular basis. It shall adapt the internal policies and procedures in light of the internal and external, current and anticipated changes, and the lessons learnt from the past.
47.60. The authorised management shall inform the internal control functions of any
significant changesmajor change in the activities (cf. Sub-chapter 7.3) or organisation in order to enable them to identify and assess the risks which may arise therefrom.
61. The authorised management shall regularly or at least annually inform the
supervisory body, in a comprehensive manner and in writing, on a regular basis and at least once a year, the board of directors of the implementation, adequacy, effectiveness of and compliance with the internal governance arrangements, includingcomprising the state of compliance and(including the concerns raised through the internal alert arrangements) and of internal control as well as the ICAAP report13/ILAAP reports on the situation and the management of the risks and the, internal and regulatory own fundscapital and liquidity (reserves). This information shall relate in particular to the state of internal control. .
48.62. Once a year, the authorised management shall confirm compliance with this
Circular to the CSSFcompetent authority by way of a single written sentence followed by the signatures of all the members of the authorised management. Where due to non-compliance, the authorised management is not able to confirm full compliance with the Circular, the aforementioned statement takes the form of a reservation which outlines the non-compliancecompliant items by providing explanations on their raison d'être. For credit institutions, The information to be provided to the CSSF pursuant to the first paragraph shallmust be submitted to the CSSF together with the annual accounts to be published to the competent authority. 13 Cf. point 26 of Circular CSSF 07/301.

CIRCULAR CSSF 20/759
41/109
49.63. Where the authorised management becomes aware that the central
administration and internal governance arrangements no longer enable a sound and prudent business management of the activities or that the risks incurred risks are or will no longer be properly borne by the institution’s ability to manage these risks, by the internal and regulatory or internal own funds orcapital and liquidity reserves, it shall inform the board of directorssupervisory body and the CSSFcompetent authority by providing them, without delay, with any necessary information to assess the situation (cf. also point 22)..
50.64. Notwithstanding the overalljoint responsibility of the members of the
authorised management (cf. point 72),, it shall designate at least one of its members towho shall be in charge of the administrative, accounting and IT organisation and who shall assume responsibility for implementing the policy and rules that it has established in this context. S/heThis member shall be in charge, in particular, in charge of developingdrawing up the organisation chart and the task description (cf. point 68) which s/he submits, prior to their implementation, to the authorised management for approval. S/he then shall ensure their proper implementation.application. The member in question shall also be in charge of the provisionproduction and publication of accounting information intended for third parties and the transmission of periodic information to the CSSF.competent authority. Thus, s/he shall ensure that the form and content of this information comply with the legal rules and the rulesinstructions of the CSSFcompetent authority in this field. The authorised management shall also designate, among its members, the person(s) in charge of the internal control functions.
51.65. The institutions shall provideinform the CSSF with information on the persons
referred to in point 105.competent authority of the appointments and removals of the members of the authorised management shall report to the CSSF in writing and as soon as possible, on the appointments and revocations of these persons by giving , in accordance with the groundsprovisions of this Circular and the Prudential Procedure, stating moreover the reasons for revocationthe removal.
Section 4.2.2. Qualification of the authorised management
52.66. The members of the authorised management shall, both individually and
collectively, should have the necessary professional competences (expertise, understandingqualifications (knowledge, skills and experience), the professional standinggood repute and personal qualities to manage the institution and effectively determine the business direction effectively. The personal qualities shall be those which enable them to properlyeffectively perform their authorised manager’s mandate with the required commitment, availability, objectivity, critical thinking and independence of mind.

CIRCULAR CSSF 20/759
42/109
Section 4.2.3.Specific (risk, capital and liquidity) policies
16. The risk policy which implements the risk strategy of the board of directors shall
include:
 the institution’s risk tolerance determination;

• the definition of a complete and consistent internal limit system adapted to
  the organisational and operational structure, the strategies and policies of the institution and which limits risk-taking in accordance with the institution’s risk tolerance. This system shall include the risk acceptance policies which define which risks can be taken and the criteria and conditions applicable in this regard;  the measures aimed to promote a sound risk culture pursuant to point 11;  the measures to be implemented in order to ensure that risk-taking and management comply with the set policies and limits. These measures shall include in particular the existence of a risk control function and management arrangements for limit breaches, including corrective measures of breaches, a follow-up procedure of the corrective measures as well as an escalation and sanction procedure in the event of continuing breach;
• the definition of a risk management information system;
   the measures to be taken in case of risk materialisation (crisis management and business continuity arrangements). Pursuant to the provisions of Part III, Chapter 2, of this circular, the risk policy shall take due account of risk concentrations.

17. The capital and liquidity policy implementing the strategy of the board of directors
    in respect of regulatory and internal own funds and liquidity shall include, in particular:
     the definition of internal standards in relation to the management, scope and quality of the regulatory and internal own funds and liquidity reserves. These internal standards shall enable the institution to cover the risks incurred and to have reasonable security margins in case of significant financial losses or liquidity bottlenecks by reference, in particular, to Circular CSSF 11/506;  the implementation of sound and effective processes to plan, monitor, report and modify the amount, type and distribution of the regulatory and internal own funds and liquidity reserves, in particular in relation to own funds and internal capital requirements for risk coverage. These processes shall enable the authorised management and the operating staff to have sound, reliable and comprehensive management information as regards risks and their coverage;  the measures implemented in order to ensure a permanent adequacy of the regulatory and internal own funds and liquidity reserves;  the measures taken in order to effectively manage stress situations (regulatory or internal capital inadequacy or liquidity crisis);

• the designation of functions in charge of the management, functioning and
  improvement of the processes, limit systems, procedures and internal controls mentioned in the above indents.

CIRCULAR CSSF 20/759
43/109
Chapter 5. Administrative, accounting and IT organisation
Sub-chapter 5.1. Organisation chart and human resources
53.67. The institution shall have a sufficient number of human resources on -site with
appropriate individual and collective professional skills in order to take decisions under the policies laid down by the authorised management and based on delegated powers, and in order to implement the decisions taken in compliance with the existing procedures and regulations. These decision-making and implementation tasks, including the initiation, recording, follow-up and monitoring of the operations, and the internal control tasks are carried out on the basis of an organisation chart of the functions and task description adopted by the authorised management in writing. The organisation chart and task description areThe organisation chart and the task description shall be laid down in writing and made available to all relevant staff in an easily accessible manner.
54.68. The organisation chart shall show for structure of the different functions
(business, support and control) functions as well as forand of the different business units (services, departments or positions) their structure and must be presented in the organisation chart, along with the reporting and businessfunctional lines between themwith each other and with the authorised management and the board of directorssupervisory body.
55.69. The task description to be filled in by the operating staff shall explain the
function, powers and responsibility of each officer.
56.70. Without prejudice to point 72, The organisation chart and the task description
shall be established based on the principle of segregation of duties. Pursuant to this principle, the duties and responsibilities shall be assigned so as to avoid that they aremaking them incompatible for the same person. The goal pursued isshall be to avoid conflicts of interest and to prevent, through a peer reviewreciprocal control environment, a person from making mistakes and irregularities which would not be identified.

CIRCULAR CSSF 20/759
44/109
57.71. Pursuant to ArticlesArticle 7 (2) and 19 (2) of the LFS, the authorised
management shall be jointly liable for the management of the institution. The principle of segregation of duties cannotshall not derogate from this joint liability. Moreover, It shall remain compatible with the practice whereby the members of the authorised management share the day-to-day tasks relating to the close monitoring of the various activities. In this context, the CSSF recommends toThe institution must organise this segregationallocation so as to avoid conflicts of interest. Thus, it is advisable not to assign thethe same member of the authorised management cannot be in charge of or be responsible for functions relating to both the risk-taking and the independent control of these risks to the same member of the authorised management. Similarly,. Moreover, if in an institution limited in size and activity, and composed of only two authorised managers, there are conflicts of interest between these two managers following the assignment of the risk-taking function and the risk control function and if these conflicts of interest cannot be mitigated effectively, a third authorised manager who himself/herself serves as Chief Compliance Officer pursuant to point 141, cannot, at the same time, be in charge of the internal audit function. Where, due to the small size of the institution, several duties and responsibilities have to be assigned to the same person, this grouping shall be organised so that it does not prejudice the objective pursued by the segregation of dutiesappointed.
58.72. The institution has an ongoingshall have a continuing vocational training
programme which shall ensure that the staff members as well as the board of directors and the authorised management body remain qualified and includeunderstand the internal governance arrangements as well as their own roles and responsibilities in this regard.
59.73. Each employee shall annually staff member must take at least tentwo
consecutive calendar weeks of personal days off.leave annually. It must be assured that the employeeeach staff member is actually absent during that leave and that his/her substitute actually takes charge of the work of the absent person. Sub-chapter 5.2. AdministrativeProcedures and technical infrastructure
18. The institution shall have support functions, necessary and sufficient material and
technical resources to execute its activities. In this respect, the principles laid down in Sections 5.2.1 to 5.2.5 shall apply.
Section 5.2.1. Administrative infrastructure of the business
functions
19. Each business function shall be based on an administrative infrastructure which
guarantees the implementation of the business decisions taken and their proper execution, as well as compliance with the powers and procedures for the area in question.

CIRCULAR CSSF 20/759
45/109
Section 5.2.2.Financial and accounting function
20. The institution shall have a financial and accounting department whose mission is
to assume the accounting management of the institution. Some parts of the financial and accounting function within the institution may be decentralised, provided however that the central financial and accounting department centralises and controls all the entries made by the various departments and prepares the global accounts. The financial and accounting department shall ensure that other departments intervene in full compliance with the chart of accounts and the instructions relating thereto. The central department shall remain responsible for the preparation of the annual accounts and the preparation of the information to be provided to the CSSF.
21. The financial and accounting function shall operate based on written procedures
which aim to:

• identify and record all transactions undertaken by the institution;
• explain the changes in the accounting balances from one closing date to the
  next by keeping the movements which had an impact on the accounting items;
• prepare the accounts by applying all the valuation and accounting rules laid
  down by the relevant accounting laws and regulations;
• verify the reliability and relevance of the market prices and fair values used
  while preparing the accounts and reporting to the CSSF;
• issue periodic information including, first, the legal and regulatory reporting,
  and to provide the CSSF with it, and to ensure its reliability, particularly in terms of solvency, liquidity and large exposures;
• keep all accounting documents in accordance with the applicable legal
  provisions;
• draw up, where appropriate, accounts according to the accounting scheme
  applicable in the home country of the shareholder in order to prepare consolidated accounts;
• undertake the reconciliation of accounts and accounting entries;
• provide accurate, complete, relevant, understandable management
  information available without delay which shall enable the authorised management to closely monitor the developments in the financial situation of the institution and its compliance with budget data. This information shall be used as management control tool and will be more effective if it is based on analytical accounting;
• ensure the reliability of the financial reporting.

22. The institutions shall have a management control which is attached either to the
    financial and accounting department or, in the organisation chart, directly to the authorised management of the institution.
23. The tasks carried out within the financial and accounting department cannot be
    combined with other both business and administrative incompatible tasks.
24. In connection with opening third-party accounts (balance sheet and off-balance
    sheet), each institution shall define specific rules on the recording of accounts in its accounting system. Moreover, it shall also specify the conditions for opening, closing and operating these accounts. The institution shall avoid having in its accounting records a multitude of accounts with uncontrollable items that could lead to the execution of non-authorised or

CIRCULAR CSSF 20/759
46/109 fraudulent transactions; particular attention should be paid to dormant accounts. In this respect, the institution shall put in place appropriate verification and monitoring procedures. The opening and closing of internal accounts in the accounting records shall be validated by the financial and accounting department. In case of opening accounts, this validation shall take place before these accounts become operational. The institution shall set out rules concerning the use of such accounts and the powers relating to their opening and closing. The financial and accounting department shall ensure that the internal accounts are periodically subject to a justification procedure. documentation It is necessary to ensure that internal accounts and payable-through accounts which would no longer be suitable for a use defined by the set rules are not kept open.
60.1. Entries that have a retroactive effect can only be used for regulating purposes.
Entries that have a retroactive effect as well as entries regarding reversals are to be authorised and supervised both within the departments which are at the origin of these entries and within the financial and accounting department.
25. The entire accounting organisation and procedures shall be described in an
accounting procedure manual.
While defining and implementing these procedures, the institutions shall ensure compliance with the principle of integrity (point 12) in order to avoid in particular that the accounting system is used for fraudulent purposes.
Section 5.2.3. IT function
26. “Institutions shall organise their IT function so as to have control over it and to
ensure robustness, effectiveness, consistency and integrity pursuant to point 12. For those purposes, they shall comply with the requirements of Circular CSSF 20/750 on requirements regarding information and communication technology (ICT) and security risk management.”14
27. (…)15
28. Institutions which rely on third parties as regards the IT function shall comply, in
particular, with the conditions laid down in Section 7.4.2.
Section 5.2.4. Internal communication and whistleblower arrangements
29. The internal communication arrangements shall ensure that the strategies, policies
and procedures of the institution as well as the decisions and measures taken by the board of directors and authorised management, directly or by way of delegation, are communicated in a clear and comprehensive manner to all staff members of the institution by taking into account their information needs and 14 Amended by Circular CSSF 20/750. 15 Deleted by Circular CSSF 20/750.

CIRCULAR CSSF 20/759
47/109 responsibilities within the institution. The internal communication arrangements shall enable staff to have easy and constant access to this information.
30. The management information system shall ensure that the management
information is, in normal circumstances and in times of stress, transmitted in a clear and comprehensive manner and without delay to all members of the board of directors, the authorised management and staff of the institution by taking into account their information needs, responsibilities within the institution and the objective to ensure sound and prudent business management.
31. The institutions shall maintain internal whistleblower arrangements which enable
the entire staff of the institution to draw attention to serious and legitimate concerns about internal governance. These arrangements shall respect the confidentiality of the persons who raise such concerns and provide for the possibility to raise these concerns outside the established reporting lines as well as with the board of directors. The warnings given in good faith shall not result in any liability of any sort for the persons who issued them.
Section 5.2.5. Crisis management arrangements
61.1. The crisis management arrangements shall be based on resources (human
resources, administrative and technical infrastructure and documentation) which shall be easily accessible and available in emergencies.
32. The crisis management arrangements shall ensure that, in times of stress, the
credit institutions provide the public with the information referred to in the EBA guidelines published on 26 April 2010 ("Principles for disclosures in times of stress (Lessons learnt from the financial crisis)"). This point shall not apply to investment firms.
33. The crisis management arrangements shall be tested and updated in a regular
basis in order to ensure and maintain its effectiveness.
Sub-chapter 5.3. Internal documentation
62.74. The institutions shall document in writing all central administration and internal
governance arrangements in writing.
This documentation shall relate to the strategies, guiding principles, policies and procedures relating to central administration and internal governance. It shall include in particular a clear and, comprehensive procedure manual which is easily , detailed and accessible tomanual of procedures, whose procedures shall be known by the institution’sentire staff concerned and which is updated on an ongoing basis.
63.75. The description of the procedures forto ensure the proper execution of
activities (transactions) concernsshall concern the following points:

• the successive and logical stages of the transaction processing, from initiation
  to documentation storage; (workflow); and
• flow of the documents used;
• periodic reviewscontrols to be carried out, as well as the means to ensure that
  they have been carried out.

CIRCULAR CSSF 20/759
48/109
As the purpose is to ensure that the transactions are properly executed, the procedures’ content should be clear, updated, comprehensive and made known to all relevant employees.
64.76. The institutions shall document, in writing, all their transactions, i.e. any
process which includes a commitment on the part of the institution as well as the decisions relating thereto. The documentation shallmust be updated and kept by the institution in accordance with the law. It should be organised in such a way that it can be easily accessed by any authorised third party. By way of illustrationFor example, as regards credit transactions, full documentation of the decisions to grant, change or terminate credits shall be included in the institution’s files in Luxembourg, as well as the agreements and any documents relating to the follow-up of the debt service and the evolution of the debtor’s financial situation.
65.77. The files, working papers and control reports of the internal control functions,
experts and subcontractors referred to in Sub-chapter 6.2 as well as the long - form reports drawn up by the réviseursréviseur d'entreprises agréé shall be kept during five years in the Luxembourg institution during at least five years, without prejudice to other applicable laws, in order to enable the institution to trackretrace the controls carried out, the identified problems, shortcomings or irregularities identified as well as the recommendations and conclusions. The CSSFcompetent authority as well as the réviseur d’entreprises agréé shallmust always be able to access these documents.
66.78. All transaction orders initiated by the institution and all correspondence with
the customers or their proxies shall be issued by the institution; all correspondence shall be addressed thereto. In the case where the institution has a branch abroad, the latter is the contact point for its own customers. Sub-chapter 5.3. Administrative and technical infrastructure
79. The institution shall have the necessary and sufficient support functions, material
and technical resources to execute its activities.
Section 5.3.1. Administrative infrastructure of the business
functions
80. Each business function must be based on an administrative infrastructure which
guarantees the implementation of the business decisions and their proper execution, as well as compliance with the powers and procedures for the area in question.

CIRCULAR CSSF 20/759
49/109
Section 5.3.2. Financial and accounting function
81. The institution shall have a financial and accounting department whose mission is
to assume the accounting and financial management of the institution. Some parts of the financial and accounting function within the institution may be decentralised, provided however that the central financial and accounting department centralises and controls all the entries made by the various departments and prepares the global accounts. The financial and accounting department must ensure that other departments intervene in full compliance with the chart of accounts and the instructions relating thereto. The central department shall remain responsible for the preparation of the annual accounts and the preparation of the information to be provided to the competent authority. In the significant institutions, the CFO shall be selected, appointed and removed from office according to a written internal procedure and with the prior approval of the supervisory body.
82. The financial and accounting function shall operate based on written procedures
which shall provide for:

• the identification and recording of all transactions undertaken by the
  institution;
• the explanation of the changes in the accounting balances from one closing
  date to the next by keeping the movements which had an impact on the accounting items;
• the preparation of the accounts by applying the accounting and valuation rules
  laid down in the relevant accounting laws and regulations;
• the verification of the reliability and relevance of the market prices and fair
  values used while preparing the accounts and of the reporting to the competent authority;
• the production and transmission of periodic information, including, primarily,
  the legal and regulatory reporting, to the competent authority, ensuring the information is reliable, particularly in terms of solvency, liquidity, non￾performing loan exposures, restructured credits and large exposures;
• the record-keeping of all accounting documents in accordance with the
  applicable legal provisions;
• the drawing-up of, where appropriate, accounts according to the accounting
  scheme applicable in the home country of the shareholder in order to prepare consolidated accounts;
• the completion of reconciliation of accounts and accounting entries;
• the production of accurate, complete, relevant, understandable management
  information available without delay which shall enable the authorised management to take informed decisions and to closely monitor the developments in the financial situation of the institution and its compliance with budget data. This information shall be used as a management control tool and will be more effective if it is based on analytical accounting;
• the guarantee that the financial reporting is reliable.

CIRCULAR CSSF 20/759
50/109
83. The institutions shall have a management control which is attached either to the
financial and accounting department or, in the organisation chart, directly to the authorised management of the institution.
84. The tasks carried out within the financial and accounting department cannot be
combined with other incompatible tasks, both business and administrative tasks.
85. In connection with the opening of third-party accounts (balance sheet and off￾balance sheet), each institution shall define specific rules on the recording of
accounts in its accounting system. Moreover, it shall specify the conditions for opening, closing and operating these accounts. The institution must avoid having, in its accounting system, a multitude of accounts with uncontrollable items that could lead to the execution of unauthorised or fraudulent transactions; particular attention should be paid to dormant accounts. In this respect, the institution shall put in place appropriate verification and monitoring procedures.
86. The opening and closing of internal accounts in the accounting system must be
validated by the financial and accounting department. In case of opening of accounts, this validation must take place before these accounts become operational. The institution shall set out rules concerning the use of such accounts and the powers relating to their opening and closing. The financial and accounting department shall ensure that the internal accounts are periodically subject to a procedure which justifies their need. It is necessary to ensure that internal accounts and payable-through accounts are not kept open where they would no longer be in line with the use defined by the set rules.
87. Entries that have a retroactive effect can only be used for regulating purposes.
Entries that have a retroactive effect as well as entries regarding reversals are to be authorised and supervised by both the departments which are at the origin of these entries and the financial and accounting department.
88. The entire accounting organisation and procedures shall be described in a manual
of accounting procedures.
While defining and implementing these procedures, the institutions shall ensure compliance with the principle of integrity in order to avoid, in particular, that the accounting system is used for fraudulent purposes.
Section 5.3.3. IT function
89. The institutions shall organise their IT function so as to have control over it and
to ensure robustness, effectiveness, consistency and integrity pursuant to
Chapter 3 of this part. For those purposes, they shall comply with the
requirements of Circular CSSF 20/750 on requirements regarding information and communication technology (ICT) and security risk management.

CIRCULAR CSSF 20/759
51/109
90. The institutions, which rely on third parties as regards the IT function, shall
comply, in particular, with the conditions laid down in Sub-chapter 7.4 of this
part.
Section 5.3.4. Communication and internal and external alert
arrangements
91. The internal communication arrangements shall ensure that the strategies,
policies and procedures of the institution as well as the decisions and measures taken by the management body, directly or by way of delegation, are communicated in a clear and comprehensive manner to all staff members of the institution, considering their information needs and their responsibilities within the institution. The internal communication arrangements shall enable staff to have easy and constant access to this information.
92. The management information system shall ensure that all management
information is, in normal circumstances and in times of stress, transmitted, in a clear and comprehensive manner, and without delay, to all members of the management body and staff of the institution, considering their information needs, their responsibilities within the institution and the objective to ensure a sound and prudent business management.
93. The institutions shall maintain internal alert arrangements (whistleblowing) which
shall enable the entire staff of the institution to draw attention to legitimate concerns about internal governance or internal and regulatory requirements in general. These arrangements shall respect the confidentiality and identity of the persons who raise such concerns and provide for the possibility to raise these concerns outside the established reporting lines as well as within the supervisory body. The alerts issued in good faith shall not result in any liability or adverse impact of any sort for the persons who issued them.
94. The CSSF has also made a tool and a procedure to report incidents directly to it
available on its website.
(https://whistleblowing.apps.cssf.lu/index.html?language=fr).
Section 5.3.5. Crisis management arrangements
95. The crisis management arrangements shall be based on resources (human
resources, administrative and technical infrastructure and documentation) which shall be easily accessible and available in emergencies.
96. The crisis management arrangements shall ensure that, in times of stress, the
credit institutions provide the public with the information referred to in the CEBS guidelines published on 26 April 2010 (“Principles for disclosures in times of stress (Lessons learnt from the financial crisis)”).
97. The crisis management arrangements shall include a recovery plan which shall
comply with the requirements of Chapter 2 of Part IV of the LFS.

CIRCULAR CSSF 20/759
52/109
98. The crisis management arrangements shall be tested and updated, on a regular
basis, in order to ensure and maintain its effectiveness.
Chapter 6. Internal control
67.99. The internal control isshall be a control system composed of rules and
procedures which aim to ensure that the objectives set by the institution are reached, the resources are economically and effectively used, the risks are controlled and the assets and liabilities are protected, the financial and management information is accurate, comprehensive, relevant, understandable and available without delay, the laws and regulations as well as the internal policies and procedures are complied with and that the applicationsrequests and requirements of the CSSFcompetent authority are met.16.
34. A suitableThe internal control environment requiresarrangements of an
institution must be adapted to its organisation and to the implementation of the following controls:

• day-to-day controls carried out by the operating staff as provided for in
  Section 6.1.1;
• ongoing critical controls carried out by the staff in charge of the
  administrative processing of transactions as specified in Section 6.1.2; 68.100.controls carried out by the members of the authorised management on the nature, scale and complexity of its activities or functions which fall under their direct responsibility as specified in Section 6.1.3;and relating risks and comply with the principles of the “three lines of defence” model. The first line of defence consists of the business units which take or are exposed to risks, which are responsible for their management and which monitor compliance with the policies, procedures and limits imposed on them, on a permanent basis. The second line consists of support functions, such as the financial and accounting function, and especially the compliance and the risk control functions which control risks on an independent basis and support the business units in complying with the applicable policies and procedures. 16 The internal control mechanisms also provide for mechanisms aimed to prevent execution errors and frauds and to enable their early detection. Pursuant to the principle of proportionality, the institutions whose asset management activity and service activities related in particular to the administration of UCIs are significant, shall define adequate internal control mechanisms for these activities, in particularespecially in the field of discretionary management, processing of held mails, safekeeping of securities of third parties (depositary bank), bookkeeping and net asset value calculation of investment funds.

CIRCULAR CSSF 20/759
53/109
The third line consists of the internal audit function which makes an independent, objective and critical assessment of the two first lines of defence and of the internal governance arrangements as a whole.

• The three lines of defence are complementary, each line of defence assuming
  its control responsibilities regardless of the other lines. controls carried out by the internal control functions as defined in Sub-chapter 6.2. The implementation of sound internal control arrangements shall go hand in hand with a relevant segregation of functions, duties and responsibilities, the implementation of a management of information access and the physical separation of certain functions and departments in order to secure data and transactions. Sub-chapter 6.1. Operational controls A sound internal control environment shall include the following types of controls:
  Section 6.1.1. Day-to-day controls carried out by the operating
  staff
  69.101.The internal control procedures shall provide that the operating staff control, on a day-to-day basis, the transactions they carry out in order to identify as soon as possible the errors and omissions that occurred during the processing of the current transactions. Examples of these controls are: the verification of the cash account balance, the verification of his/her positions by the trader, the follow-up of outstanding issues by each employeestaff member.
  Section 6.1.2. Ongoing critical controls
  70.102.This category of controls shall include inter alia:
• hierarchical control;
• validation (for example dual signature, codes of access to specific features)
  regardingassociated with the monitoring of compliance with the authorisation procedure and procedure for delegating powers adopted by the authorised management (in particular as regards creditcredits);
• peer reviews;
• establishmentreciprocal controls;
• regular statement of the existence ofand the value of the assets and liabilities,
  on a regular basis, in particular by means of verification of the inventories;
• reconciliation and confirmation of accounts;
• monitoring of the accuracy and completeness of the data transmitted by the
  persons in chargeheads of the business and operational functions with a view to an administrative follow-up of transactions;

CIRCULAR CSSF 20/759
54/109

• monitoring of the compliance with the internal limits imposed by the
  authorised management (in particular as regards market and credit activities);
• normal nature of the concluded transactions concluded, in particular, in
  respect of their price, their scale, the possible guarantees to be received or provided, the profits generated and losses incurred, the amount of possible brokerage fees. The proper functioning of ongoing critical controls shall beis guaranteed only if the principle of segregation of duties is complied with.
  Section 6.1.3. Controls carried out by the members of the
  authorised management on the activities or functions which fall under their direct responsibility 71.103.The members of the authorised management shall personally oversee the activities and functions, which fall under their direct responsibility, on a regular basis. These controls areshall be carried out based on the data received in this respect from the business, support and control functions or the various business units of the institution. The areas requiring particular attention by these persons are inter alia:
• the risks associated with the activities and functions for which they are directly
  responsible;
• the compliance with the laws and standards applicable to the institution, with
  a particular emphasis on prudential standards on solvency, liquidity, non￾performing loan exposures, restructured credits and regulations on large exposures;
• the compliance with the policies and procedures established by the authorised
  management pursuant to point 18;
• the compliance with established budgets: review of actual achievements and
  gaps;
• the compliance with limits (in particular based on exception reports),);
• the characteristics of the transactions, in particular their price, their individual
  profitability;
• evolutionthe development of the overall profitability of an activity.
  The members of the authorised management shall inform their colleagues of the authorised management, on a regular basis, about the exercise of their control function, on a regular basis.

CIRCULAR CSSF 20/759
55/109
Sub-chapter 6.2. Internal control functions 72.104.The policies implemented with respect to risk control, compliance and internal audit pursuant to point 18 shall provide for three distinct internal control functions: on the one hand, the risk control function and the compliance function which are part of the second line of defence and on the other hand, the internal audit function which is part of the third line of defence (cf. point 9).. Moreover, these policies whichshall describe the fields of intervention directly related to each internal control function shall, clearly define the responsibilities for the common fields of intervention andin order to avoid redundancies and conflicts of powers, and define the objectives as well as the independence, authority, objectivity and permanence of the internal control functions.
35. Each internal control function shall be under the responsibility of a separate head
of the function who shall be appointed and revoked in accordance with an internal written procedure. Where, in application of the principle of proportionality, a single member of the authorised management performs compliance and risk control functions, this person shall combine, as an exception to the foregoing, the positions of head of the compliance function and risk control function (cf. also point 72). The appointments and revocations of the persons in charge of the internal control functions shall be approved by the board of directors and reported in writing to the CSSF in compliance with the prudential authorisation procedure of key function holders as published by the CSSF on its website. The persons in charge of the three internal control functions shall be responsible vis-à-vis the authorised management and ultimately vis-à-vis the board of directors for the performance of their mandate. In this respect, these persons shall be able to contact and inform, directly and on their own initiative, the chairman of the board of directors or, where appropriate, the members of the audit committee. The persons in charge of the internal control functions are referred to as Chief Risk Officer for the risk control function, Chief Compliance Officer for the compliance function and Chief Internal Auditor for the internal audit function.
Section 6.2.1. General responsibilities of the internal control
functions
73.105.The main purpose of the internal control functions isshall be to verify compliance with all the internal policies and procedures which fall within the area for which they are responsible, to regularly assess their suitability as regardsadequacy with respect to the organisational and operational structure, the strategies, the activities and the risks of the institution as well as as regardswith respect to the applicable legal and regulatory requirements, and to report directly to the authorised management as well as the board of directors pursuant to point 116.to the supervisory body and, where appropriate, to the specialised committees. They shall provide the authorised management and the board of directorssupervisory body, and, where appropriate, the specialised committees with the opinions and advice they deem necessary in order to improve the central administration and internal governance arrangements of the institution. useful or which are requested by these bodies or committees.

CIRCULAR CSSF 20/759
56/109
74.106.The internal control functions shall respond as soon as possible to the requests for advice and opinions from the authorised management and the board of directors or, where appropriate, the specialised committees. If Where they consider that the effective, sound or prudent business management is challengedcompromised, the persons responsible forheads of the internal control functions, shall promptly inform, on their own initiative, the authorised management and the board of directorssupervisory body or, where appropriate, the specialised committees in accordance with the applicable internal procedures. 75.107.Where the institution is the group head, its internal control functions shall supervise and control the internal control functions of the different entities of the group. The internal control functions of the institution shall ensure that the problems, shortcomings, irregularities and risks identified throughout the whole group are reported to the local management and supervisory bodies and boards of directors as well as to the authorised management and board of directors ofto the institution pursuant to point 116supervisory body of the group head.
Section 6.2.2. Characteristics of the internal control functions
76.108.The internal control functions shall be permanent and independent functions each with sufficient authority. The persons in chargeheads of these functions shall have direct access right to the board of directorssupervisory body or its chairmanchairperson or, where appropriate, the chairmen ofto the specialised committees which are part of it, to the réviseur d’entreprises agréé of the institution as well as to the CSSFcompetent authority. The independence of the internal control functions is incompatible with the situation in whichwhere:

• the staff of the internal control functions are in charge of tasks they are called
  upon to control or tasks which are not related to their respective control area;  the internal control functions are, from an organisational point of view, included in the business units they control or report hierarchically to them and
• the remuneration of the staff of the internal control functions is linked to the
  performance of the activities they control or is determined according to other criteria which compromise the objectivity of the work carried out by the internal control functions;
• The authority,the internal control functions are, from an organisational point
  of view, included in the business units they control or report hierarchically to them;
• the heads of the internal control functions are subordinated to the persons in
  charge of, or responsible for, the activities which the internal control functions shallare called upon to control.

CIRCULAR CSSF 20/759
57/109
77.109.The authority which the internal control functions must have, requires that these functions should be able to exercise their responsibilities, on their own initiative, express themselves freely and access all external and internal data and information (in all the institution’s business units of the institution they control) deemedthey deem necessary to fulfil their missions. 78.110.The staff of The internal control functions or third parties (cf. point 118) acting on behalf of these functions shallmust be objective inwhen carrying out their work. In order to ensure objectivity, the persons in chargeheads of the internal control functions shall exercisebe independent thinking and judgementminded: they shouldmust not make their own judgement conditional upon that of other persons including, in particular, those controlled and shall ensure to avoid conflicts of interest. Objectivity also requires that conflicts of interest are avoided. 79.111.In order to ensure the effectiveness The members of the internal control functions, its members shall must, individually and collectively, possess high professional knowledge, skills and experience in the field of banking and financial activities and , especially in their field of responsibility with respect to applicable standards. This competence shall be assessed by taking into account both the nature of In accordance with the principle of proportionality, the required skill level shall increase with the missionsorganisation of the associatesinstitution and the nature, scale and complexity and diversity of the activities carried out by the institution in order to enable thorough coverage of the activities and risks. ThisThe individual competence shallskill must include the ability to make critical judgements and to be heard by the authorised managers of the institution. The internal control functions shall update the acquired knowledge and organise ongoing training which is adapted to each of the associates. In addition to their high professional experience, the persons in chargeheads of the internal control functions, who take on such a position for the first time, shall have the necessary theoretical knowledge that enables them to effectively perform this function. 80.112.In order to guarantee the execution of the tasks assigned to them, the internal control functions shall have the necessary and sufficient human resources, infrastructure and budgets, pursuant tobudget, in keeping with the principle of proportionality (point 4).. The budget shallmust be sufficiently flexible to reflect an adaptation of the missions of the internal control functions in response to changes ofin the institution’s risk profile. These provisions are compatible with the outsourcing oforganisation, the activities and risks or upon the internal audit function and the use of internal control functions to external experts pursuant to points 117 and 118. occurrence of specific events.

CIRCULAR CSSF 20/759
58/109
81.113.The scope of intervention of the internal control frameworkfunctions shall cover the whole institution within the limits of itstheir respective competences. It shall include the non-standard and potentially non-transparent activities referred to in Section 7.1.1. 82.114.Each institution shall take the necessary measures to ensure that the members of the internal control functions perform their functions with integrity and discretion.
Section 6.2.3. Execution of the internal control
functions’functions' work
83.115.The internal control functions shall document the work carried out in accordance with the assigned responsibilities, in particular in order to allow trackingretracing the interventions as well as the conclusions reached. 84.116.The internal control functions shall report, in writing, on a regular basis and, if necessary, on an ad hoc basis, to the authorised management and the supervisory body or, where appropriate, to the specialised committees. These reports shall concern the follow-up ofto the recommendations, problems, shortcomings and irregularities identifiedfound in the past as well as the new identified problems, shortcomings and irregularities identified. Each report shall specify the risks related thereto as well as their seriousness (measurement ofseverity (measuring the impact) and shall propose corrective measures, as well as in general the position of the persons concerned. Each internal control function shall prepare, at least once a year, a summary report on its activities and its operation. covering all the activities assigned to it. As regards the activities, each summary report shall include a statement of the function’s activities carried out since the last report, the main recommendations to the authorised management of, the main recommendations on (existing or emerging) problems, significantthe major shortcomings and irregularities found since the last report, and the measures taken in this respect as well as the statement of the significant problems, shortcomings and irregularities identified in the last report but which have not yet been the subject ofto appropriate corrective measures. The report shall also provide information on the activities linked to the other responsibilities of the control function, including those defined in Sections 6.2.5, 6.2.6 and 6.2.7. Finally, the report shall indicate the state of their control area as a whole. As far as operation is concerned, the report shall mention, in particular, comment on the adequacy of the internal human and technical resources, and the nature and level of reliance on external experts pursuant to point 118human and technical resources as well as on any problems which may have occurred in this context. This report shall be submitted for approval to the board of directors and, where appropriate,supervisory body or the competent specialised committees for approvalto ensure its follow-up and that the supervisory body is informed; it isshall be submitted for information to the authorised management for information.

CIRCULAR CSSF 20/759
59/109
Pursuant to point 107, In case of serious problems, shortcomings and irregularities, the persons in chargeheads of the internal control functions shall immediately inform the authorised management, the chairmanchairperson of the board of directorssupervisory body and, where appropriate, the chairpersons of the specialised committees thereof. In such cases, the CSSF recommends that the persons in chargeheads of the internal control functions aremay request to be heard by the specialised committees in a private meeting. The internal control functions shall verify the effective follow-up of the recommendations relating to the problems, shortcomings and irregularities identified in accordance with the procedure laid down in the third paragraph of point 57. They shall report, on a regular basis, on this subject to the authorised management on a regular basis.
Section 6.2.4. Organisation of the internal control functions
117.Each internal control function shall be under the responsibility of a separate head of the function who shall be selected, appointed and dismissed in accordance with a written internal procedure. The appointments and removals of the heads of the internal control functions shall be approved beforehand by the supervisory body and reported in writing to the competent authority in accordance with the Prudential Procedure as published by the CSSF on its website. 118.The heads of the three internal control functions shall be responsible vis-à-vis the authorised management and, ultimately, vis-à-vis the supervisory body for the performance of their mandate. In this respect, these heads must be able to contact, directly and on their own initiative, the chairperson of the supervisory body or, where appropriate, the competent specialised committee. The heads of the three internal control functions shall be referred to as Chief Risk Officer for the risk control function, Chief Compliance Officer for the compliance function and as Chief Internal Auditor for the internal audit function. 119.Outsourcing of the compliance function and risk control function is not authorised. The operational tasks of the internal audit function canmay be outsourced by smallersmall institutions whose risk profile is with a low and non-complex, subject to the conditions laid down in point 118 and Sub-section 6.2.7.4. This kind of risk profile. Such outsourcing is not, in principle, not acceptable for institutions with agencies, branches or subsidiaries. The supervisory body of the institution shall remain ultimately responsible for outsourcing the internal audit operational tasks. External providers entrusted with the outsourced internal audit operational tasks shall depend on and report directly to the member of the authorised management in charge of internal audit. They shall have direct access to the supervisory body or, where appropriate, the chairperson of the audit committee.

CIRCULAR CSSF 20/759
60/109
85.120.The provisions of the preceding point 112 doshall not exclude the possibility for the internal control functions to use the expertise and human or technical resourcesmeans of third parties (belonging or not to the same group as the institution) for certain aspects. This use isshall be governed by an internal procedure which shallmust allow, in particular, enable the authorised management and the board of directorssupervisory body to assess the dependencies and risks for the institution arising from which a significant use of these third parties.external resources might pose for the institution. The authorised management shall select these third parties ("experts") on the basis of external resources based on an analysis of suitabilitycorrelation between the institution’s needs and services, the level of objectivity and independence, and the specific services and competencesskills offered by these third parties. The selected expert shall which must be independent from the institution’s réviseur d'entreprises agréé(statutory auditor) and the cabinet de révision agréé as well as(approved audit firm) and from the group to which these personsparties belong. to. The supervisory body shall approve the external resources selected by the authorised management. 86.121.TheAny use of an external expert shallresources must be based on a written mandate. The expertThese third parties shall carry out his/hertheir work in complianceaccordance with the regulatory and internal provisions (including the internal audit and compliance charters) which are applicable to the internal control function and the area of control in question. The expert shall They must be placed under the dependenceauthority of the person in chargehead of the internal control function covering the controlled area. This person superviseshead shall supervise the experts' work. of these third parties. 122.Pursuant to point 3, the internal control functions of an institution shall Where the institution can demonstrate, in accordance with the principle of proportionality, that there is no justification for setting up a distinct risk control function and a compliance function or for appointing two heads of these functions full time, the institution may set up a combined function or a position with combined responsibility, subject to prior approval of the competent authority. However, the application of the principle of proportionality may not result in the accumulation of other responsibilities for a person already combining the responsibility for the risk control function and the compliance function. The institution wishing to create a combined risk control and compliance function, allocate the responsibilities for these two functions to one single person or combine one of these responsibilities with other tasks must submit a request to the competent authority which shall include:

• a description of the combined function or the position with combined
  responsibility;

CIRCULAR CSSF 20/759
61/109

• the analysis of its conclusions justifying the creation of a combined function or
  a position with combined responsibility given the institution’s organisation, the nature, scale and complexity of its activities and risks; and
• the decision of the supervisory body approving the analysis and its
  conclusions.
  123.The institution wishing, in accordance with the principle of proportionality, to outsource the operational tasks of the internal audit function must submit a prior request to the competent authority which shall include:
• the description of the outsourcing, the provider chosen, the contracted
  external resources and the name of the head of the external team fulfilling the internal audit duties; as well as
• the person in charge of this outsourcing within the institution;
• the analysis and its conclusions justifying the outsourcing of the operational
  tasks of the internal audit function; and
• the decision of the supervisory body approving the analysis and its conclusions
  and, where appropriate, the opinion of the audit committee.
  These external providers may be the internal auditors of the group to which the institution belongs. The supervisory body shall ensure that these resources are sufficient and that they have the necessary experience and skills to cover all the business areas of the institution and the associated risks as well as the required management to ensure high quality audit. 87.124.The internal control functions of an institution must also be put in placeset up at thegroup level of, in the group, legal entities and in the branches composing itthe group. These constituent parts shallmust each have their own internal control functions, taking into accountconsidering the principle of proportionality as indicated in point 4. . 88.125.Within the branches of the institution, the internal control functions shall depend, from a hierarchical and functional point of view, on the control functions of the group head to which legal entities to which they belong and to which they report. As regardsWithin the subsidiaries, the internal control functions shall depend, from a functional point of view, on the control functions of the group head to which they belong.. The heads of the control functions in the group head must give their consent for any recruitment, dismissal and significant decisions regarding the remuneration of the heads of the control functions in branches and/or subsidiaries. The reports drawn up in accordance with the provisions of this Circular shall be submitted bothnot only to the local management and supervisory bodiesbody but also, in summarised form, to the internal control functions of the parent institutiongroup head which analysesshall analyse them and reportsreport the points to be noted in accordance with point 116.

CIRCULAR CSSF 20/759
62/109
Pursuant to the principle of proportionality, the institution which created three permanent and independent internal control functions may decide not to set up individual internal control functions in the legal entities or branches of the group which are limited in size and activities. In this case, the institution shall ensure that its internal control functions carry out regular and frequent controls, including annual on-site inspections of these entities. Where the institution is not athe parent undertaking within the meaning of point 3, the institution, it shall seek to obtain a summary of the reports of the internal control functions of the legal entities in question and have them analysed by its own internal control functions. They shall report the major recommendations, main problems, shortcomings and irregularities identified, agreed corrective measures and the effective follow-up of these measures in accordance with point 116. In accordance with point 4, the institution can relinquish the option of putting in place own internal control functions within legal entities or branches of the group. In this case, the institution shall ensure that its internal control functions carry out controls, including on-site inspections on these entities on a regular basis. 89.126.The principles of this Circular doshall not exclude that, for Luxembourg institutions which are, whether or not branchthey are branches or subsidiarysubsidiaries of Luxembourg financial professionals having internal control functions at the level of these professionals, the internal control functions are functionally linked to those of the professional in question.
Section 6.2.5. Risk control function
Sub-section 6.2.5.1.
Comments:

1. Reference is made to points 9, 17, 21, 33, 45 to 51, 57, 104 to 121,
   147Scope and 179 also relating to specific responsibilities of the risk control function.
2. The term "risk control function" is borrowed from the "EBA Guidelines on
   Internal Governance (GL 44)". This terminology is not aimed to reduce this function to a mere ex post risk limit "control" as referred to in the second sentence of point 124. The The risk control function shall more broadly take on risk analysis and follow-up tasks in accordance with point 123.

CIRCULAR CSSF 20/759
63/109
3. The risk control function shall submit a copy of its summary annual report to
the CSSF (points 116 and 210). Pursuant to point 116, this report includes the current state of risks and thus possibly duplicates the ICAAP report (point 61) drawn up by the authorised management for the board of directors. The risk of duplication exists, especially considering that, in general, the risk control function is associated with the drafting of the ICAAP report. For the sake of avoiding any undue duplication between the ICAAP report and summary report of the risk control function, it is sufficient, for the risk assessment in line with the ICAAP, that the risk control function makes reference to the ICAAP report in its summary report, insofar as it shares the risk descriptions and analyses included therein. Where it does so, the risk control function shall nevertheless issue, in its summary report, its own conclusions drawn from the aforementioned descriptions and analyses. The summary report shall then deal exclusively with the other areas referred to in point 116. However, when the risk control function does not share the aforementioned descriptions and analyses, it shall explicitly mention it in its summary report in which it includes its own assessments.
4. Another possible duplication field exists in respect of the segregation of duties
between the compliance function in charge of the risk compliance (point 131) and the risk control function in charge of "all risks" (point 123). The institutions shall ensure that these tasks are internally assigned in an effective and efficient way.
36. The risk control function is entrusted to a dedicated department composed of
one or several persons.
90.127.The risk control function is in charge of the anticipation, identification, measurement, monitoring, control and reporting of all business units anticipate, identify, assess, measure, monitor, manage and duly report all the risks to which the institution is or may be exposed. Thus, it shall It shall carry out its tasks continuously and without delay. It shall be a central element of the internal governance and organisation of the institution dedicated to limiting risks. It shall inform and advise the supervisory body and assist the authorised management, propose improvements in the risk management in limiting framework and actively participate in the decision-making processes, ensuring that appropriate attention is given to risk considerations. The ultimate responsibility for the decisions regarding risks shall remain, however, with the business units which take the risks. It shall ensure that the risks are properly managed and, finally, with the authorised management and supervisory body. Thus, the term “risk control function” shall not reduce this function to a simple ex-post “control” of the limits. These tasks are to be performed on an ongoing basis and without delay.
91.128. The fieldscope of intervention of the risk control function shall also
includecover the whole institution, including the risks associated with the complexity of the institution’s legal structure of the institution and the relationships of the institution with related parties.

CIRCULAR CSSF 20/759
64/109
Sub-section 6.2.5.1. Specific responsibilities and scope of the risk control function 92.129.The risk control function shall ensure that the regulatory and internal risk objectives and limits are robust and compatible with the regulatory framework, the internal strategies, and policies, the activities, and the organisational and operational structure of the institution. It shall monitor compliance with these objectives and limits and the proper application, propose appropriate remedial measures in case of breach, ensure compliance with the escalation procedure provided for in case of significant breach and shall ensure that the breaches are remedied as soon as possible. 93.130.The head of the risk control function shall ensure that the authorised management and the board of directorssupervisory body receive aan independent, comprehensive, objective and relevant overview of the risks to which the institution is or may be exposed17. This overview shall include, in particular, an assessment of the correlation between these risks and the own funds and liquidity (reserves) and the institution’sinstitution's ability to manage these risks in normal times and in times of stress. This assessment shall be based, in particular, on the stress test programme in accordance with Circular CSSF 11/506. It shall also include an assessment as regardsof the correlation between the risks incurred and the strategies laid downrisk appetite defined by the board of directorssupervisory body. The frequency of this communication shall be adapted to the institution’s characteristics and needs, in particular regarding the risk tolerance. view of its business model, the risks incurred and its organisation. The summary annual report of the risk control function, a copy of which shall be provided to the competent authority, possibly duplicates elements of the ICAAP and ILAAP report. The risk control function may therefore refer to the ICAAP and ILAAP report in its summary report, provided that it agrees with the descriptions and analyses of risks contained therein. In case of disagreement, the risk control function shall provide its own assessments and conclusions in its summary report. 94.131.The risk control function shall ensure that the terminology, methodsmethodology and technical resources used for the risk anticipation, identification, measurement, reporting, management and monitoringcontrol are consistent and effective. 95.132.The risk control function shall ensure that the qualitative and quantitative risk assessment is based on conservative assumptions and on a range of relevant scenarios, in particular regarding dependencies between risks. The Quantitative assessments are toshall be validated by qualitative (assessment methods and expert) judgements based on structured and documented analyses. 17 In line with “Principles for effective risk data aggregation and risk reporting” (BCBS 239) of January 2013.

CIRCULAR CSSF 20/759
65/109
The risk control function shall inform the authorised management and supervisory body of the assumptions, limits and possible deficiencies of the applied analyses and models and must regularly compare its ex-ante possible risk assessments of the possible risks measured with the ex-post materialised risks on a regular basis in order to improve the adequacyaccuracy of its assessment methods (back￾testing). 96.133.The risk control function shall strive to anticipate and recognise the risks arising in a changing environment. In this respect, it shall also monitor the implementation of the changes in the activities (“New Product Approval Process”) in order to guarantee that the associated risks relating thereto remain controlled. under control. Sub-section 6.2.5.2. Organisation of the risk control function
37. Where, pursuant to the principle of proportionality (point 4), the creation of a
full-time position of Chief Risk Officer is not necessary, a person may be entrusted with this position on a part-time basis. It is appropriate to ensure that the other tasks performed by this employee remain compatible with the responsibilities incumbent upon him/her pursuant to the provisions of this circular.
134. The institution which is not willing to create a full-time position of The
institutions shall create a permanent and independent risk control function, considering the principle of proportionality and the criteria governing its application as well as the considerations regarding the organisation of the internal control functions laid down in Section 6.2.4. Where the organisation of an institution, the scale and complexity of its activities or even the incurred risks justify setting up satellite risk control or compliance functions within the business units, the institution must nevertheless set up a central risk control function to which the different satellite functions shall report. This central function shall manage the consolidated overview of risks and ensure compliance with the defined risk strategies and appetite. 135.Within the significant institutions, the head of the risk control function shall be a member of the authorised management who is independent and individually responsible for the risk control function. Where the principle of proportionality does not require such an appointment, another member of the senior management of the institution may assume that function, provided there is no conflict of interest. 136.The head of the risk control function must be able to challenge the decisions of the authorised management. These challenges and the reasons cited must be documented by the institution. Where the institution gives a veto right over the decisions of the authorised management to the Chief Risk Officer, the scope of this right must be decided clearly and in writing, including the escalation process of the supervisory body.

CIRCULAR CSSF 20/759
66/109
The decisions which were given a reasoned negative opinion by the Chief Risk Officer shall inform the CSSF by stating the grounds of its should be subject to an enhanced decision-making process. It is acceptable for the member of the authorised management designated as being directly in charge of the risk control function to assume himself/herself the position of Chief Risk Officer.
Section 6.2.6. Compliance function
This Circular comprises the “general guidelines” contained in the ESMA Guidelines on certain aspects of the MiFID compliance function requirements (ESMA/2012/388) and applies them to all the activities of the institution, including the provision of investment services. Where the institutions implement these requirements in relation to investment services within the meaning of the LFS, they shall take into account the "supporting guidelines" set out in Guidelines ESMA/2012/388. Comments:

1. Reference is made to points 9, 17, 21, 33, 44, 55, 57, 104 to 121, 147 and
   179 also relating to the compliance function.
2. There might be a duplication in respect of the segregation of duties between
   the compliance function in charge of the compliance risks (point 131) and the risk control function in charge of "all risks" (point 123). The institutions shall ensure that these tasks are internally assigned in an effective and efficient way.
3. The compliance function is entrusted to a dedicated department composed of
   one or several persons.
4. The aim of the compliance function is to anticipate, identify and assess the
   compliance risks of an institution as well as to assist the authorised management in limiting these risks. These risks may include a variety of risks such as the reputational risk, legal risk, risk of dispute, risk of sanctions, as well as some operational risk aspects, in connection with all activities of the institution. This task is to be performed on an ongoing basis and without delay. The institutions which provide investment services within the meaning of the LFS shall implement a compliance function which complies with the ESMA guidelines of 6 July 2012 (Guidelines on certain aspects of the MiFID compliance function requirements (ESMA/2012/388)). Specification:
   This circular includes "general guidelines" included in the document ESMA/2012/388 and applies them to all activities of the institution, including the provision of investment services. Where they implement these requirements in relation to the investment services within the meaning of the LFS, the institutions shall take into account the "supporting guidelines" set out in the document ESMA/2012/388.

CIRCULAR CSSF 20/759
67/109
Sub-section 6.2.6.1. Compliance charter
97.137.The terms of operationoperational arrangements of the compliance function in terms of objectives, responsibilities and powers areshall be laid down in a compliance charter drawn up by the compliance function and approved by the authorised management and ultimately by the board of directors. supervisory body. 98.138.The compliance charter shallmust at least:

• define the position of the compliance function in the organisation chart of the
  institution bywhile specifying its key characteristics (independence, objectivity, integrity, competences, authority and adequacy of the resources);
• recognise the compliance function’s right of initiative to open inquiries
  oninvestigations about all activities of the institution, including those of its branches and subsidiaries in Luxembourg and abroad, and the right to access to all documents, materials, and minutes of the consultative and decision￾making bodies of the institution, to meet all persons working in the institution, to the extent required to fulfil its mission;
• define the responsibilities and reporting lines of the Chief Compliance Officer;
• describe the relationships with the risk control and internal audit functions as
  well as possible delegation and/or coordination needs;
• establishdefine the conditions and circumstances applicable where external
  experts are used;
• establish the right for the Chief Compliance Officer to, directly and on his/her
  own initiative, contact the chairmanchairperson of the board of directorssupervisory body or, where appropriate, the members of the audit committee or the compliance committee as well as the CSSFcompetent authority. The content of the compliance charter isshall be brought to the attention of all staff members of the institution, including those who work in branches abroad and subsidiaries in Luxembourg and abroad. 99.139.The compliance charter shallmust be updated as soon as possible in order to take into account the changes in the applicable standards affecting the institution. Any changes shallmust be approved by the authorised management, confirmed by the audit committee or, where appropriate, the compliance committee and ultimately approved by the board of directors.supervisory body. They areshall be brought to the attention of all staff members.

CIRCULAR CSSF 20/759
68/109
Sub-section 6.2.6.2. Scope and specific responsibilities and scope of the compliance function 140.The aim of the compliance function is to anticipate, identify, assess, report and monitor the compliance risks of an institution as well as to assist the authorised management in providing the institution with measures to comply with the applicable laws, regulations and standards. The compliance risks may include a variety of risks such as the reputational risk, legal risk, risk of dispute, risk of sanctions, as well as some other operational risk aspects, in connection with all the institution’s activities. These tasks shall be performed on an ongoing basis and without delay.
100.141. For the purposepurposes of reaching the objectives set, the
responsibilities of the compliance function shallmust cover at least the following aspects:

• The compliance function shall identify the standards to which the institution is
  subject in the exercise of its activities in the various markets and shall keep records of the main rules. These records shallmust be accessible to the relevant staff of the institution;
• The compliance function shall identify the compliance risks to which the
  institution is exposed in the exercise of its activities and shall assess their significance and the possible consequences. The compliance risk classification so determined shallmust enable the compliance function to develop a control plan according to the risk, thereby allowing an effective use of the compliance function’s resources.;
• The compliance function shall ensure the identification and assessment of the
  compliance risk before the institution expands into new activities, products or business relationships, as well as when developing the transactions and the network of thea group at international level. (“New Product Approval Process”);
• The compliance function shall ensure that, for the implementation of the
  compliance policy, the institution has rules that can be used as guidelines by the staff from different disciplines in the exercise of itstheir day-to-day tasks. These rules shallmust be properlyappropriately reflected in the instructions, procedures and internal controls inof areas directly related to compliance. In drawing up these rules,under the compliance function and shall take into account, as far as necessary for the institution in question, theinstitution’s code of conduct laid down in the internal governance arrangements.and corporate values;

CIRCULAR CSSF 20/759
69/109

• The areas falling directly related tounder the remit of the compliance function
  are typically the fight against money laundering and terrorist financing, the investment services, the prevention regarding market abuse and personal transactions, the integrity of the financial instruments marketsfrauds, the protection of the customers’ and investors’ interests, the and data protection and observance of professional secrecy, the avoidance the prevention and management of conflicts of interest,. This list is not exhaustive and each institution shall decide whether its compliance function should also cover compliance with rules other than those listed above;
• The Chief Compliance Officer shall ensure, in particular, that the prevention of
  fight against money laundering and terrorist financing translates into effective controls and measures which are appropriate to the userisk. The summary report of the financial sector by third parties to circumvent their regulatory obligations and compliance function, a copy of which shall be submitted to the management ofcompetent authority, shall cover the compliance risk related to cross-border field of anti-money laundering and counter terrorist financing in a dedicated chapter laying down the activities. In the more general context of compliance with and events relating to this area, i.e. the code of conductmain recommendations issued, major (existing or emerging) deficiencies, irregularities and problems identified, the compliance function has also to cover the fields of ethics and professional conduct or even frauds. This list is not exhaustive. corrective and preventive measures implemented, as well as a list of deficiencies, irregularities and problems which have not yet been subject to appropriate corrective measures;
• In general, the compliance function shall be organised so that it covers all the
  areas which may result in compliance risks. However, insofar as some areas, resulting in practice in compliance risks, may also be linked to other functions such as the risk control function, finance function or legal function, and for the sake of avoiding any duplication of the compliance controls, The areas other than those referred tolisted above may not be directly covered by the compliance function. In this case, it The compliance risk is understood that the compliance risk isthen to be covered by the other internal control functions in accordance with a compliance policy clearly defining the competencesduties and responsibilities of the different stakeholders in this area and subject to compliance with the segregation of duties. In this case, the Chief Compliance Officer shall assume the role of coordination, centralisation of information and verification that the other areas, which do not directly fall within its competencehis/her scope of intervention, are well covered.  The institution is in charge of deciding whether, in view of the particular characteristics of the activities performed, its compliance function includes monitoring compliance with the rules that are not directly related to banking and financial activities, strictly speaking, such as in particular the rules under labour law, social law, company law or environmental law.

CIRCULAR CSSF 20/759
70/109
101.142. The compliance function shall verify compliance with the compliance
policy and procedures, on a regular basis, and isshall be in charge of the adaptation proposals, if required. To this end, the compliance function shall assess and control the compliance risk, on a regular basis., in the context of a structured monitoring programme. In respect of the compliance risk controls as well asand the verification of the procedures and instructions, the provisions of this Circular doshall not prevent the compliance function from taking into account the internal audit work.
102.143. The compliance function shall centralise all information on the
compliance problems (inter alia infringementsinternal and external frauds, breaches of standards, non-compliance with procedures and limits or conflicts of interest) identified by the institution. InsofarIn so far as it did not obtain this information onas part of its own involvement, it shall examine relevant documents, whether internal (for instance, control reports and internal audit reports, reports or statements of the authorised management or, where appropriate, the board of directorssupervisory body) or external (for instance, reports of the external auditorréviseur d'entreprises agréé, correspondence from the supervisory authority).
103.144. The compliance function shall assist and advise the authorised
management on issues of compliance and applicable laws, regulations and standards, notably by drawing its attention to changes in standards which may subsequently have an impact on the compliance area.
104.145. The compliance function shall raise awareness of the staff about the
significance of compliance and related aspects and assist them in their day-to￾day operations. related to compliance. To this end, it shall also develop an ongoing training programme and ensure its implementation.
105.146. The Chief Compliance Officer isshall be the key contact person of the
competent authorities in relation to the fight against money laundering and terrorist financing, for any question in this respect as well as in relation to market abuse. It isshall also be in charge of the transmission of any information or statementreport to these authorities. Sub-section 6.2.6.3. Organisation of the compliance function
40. Where, pursuant toThe institutions shall create a permanent and independent
compliance function, considering the principle of proportionality (point 4), the creation of a full-time position of Chief Compliance Officer is not necessary, a person may be entrusted with this position on a part-time basis. It is appropriate to ensure that the other tasks performed by this employee remain compatible with the responsibilities incumbent upon him/her pursuant to the provisions of this circular.

CIRCULAR CSSF 20/759
71/109
The institution which does not want to create a full-time position of Chief Compliance Officer, shall obtain explicit permission from the CSSF. To this end, the authorised management and the chairman of the board of directors shall submit to the CSSF a written request providing the grounds as well as the necessary information to enable to assess that the correct and the criteria governing its application of the provisions of this circular and the proper performance of the compliance function remain assured. Subject to specific authorisation by the CSSF, the member of the authorised management directly as well as general considerations regarding the organisation of the internal control functions laid down in charge of the compliance function himself/herself may take up the position of Chief Compliance Officer himself/herselfSection 6.2.4.
Section 6.2.7. Internal audit function
41. The internal audit function is entrusted with the internal audit department,
composed of one or several persons.
42. The audit function shall constitute within the organisation of the institution an
independent and permanent function of critical assessment of the adequacy and effectiveness of the central administration, internal governance and business and risk management as a whole in order to assist the board of directors and authorised management of the institution and to enable them to best control their activities and the risks related thereto and thus to protect its organisation and reputation. Sub-section 6.2.7.1. Internal audit charter
106.147. The terms of operationoperational arrangements of the internal audit
function in terms of objectives, responsibilities and powers shallmust be laid down byin an internal audit charter drawn up by the internal audit function and approved by the authorised management confirmed, where appropriate, by the audit committee, and ultimately approved by the board of directorssupervisory body. The internal audit charter shallmust at least:

• define the position of the internal audit function in the organisation chart of
  the institution bywhile specifying the key characteristics (independence, objectivity, integrity, competence, authority and adequacy of resources); Comment:
  Reference is made to points 9, 17, 21, 33, 38 to 44, 55, 57 and 104 to 121 also relating to the internal audit function.

CIRCULAR CSSF 20/759
72/109

• confer to the internal audit function the right of initiative and authorise it to
  review all the activities and functions of the institution including those of theirits branches abroad and subsidiaries in Luxembourg and abroad as well as the outsourced activities and functions, to access all documents, instrumentsmaterials, minutes of the consultative and decision-making bodies of the institution, to meet all persons working in the institution, to the extent required to fulfil its mission;
• lay down the reporting and functional lines of the conclusions that canmay be
  drawn from the audit missions;
• define the relationships with the compliance and risk control functions;
• establishdefine the conditions and circumstances applicable where third-party
  experts are used;
• define the nature of the work and conditions under which the internal audit
  function may provide internal consulting services or perform other special missions;
• define the responsibilities and reporting lines of the person in chargehead of
  the internal audit function;
• establish the right for the Chief Internal Auditor to contact, directly and on
  his/her own initiative contact, the chairmanchairperson of the board of directorssupervisory body or, where appropriate, the members of the audit committee as well as the CSSFcompetent authority;
• specify that the internal audit missions are performed in accordance with the
  the recognised professional standards governing the functioning and work of the internal audit18;
• specify the procedures to be observed in respect of coordination and
  cooperation with the réviseur d'entreprises agréé.
  The content of the internal audit charter isshall be brought to the attention of all staff members of the institution, including those who work in branches abroad and subsidiaries in Luxembourg and abroad. The internal audit charter shallmust be updated as soon as possible to take into account the changes that have occurred. All changes shallAny amendments must be approved by the authorised management, confirmed, where appropriate, by the audit committee and ultimately approved by the board of directors.supervisory body. They areshall be brought to the attention of all staff members. 18 Such as, for example, the International Professional Practices Framework (IPPF) of the Institute of Internal Auditors (IIA).

CIRCULAR CSSF 20/759
73/109
107.148. In addition to points 110 to 112, The internal audit department
hasshall have a sufficient number of staff and hashave the required skills as a whole to cover all activities of the institution. The internal auditors shallmust have sufficient knowledge of the audit techniques. In order not to challengejeopardise their independence of judgement, the persons responsible forfrom the internal audit cannot be in charge of the preparation orand establishment of elements of the central administration and internal governance arrangements. This principle doesshall not prevent them from taking part in the implementation of sound internal control mechanisms through opinions and recommendations which they provide in this respect (cf. in particular point 107).. Moreover, in order to avoid conflicts of interest, a rotation of the control tasks assigned to the various internal auditors shouldshall be ensured, where possible, and it should be avoided that the auditors hired within the institution controlaudit the activities or functions which they used to perform themselves recently. Sub-section 6.2.7.2. Specific responsibilities and scope of the internal audit function
108.149. In general, The internal audit function shall reviewexamine and assess
whether the central administration and internal governance arrangements are adequate and operate effectively. In this respect, the internal audit function shall assess inter alia: , among others (non-exhaustive list19), the following in accordance with the organisation and the nature, scale and complexity of the activities:

• monitoring of compliance with the laws and regulations as well as theany
  prudential requirements imposed by the CSSFcompetent authority;
• internal control’s efficiency and effectiveness;
• adequacy and efficiency of the administrative, accountingcentral
  administration, governance and IT organisationinternal control arrangements, including the risk control and compliance functions;
• safeguarding of the securitiesvalues and assets;
• adequacy of the segregation of duties and of the execution of transactions;
• accurate and complete registration of the transactions and the
  provisionproduction of accurate, complete, relevant and understandable financial and prudential information available without delay to the board of directors, specialised committeessupervisory body and, where appropriate, the specialised committees, to the authorised management and the CSSFcompetent authority; 19 Principle 7 of the document “BCBS_223 The internal audit function in banks” contains a more comprehensive list of activities which may fall within the scope of the institutions’ internal audit function.

CIRCULAR CSSF 20/759
74/109

• implementation of the decisions taken by the authorised management and
  by the persons acting by delegation and under its responsibility;
• compliance with the policies and procedures, in particular those governing
  thecapital adequacy of the regulatory and internal own funds and liquidity (reserves) in accordance with points 67, second;
• integrity of the processes ensuring the reliability of the methods and tools used
  by the institution, the assumptions and third indents, and 125;data used in the internal models, the qualitative tools for risk identification and assessment, as well as the risk mitigation measures taken.
• adequacy of the risk management;
• operation and effectiveness of the compliance and risk control functions
  (Sections 6.2.5 and 6.2.6).
  109.150. Where there is, within anthe institution, a separate department in
  charge of the control or supervision of a specific activity or function, the existence of such a department doesshall not discharge the internal audit department from its responsibility to controlaudit this specific area. However, the internal audit department may take into account, in its work the, assessments issued by this department on the area in question. The internal audit shallmust be independent from the other internal control functions which it audits. Consequently, the risk control function or the compliance function cannot be part of the internal audit department of an institution. However, these functions may take into account the internal audit work as regards the verification of the correct implementation of the applicable standards to the exercise of the activities by the institution.
  110.151. Further to points 119 and 120, The establishment of a local internal
  audit function in the subsidiaries of the institution doesshall not discharge the internal audit of the group head from carrying out regular on-site inspections onof these local internal audit functions.

43. The Chief Internal Auditor shall ensure that the department applies the
    international standards of the Institute of Internal Auditors or equal international standards in accordance with point 21 as well as the rules of conduct in accordance with point 55.

CIRCULAR CSSF 20/759
75/109
Sub-section 6.2.7.3. Execution of the internal audit work
111.152. All internal audit missions shall be planned and executed in accordance
with an internal audit plan. The plan shall be established by the person in chargehead of the internal audit function for a period of several years (in general three years). Its purpose isshall be to cover all activities and functions, taking into accountconsidering both the risks posed by an activity or function of the institution and the effectiveness of the organisation and internal control in place for this activity or function. (risk-based approach). The plan shouldshall consider the opinions issued by the board of directors andsupervisory body or, where appropriate, the audit committee, as well as the authorised management. The plan shall cover all matters of prudential interest (including the CSSF’s commentscompetent authority’s observations and requests) and shall also reflect the developments and innovations provided for as well as the risks which may arise therefrom.
112.153. The plan shall be discussed with the authorised management and
submitted to the authorised management and approved by it, confirmed, where appropriate, bywith the audit committee and ultimately approved by the board of directors.supervisory body. It shall be reviewed, on an annual basis, and adapted, where appropriate, in light of the to developments and emergencies. Any adaptation is toThe plan shall be formallyreviewed by the authorised management and, where appropriate, by the audit committee before being approved by the authorised management and, where appropriate, the audit committeesupervisory body. The approval implies that the authorised management provides the internal audit department with the means necessary to implement the internal audit plan. In its summary report to the board of directors in accordance with point 116supervisory body, the internal audit shall indicate and state the reasons for the main changes brought to the audit plan as initially approved by the board of directorssupervisory body: cancelled missions, delayed missions as well as the missions whose scope washas significantly changed.
113.154. The plan, which is adequately documented, shall set out the objectives
of each mission and the scope of the tasks to be executed, give an estimate of the necessary time and human and material resources and assign an audit frequency to each missionactivity and risk. The internal audit plan shall also provide for the adequate and sufficiently frequent coverage, within a multi-year planning period of several years, of important or complex activities which representwith a potential significant potential risk, including a reputational risk. It shall focus on the risk of execution errors and the risk of fraud. The internal audit plan shall provide for adequate coverage of areas with a risk of money laundering or terrorist financing, so that the internal audit may give an account of the compliance with the policy regarding the fight against money laundering or terrorist financing in its summary report on an annual basis.

CIRCULAR CSSF 20/759
76/109
114.155. Where the internal audit department of the parent undertaking of the
Luxembourg institution carries out on-site inspections onof its subsidiary, on a regular basis, it is recommended for reasons of effectiveness, that, insofarin so far as possible, the Luxembourg institution coordinates its internal audit plan with that of the parent undertaking.
115.156. The internal audit department shall regularly inform the authorised
management and, where appropriate, the audit committee on the implementation of the internal audit plan.
116.157. Each internal audit mission shall be planned, executed and
documented in compliance with the professional standards adopted by the internal audit function in its internal audit charter.
117.158. Each mission shall be the subject toof a written report of the internal
audit department, in general, intended for the supervisedaudited persons, the authorised management as well as - possibly in summarised form - for the board of directors supervisory body (and, where appropriate, the audit committee) in accordance with point 116.). The reports shall also be made available to the réviseur d'entreprises agréé and the CSSF.competent authority. These reports shall be writtendrafted in French, German or English. The internal audit department shall prepare a table of the internal audit missions and the written reports related thereto. It shall draft, at least once a year, a summary report pursuant to point 116. Sub-section 6.2.7.4. Organisation of the internal audit function
44. The institution which, in line with point 117, decides to outsource the internal
audit function, shall submit a written request to the CSSF. This request shall include the information necessary for its assessment, including, in particular, the name of the external expert (natural person) who will take on the internal audit function of the institution. The choice of the external expert, who carries out the internal audit work shall be approved by the board of directors, where appropriate, based on the opinion of the audit committee created in compliance with point 33. The selected expert shall be independent from the réviseur d'entreprises agréé and the cabinet de révision agréé of the institution as well as from the group to which these persons belong. It shall carry out the tasks in accordance with point 118 and mutatis mutandis the provisions of this circular. In this respect, it shall take over all duties and responsibilities incumbent upon the internal audit under this circular. 159.In case of use of an external expert for certain aspects in accordance with point 118, this expert shall carry out his/herThe institutions shall create a permanent and independent internal audit function, considering the principle of proportionality and the criteria governing its application as well as the considerations regarding the organisation of the internal control functions laid down in Section 6.2.4.

CIRCULAR CSSF 20/759
77/109
118.160. In case the operational tasks of the internal audit are outsourced, the
external providers shall carry out their work under the internal audit plan of the institution by following a work programme, by producing detailed documentation on his/hertheir work and by drafting the reports for each mission. These reports are toshall be drafted in French, German or English and to be delivered to submitted to the designated head of the Chief Internal Auditorfunction, the authorised management, where appropriate, the audit committee and the board of directors according to point 116supervisory body.
45. Pursuant to point 118, the external experts may be internal auditors of the group
to which the institution belongs. Where experts act as réviseurs d'entreprises agréés, they shall, in all respects, be independent from the réviseur d'entreprises agréé and the cabinet de révision agréé of the institution as well as the group to which these persons belong.
Chapter 7. Specific requirements
Sub-chapter 7.1. Organisational structure and legal entities (Know-your￾structure)
46. The organisational structure shall be, in terms of legal entities (structures)), be
appropriate and justified as regards the strategies and guiding principles referred to in point 17 of this circular. 161.. It shall be clear and transparent for all the stakeholders. The legal, organisational and operational structure must enable and promote effective, sound and prudent business management. It shallmust not impede the abilitysound governance of the institution, in particular the ability of its administration andthe management bodiesbody, to effectively manage and controloversee the activities (and the risks) of the institution and the different legal entities which are part of it. The group head institution shall clearly define and limitdelineate the powers which it agrees to delegate to the headsmanagers of the legal entities which are part of the group in order to make sure that the group headparent undertaking can monitor their activity, on an ongoing basis, and that it is involved in any transaction of a certain importance.
119.162. The guiding principles that the board of directorssupervisory body lays
down as regards the organisational structure (in terms of legal entities) shall provide notably that:

• the organisational structure does not involveis free from any undue
  complexity;
• the provisionproduction and distribution, in a timely manner, of all necessary
  information to ensurenecessary for a sound and prudent management of the institution and the legal entities which are part of it are ensured;

CIRCULAR CSSF 20/759
78/109

• any significant flow of management information between legal entities
  composingwhich are part of the institution is documented and may be promptly provided to the board of directors, supervisory body, the authorised management, the internal control functions or the CSSF,competent authority upon their request.
  Section 7.1.1. Guiding principles as regards "non-Complex
  structures and non-standard" or "potentially non-transparent" activities
  120.163. "Non-standard" or "potentially non-transparent" activities are those
  carried out through special-purpose or assimilatedcomplex legal entities (special purpose vehicles) (structures)or arrangements or in jurisdictions that impedewhich lack transparency or which do not meet international banking standards.

47. The guiding principles that the board of directors lays down as regardsregarding
    internal governance, which the supervisory body lays down, shall provide in particular, notably that thecomplex structures and non-standard andor potentially non-transparent activities are  only acceptable provided that subject to an in-depth analysis and an ongoing monitoring of risks, in particular, those associated with financial crime. Irrespective of the fact that the activities are carried out for own account or for the account of customers, the institution is confident thatmust understand the inherent risks can be effectively managed;  controlled through processesusefulness of approvalthese structures and management ofmanage the risks and management information available at the level of the authorised management and internal control functions of the institution;  monitored, on a regular basis, in order to ensure that they remain necessary and consistent with that accompany their original purposes and  monitored, on a regular basis, by the internal control functions and by the réviseur d’entreprises agréé of the institution.
    121.164. Points 162 and 163 shall also apply where the institution carries out
    non-standard and non-transparent activities on behalf of its customersestablishment and their operational functioning. Sub-chapter 7.2. Management of conflicts of interest
    122.165. The policy on managingthe management of conflicts of interest shall
    cover all conflicts of interest, withfor economic, personal, professional or political purposes, whether they are persistent or linked to a single event. Particular attention must be given to the conflicts of interest between the institution and its related parties and third-party subcontractors. This policy shall be applicable to all staff as well as to the authorised management and members of the board of directorssupervisory body.

CIRCULAR CSSF 20/759
79/109
123.166. The policy on managingthe management of conflicts of interest shall
provide that all current and possible conflicts of interest shallmust be identified with the aim of avoiding them, assessed, managed and mitigated or avoided. Where conflicts of interest remain, the policy in this respect shall lay down the procedures to be followed in order to report, document and manage them in the interest ofso as to avoid that the institution, its counterparties and pursuant to the regulatory provisions on customer protection.the customers suffer unjustified consequences thereof. The policy and procedures in question shall also lay downinclude the procedure to be followed in case of non-compliance with thethis policy in question.
124.167. The policy on managing the management of conflicts of interest shall
identifyprovide for the identification of the main sources of conflicts of interest - potentially affected relationships and activities as well as all internal and external parties involved - with which the institution isor its staff and its representatives are or may be faced and. It shall state how these take into consideration not only present situations and events which may result in conflicts of interest shall be managed. In order to minimise, but also those in the recent past in so far as these events continue to have a potential of conflicts of interest,impact on the institution or person concerned. The institution shall determine the materiality of the identified conflicts and shall put in place appropriate segregation of duties and activities.decide how they must be managed. 168.In order to minimise the possible conflicts of interests, the institution shall set up an appropriate segregation of duties and activities, including through the management of information access and the use of Chinese walls.
125.169. The policy in question shall also determine the reporting and escalation
procedures applicable within the institution. Where the staff members are or have been faced with a conflict of interest, they shall promptly inform their senior manager on their own initiative. Where the senior manager notes that the conflict of interest is acceptable in view of the internal policy, s/he shall authorise it under the terms and conditions provided for in this policy. The policy in question shall also lay down the escalation procedure which determines the conflicts of interest which shall be reported to the authorised management and authorised by it.

CIRCULAR CSSF 20/759
80/109
The members of the authorised management and the board of directorssupervisory body, who are subject to a conflict of interest, shall promptly inform the authorised management or the supervisory board of directors, respectively, on their own initiative. The procedures in this regard shall provide that these members shall abstain from participating in the decision-making processes where they may have a conflict of interest or which prevent themwhere they are prevented from deciding with full objectivity and independence.20
126.170. The internal control functions areshall be in charge of identifying and
managing conflicts of interest.
Section 7.2.1. AdditionalSpecific requirements relating to the
conflicts of interest involving related parties
127.171. The business relationshipstransactions with related parties areshall be
subject to the board of directors’supervisory body's approval where they have or may have, individually or on an aggregate basis, a significant and negative impact on the risk profile of the institution. The rule shall also apply where, in the absence of any significant impact on each individual transaction, the influence is significant for all transactions with related parties.
128.172. Any material change in the significant transactions carried out with
related parties shallmust be brought to the attention of the board of directorssupervisory body as soon as possible.
129.173. Transactions with related parties shallmust be carried out in the
interest of the institution. The institution’s interest is not met where transactions with related parties:

• are carried out on less advantageous terms (for the institution) than those
  which would apply to the same transaction carried out with a third party (at arm's length);
• impair the solvency, liquidity situation or risk management capacitiesabilities
  of the institution from a regulatory or internal point of view;
• exceed the risk management and control capacities of the institution; or are
  not part of the standard activities of the institution;
• are contrary to the sound and prudent management principles in the interest
  of the institution.
  20 This provision is in line with thatthose of Article 57Articles 441-7 (one-tier system) and 442-18 (two-tier system) of the Law of 10 August 1915 on commercial companies stating that as regards public limited companies (sociétés anonymes) and European companies "which lays down that any director or member of the supervisory board, respectively, or the member of the Executive Board having an interest in a transaction submitted for approval of the board of directors conflictingbody concerned which conflicts with that of the company, shall be obliged to adviseinform the boardbody in question thereof and to cause a record of his/her statement to be included in the minutes of the meeting. S/he may not take part in these deliberations."..

CIRCULAR CSSF 20/759
81/109
130.174. Where the institution is group head, it shall consider, in a balanced
way and balancein compliance with the applicable legal provisions, the interests of all legal entities and branches which are part of the group and comply with the applicable legal provisions.. It shall consider how these interests contribute to the common purposeobjectives and interests of the group over the long term. Sub-chapter 7.3. New Product Approval Process
131.175. "New products" The new product approval process shall mean any
change incover the development of new activities (in terms of coverage ofproducts, services, markets, systems and processes or customers, products and services). as well as their material changes and exceptional transactions.
48. No new activity shall be undertaken unless approved by the authorised
management, all relevant parties have been heard, and the means mentioned in point 179 are available. The process in question is laid down in a new product approval process which complies with the provisions of points 177 to 180. It must ensure that any new product remains consistent with the guiding principles established by the supervisory body, the risk strategy, the risk appetite of the institution and the corresponding limits.
132.176. The new product approval process shall define, in particular, the
changes in the activities subject to the approval process (significant change in the activities), the considerations to be taken into account, the main issues to be addressed as well as the implementation of the approval process, including the responsibilities of all the parties concerned. The approval process shall lay down the rights and obligations of all relevant parties, including the internal control functions as well as the conditionsmain issues to be fulfilled for approval. These conditionsaddressed shall include regulatory compliance, accounting, pricing and models, the impact on risk control, internal expertise, technical infrastructure and sufficient humanprofile, capital adequacy and profitability, the availability of adequate front, back and middle office resources and the availability of adequate internal tools and expertise to ensureunderstand and monitor the entire operational processing. associated risks.

CIRCULAR CSSF 20/759
82/109
133.177. Consequently, the institutions shall carefully analyse any proposed
change in the activities and ensure that they have the ability to bear the risks related thereto, the technical infrastructure and sufficient and competent human resources to control these activities and the associated risks related thereto.. The business unit which requestsrequesting the change in its activities isshall be in charge of issuing an analysis of the risks in this regard. Similarly, the risk control function shall carry out a prior, objective and comprehensive analysis of the risks associated with any proposed change in the activities. The risk analysis shall take into account the various scenarios and shall indicate, in particular, the institution’s ability of the institution to bear, manage and control the risks inherent in the planned activities. The compliance risk inherent in new products shall also be subject to prior analysis by the compliance function. With respect to their opinions, the internal control functions can rely on analyses carried out by the business units. 178.No new activity must be undertaken unless the authorised management approved it, all relevant parties have been heard, and the means mentioned in the preceding point are available.
134.179. The internal control functions may require that a change in activities
shall be deemed to be significantmaterial and thus be subject to the approval process. Sub-chapter 7.4. Outsourcing
135.180. Outsourcing shall mean the complete or partial transfer of the
operational functionstasks, activities or provisions of services of the institution to an external service provider, whether or not s/heit is part of the group to which the institution belongs. Whereas IT outsourcing, or a chain of outsourcing exclusively composed of IT outsourcing, relies on a cloud computing infrastructure as defined in Circular CSSF 17/654, the points of sub-chapter 7.4 of this circular shall not apply and the financial professional shall comply with the requirements of Circular CSSF 17/654. For the purposes of this sub-chapter, the term "“activity"” shall refer to the operational functionstasks, activities and provisions of services mentioned in the first paragraph. Any activity that, when it is not carried out in accordance with the rules, reduces the institution’sinstitution's ability to meet the regulatory requirements or to continue its operations as well as any activity necessary for the sound and prudent risk management shall be deemed to be "“material".”. 181.Where outsourcing or an outsourcing chain concerns purely services that are IT in nature and where at least one outsourcing meets the definition of cloud computing under Circular CSSF 17/654, the requirements of this sub-chapter shall not apply and the institution shall comply with the requirements of Circular CSSF 17/654.

CIRCULAR CSSF 20/759
83/109
The exception laid down in the preceding paragraph shall not apply to business process outsourcing relying on an outsourced cloud computing infrastructure.
Section 7.4.1. General outsourcing requirements
136.182. Outsourcing shouldmust not result in non-compliance with the rules of
this Circular on central administration (Chapters 1 and 3). .
The outsourcing institution shall, in particular, comply with the following requirements:

• The strategic functions or core functions cannot be outsourced;
• The institution shall retain the necessary expertise to effectively monitor the
  outsourced services or functionstasks and managethe management of the risks associated with the outsourcing;  The data protection shall be guaranteed at all times;
• The institution shall ensure protection of the data concerned by an outsourcing
  in accordance with the General Data Protection Regulation (GDPR) and with the requirements of the authority competent in this matter, the National Commission for Data Protection (CNPD);
• In case of outsourcing, the institution shall apply the provisions of Article
  41(2a) of the LFS with respect to professional secrecy;
• The outsourcing does not relieve the institution of its legal and regulatory
  obligations or its responsibilities to its customers. It shall not result in anythe delegation of the institution’s responsibility to the subcontractor, except as regards the obligation of professional secrecy where the subcontractor acts under Article 41(5) of the LFS; subcontractor;
• The final responsibility offor the risk management of risks associated with
  outsourcing is incumbent uponshall lie with the authorised managementinstitution which is outsourcing;  The institution shall assess, in view of possible legal risks and legal obligations, whether or not the third parties concerned by this outsourcing, and in particular financial sector customers, should be informed, or their consent be obtained. In this respect, the institution shall comply with the regulations in force relating to personal data protection;
• The confidentiality and integrity of data and systems shallmust be controlled
  throughout the outsourcing chain. In particular, access to data and systems shallmust fulfil the principles of “need to know” and “least privilege”, i.e. access isshall only be granted to persons whose functions so require, for a specific purpose, and their privileges shall be limited to the strict necessary minimum to exercise their functions;

CIRCULAR CSSF 20/759
84/109

• The institution which intends to outsource a material activity shallmust obtain
  prior authorisation from the CSSF.competent authority. A notification to the CSSF statingcompetent authority justifying that the conditions laid down in this Circular are complied with is sufficient where the institution resorts to a Luxembourg credit institution or a support PFS according toin accordance with Articles 29-1 to 29-6 of the LFS;
• The access of the CSSFcompetent authority, the réviseur d’entreprises agréé
  and the internal control functions of the institution to the information relating to the outsourced activities shallmust be guaranteed in order to enable them to issue ana well-founded opinion on the adequacy of the outsourcing. This access implies that they may also verify the relevant data held by an external partner and, in the cases provided for in the applicable national law, have the power to perform on-site inspections onof an external partner. The aforementioned opinion may be, where appropriate, be based on the reports of the subcontractor’s external réviseur (auditor. ).
  137.183. The outsourcing institution shall base its decision to outsource on a
  prior and in-depth analysis demonstrating that it does not result in the relocation of the central administration. This analysis shall include at least a detailed description of the services or activities to be outsourced, the expected results of the outsourcing and an in-depth evaluationassessment of the risks of the contemplated outsourcing project as regards financial, operational, legal and reputational risks. The analysis shall include a detailed (due diligence) assessment of the proposed service provider.
  138.184. Special attention shouldmust be paid to the outsourcing of critical
  activities in respect of which the occurrence of a problem may have a significant impact on the institution’sinstitution's ability to meet the regulatory requirements or even to continue its activities.
  139.185. Special attention shouldmust be paid to the concentration and
  dependence risks which may arise when large parts of activities or important functions are outsourced to a single provider during a sustained period.
  140.186. The institutions shallmust take into account the risks associated with
  the outsourcing "chains" (where a service provider outsources part of his/herthe outsourced activities to other service providers). In this respect, they shall take particular account of the safeguarding of the integrity of the internal and external control. Moreover, the institution shall ensure to provide the CSSFcompetent authority with any elements proving that the sub-outsourcing process is under control.

CIRCULAR CSSF 20/759
85/109
141.187. The outsourcing policy should considershall take into account the
impact of the outsourcing on the institution’s businessactivities and the risks it faces., in particular, the operational risks arising therefrom, such as legal risk, IT risk, reputational risk or concentration risk (at the level of service providers). It shall include reportinglay down the applicable requirements regarding outsourcing to which the service providers andare subject, from the preparation phase to the expiry or termination and through the reporting, and determine the control mechanism which the institution implements in this respect are subject from inception to the end of the outsourcing agreement. Outsourcing may, in no circumstances, lead to the circumvention of any regulatory restrictions or prudential measures of the CSSFcompetent authority or the challenge the CSSF’sof its supervision.
142.188. Special attention shouldmust be paid to the continuity aspects and the
revocable nature of outsourcing. The institution shallmust be able to continue its critical functions in case of exceptional events or crisis. In this respect, the outsourcing agreements shall provide for a notice of termination which shall give sufficient time to the institution to take the necessary measures to ensure continuity of the outsourced services and shall not include any termination clausesclause or service termination clausesclause because of resolution actions or reorganisation measures or a winding-up procedure applied to the institution, as provided forlaid down in the Law of 18 December 2015 on the failure of credit institutions and certain investment firms. The institution shall also take the necessary measures to be in a position to adequately transfer the outsourced activitiesservices to a different provider or to perform those activities itselfbring them in-house whenever the continuity or quality of the service provision areis likely to be affected.
143.189. For each outsourced activity, the institution shall designate, from
among its employeesstaff, a person who will be in charge of managing the outsourcing relationship and managing access to confidential data.
Section 7.4.2. Specific IT outsourcing requirements
144.190. The institution shall implement an IT policy which covers all IT
activities scattereddistributed among the institution and all the actors in the outsourcing chain. The IT organisation shall be adapted in order to integrate the outsourced activities to the proper functioning of the institution and the procedureprocedures manual shall be adapted accordingly. The institution’s continuity plan shall be established in accordance with the continuity plan of its subcontractor(s). The institution shall also provide for the regular testing of backups and of the facilities to restore backups.

CIRCULAR CSSF 20/759
86/109
145.191. The IT systeminstitution’s policy on information systems security
policy of the institution shouldshall consider the personalindividual security establishedimplemented by its subcontractor(s)), in order to ensure the overall consistency.
146.192. IT outsourcing may cover consulting, development and maintenance
services (Sub-section 7.4.2.2), hosting services (Sub-section 7.4.2.3) or IT system management/operation services (Sub-section 7.4.2.1). Sub-section 7.4.2.1. IT system management/operation services
147.193. The institutions may contractually use services for the
management/operation of their systems:

• In Luxembourg, solely from:
  o a credit institution or a financial professional holding a support PFS authorisation in accordance with Articles 29-3 and 29-4 of the LFS (primary IT systems operators of the financial sector or secondary IT systems and communication networks operators of the financial sector); o an entity of the group to which the institution belongs and, which exclusively deals withprocesses group transactions, provided that. In case these systems do not include any readable confidential data on theof customers. Otherwise, the institution shall assess, in view of possible legal risks and legal obligations, whether or notensure compliance with the provisions of Article 41(2a) of the third parties concerned by this outsourcing, and in particular financial sector customers, should be informed, or their consent be obtained. In this respect, the institution shall comply with the regulations in force relating to personal data protectionLFS.
• Abroad, from:
  o any IT service provider, including from an entity of the group to which the institution belongs, provided that to. In case these systems do not include any readable confidential data onof customers. Otherwise, the institution shall assess, in view of possible legal risks and legal obligations, whether or not the third parties concerned by this outsourcing, and in particular financial sector customers, should be informed, or their consent be obtained. In this respect, the institution shall complyensure compliance with the regulations in force relating to personal data protectionprovisions of Article 41(2a) of the LFS. Sub-section 7.4.2.2. Consulting, development and maintenance services
  148.194. The consulting, development and maintenance services may be
  contracted with any IT service provider, including an IT service of the group to which the institution belongs or a support PFS.

CIRCULAR CSSF 20/759
87/109
149.195. Third-party subcontractors other than support PFS which provide
consulting, development or maintenance services shallmust operate by default outside the IT production system. Formal agreement of the institution is required for each intervention on the production system. If an exceptional situation requires an intervention on the production system and if the access to confidential data cannot be avoided, the institution shallmust ensure that the third party in question is supervised throughout its mission by a person of the institution in charge of IT. Formal agreement of the institution is required for each intervention on the production system, except interventions carried out by a support PFS as
part of its mandate. and that the provisions of Article 41(2a) of the LFS are
complied with.
150.196. Any change in the application functionality by a third party - other than
the changes relating to corrective maintenance - shallmust be submitted for approval to the institution prior to its implementation.
151.197. The institution shall ensure that there are, if needed, no legal obstacles
to obtain access to the operating systems which have been developed by this third-party subcontractor. This can be achieved, for example, when the institution is the legal owner of the programmes. The institution shall ensure that it is possible to continue operating the applications which are critical for the activity in case the subcontractor defaultsevent of a subcontractor’s failure, for a period compatible with a transfer of this outsourcing to another subcontractor or a taking overtakeover of the applications concerned by the institution itself. Sub-section 7.4.2.3. Hosting services and infrastructure ownership
152.198. The IT infrastructure may be owned by the institution or be provided
by the subcontractor.
Where the IT infrastructure includes readable confidential data, only the staff of customers, the institution shall ensure compliance with the support PFS orprovisions of the Luxembourg credit institution can work either in their premises or those of the financial professional without any specific supervision by the staff of the institution, provided that the service is provided under Article 41(52a) of the LFS and is the subject of a service contract enabling this autonomy. Where the subcontractor is not a support PFS or a Luxembourg credit institution, the institution shall assess, in view of possible legal risks and legal obligations, whether or not the third parties concerned by this outsourcing, and in particular financial sector customers, should be informed, or their consent be obtained.. Otherwise, the subcontractor cannot interveneoperate on the premises infrastructure of the institution without being accompanied, throughout its mission, by a person of the institution in charge of IT.

CIRCULAR CSSF 20/759
88/109
Where the IT infrastructure does not include confidential data, express approvalFormal agreement of the institution is required for each intervention on the IT infrastructure by a third party, except for interventions carried out by a support PFS as part of its mandate as operator.
153.199. It is not mandatory for the processing centre to be physically located
in the premises of the entity which is contractually responsible for the management of the IT systems. Whether the processing centre is in Luxembourg or abroad, it is thus possible that the hosting of the site is entrusted with another provider than that which providesthe one providing IT system management services. In this case, the institution shallmust ensure that the principles containedset out in this sub-chapter are complied with by the entity which is contractually responsible for the management of IT systems and that the sub￾outsourcing process is under control.
154.200. Where the processing centre is in Luxembourg, it may be hosted at a
provider other than a credit institution or a support PFS, provided that it does not act as operator. If the provider has no physical andor logical access to the institution’s systems, the institution shall ensure compliance with the provisions of Article 41(2a) of the LFS.
155.201. Where the processing centre is abroad, no confidential data which
enables the identification of a customer of the institution can be stored therein, unless it is protected. The confidentiality and integrity of data and systems shallmust be controlled throughout the IT outsourcing chain. In particular, access to data and systems shallmust fulfil the principles of “need to know” and “least privilege”, i.e. access isshall only be granted to persons whose functions so require, withfor a specific purpose, and their privileges shall be limited to the strict necessary minimum to exerciseperform their functions. The institution shall assess, in viewensure compliance with the provisions of possible legal risks and legal obligations, whether or not the third parties concerned by this outsourcing, and in particular financial sector customers, should be informed, or their consent be obtained. Article 41(2a) of the LFS.
Section 7.4.3. Additional general requirements
156.202. In order to enable the institution to assess the reliability and
comprehensivenesscompleteness of the data produced by the IT system as well as theirits compatibility with the accounting and internal control requirements, there should be one person, among its employees withstaff members, must have the requirednecessary IT knowledge to understand both the impact of the programmes on the accounting system and the actions takenperformed by the third party within the context of the provided services. The institution shallmust also have, in its premises, sufficient documentation on the programmes used.

CIRCULAR CSSF 20/759
89/109
157.203. In case of IT service provision via telecommunication, the institution
shallmust ensure that:

• sufficient safeguards are taken in order to avoid that non-authorised persons
  access its system. The institution shallmust, in particular, make sure that telecommunications are encrypted or protected through other available technical resources likelyso as to ensure the security of communication;
• the ITnetwork link enables the Luxembourg institution to have quick and
  unfetteredunlimited access to the information stored in the processing unit (i.e. through an adaptedappropriate access path and debitdata rate and through data recovery). redundancy).
  158.204. The institution shallmust ensure that the capture, printing, backup,
  storage and archiving mechanisms guarantee the confidentiality of the data.
  159.205. Outsourcing shallmust not result in the transfer of the financial and
  accounting function to a third party. The institution shall have, at the closing of each day, the balance of all accounts and of all accounting movements of the day. The system shallmust allow keeping regular accounts in accordance with the rulesstandards applicable in Luxembourg and thus respecting the form and content rules imposed by the Luxembourg accounting laws and regulations.

49. Where the institution operates abroad by using services of professional
    intermediaries (even if they are part of the group to which the institution belongs) or where it has branches or representative offices, any access by these intermediaries or representatives and employees of these offices and branches to its IT system in Luxembourg shall be approved by the CSSF.
    Section 7.4.4. Documentation
    160.206. Any outsourcing of material or non-material activities or not, including
    that carried out within the group to which the institution belongs to, shall be in line with a written policy requiring approval from the authorised management and including the contingency plans and exit strategies. This outsourcing policy shall be updated and re-approved, at regular intervals, by the supervisory body so that appropriate changes are rapidly implemented by the authorised management. Any outsourcing approval shall be the subject of an official and detailed contract (including specifications).
    161.207. The written documentation shouldshall also provide a clear description
    of the responsibilities of the two parties as well as the clear communication means accompanied by an obligation for the external service provider to report any significant problem having an impact on the outsourced activities as well as any emergency situation.
    162.208. The institutions shall take the necessary measures to ensure that the
    internal control functions have access to any documentation relating to the outsourced activities, at any time and without difficulty, and that these functions retain the possibilityfull opportunity to exercise their controls.

CIRCULAR CSSF 20/759
90/109
Chapter 8. Legal reporting
163.209. The credit institutions shall provide the CSSF competent authority with
the ICAAP report /ILAAP reports and compliancethe annual certificate issued by the authorised management in accordance of compliance with point 61the requirements of this Circular as well as the summary reports of the internal control functions in accordance with point 116 together with the draft annual accounts to be published ("VISA procedure"). Investment firms shall provide the CSSF with this information within the month of the general meeting having approved the annual accounts.the requirements of Circular CSSF 15/602. The relevant information are toshall be drafted in French, German or English.
Part III. Risk management
Chapter 1. General principles as regards risk measurement and
risk management
Sub-chapter 1.1. Institution-wide risk management framework
Section 1.1.1. General information

1. The institutions shall put in place a consistent and exhaustive institution-wide risk
   management framework, which covers all the activities and operational units of the institutions, including the internal control functions, and which fully recognises the economic substance of all their exposures, allowing the management body to retain control over all the risks to which the institution is or may be exposed.
2. The risk management framework must include a set of policies and procedures,
   limits, controls and alerts ensuring the identification, measurement, management or mitigation and report of these risks by the operational units, the institution as a whole, including, if necessary, at consolidated and sub-consolidated levels.
   Section 1.1.2. Specific (risk, capital and liquidity) policies
3. The risk policy which implements the risk strategy defined by the supervisory
   body shall include:

• the determination of the institution’s risk appetite;
• the definition of a complete and consistent internal limit system which is
  adapted to the organisational and operational structure, the strategies and policies of the institution and which limits risk-taking in accordance with the institution’s risk appetite. This system shall include the risk acceptance policies which define which risks can be taken and the criteria and conditions applicable in this regard;

CIRCULAR CSSF 20/759
91/109

• the measures aimed to promote a sound risk culture;
• the measures to be implemented in order to ensure that risk-taking and risk
  management comply with the set policies and limits. These measures shall include, in particular, the existence of a risk control function, alert thresholds and management arrangements for limit breaches, including corrective measures for breaches, a follow-up procedure of the corrective measures as well as an escalation and sanction procedure in the event of continuing breach;
• the definition of a risk management information system;
• the measures to be taken in case of risk materialisation (crisis management
  and business continuity arrangements).

50. The risks shall be assessed based on an objective and critical analysis specific to
    the institution. It should not exclusively rely on external assessments.
51. The institution shall explicitly reflect all the different risks in their internal
    governance arrangements including in particular the strategies and policies on regulatory and internal own funds and liquidity (reserves). It shall determine, in particular, its tolerance levels as regards all risks to which it is exposed. The risk policy shall describe how the various risks are identified, measured, reported, managed, limitedmonitored and controlledreported. It shall lay down the specific approval process which governs risk-taking (and the implementation of possible mitigation measures) as well as the measurement and reporting processes which ensuresensure that the institution has a thorough overview of all the risks at all times. The institutionsPursuant to the provisions of Chapter 2, the risk policy shall have an internal limit and alert threshold systemtake due account of concentration risks.
    1.4. The capital and liquidity policy implementing the strategy of the supervisory body
    in respect of all their risks.regulatory and internal capital and liquidity shall include, in particular:

• the definition of internal standards in relation to the management, size and
  quality of the regulatory and internal capital and liquidity. These internal standards must enable the institution to cover the risks toward related parties are to be dealt with internallyincurred and to have reasonable security margins in case of significant financial losses or liquidity bottlenecks by reference, in particular, to Circular CSSF 11/506;
• the implementation of sound and effective processes to plan, monitor, report
  and modify the amount, type and distribution of the regulatory and internal capital and liquidity reserves, in particular in relation to internal capital and liquidity requirements for risk coverage. These processes shall enable the authorised management and the operating staff to have sound, reliable and comprehensive management information as regards risks and their coverage;
• the measures implemented in order to ensure a permanent adequacy of the
  regulatory and internal capital and liquidity (reserves);

CIRCULAR CSSF 20/759
92/109

• the measures taken in order to effectively manage stress situations (capital
  inadequacy or regulatory or internal liquidity bottleneck);
• the designation of functions in charge of the management, functioning and
  improvement of the processes, limit systems, procedures and internal controls mentioned in the above indents. toward third parties. Section 1.1.3. Risk identification, management, measurement and reporting

5. The inherent and residual risks shall be assessed based on an objective and critical
   analysis specific to the institution. It should not rely solely on external assessments.
   2.6. The institution must explicitly reflect all the different risks in its internal
   governance arrangements shall apply to them in their entirety.including, in particular, the strategies and policies on risks and on capital and liquidity reserves. Sub-chapter 1.2. Risk measurement
6. The risk management in respect of related parties shall be included in all the
   elements of the internal governance arrangements.
   3.8. The risk measurement and reporting arrangements shouldshall enable the
   institution to obtain the required aggregate overviews in order to manage and control all risks of the institution and legal entities (structures) composing it.
   4.9. The decisions on risk-taking and risk strategies and risk policies shouldshall
   consider the theoretical and practical limits inherent in the risk models, methods and quantitative risk measures as well as the economic environment in which these risks fall.
   5.10. In general, the risk measurement techniques implemented by an institution
   shouldshall be based on choices, assumptions and approximations. There is no absolute measurement. Consequently, the institutions shallmust avoid any excess of confidence in any specific methodology or model. The risk measurement techniques used shallmust always be the subject of an internal, independent, objective and critical validation and the risk measurements which arise from these techniques are to be critically assessed, and wisely and carefully used by all staff, the authorised management and the board of directorssupervisory body of the institution. The quantitative risk assessments shall be supplemented by qualitative approaches, including (independent) expert judgements. , based on structured and documented analyses.

CIRCULAR CSSF 20/759
93/109
Chapter 2. Concentration risk
6.11. Concentration risk results, in particular, from large (concentrated) exposures
to customers or, counterparties or service providers, respectively, or groups of customers or related, counterparties or related service providers, including related parties, onto countries or sectors (industries) as well as onto specific products or markets (intra-risk concentration). These exposures may be assets and liabilities items or off-balance sheet items, but concentration risk doesare not necessarily referlimited to balance sheet items or off-balance sheet items. Moreover, concentration risk may be the result of various risks (credit risk, market risk, liquidity risk, operational risk - in particular those related to outsourcing - or systemic risk) which combine (inter-risk concentration). Intra-risk or inter-risk concentrationconcentrations may result in economic and financial losses as well as in a significant and negative impact on the risk profile of the institution.
52. Points 211 to 215 shall apply, in particular, to concentration risk.
Concentration risk must be subject to particular vigilance and identification effort as it may jeopardise the financial stability of the institution.
12. For institutions operating on the domestic market, there is generally a
concentrated exposure to the Luxembourg real estate market. A significant market downturn would undermine the financial stability of these institutions and have an adverse impact on the image of the Luxembourg financial centre as a whole. Consequently, the institutions shall implement prudent policies as regards the granting of real estate mortgage credits pursuant to Sub-chapters 3.2 and 3.3.
Chapter 3. Credit risk
Sub-chapter 3.1. General principles21
13. Risk-taking within the meaning of this sub-chapter shall mean not only the
decisions on new credits to be granted, but also the decisions made in the context of the restructuring or renegotiation of exiting credits, particularly following a significant deterioration of the debtor’s creditworthiness. The restructuring and renegotiations (forbearance) shall comprise, in particular, granting extensions, deferrals, renewals or amendments of the credit terms, including the repayment plan and any forbearance measures within the meaning of Article 49b of the CRR and non-performing loans within the meaning of Article 47a(3) of the CRR. 21 Supplementing the provisions of Article 9 of RCSSF 15-02 regarding credit and counterparty risk.

CIRCULAR CSSF 20/759
94/109
7.14. Each credit risk-taking shallmust be subject to a written analysis which
shouldshall cover at least the debtor’s creditworthiness, the repayment plan and the borrower’s repayment ability throughoutover the maturityperiod of the debt.borrowing. In particular, the credit decision cannot be based on an exclusive analysis of collateral or other credit risk mitigation techniques. The institutions shall take into account the overall debt level of the borrowerdebtor or the group of associated debtors, respectively. Regular repayments cannot exceed an amount which would not allow the borrower to have an adequate disposable income. There shallmust be a reasonable security margin in order to cover an increase in interest rates.
8.15. Each credit risk-taking shallmust be subject to a predetermined decision￾making process which shouldshall also involve a body separate from the business
function.
For low credit risk-taking, the institutions may establishput in place a grant￾making process which should enableenables them to monitor this risk-taking, as a whole, without necessarily going through the decision-making processes and individual analyses as referred to in points 221 and 222here. The institutions areshall be in charge of internally defining the concept of "“low"” credit risk for the purposes of the firstpreceding paragraph. This definition is based, in particular, shall focus at least on the institution’s ability to manage, bear and control these risks.
53. The institutions shall have clear policies which define the measures to be taken
where a debtor does not comply with or indicates to the bank that s/he is no longer able to comply with the contractual provisions of his/her commitment, in particular the various payment deadlines.
54. Each decision to restructure the , on the one hand, and on the exposure amount
and credit shall be subject to the decision-making process laid down in points 221 to 223. The institutions shall maintain a list including all the restructured credits. The restructuring measures are those which are related to deterioration of the creditworthiness of the debtor. They shall include in particular the granting of extensions, postponements, renewals or changes in credit terms and conditions, including the repayment plan. The institutions shall have sound arrangements to identify and manage past due commitments. Past due commitments are commitments whose contractual maturity dates set for the payment of principal quality of the debtor and/or interests have expired transaction, on the other hand. The institutions shall have sound arrangements for the identification, management and provisioning of "doubtful" commitments. These refer to all commitments "in default" within the meaning of Part VII, Sub-section 3.4.2.2, of Circulars CSSF 06/273 and CSSF 07/290 which define the default in terms of significant delays in payment (exceeding 90 days) or indication of unlikeliness to pay.
55. The institutions shall maintain a list of the doubtful commitments on the debtor
or group of related debtors. These commitments shall be subject to periodic and

CIRCULAR CSSF 20/759
95/109 objective review which shall enable the institution to acknowledge and carry out the impairment and provisions of assets as required. Sub-chapter 3.2. Residential mortgages real estate mortgage credit to individuals Specification:
For institutions operating on the domestic market, there is generally a concentrated exposure on the Luxembourg real estate market. A significant market downturn, which is very difficult to predict, would be likely to jeopardise the financial stability of these institutions and to have an adverse impact on the image of the Luxembourg financial centre as a whole. Consequently, institutions shall implement prudent policies as regards the granting of mortgages pursuant to Sub-chapter 3.1 and point 228. Moreover, institutions shall have sufficient capital in order to face adverse developments in the residential real estate market. The requirements prescribed in point 229 aim to strengthen the financial stability of these institutions through duly risk-adjusted regulatory capital requirements. These requirements strengthen the current rules included in Circular CSSF 06/273 according to the lessons learnt from the recent financial crisis episodes. Thus, in accordance with the first indent of point 229, institutions using the standardised approach for credit risk can, from now on, only apply the preferential risk weight of 35% to the parts of their mortgages whose loan-to￾value ratio (LTV) is below 80% (mortgages "whose value of the property is at least 25% higher than that of the exposure"). Consequently, a mortgage which fulfils all qualifying criteria of Section 2.2.7.1 of Part VII of Circular CSSF 06/273 (weighted retail exposure of 75%) and the criteria of Section 2.2.8.1 of Part VII of this circular (preferential risk weight of 35%) except for the new criteria 41, point d) which limits the LTV to 80% shall be, from now on, weighted for the purposes of determining the regulatory capital requirements at (0.8/LTV)*35%+((LTV-0.8)/LTV)*75% instead of 35%. The part of the mortgage exceeding 80% of the value of the real estate object is to be weighted according to the underlying exposure class. In this particular instance, the exposure shall comply with all criteria for retail exposures and the risk weight shall consequently be 75%. For the purpose of determining the LVT, the institutions may take into account all risk mitigation factors - direct personal contribution from the borrower or even the intervention of third parties by way of contributions, security interests or guarantees or collateral under the conditions provided for in Part IX of Circular CSSF 06/273 ("recognition of credit risk mitigation techniques"). For institutions using the internal ratings-based approach and in accordance with the second indent of point 229, the absolute floor for the loss ratio in the event of default shall remain at 10% after 31 December 2012.

CIRCULAR CSSF 20/759
96/109
These institutions shall also ensure that their regulatory capital adequacy is subject to a stress test which shall at least fall within the parameters referred to in the third indent of point 229.
9.16. The institutions shall apply a prudent credit granting policy which aims to
safeguard their financial stability regardless of the observed or expected developments in the residential real estate market. This policy shall focus on a healthy ratiovalues of debt ratios and ratios between debt burden and income for the whole credit duration, as well as between the amount of the credit granted and the value of the securities heldobtained guarantees (loan-to-value), including the underlying mortgage on the property, based on prudent assessment methods.
56. Part VII of Circular CSSF 06/273 shall be amended as follows:
 Under point 41, point d), the phrase ", by a substantial margin," shall be replaced by "by at least 25%";  Under point 176, the beginning of the sentence "Until 31 December 2012," shall be deleted. In the title of paragraph 3.2.4.2.3., the word "transitional" shall be deleted;  Under point 257, the third sentence "The test to be employed shall be meaningful and reasonably conservative, considering at least the effect of mild economic recession scenarios" shall be replaced by "The test to be employed shall be relevant and reflect the consequences of a severe but plausible economic recession scenario". Finally, a second paragraph with the following content shall be added at the end of point 257: "For the purposes of the first paragraph, the stress test on the retail exposures secured by residential property requires an increase of minimum 50% of the PDs and a LGD of at least 20%". Sub-chapter 3.3. CreditCredits to real estate developers
10.17. Each real estate development project funding shallfinancing must provide for
a start date of the principal repayment when the credit is granted. This date cannot exceed a reasonable time limit as regards the beginning of the project fundingfinancing. When this time limit is exceeded, the file shall be automatically classified under the list of restructured credits (cf. point 225)credits “in default” within the meaning of Article 178 of the CRR, Article 14 of CSSF Regulation 18- 03 and the EBA/GL/2016/07 and the full provisioning of unpaid interests shall be fully paidinterest. The real estate development funding shallfinancing must not only be based on the developer's reputation. It shallIn particular, it must take into consideration all the other factors which enable the assessment of the developer’s strength, the legal structuring and the financial strength of the project, the environment in which the projects are carried out, their development phases and all the related guarantees and insurance.

CIRCULAR CSSF 20/759
97/109
Moreover, the financing must be covered, in addition to the mortgage on the financed object, by a personal guarantee of the developer unless other guarantees or securities significantly cover the total cost of the financed object. The institutions shall set an internal limit for aggregate exposure they incur on the real estate development sector. Without prejudice to the rules applicable regarding large exposureexposures (Part XVIFour of Circular CSSF 06/273), the CRR), the completion bank guarantees may be excluded from this aggregate limit as far as the completion costs are adequately covered by pre-sale or pre-lease rates. This limit shallmust be in healthy proportion to their regulatory capital. It should be borne in mind that speculative immovable property financing as defined in Article 4(1)(79) of the CRR are deemed exposures associated with particularly high risk. In this respect, they shall be assigned a risk weight of 150%, as defined in Article 128(2)(d) of the CRR, under the standardised approach for credit risk. Sub-chapter 3.4. Exposures associated with particularly high risk
18. The institutions applying a standardised approach for credit risk shall put in place
a process to identify exposures associated with particularly high risk. This process shall cover at least the exposures within the meaning of Article 128(2) and (3) of the CRR.
19. The institutions shall apply Guidelines EBA/GL/2019/01 which specify the terms
“investment in venture capital firms” and “investment in private equity” as defined in Article 128(2)(a) and (c) of the CRR. These Guidelines also specify which types of exposures, other than those mentioned in Article 128(2) of the CRR, must be associated with particularly high risk and under which circumstances. The types of exposures identified by the institutions as carrying a particularly high risk of loss, without however meeting the specific characteristics described in EBA/GL/2019/01, must be notified to the competent authority by using the corresponding form available on the CSSF website. Sub-chapter 3.5. Non-performing and forborne exposures
20. The institutions shall have sound arrangements for the identification and
management of commitments whose contractual maturity dates set for the payment of principal and/or interests have expired. To this end, the institutions shall have policies in place which define the measures to be taken where a debtor does not comply with or indicates to the bank that s/he is no longer able to comply with the contractual provisions of his/her commitment, in particular the various payment deadlines.

CIRCULAR CSSF 20/759
98/109
In addition, the institutions shall have sound arrangements for the identification, management and provisioning of commitments “in default” within the meaning of
Article 178 of the CRR, Article 14 of CSSF Regulation No 18-03 and
EBA/GL/2016/07.
21. The institutions must maintain a list of commitments on a debtor or group of
related debtors, whether they are forborne within the meaning of Article 49b of the CRR, non-performing within the meaning of Article 47a(3) of the CRR or “in default”. These commitments shall be subject to periodic and objective review which must enable the institution to acknowledge and carry out the impairment and provisions of assets as required.
22. The institutions must have appropriate practices regarding governance and risk
management of their non-performing exposures22, their forborne exposures23 and foreclosed assets in order to efficiently and sustainably reduce non-performing exposures in their balance sheets in accordance with the requirements of Circular CSSF 20/751.
Chapter 4. Risk transfer pricing
11.23. The institutioninstitutions shall implement a pricing mechanism for all risks
incurred. This mechanism, which is part of the internal governance arrangements, serves as an incentive to effectively allocate the financial resources in accordance with the risk toleranceappetite and the principle of sound and prudent business management.
12.24. The pricing mechanism shall be approved by the authorised management and
supervisedmonitored by the risk control function. The transfer prices shallmust be transparent and communicated to the relevant employees.staff members. The comparability and consistency of the internal transfer pricepricing systems used within the group shallmust be ensured.
13.25. The institution shall establish a complete and effective internal transfer
pricepricing system for liquidity. This system shall include all liquidity costs, benefits and risks. 22 Exposures classified as non-performing in accordance with Annex V of Commission Implementing Regulation (EU) No 680/2014. 23 Exposures for which forbearance measures were applied in accordance with Annex V of Commission Implementing Regulation (EU) No 680/2014.

CIRCULAR CSSF 20/759
99/109
Chapter 5. Private wealth management (“private banking”)
26. Private banking activity is especially exposed to money laundering and terrorist
financing risks. Consequently, the institutions shall pay particular attention to comply with the anti-money laundering and counter terrorist financing obligations, whether they are regulatory, deriving from internal policies and procedures or falling within the good practices and organisation recommendations recognised as authority in this field.
14.27. The institutions shall have sound arrangementsprocesses to ensure that the
business relationships with their customers comply with the contracts entered intoagreements concluded with these customers. This objective may be best achieved when the discretionary management, advice management and simple execution of activities are separated from an organisational point of view.
15.28. The institutions shall have sound arrangements to ensure compliance with the
customers’customers' risk profiles, for the purposepurposes, in particular, of fulfilling the requirements arising from the MiFID regulations.
16.29. The institutions shall have sound arrangements in place to ensure the
communication of accurate information to the customers on the state of their assets. The issue and distribution of account statements and any other information on the state of assets shallmust be separated from the business function.
17.30. TransfersThe physical inflows and withdrawalsoutflows of cash, securities or
other valuables (for instance cash and bearer instruments) shallmust be carried out and controlledoverseen by a function separated from the business function.
18.31. Any entry and amendment of customers' identification data shallmust be
carried out and controlledoverseen by an a function that is independent function from the business function.
19.32. If a customer purchases an exchange-traded a derivative traded on an
organised market, the institution shall forthwith pass on (at least) the margin calls to be provided by the institution to the customer.

CIRCULAR CSSF 20/759
100/109
20.33. The institutions shallmust have sound arrangements in respect of credit control
and bank overdraft within the context of the private banking activities. The financial guarantees covering these credits shallmust be sufficiently diversified and liquid. For the purposepurposes of having an adequate security margin, prudent discounts shallmust be applied according to the nature of the financial collateralguarantees. The institutions shallmust have an early warning system independent from the business function which should organiseorganises the monitoring of the financial collateral’sguarantees’ value and triggertriggers the liquidation process of the financial guarantees. It shallmust ensure that the liquidation process is triggered in good time, and in any case before the value of the collateralguarantees becomes lower than the credit. Contracts with customers shallmust clearly describe the procedure triggered in the event of inadequacy of the guarantees.
Chapter 6. Exposures to shadow banking entities
57. This Chapter shall only apply to institutions to which Part Four (Large exposures)
of Regulation (EU) No 575/2013 applies, in accordance with the level of application set out in Part One, Title II of said regulation. Sub-chapter 6.1. Implementation of sound internal control principles
21.34. The institutions shall put in place an internal framework for the identification,
management, controlmonitoring and mitigation of the risks arising from the exposures to shadow banking entities24 in accordance with EBA/GL/2015/20.
22.35. The institutions shall apply a materiality threshold to identify the exposures to
shadow banking entities. In accordance with EBA/GL/2015/20, any individual exposure to a shadow banking entity that is equal to or in excess of 0.25%25 of the institution’s eligible capital26, after taking into account the effect of the credit risk mitigation and exemptions27, shallmust be taken into consideration and cannot be deemed as low exposure. 24 Shadow banking entities are defined in paragraph 11 “Definitions” of EBA/GL/2015/20. These entities are undertakings that carry out one or more credit intermediation activities and that are not excluded undertakings within the meaning of said paragraph. “Credit intermediation activities” shall mean: “bank-like activities involving maturity transformation, liquidity transformation, leverage, credit risk transfer or similar activities”. 25 According to the definition “Exposures to shadow banking entities” of paragraph 11 of EBA/GL/2015/20. 26 Within the meaning of point (71) of Article 4(1) of Regulation (EU) No 575/2013the CRR. 27 i) Credit risk mitigating effects in accordance with Articles 399 and 403 of Regulation (EU) No 575/2013the CRR; ii) Exemptions provided for in Articles 400 and 493(3) of Regulation (EU) No 575/2013the CRR.

CIRCULAR CSSF 20/759
101/109
23.36. The institutions shall ensure that any possible risks for the institution as a
result of their various exposures to shadow banking entities are adequately taken into account within the institution’s Internal Capital Adequacy Assessment (ICAAP) and capital planning. Sub-chapter 6.2. Application of quantitative limits
24.37. The institutions shall limit their exposures to shadow banking entities in
accordance with one of the two approaches (principal approach or fallback approach) as defined in Guidelines EBA/GL/2015/20.
25.38. In accordance with the principal approach, the institutions shouldmust set an
aggregate limit to their exposures to shadow banking entities relative to their eligible capital.
26.39. When setting an aggregate limit to exposures to shadow banking entities, each
institution shouldmust take into account:

• its business model, risk management framework, and risk appetite;
• the size of its current exposures to shadow banking entities relative to its total
  exposures and relative to its total exposure to regulated financial sector entities;
• interconnectedness between, on the one hand, between shadow banking
  entities and, on the other hand, between shadow banking entities and the institution.
  27.40. Independently of the aggregate limit, and in addition to it, institutions
  shouldmust set tighter limits on their individual exposures to shadow banking entities.
  28.41. When setting those limits, as part of their internal assessment process, the
  institutions shouldmust take into account:
• the regulatory status of the shadow banking entity, in particular whether it is
  subject to any type of prudential or supervisory requirements;
• the financial situation of the shadow banking entity including, but not limited
  to, its capital position, leverage and liquidity position;
• information available about the portfolio of the shadow banking entity, in
  particular non-performing loans;
• available evidence about the adequacy of the credit analysis performed by the
  shadow banking entity on its portfolio, if applicable;
• whether the shadow banking entity will be vulnerable to asset price or credit
  quality volatility;
• concentration of credit intermediation activities relative to other business
  activities of the shadow banking entity;
• interconnectedness between, on the one hand, between shadow banking
  entities and, on the other hand, between shadow banking entities and the institution;

CIRCULAR CSSF 20/759
102/109

• any other relevant factors identified by the institution as exposures to shadow
  banking entities, all potential risks to the institution arising from those exposures, and the potential impact of those risks.
  29.42. If institutions are not able to apply the principal approach as set out above,
  their aggregate exposures to shadow banking entities shouldmust be subject to the limits on large exposures in accordance with Article 395 of Regulation (EU) No 575/2013the CRR (hereinafter the “fallback approach”).
  30.43. The fallback approach shouldmust be applied in the following way:
• If institutions cannot meet the requirements regarding effective processes and
  control mechanisms or oversight by their management body as set out in
  Section 4 of EBA/GL/2015/20, they shouldmust apply the fallback approach to
  all their exposures to shadow banking entities (i.e. the sum of all their exposures to shadow banking entities).
• If institutions can meet the requirements regarding effective processes and
  control mechanisms or oversight by their management body as set out in Sub￾chapter 6.1, but cannot gather sufficient information to enable them to set out appropriate limits as set out in SectionSub-chapter 6.2.1, they shouldmust only apply the fallback approach to the exposures to shadow banking entities for which the institutions are not able to gather sufficient information. The principal approach as set out in SectionSub-chapter 6.2.1 should must be applied to the remaining exposures to shadow banking entities.
  Chapter 7. Asset encumbrance

58. This chapter only applies to credit institutions.
    31.44. The credit institutions shall put in place risk management policies to define
    their approach to asset encumbrance as well as procedures and controls that ensure that the risks associated with collateral management and asset encumbrance are adequately identified, monitored and managed. These policies shouldshall take into account each credit institution’s business model, the Member States in which they operate, the specificities of the funding markets and the macroeconomic situation. The policies shouldmust be approved in accordance withby the provisions of point 19supervisory body.
    32.45. The credit institutions shall have in place a general monitoring framework that
    provides timely information, at least once a year, to the authorised management and the board of directorssupervisory body on:

• the level, evolution and types of asset encumbrance and related sources of
  encumbrance, such as secured funding or other transactions;
• the amount, evolution and credit quality of unencumbered but encumberable
  assets, specifying the volume of assets available for encumbrance;
• the amount, evolution and types of additional encumbrance on additional
  assets resulting from stress scenarios (contingent encumbrance).

CIRCULAR CSSF 20/759
103/109
33.46. The credit institutions shall include, in their business continuity plan, actions
to address the contingent encumbrance resulting from relevant stress events, which means plausible albeit unlikely shocks, including downgrades in the credit institution’s credit rating, devaluation of pledged assets and increases in margin requirements. Specification:
Risk encumbrance shall be monitored through additional tables aiming at reporting encumbered assets, which will supplement Commission Implementing Regulation (EU) No 680/2014, in accordance with the CRR on prudential requirements for credit institutions. Draft provisional templates were published by the European Banking Authority on 24 July 2014 (EBA/ITS/2013/04/rev1).
Chapter 8. Interest rate risk
Sub-chapter 8.1 Interest rate risk arising from non-trading book activities
34.47. CRR institutions28, When implementing Article 14 (Interest rate risk arising
from non-trading book activities) of CSSF Regulation N°RCSSF 15-02 relating to, the supervisory review and evaluation process that applies to CRR institutions, shall comply with the guidelines published by the European Banking Authority in this respect.29 Investment firms which are not CRR investment firms do not fall within this chapterEBA/GL/2018/02. These guidelines include high-level guidelines and detailed guidelines which target the following three areas: internalSub-chapter 8.2. Corrections to modified duration for debt instruments
59. The institutions applying the standardised approach for the calculation of their
capital allocated to the requirements associated with the general interest rate risk in the banking book (“IRRBB 1”), measurement of this risk (“IRRBB 2” and “IRRBB 3”) and internal governance arrangements with regardare required to apply modifications to the calculation of the duration to interest rate risk in the banking book (“IRRBB 4.1” and “IRRBB 4.2”).
Part IV.Entry into force, transitional measures and
repealing provisions
60. This circular is applicable as from 1 July 2013.
29 “Guidelines on the management of interest rate risk arising from non-trading activities” (EBA/GL/2015/08) available on the EBA’s website: https://www.eba.europa.eu/-/eba-updates-guidelines-on-interest-rate-risk￾arising-from-non-trading-activities.

CIRCULAR CSSF 20/759
104/109
By way of derogation from the first paragraph, the following provisions are applicable as from 1 January 2014:
 Section 4.1.2 (Composition and qualificationreflect prepayment risk for debt instruments. The institutions shall apply one of the board of directors);  Section 4.1.4 relatingtwo methods for the correction to the specialised committees, with the exception of the audit committee;  Point 32 (Prohibition to combine the mandates of chairman of the board of directors and authorised manager);
35.48. The need to lay down in writing the guidelinesmodified duration provided for
in indents 4 to 8 of point 17EBA/GL/2016/09.
Chapter 9. Risks associated with the custody of financial assets by
third parties
49. The institutions shall have a policy for the selection of sub-custodians which hold
their customers’ financial assets. This policy shall establish minimum quality criteria which a sub-custodian must meet.
50. The institutions shall carry out due diligence controls before concluding an
agreement with a sub-custodian and they shall exercise an ongoing supervision of the sub-custodian for the whole duration of the relationship in order to ensure that these quality criteria are met.
51. The institutions shall perform regular reconciliations between the assets recorded
in their accounts as belonging to the customers and those confirmed by their sub￾custodians.
Part IV. Chronology

• Circular CSSF 12/552 implementing the guidelines of the European Banking
  Authority (EBA) on internal governance of 27 September 2011 (“GL44”), those of the Basel Committee on Banking Supervision (BCBS) on the internal audit function in banks of 28 June 2012, the CEBS Guidelines published on 26 April 2010 (Principles for disclosures in times of stress (Lessons learnt from the financial crisis)), the CEBS Guidelines of 2 September 2010 on the management of concentration risk under the supervisory review process (“GL31”) and the guidelines of 27 October 2010 on Liquidity Cost Benefit Allocation.

61. Circular CSSF 12/522 cancels and replaces Circulars IML 93/94 and CSSF 10/466
    shall be repealed, as well as from 1 July 2013.
    Circulars IML 95/120, IML 96/126, IML 98/143, CSSF 04/155 and CSSF 05/178 shall no longer be applicable tofor credit institutions and investment firms as from 1 July 2013.
62. Successive updates:

CIRCULAR CSSF 20/759
105/109

• Circular CSSF 13/563 transposingimplementing the EBA guidelines on the
  eligibility of the directors, authorised managers and persons in charge of the key functions dated 22 November 2012 (Guidelines on the assessment of the suitability of members of the management body and key function holders – dated 22 November 2012 (EBA/GL/2012/06) as well as the ESMA Guidelines of 6 July 2012 on certain aspects of the MiFID compliance function requirements – dated 6 July 2012 (ESMA/2012/388). The aforementioned guidelines are available on the EBA’s website ) and ESMA’s website ().
• Circular CSSF 14/597 transposing implementing the Recommendation of the
  European Systemic Risk Board (ESRB) on funding of credit institutions (ESRB/2012/2) -), Recommendation B on the implementationestablishment of a general risk management framework as regardsfor asset encumbrance. The aforementioned recommendation is available on the ESRB’s website ().
• Circular CSSF 16/642 implementing the EBA Guidelines on the management of
  interest rate risk arising from non-trading activities – (EBA/GL/2015/08.).
• Circular CSSF 16/647 implementing the EBA Guidelines relating to theon limits on
  exposures to shadow banking entities which carry out banking activities outside a regulated framework under Article 395(2) of Regulation (EU) No 575/2013 (EBA/GL/2015/20).
• Circular CSSF 20/750 implementing the EBA Guidelines on ICT and security risk
  management (EBA/GL/2019/04).
• Circular CSSF 20/759 implementing the EBA Guidelines on internal governance
  under Directive 2013/36/EU (EBA/GL/2017/11), the Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders (EBA/GL/2017/12), the EBA Guidelines on the application of the definition of default under Article 178 of Regulation (EU) No 575/2013 (EBA/GL/2016/07), the EBA Guidelines on specification of types of exposures to be associated with high risk (EBA/GL/2019/01), the EBA Guidelines on the management of interest rate risk arising from non-trading book activities (EBA/GL/2018/02) and the EBA Guidelines on corrections to modified duration for debt instruments under the second subparagraph of Article 340(3) of Regulation (EU) 575/2013 (EBA/GL/2016/09). The above-mentioned guidelines and recommendations are available on the websites of the EBA (www.eba.europa.eu), ESMA, (www.esma.europa.eu), the BCBS (https://www.bis.org/bcbs/index.htm) and the ESRB (www.esrb.europa.euEBA’s website (www.eba.europa.eu).).

CIRCULAR CSSF 20/759
106/109
COMMISSION DE SURVEILLANCE DU SECTEUR FINANCIER

CIRCULAR CSSF 20/759
107/109
Annex I - Extracts from Section 9.3 of EBA/GL/2017/12, independent members of a
CRD-institution’s management body in its supervisory function
91. Without prejudice to paragraph 92, in the following situations it is presumed that
a member of a CRD-institution’s management body in its supervisory function is regarded as not ‘being independent’:
a. the member has or has had a mandate as a member of the management body in its management function within an institution within the scope of prudential consolidation, unless he or she has not occupied such a position for the previous 5 years; b. the member is a controlling shareholder of the CRD-institution, being determined by reference to the cases mentioned in Article 22(1) of Directive 2013/34/EU, or represents the interest of a controlling shareholder, including where the owner is a Member State or other public body;
c. the member has a material financial or business relationship with the CRD￾institution;
d. the member is an employee of, or is otherwise associated with a controlling shareholder of the CRD-institution; e. the member is employed by any entity within the scope of consolidation, except when both of the following conditions are met:
i. the member does not belong to the institution’s highest hierarchical level, which
is directly accountable to the management body;
ii. the member has been elected to the supervisory function in the context of a
system of employees’ representation and national law provides for adequate protection against abusive dismissal and other forms of unfair treatment; f. the member has previously been employed in a position at the highest hierarchical level in the CRD-institution or another entity within its scope of prudential consolidation, being directly accountable only to the management body, and there has not been a period of at least 3 years, between ceasing such employment and serving on the management body; g. the member has been, within a period of 3 years, a principal of a material professional adviser, an external auditor or a material consultant to the CRD￾institution or another entity within the scope of prudential consolidation, or otherwise an employee materially associated with the service provided; h. the member is or has been, within the last year, a material supplier or material customer of the CRD-institution or another entity within the scope of prudential consolidation or had another material business relationship, or is a senior officer of or is otherwise associated directly or indirectly with a material supplier, customer or commercial entity that has a material business relationship;

CIRCULAR CSSF 20/759
108/109
i. the member receives in addition to remuneration for his or her role and
remuneration for employment in line with point (e) significant fees or other benefits from the CRD-institution or another entity within its scope of prudential consolidation; j. the member served as member of the management body within the entity for 12 consecutive years or longer; k. the member is a close family member of a member of the management body in the management function of the CRD-institution or another entity in the scope of prudential consolidation or a person in a situation referred to under points (a) to (h).
92. The mere fact of meeting one or more situations under paragraph 91 is not
automatically qualifying a member as not being independent. Where a member falls under one or more of the situations set out in paragraph 91, the CRD-institution may demonstrate to the competent authority that the member should nevertheless be considered as ‘being independent’. To this end CRD-institutions should be able to justify to the competent authority the reasoning why the members’ ability to exercise objective and balanced judgement and to take decisions independently are not affected by the situation.
93. For the purposes of paragraph 92 CRD-institutions should consider that being a
shareholder of a CRD-institution, having private accounts or loans or using other services, other than in the cases explicitly listed within this section, should not lead to a situation where the member is considered to be non-independent if they stay within an appropriate de minimis threshold. Such relationships should be taken into account within the management of conflicts of interest in accordance with the EBA Guidelines on Internal Governance.

CIRCULAR CSSF 20/759
109
/109
Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1 - 1 direction@cssf.lu www.cssf.lu